source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "smbd/globals.h"
  29
  30 extern enum protocol_types Protocol;
  31
  32 /****************************************************************************
  33  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  34  path or anything including wildcards.
  35  We're assuming here that '/' is not the second byte in any multibyte char
  36  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  37  set.
  38 ****************************************************************************/
  39
  40 /* Custom version for processing POSIX paths. */
  41 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  42
  43 static NTSTATUS check_path_syntax_internal(char *path,
  44                                            bool posix_path,
  45                                            bool *p_last_component_contains_wcard)
  46 {
  47         char *d = path;
  48         const char *s = path;
  49         NTSTATUS ret = NT_STATUS_OK;
  50         bool start_of_name_component = True;
  51         bool stream_started = false;
  52
  53         *p_last_component_contains_wcard = False;
  54
  55         while (*s) {
  56                 if (stream_started) {
  57                         switch (*s) {
  58                         case '/':
  59                         case '\\':
  60                                 return NT_STATUS_OBJECT_NAME_INVALID;
  61                         case ':':
  62                                 if (s[1] == '\0') {
  63                                         return NT_STATUS_OBJECT_NAME_INVALID;
  64                                 }
  65                                 if (strchr_m(&s[1], ':')) {
  66                                         return NT_STATUS_OBJECT_NAME_INVALID;
  67                                 }
  68                                 if (StrCaseCmp(s, ":$DATA") != 0) {
  69                                         return NT_STATUS_INVALID_PARAMETER;
  70                                 }
  71                                 break;
  72                         }
  73                 }
  74
  75                 if (!posix_path && !stream_started && *s == ':') {
  76                         if (*p_last_component_contains_wcard) {
  77                                 return NT_STATUS_OBJECT_NAME_INVALID;
  78                         }
  79                         /* Stream names allow more characters than file names.
  80                            We're overloading posix_path here to allow a wider
  81                            range of characters. If stream_started is true this
  82                            is still a Windows path even if posix_path is true.
  83                            JRA.
  84                         */
  85                         stream_started = true;
  86                         start_of_name_component = false;
  87                         posix_path = true;
  88
  89                         if (s[1] == '\0') {
  90                                 return NT_STATUS_OBJECT_NAME_INVALID;
  91                         }
  92                 }
  93
  94                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
  95                         /*
  96                          * Safe to assume is not the second part of a mb char
  97                          * as this is handled below.
  98                          */
  99                         /* Eat multiple '/' or '\\' */
 100                         while (IS_PATH_SEP(*s,posix_path)) {
 101                                 s++;
 102                         }
 103                         if ((d != path) && (*s != '\0')) {
 104                                 /* We only care about non-leading or trailing '/' or '\\' */
 105                                 *d++ = '/';
 106                         }
 107
 108                         start_of_name_component = True;
 109                         /* New component. */
 110                         *p_last_component_contains_wcard = False;
 111                         continue;
 112                 }
 113
 114                 if (start_of_name_component) {
 115                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 116                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 117
 118                                 /*
 119                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 120                                  */
 121
 122                                 /* If  we just added a '/' - delete it */
 123                                 if ((d > path) && (*(d-1) == '/')) {
 124                                         *(d-1) = '\0';
 125                                         d--;
 126                                 }
 127
 128                                 /* Are we at the start ? Can't go back further if so. */
 129                                 if (d <= path) {
 130                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 131                                         break;
 132                                 }
 133                                 /* Go back one level... */
 134                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 135                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 136                                 /* Decrement d first as d points to the *next* char to write into. */
 137                                 for (d--; d > path; d--) {
 138                                         if (*d == '/')
 139                                                 break;
 140                                 }
 141                                 s += 2; /* Else go past the .. */
 142                                 /* We're still at the start of a name component, just the previous one. */
 143                                 continue;
 144
 145                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 146                                 if (posix_path) {
 147                                         /* Eat the '.' */
 148                                         s++;
 149                                         continue;
 150                                 }
 151                         }
 152
 153                 }
 154
 155                 if (!(*s & 0x80)) {
 156                         if (!posix_path) {
 157                                 if (*s <= 0x1f || *s == '|') {
 158                                         return NT_STATUS_OBJECT_NAME_INVALID;
 159                                 }
 160                                 switch (*s) {
 161                                         case '*':
 162                                         case '?':
 163                                         case '<':
 164                                         case '>':
 165                                         case '"':
 166                                                 *p_last_component_contains_wcard = True;
 167                                                 break;
 168                                         default:
 169                                                 break;
 170                                 }
 171                         }
 172                         *d++ = *s++;
 173                 } else {
 174                         size_t siz;
 175                         /* Get the size of the next MB character. */
 176                         next_codepoint(s,&siz);
 177                         switch(siz) {
 178                                 case 5:
 179                                         *d++ = *s++;
 180                                         /*fall through*/
 181                                 case 4:
 182                                         *d++ = *s++;
 183                                         /*fall through*/
 184                                 case 3:
 185                                         *d++ = *s++;
 186                                         /*fall through*/
 187                                 case 2:
 188                                         *d++ = *s++;
 189                                         /*fall through*/
 190                                 case 1:
 191                                         *d++ = *s++;
 192                                         break;
 193                                 default:
 194                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 195                                         *d = '\0';
 196                                         return NT_STATUS_INVALID_PARAMETER;
 197                         }
 198                 }
 199                 start_of_name_component = False;
 200         }
 201
 202         *d = '\0';
 203
 204         return ret;
 205 }
 206
 207 /****************************************************************************
 208  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 209  No wildcards allowed.
 210 ****************************************************************************/
 211
 212 NTSTATUS check_path_syntax(char *path)
 213 {
 214         bool ignore;
 215         return check_path_syntax_internal(path, False, &ignore);
 216 }
 217
 218 /****************************************************************************
 219  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 220  Wildcards allowed - p_contains_wcard returns true if the last component contained
 221  a wildcard.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 225 {
 226         return check_path_syntax_internal(path, False, p_contains_wcard);
 227 }
 228
 229 /****************************************************************************
 230  Check the path for a POSIX client.
 231  We're assuming here that '/' is not the second byte in any multibyte char
 232  set (a safe assumption).
 233 ****************************************************************************/
 234
 235 NTSTATUS check_path_syntax_posix(char *path)
 236 {
 237         bool ignore;
 238         return check_path_syntax_internal(path, True, &ignore);
 239 }
 240
 241 /****************************************************************************
 242  Pull a string and check the path allowing a wilcard - provide for error return.
 243 ****************************************************************************/
 244
 245 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 246                         const char *base_ptr,
 247                         uint16 smb_flags2,
 248                         char **pp_dest,
 249                         const char *src,
 250                         size_t src_len,
 251                         int flags,
 252                         NTSTATUS *err,
 253                         bool *contains_wcard)
 254 {
 255         size_t ret;
 256
 257         *pp_dest = NULL;
 258
 259         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 260                                  src_len, flags);
 261
 262         if (!*pp_dest) {
 263                 *err = NT_STATUS_INVALID_PARAMETER;
 264                 return ret;
 265         }
 266
 267         *contains_wcard = False;
 268
 269         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 270                 /*
 271                  * For a DFS path the function parse_dfs_path()
 272                  * will do the path processing, just make a copy.
 273                  */
 274                 *err = NT_STATUS_OK;
 275                 return ret;
 276         }
 277
 278         if (lp_posix_pathnames()) {
 279                 *err = check_path_syntax_posix(*pp_dest);
 280         } else {
 281                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 282         }
 283
 284         return ret;
 285 }
 286
 287 /****************************************************************************
 288  Pull a string and check the path - provide for error return.
 289 ****************************************************************************/
 290
 291 size_t srvstr_get_path(TALLOC_CTX *ctx,
 292                         const char *base_ptr,
 293                         uint16 smb_flags2,
 294                         char **pp_dest,
 295                         const char *src,
 296                         size_t src_len,
 297                         int flags,
 298                         NTSTATUS *err)
 299 {
 300         bool ignore;
 301         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 302                                      src_len, flags, err, &ignore);
 303 }
 304
 305 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 306                                  char **pp_dest, const char *src, int flags,
 307                                  NTSTATUS *err, bool *contains_wcard)
 308 {
 309         return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
 310                                      pp_dest, src, smbreq_bufrem(req, src),
 311                                      flags, err, contains_wcard);
 312 }
 313
 314 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 315                            char **pp_dest, const char *src, int flags,
 316                            NTSTATUS *err)
 317 {
 318         bool ignore;
 319         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 320                                          flags, err, &ignore);
 321 }
 322
 323 /****************************************************************************
 324  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 325 ****************************************************************************/
 326
 327 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 328                     files_struct *fsp)
 329 {
 330         if (!(fsp) || !(conn)) {
 331                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 332                 return False;
 333         }
 334         if (((conn) != (fsp)->conn) || req->vuid != (fsp)->vuid) {
 335                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 336                 return False;
 337         }
 338         return True;
 339 }
 340
 341 /****************************************************************************
 342  Check if we have a correct fsp pointing to a file.
 343 ****************************************************************************/
 344
 345 bool check_fsp(connection_struct *conn, struct smb_request *req,
 346                files_struct *fsp)
 347 {
 348         if (!check_fsp_open(conn, req, fsp)) {
 349                 return False;
 350         }
 351         if ((fsp)->is_directory) {
 352                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 353                 return False;
 354         }
 355         if ((fsp)->fh->fd == -1) {
 356                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 357                 return False;
 358         }
 359         (fsp)->num_smb_operations++;
 360         return True;
 361 }
 362
 363 /****************************************************************************
 364  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 365  the CHECK_NTQUOTA_HANDLE_OK macro.
 366 ****************************************************************************/
 367
 368 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 369                               files_struct *fsp)
 370 {
 371         if (!check_fsp_open(conn, req, fsp)) {
 372                 return false;
 373         }
 374
 375         if (fsp->is_directory) {
 376                 return false;
 377         }
 378
 379         if (fsp->fake_file_handle == NULL) {
 380                 return false;
 381         }
 382
 383         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 384                 return false;
 385         }
 386
 387         if (fsp->fake_file_handle->private_data == NULL) {
 388                 return false;
 389         }
 390
 391         return true;
 392 }
 393
 394 /****************************************************************************
 395  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 396 ****************************************************************************/
 397
 398 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 399                       files_struct *fsp)
 400 {
 401         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 402             && (req->vuid == (fsp)->vuid)) {
 403                 return True;
 404         }
 405
 406         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 407         return False;
 408 }
 409
 410 static bool netbios_session_retarget(const char *name, int name_type)
 411 {
 412         char *trim_name;
 413         char *trim_name_type;
 414         const char *retarget_parm;
 415         char *retarget;
 416         char *p;
 417         int retarget_type = 0x20;
 418         int retarget_port = 139;
 419         struct sockaddr_storage retarget_addr;
 420         struct sockaddr_in *in_addr;
 421         bool ret = false;
 422         uint8_t outbuf[10];
 423
 424         if (get_socket_port(smbd_server_fd()) != 139) {
 425                 return false;
 426         }
 427
 428         trim_name = talloc_strdup(talloc_tos(), name);
 429         if (trim_name == NULL) {
 430                 goto fail;
 431         }
 432         trim_char(trim_name, ' ', ' ');
 433
 434         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 435                                          name_type);
 436         if (trim_name_type == NULL) {
 437                 goto fail;
 438         }
 439
 440         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 441                                              trim_name_type, NULL);
 442         if (retarget_parm == NULL) {
 443                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 444                                                      trim_name, NULL);
 445         }
 446         if (retarget_parm == NULL) {
 447                 goto fail;
 448         }
 449
 450         retarget = talloc_strdup(trim_name, retarget_parm);
 451         if (retarget == NULL) {
 452                 goto fail;
 453         }
 454
 455         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 456
 457         p = strchr(retarget, ':');
 458         if (p != NULL) {
 459                 *p++ = '\0';
 460                 retarget_port = atoi(p);
 461         }
 462
 463         p = strchr_m(retarget, '#');
 464         if (p != NULL) {
 465                 *p++ = '\0';
 466                 sscanf(p, "%x", &retarget_type);
 467         }
 468
 469         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 470         if (!ret) {
 471                 DEBUG(10, ("could not resolve %s\n", retarget));
 472                 goto fail;
 473         }
 474
 475         if (retarget_addr.ss_family != AF_INET) {
 476                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 477                 goto fail;
 478         }
 479
 480         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 481
 482         _smb_setlen(outbuf, 6);
 483         SCVAL(outbuf, 0, 0x84);
 484         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 485         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 486
 487         if (!srv_send_smb(smbd_server_fd(), (char *)outbuf, false, 0, false,
 488                           NULL)) {
 489                 exit_server_cleanly("netbios_session_regarget: srv_send_smb "
 490                                     "failed.");
 491         }
 492
 493         ret = true;
 494  fail:
 495         TALLOC_FREE(trim_name);
 496         return ret;
 497 }
 498
 499 /****************************************************************************
 500  Reply to a (netbios-level) special message.
 501 ****************************************************************************/
 502
 503 void reply_special(char *inbuf)
 504 {
 505         int msg_type = CVAL(inbuf,0);
 506         int msg_flags = CVAL(inbuf,1);
 507         fstring name1,name2;
 508         char name_type1, name_type2;
 509         struct smbd_server_connection *sconn = smbd_server_conn;
 510
 511         /*
 512          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 513          * calculation & friends (srv_send_smb uses that) we need the full smb
 514          * header.
 515          */
 516         char outbuf[smb_size];
 517
 518         *name1 = *name2 = 0;
 519
 520         memset(outbuf, '\0', sizeof(outbuf));
 521
 522         smb_setlen(outbuf,0);
 523
 524         switch (msg_type) {
 525         case 0x81: /* session request */
 526
 527                 if (sconn->nbt.got_session) {
 528                         exit_server_cleanly("multiple session request not permitted");
 529                 }
 530
 531                 SCVAL(outbuf,0,0x82);
 532                 SCVAL(outbuf,3,0);
 533                 if (name_len(inbuf+4) > 50 ||
 534                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 535                         DEBUG(0,("Invalid name length in session request\n"));
 536                         return;
 537                 }
 538                 name_type1 = name_extract(inbuf,4,name1);
 539                 name_type2 = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 540                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 541                          name1, name_type1, name2, name_type2));
 542
 543                 if (netbios_session_retarget(name1, name_type1)) {
 544                         exit_server_cleanly("retargeted client");
 545                 }
 546
 547                 set_local_machine_name(name1, True);
 548                 set_remote_machine_name(name2, True);
 549
 550                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 551                          get_local_machine_name(), get_remote_machine_name(),
 552                          name_type2));
 553
 554                 if (name_type2 == 'R') {
 555                         /* We are being asked for a pathworks session ---
 556                            no thanks! */
 557                         SCVAL(outbuf, 0,0x83);
 558                         break;
 559                 }
 560
 561                 /* only add the client's machine name to the list
 562                    of possibly valid usernames if we are operating
 563                    in share mode security */
 564                 if (lp_security() == SEC_SHARE) {
 565                         add_session_user(sconn, get_remote_machine_name());
 566                 }
 567
 568                 reload_services(True);
 569                 reopen_logs();
 570
 571                 sconn->nbt.got_session = true;
 572                 break;
 573
 574         case 0x89: /* session keepalive request
 575                       (some old clients produce this?) */
 576                 SCVAL(outbuf,0,SMBkeepalive);
 577                 SCVAL(outbuf,3,0);
 578                 break;
 579
 580         case 0x82: /* positive session response */
 581         case 0x83: /* negative session response */
 582         case 0x84: /* retarget session response */
 583                 DEBUG(0,("Unexpected session response\n"));
 584                 break;
 585
 586         case SMBkeepalive: /* session keepalive */
 587         default:
 588                 return;
 589         }
 590
 591         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 592                     msg_type, msg_flags));
 593
 594         srv_send_smb(smbd_server_fd(), outbuf, false, 0, false, NULL);
 595         return;
 596 }
 597
 598 /****************************************************************************
 599  Reply to a tcon.
 600  conn POINTER CAN BE NULL HERE !
 601 ****************************************************************************/
 602
 603 void reply_tcon(struct smb_request *req)
 604 {
 605         connection_struct *conn = req->conn;
 606         const char *service;
 607         char *service_buf = NULL;
 608         char *password = NULL;
 609         char *dev = NULL;
 610         int pwlen=0;
 611         NTSTATUS nt_status;
 612         const char *p;
 613         DATA_BLOB password_blob;
 614         TALLOC_CTX *ctx = talloc_tos();
 615         struct smbd_server_connection *sconn = smbd_server_conn;
 616
 617         START_PROFILE(SMBtcon);
 618
 619         if (req->buflen < 4) {
 620                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 621                 END_PROFILE(SMBtcon);
 622                 return;
 623         }
 624
 625         p = (const char *)req->buf + 1;
 626         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 627         p += 1;
 628         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 629         p += pwlen+1;
 630         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 631         p += 1;
 632
 633         if (service_buf == NULL || password == NULL || dev == NULL) {
 634                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 635                 END_PROFILE(SMBtcon);
 636                 return;
 637         }
 638         p = strrchr_m(service_buf,'\\');
 639         if (p) {
 640                 service = p+1;
 641         } else {
 642                 service = service_buf;
 643         }
 644
 645         password_blob = data_blob(password, pwlen+1);
 646
 647         conn = make_connection(sconn,service,password_blob,dev,
 648                                req->vuid,&nt_status);
 649         req->conn = conn;
 650
 651         data_blob_clear_free(&password_blob);
 652
 653         if (!conn) {
 654                 reply_nterror(req, nt_status);
 655                 END_PROFILE(SMBtcon);
 656                 return;
 657         }
 658
 659         reply_outbuf(req, 2, 0);
 660         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 661         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 662         SSVAL(req->outbuf,smb_tid,conn->cnum);
 663
 664         DEBUG(3,("tcon service=%s cnum=%d\n",
 665                  service, conn->cnum));
 666
 667         END_PROFILE(SMBtcon);
 668         return;
 669 }
 670
 671 /****************************************************************************
 672  Reply to a tcon and X.
 673  conn POINTER CAN BE NULL HERE !
 674 ****************************************************************************/
 675
 676 void reply_tcon_and_X(struct smb_request *req)
 677 {
 678         connection_struct *conn = req->conn;
 679         const char *service = NULL;
 680         DATA_BLOB password;
 681         TALLOC_CTX *ctx = talloc_tos();
 682         /* what the cleint thinks the device is */
 683         char *client_devicetype = NULL;
 684         /* what the server tells the client the share represents */
 685         const char *server_devicetype;
 686         NTSTATUS nt_status;
 687         int passlen;
 688         char *path = NULL;
 689         const char *p, *q;
 690         uint16 tcon_flags;
 691         struct smbd_server_connection *sconn = smbd_server_conn;
 692
 693         START_PROFILE(SMBtconX);
 694
 695         if (req->wct < 4) {
 696                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 697                 END_PROFILE(SMBtconX);
 698                 return;
 699         }
 700
 701         passlen = SVAL(req->vwv+3, 0);
 702         tcon_flags = SVAL(req->vwv+2, 0);
 703
 704         /* we might have to close an old one */
 705         if ((tcon_flags & 0x1) && conn) {
 706                 close_cnum(conn,req->vuid);
 707                 req->conn = NULL;
 708                 conn = NULL;
 709         }
 710
 711         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 712                 reply_doserror(req, ERRDOS, ERRbuftoosmall);
 713                 END_PROFILE(SMBtconX);
 714                 return;
 715         }
 716
 717         if (sconn->smb1.negprot.encrypted_passwords) {
 718                 password = data_blob_talloc(talloc_tos(), req->buf, passlen);
 719                 if (lp_security() == SEC_SHARE) {
 720                         /*
 721                          * Security = share always has a pad byte
 722                          * after the password.
 723                          */
 724                         p = (const char *)req->buf + passlen + 1;
 725                 } else {
 726                         p = (const char *)req->buf + passlen;
 727                 }
 728         } else {
 729                 password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
 730                 /* Ensure correct termination */
 731                 password.data[passlen]=0;
 732                 p = (const char *)req->buf + passlen + 1;
 733         }
 734
 735         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 736
 737         if (path == NULL) {
 738                 data_blob_clear_free(&password);
 739                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 740                 END_PROFILE(SMBtconX);
 741                 return;
 742         }
 743
 744         /*
 745          * the service name can be either: \\server\share
 746          * or share directly like on the DELL PowerVault 705
 747          */
 748         if (*path=='\\') {
 749                 q = strchr_m(path+2,'\\');
 750                 if (!q) {
 751                         data_blob_clear_free(&password);
 752                         reply_doserror(req, ERRDOS, ERRnosuchshare);
 753                         END_PROFILE(SMBtconX);
 754                         return;
 755                 }
 756                 service = q+1;
 757         } else {
 758                 service = path;
 759         }
 760
 761         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 762                                 &client_devicetype, p,
 763                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 764
 765         if (client_devicetype == NULL) {
 766                 data_blob_clear_free(&password);
 767                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 768                 END_PROFILE(SMBtconX);
 769                 return;
 770         }
 771
 772         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 773
 774         conn = make_connection(sconn, service, password, client_devicetype,
 775                                req->vuid, &nt_status);
 776         req->conn =conn;
 777
 778         data_blob_clear_free(&password);
 779
 780         if (!conn) {
 781                 reply_nterror(req, nt_status);
 782                 END_PROFILE(SMBtconX);
 783                 return;
 784         }
 785
 786         if ( IS_IPC(conn) )
 787                 server_devicetype = "IPC";
 788         else if ( IS_PRINT(conn) )
 789                 server_devicetype = "LPT1:";
 790         else
 791                 server_devicetype = "A:";
 792
 793         if (Protocol < PROTOCOL_NT1) {
 794                 reply_outbuf(req, 2, 0);
 795                 if (message_push_string(&req->outbuf, server_devicetype,
 796                                         STR_TERMINATE|STR_ASCII) == -1) {
 797                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 798                         END_PROFILE(SMBtconX);
 799                         return;
 800                 }
 801         } else {
 802                 /* NT sets the fstype of IPC$ to the null string */
 803                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 804
 805                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 806                         /* Return permissions. */
 807                         uint32 perm1 = 0;
 808                         uint32 perm2 = 0;
 809
 810                         reply_outbuf(req, 7, 0);
 811
 812                         if (IS_IPC(conn)) {
 813                                 perm1 = FILE_ALL_ACCESS;
 814                                 perm2 = FILE_ALL_ACCESS;
 815                         } else {
 816                                 perm1 = CAN_WRITE(conn) ?
 817                                                 SHARE_ALL_ACCESS :
 818                                                 SHARE_READ_ONLY;
 819                         }
 820
 821                         SIVAL(req->outbuf, smb_vwv3, perm1);
 822                         SIVAL(req->outbuf, smb_vwv5, perm2);
 823                 } else {
 824                         reply_outbuf(req, 3, 0);
 825                 }
 826
 827                 if ((message_push_string(&req->outbuf, server_devicetype,
 828                                          STR_TERMINATE|STR_ASCII) == -1)
 829                     || (message_push_string(&req->outbuf, fstype,
 830                                             STR_TERMINATE) == -1)) {
 831                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 832                         END_PROFILE(SMBtconX);
 833                         return;
 834                 }
 835
 836                 /* what does setting this bit do? It is set by NT4 and
 837                    may affect the ability to autorun mounted cdroms */
 838                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 839                       (lp_csc_policy(SNUM(conn)) << 2));
 840
 841                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
 842                         DEBUG(2,("Serving %s as a Dfs root\n",
 843                                  lp_servicename(SNUM(conn)) ));
 844                         SSVAL(req->outbuf, smb_vwv2,
 845                               SMB_SHARE_IN_DFS | SVAL(req->outbuf, smb_vwv2));
 846                 }
 847         }
 848
 849
 850         DEBUG(3,("tconX service=%s \n",
 851                  service));
 852
 853         /* set the incoming and outgoing tid to the just created one */
 854         SSVAL(req->inbuf,smb_tid,conn->cnum);
 855         SSVAL(req->outbuf,smb_tid,conn->cnum);
 856
 857         END_PROFILE(SMBtconX);
 858
 859         req->tid = conn->cnum;
 860         chain_reply(req);
 861         return;
 862 }
 863
 864 /****************************************************************************
 865  Reply to an unknown type.
 866 ****************************************************************************/
 867
 868 void reply_unknown_new(struct smb_request *req, uint8 type)
 869 {
 870         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 871                   smb_fn_name(type), type, type));
 872         reply_doserror(req, ERRSRV, ERRunknownsmb);
 873         return;
 874 }
 875
 876 /****************************************************************************
 877  Reply to an ioctl.
 878  conn POINTER CAN BE NULL HERE !
 879 ****************************************************************************/
 880
 881 void reply_ioctl(struct smb_request *req)
 882 {
 883         connection_struct *conn = req->conn;
 884         uint16 device;
 885         uint16 function;
 886         uint32 ioctl_code;
 887         int replysize;
 888         char *p;
 889
 890         START_PROFILE(SMBioctl);
 891
 892         if (req->wct < 3) {
 893                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 894                 END_PROFILE(SMBioctl);
 895                 return;
 896         }
 897
 898         device     = SVAL(req->vwv+1, 0);
 899         function   = SVAL(req->vwv+2, 0);
 900         ioctl_code = (device << 16) + function;
 901
 902         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 903
 904         switch (ioctl_code) {
 905             case IOCTL_QUERY_JOB_INFO:
 906                     replysize = 32;
 907                     break;
 908             default:
 909                     reply_doserror(req, ERRSRV, ERRnosupport);
 910                     END_PROFILE(SMBioctl);
 911                     return;
 912         }
 913
 914         reply_outbuf(req, 8, replysize+1);
 915         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 916         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 917         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 918         p = smb_buf(req->outbuf);
 919         memset(p, '\0', replysize+1); /* valgrind-safe. */
 920         p += 1;          /* Allow for alignment */
 921
 922         switch (ioctl_code) {
 923                 case IOCTL_QUERY_JOB_INFO:
 924                 {
 925                         files_struct *fsp = file_fsp(
 926                                 req, SVAL(req->vwv+0, 0));
 927                         if (!fsp) {
 928                                 reply_doserror(req, ERRDOS, ERRbadfid);
 929                                 END_PROFILE(SMBioctl);
 930                                 return;
 931                         }
 932                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 933                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 934                                     global_myname(), 15,
 935                                     STR_TERMINATE|STR_ASCII);
 936                         if (conn) {
 937                                 srvstr_push((char *)req->outbuf, req->flags2,
 938                                             p+18, lp_servicename(SNUM(conn)),
 939                                             13, STR_TERMINATE|STR_ASCII);
 940                         } else {
 941                                 memset(p+18, 0, 13);
 942                         }
 943                         break;
 944                 }
 945         }
 946
 947         END_PROFILE(SMBioctl);
 948         return;
 949 }
 950
 951 /****************************************************************************
 952  Strange checkpath NTSTATUS mapping.
 953 ****************************************************************************/
 954
 955 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
 956 {
 957         /* Strange DOS error code semantics only for checkpath... */
 958         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 959                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 960                         /* We need to map to ERRbadpath */
 961                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 962                 }
 963         }
 964         return status;
 965 }
 966
 967 /****************************************************************************
 968  Reply to a checkpath.
 969 ****************************************************************************/
 970
 971 void reply_checkpath(struct smb_request *req)
 972 {
 973         connection_struct *conn = req->conn;
 974         struct smb_filename *smb_fname = NULL;
 975         char *name = NULL;
 976         NTSTATUS status;
 977         TALLOC_CTX *ctx = talloc_tos();
 978
 979         START_PROFILE(SMBcheckpath);
 980
 981         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
 982                             STR_TERMINATE, &status);
 983
 984         if (!NT_STATUS_IS_OK(status)) {
 985                 status = map_checkpath_error(req->flags2, status);
 986                 reply_nterror(req, status);
 987                 END_PROFILE(SMBcheckpath);
 988                 return;
 989         }
 990
 991         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
 992
 993         status = filename_convert(ctx,
 994                                 conn,
 995                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 996                                 name,
 997                                 0,
 998                                 NULL,
 999                                 &smb_fname);
1000
1001         if (!NT_STATUS_IS_OK(status)) {
1002                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1003                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1004                                         ERRSRV, ERRbadpath);
1005                         END_PROFILE(SMBcheckpath);
1006                         return;
1007                 }
1008                 goto path_err;
1009         }
1010
1011         if (!VALID_STAT(smb_fname->st) &&
1012             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1013                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1014                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1015                 status = map_nt_error_from_unix(errno);
1016                 goto path_err;
1017         }
1018
1019         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1020                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1021                                 ERRDOS, ERRbadpath);
1022                 goto out;
1023         }
1024
1025         reply_outbuf(req, 0, 0);
1026
1027  path_err:
1028         /* We special case this - as when a Windows machine
1029                 is parsing a path is steps through the components
1030                 one at a time - if a component fails it expects
1031                 ERRbadpath, not ERRbadfile.
1032         */
1033         status = map_checkpath_error(req->flags2, status);
1034         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1035                 /*
1036                  * Windows returns different error codes if
1037                  * the parent directory is valid but not the
1038                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1039                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1040                  * if the path is invalid.
1041                  */
1042                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1043                                 ERRDOS, ERRbadpath);
1044                 goto out;
1045         }
1046
1047         reply_nterror(req, status);
1048
1049  out:
1050         TALLOC_FREE(smb_fname);
1051         END_PROFILE(SMBcheckpath);
1052         return;
1053 }
1054
1055 /****************************************************************************
1056  Reply to a getatr.
1057 ****************************************************************************/
1058
1059 void reply_getatr(struct smb_request *req)
1060 {
1061         connection_struct *conn = req->conn;
1062         struct smb_filename *smb_fname = NULL;
1063         char *fname = NULL;
1064         int mode=0;
1065         SMB_OFF_T size=0;
1066         time_t mtime=0;
1067         const char *p;
1068         NTSTATUS status;
1069         TALLOC_CTX *ctx = talloc_tos();
1070         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1071
1072         START_PROFILE(SMBgetatr);
1073
1074         p = (const char *)req->buf + 1;
1075         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1076         if (!NT_STATUS_IS_OK(status)) {
1077                 reply_nterror(req, status);
1078                 goto out;
1079         }
1080
1081         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1082                 under WfWg - weird! */
1083         if (*fname == '\0') {
1084                 mode = aHIDDEN | aDIR;
1085                 if (!CAN_WRITE(conn)) {
1086                         mode |= aRONLY;
1087                 }
1088                 size = 0;
1089                 mtime = 0;
1090         } else {
1091                 status = filename_convert(ctx,
1092                                 conn,
1093                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1094                                 fname,
1095                                 0,
1096                                 NULL,
1097                                 &smb_fname);
1098                 if (!NT_STATUS_IS_OK(status)) {
1099                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1100                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1101                                                 ERRSRV, ERRbadpath);
1102                                 goto out;
1103                         }
1104                         reply_nterror(req, status);
1105                         goto out;
1106                 }
1107                 if (!VALID_STAT(smb_fname->st) &&
1108                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1109                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1110                                  smb_fname_str_dbg(smb_fname),
1111                                  strerror(errno)));
1112                         reply_nterror(req,  map_nt_error_from_unix(errno));
1113                         goto out;
1114                 }
1115
1116                 mode = dos_mode(conn, smb_fname);
1117                 size = smb_fname->st.st_ex_size;
1118
1119                 if (ask_sharemode) {
1120                         struct timespec write_time_ts;
1121                         struct file_id fileid;
1122
1123                         ZERO_STRUCT(write_time_ts);
1124                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1125                         get_file_infos(fileid, NULL, &write_time_ts);
1126                         if (!null_timespec(write_time_ts)) {
1127                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1128                         }
1129                 }
1130
1131                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1132                 if (mode & aDIR) {
1133                         size = 0;
1134                 }
1135         }
1136
1137         reply_outbuf(req, 10, 0);
1138
1139         SSVAL(req->outbuf,smb_vwv0,mode);
1140         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1141                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1142         } else {
1143                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1144         }
1145         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1146
1147         if (Protocol >= PROTOCOL_NT1) {
1148                 SSVAL(req->outbuf, smb_flg2,
1149                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1150         }
1151
1152         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1153                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1154
1155  out:
1156         TALLOC_FREE(smb_fname);
1157         TALLOC_FREE(fname);
1158         END_PROFILE(SMBgetatr);
1159         return;
1160 }
1161
1162 /****************************************************************************
1163  Reply to a setatr.
1164 ****************************************************************************/
1165
1166 void reply_setatr(struct smb_request *req)
1167 {
1168         struct smb_file_time ft;
1169         connection_struct *conn = req->conn;
1170         struct smb_filename *smb_fname = NULL;
1171         char *fname = NULL;
1172         int mode;
1173         time_t mtime;
1174         const char *p;
1175         NTSTATUS status;
1176         TALLOC_CTX *ctx = talloc_tos();
1177
1178         START_PROFILE(SMBsetatr);
1179
1180         ZERO_STRUCT(ft);
1181
1182         if (req->wct < 2) {
1183                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1184                 goto out;
1185         }
1186
1187         p = (const char *)req->buf + 1;
1188         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1189         if (!NT_STATUS_IS_OK(status)) {
1190                 reply_nterror(req, status);
1191                 goto out;
1192         }
1193
1194         status = filename_convert(ctx,
1195                                 conn,
1196                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1197                                 fname,
1198                                 0,
1199                                 NULL,
1200                                 &smb_fname);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1203                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1204                                         ERRSRV, ERRbadpath);
1205                         goto out;
1206                 }
1207                 reply_nterror(req, status);
1208                 goto out;
1209         }
1210
1211         if (smb_fname->base_name[0] == '.' &&
1212             smb_fname->base_name[1] == '\0') {
1213                 /*
1214                  * Not sure here is the right place to catch this
1215                  * condition. Might be moved to somewhere else later -- vl
1216                  */
1217                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1218                 goto out;
1219         }
1220
1221         mode = SVAL(req->vwv+0, 0);
1222         mtime = srv_make_unix_date3(req->vwv+1);
1223
1224         ft.mtime = convert_time_t_to_timespec(mtime);
1225         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1226         if (!NT_STATUS_IS_OK(status)) {
1227                 reply_nterror(req, status);
1228                 goto out;
1229         }
1230
1231         if (mode != FILE_ATTRIBUTE_NORMAL) {
1232                 if (VALID_STAT_OF_DIR(smb_fname->st))
1233                         mode |= aDIR;
1234                 else
1235                         mode &= ~aDIR;
1236
1237                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1238                                      false) != 0) {
1239                         reply_nterror(req, map_nt_error_from_unix(errno));
1240                         goto out;
1241                 }
1242         }
1243
1244         reply_outbuf(req, 0, 0);
1245
1246         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1247                  mode));
1248  out:
1249         TALLOC_FREE(smb_fname);
1250         END_PROFILE(SMBsetatr);
1251         return;
1252 }
1253
1254 /****************************************************************************
1255  Reply to a dskattr.
1256 ****************************************************************************/
1257
1258 void reply_dskattr(struct smb_request *req)
1259 {
1260         connection_struct *conn = req->conn;
1261         uint64_t dfree,dsize,bsize;
1262         START_PROFILE(SMBdskattr);
1263
1264         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1265                 reply_nterror(req, map_nt_error_from_unix(errno));
1266                 END_PROFILE(SMBdskattr);
1267                 return;
1268         }
1269
1270         reply_outbuf(req, 5, 0);
1271
1272         if (Protocol <= PROTOCOL_LANMAN2) {
1273                 double total_space, free_space;
1274                 /* we need to scale this to a number that DOS6 can handle. We
1275                    use floating point so we can handle large drives on systems
1276                    that don't have 64 bit integers
1277
1278                    we end up displaying a maximum of 2G to DOS systems
1279                 */
1280                 total_space = dsize * (double)bsize;
1281                 free_space = dfree * (double)bsize;
1282
1283                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1284                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1285
1286                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1287                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1288
1289                 SSVAL(req->outbuf,smb_vwv0,dsize);
1290                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1291                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1292                 SSVAL(req->outbuf,smb_vwv3,dfree);
1293         } else {
1294                 SSVAL(req->outbuf,smb_vwv0,dsize);
1295                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1296                 SSVAL(req->outbuf,smb_vwv2,512);
1297                 SSVAL(req->outbuf,smb_vwv3,dfree);
1298         }
1299
1300         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1301
1302         END_PROFILE(SMBdskattr);
1303         return;
1304 }
1305
1306 /*
1307  * Utility function to split the filename from the directory.
1308  */
1309 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1310                                      char **fname_dir_out,
1311                                      char **fname_mask_out)
1312 {
1313         const char *p = NULL;
1314         char *fname_dir = NULL;
1315         char *fname_mask = NULL;
1316
1317         p = strrchr_m(fname_in, '/');
1318         if (!p) {
1319                 fname_dir = talloc_strdup(ctx, ".");
1320                 fname_mask = talloc_strdup(ctx, fname_in);
1321         } else {
1322                 fname_dir = talloc_strndup(ctx, fname_in,
1323                     PTR_DIFF(p, fname_in));
1324                 fname_mask = talloc_strdup(ctx, p+1);
1325         }
1326
1327         if (!fname_dir || !fname_mask) {
1328                 TALLOC_FREE(fname_dir);
1329                 TALLOC_FREE(fname_mask);
1330                 return NT_STATUS_NO_MEMORY;
1331         }
1332
1333         *fname_dir_out = fname_dir;
1334         *fname_mask_out = fname_mask;
1335         return NT_STATUS_OK;
1336 }
1337
1338 /****************************************************************************
1339  Reply to a search.
1340  Can be called from SMBsearch, SMBffirst or SMBfunique.
1341 ****************************************************************************/
1342
1343 void reply_search(struct smb_request *req)
1344 {
1345         connection_struct *conn = req->conn;
1346         char *path = NULL;
1347         const char *mask = NULL;
1348         char *directory = NULL;
1349         struct smb_filename *smb_fname = NULL;
1350         char *fname = NULL;
1351         SMB_OFF_T size;
1352         uint32 mode;
1353         struct timespec date;
1354         uint32 dirtype;
1355         unsigned int numentries = 0;
1356         unsigned int maxentries = 0;
1357         bool finished = False;
1358         const char *p;
1359         int status_len;
1360         char status[21];
1361         int dptr_num= -1;
1362         bool check_descend = False;
1363         bool expect_close = False;
1364         NTSTATUS nt_status;
1365         bool mask_contains_wcard = False;
1366         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1367         TALLOC_CTX *ctx = talloc_tos();
1368         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1369         struct dptr_struct *dirptr = NULL;
1370         struct smbd_server_connection *sconn = smbd_server_conn;
1371
1372         START_PROFILE(SMBsearch);
1373
1374         if (req->wct < 2) {
1375                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1376                 goto out;
1377         }
1378
1379         if (lp_posix_pathnames()) {
1380                 reply_unknown_new(req, req->cmd);
1381                 goto out;
1382         }
1383
1384         /* If we were called as SMBffirst then we must expect close. */
1385         if(req->cmd == SMBffirst) {
1386                 expect_close = True;
1387         }
1388
1389         reply_outbuf(req, 1, 3);
1390         maxentries = SVAL(req->vwv+0, 0);
1391         dirtype = SVAL(req->vwv+1, 0);
1392         p = (const char *)req->buf + 1;
1393         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1394                                        &nt_status, &mask_contains_wcard);
1395         if (!NT_STATUS_IS_OK(nt_status)) {
1396                 reply_nterror(req, nt_status);
1397                 goto out;
1398         }
1399
1400         p++;
1401         status_len = SVAL(p, 0);
1402         p += 2;
1403
1404         /* dirtype &= ~aDIR; */
1405
1406         if (status_len == 0) {
1407                 nt_status = filename_convert(ctx, conn,
1408                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1409                                              path,
1410                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1411                                              &mask_contains_wcard,
1412                                              &smb_fname);
1413                 if (!NT_STATUS_IS_OK(nt_status)) {
1414                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1415                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1416                                                 ERRSRV, ERRbadpath);
1417                                 goto out;
1418                         }
1419                         reply_nterror(req, nt_status);
1420                         goto out;
1421                 }
1422
1423                 directory = smb_fname->base_name;
1424
1425                 p = strrchr_m(directory,'/');
1426                 if ((p != NULL) && (*directory != '/')) {
1427                         mask = p + 1;
1428                         directory = talloc_strndup(ctx, directory,
1429                                                    PTR_DIFF(p, directory));
1430                 } else {
1431                         mask = directory;
1432                         directory = talloc_strdup(ctx,".");
1433                 }
1434
1435                 if (!directory) {
1436                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1437                         goto out;
1438                 }
1439
1440                 memset((char *)status,'\0',21);
1441                 SCVAL(status,0,(dirtype & 0x1F));
1442
1443                 nt_status = dptr_create(conn,
1444                                         directory,
1445                                         True,
1446                                         expect_close,
1447                                         req->smbpid,
1448                                         mask,
1449                                         mask_contains_wcard,
1450                                         dirtype,
1451                                         &dirptr);
1452                 if (!NT_STATUS_IS_OK(nt_status)) {
1453                         reply_nterror(req, nt_status);
1454                         goto out;
1455                 }
1456                 dptr_num = dptr_dnum(dirptr);
1457         } else {
1458                 int status_dirtype;
1459                 const char *dirpath;
1460
1461                 memcpy(status,p,21);
1462                 status_dirtype = CVAL(status,0) & 0x1F;
1463                 if (status_dirtype != (dirtype & 0x1F)) {
1464                         dirtype = status_dirtype;
1465                 }
1466
1467                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1468                 if (!dirptr) {
1469                         goto SearchEmpty;
1470                 }
1471                 dirpath = dptr_path(sconn, dptr_num);
1472                 directory = talloc_strdup(ctx, dirpath);
1473                 if (!directory) {
1474                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1475                         goto out;
1476                 }
1477
1478                 mask = dptr_wcard(sconn, dptr_num);
1479                 if (!mask) {
1480                         goto SearchEmpty;
1481                 }
1482                 /*
1483                  * For a 'continue' search we have no string. So
1484                  * check from the initial saved string.
1485                  */
1486                 mask_contains_wcard = ms_has_wild(mask);
1487                 dirtype = dptr_attr(sconn, dptr_num);
1488         }
1489
1490         DEBUG(4,("dptr_num is %d\n",dptr_num));
1491
1492         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1493         dptr_init_search_op(dirptr);
1494
1495         if ((dirtype&0x1F) == aVOLID) {
1496                 char buf[DIR_STRUCT_SIZE];
1497                 memcpy(buf,status,21);
1498                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1499                                 0,aVOLID,0,!allow_long_path_components)) {
1500                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1501                         goto out;
1502                 }
1503                 dptr_fill(sconn, buf+12,dptr_num);
1504                 if (dptr_zero(buf+12) && (status_len==0)) {
1505                         numentries = 1;
1506                 } else {
1507                         numentries = 0;
1508                 }
1509                 if (message_push_blob(&req->outbuf,
1510                                       data_blob_const(buf, sizeof(buf)))
1511                     == -1) {
1512                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1513                         goto out;
1514                 }
1515         } else {
1516                 unsigned int i;
1517                 maxentries = MIN(
1518                         maxentries,
1519                         ((BUFFER_SIZE -
1520                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1521                          /DIR_STRUCT_SIZE));
1522
1523                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1524                         directory,lp_dontdescend(SNUM(conn))));
1525                 if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1526                         check_descend = True;
1527                 }
1528
1529                 for (i=numentries;(i<maxentries) && !finished;i++) {
1530                         finished = !get_dir_entry(ctx,
1531                                                   dirptr,
1532                                                   mask,
1533                                                   dirtype,
1534                                                   &fname,
1535                                                   &size,
1536                                                   &mode,
1537                                                   &date,
1538                                                   check_descend,
1539                                                   ask_sharemode);
1540                         if (!finished) {
1541                                 char buf[DIR_STRUCT_SIZE];
1542                                 memcpy(buf,status,21);
1543                                 if (!make_dir_struct(ctx,
1544                                                 buf,
1545                                                 mask,
1546                                                 fname,
1547                                                 size,
1548                                                 mode,
1549                                                 convert_timespec_to_time_t(date),
1550                                                 !allow_long_path_components)) {
1551                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1552                                         goto out;
1553                                 }
1554                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1555                                         break;
1556                                 }
1557                                 if (message_push_blob(&req->outbuf,
1558                                                       data_blob_const(buf, sizeof(buf)))
1559                                     == -1) {
1560                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1561                                         goto out;
1562                                 }
1563                                 numentries++;
1564                         }
1565                 }
1566         }
1567
1568   SearchEmpty:
1569
1570         /* If we were called as SMBffirst with smb_search_id == NULL
1571                 and no entries were found then return error and close dirptr
1572                 (X/Open spec) */
1573
1574         if (numentries == 0) {
1575                 dptr_close(sconn, &dptr_num);
1576         } else if(expect_close && status_len == 0) {
1577                 /* Close the dptr - we know it's gone */
1578                 dptr_close(sconn, &dptr_num);
1579         }
1580
1581         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1582         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1583                 dptr_close(sconn, &dptr_num);
1584         }
1585
1586         if ((numentries == 0) && !mask_contains_wcard) {
1587                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1588                 goto out;
1589         }
1590
1591         SSVAL(req->outbuf,smb_vwv0,numentries);
1592         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1593         SCVAL(smb_buf(req->outbuf),0,5);
1594         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1595
1596         /* The replies here are never long name. */
1597         SSVAL(req->outbuf, smb_flg2,
1598               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1599         if (!allow_long_path_components) {
1600                 SSVAL(req->outbuf, smb_flg2,
1601                       SVAL(req->outbuf, smb_flg2)
1602                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1603         }
1604
1605         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1606         SSVAL(req->outbuf, smb_flg2,
1607               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1608
1609         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1610                 smb_fn_name(req->cmd),
1611                 mask,
1612                 directory,
1613                 dirtype,
1614                 numentries,
1615                 maxentries ));
1616  out:
1617         TALLOC_FREE(directory);
1618         TALLOC_FREE(smb_fname);
1619         END_PROFILE(SMBsearch);
1620         return;
1621 }
1622
1623 /****************************************************************************
1624  Reply to a fclose (stop directory search).
1625 ****************************************************************************/
1626
1627 void reply_fclose(struct smb_request *req)
1628 {
1629         int status_len;
1630         char status[21];
1631         int dptr_num= -2;
1632         const char *p;
1633         char *path = NULL;
1634         NTSTATUS err;
1635         bool path_contains_wcard = False;
1636         TALLOC_CTX *ctx = talloc_tos();
1637         struct smbd_server_connection *sconn = smbd_server_conn;
1638
1639         START_PROFILE(SMBfclose);
1640
1641         if (lp_posix_pathnames()) {
1642                 reply_unknown_new(req, req->cmd);
1643                 END_PROFILE(SMBfclose);
1644                 return;
1645         }
1646
1647         p = (const char *)req->buf + 1;
1648         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1649                                        &err, &path_contains_wcard);
1650         if (!NT_STATUS_IS_OK(err)) {
1651                 reply_nterror(req, err);
1652                 END_PROFILE(SMBfclose);
1653                 return;
1654         }
1655         p++;
1656         status_len = SVAL(p,0);
1657         p += 2;
1658
1659         if (status_len == 0) {
1660                 reply_doserror(req, ERRSRV, ERRsrverror);
1661                 END_PROFILE(SMBfclose);
1662                 return;
1663         }
1664
1665         memcpy(status,p,21);
1666
1667         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1668                 /*  Close the dptr - we know it's gone */
1669                 dptr_close(sconn, &dptr_num);
1670         }
1671
1672         reply_outbuf(req, 1, 0);
1673         SSVAL(req->outbuf,smb_vwv0,0);
1674
1675         DEBUG(3,("search close\n"));
1676
1677         END_PROFILE(SMBfclose);
1678         return;
1679 }
1680
1681 /****************************************************************************
1682  Reply to an open.
1683 ****************************************************************************/
1684
1685 void reply_open(struct smb_request *req)
1686 {
1687         connection_struct *conn = req->conn;
1688         struct smb_filename *smb_fname = NULL;
1689         char *fname = NULL;
1690         uint32 fattr=0;
1691         SMB_OFF_T size = 0;
1692         time_t mtime=0;
1693         int info;
1694         files_struct *fsp;
1695         int oplock_request;
1696         int deny_mode;
1697         uint32 dos_attr;
1698         uint32 access_mask;
1699         uint32 share_mode;
1700         uint32 create_disposition;
1701         uint32 create_options = 0;
1702         NTSTATUS status;
1703         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1704         TALLOC_CTX *ctx = talloc_tos();
1705
1706         START_PROFILE(SMBopen);
1707
1708         if (req->wct < 2) {
1709                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1710                 goto out;
1711         }
1712
1713         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1714         deny_mode = SVAL(req->vwv+0, 0);
1715         dos_attr = SVAL(req->vwv+1, 0);
1716
1717         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1718                             STR_TERMINATE, &status);
1719         if (!NT_STATUS_IS_OK(status)) {
1720                 reply_nterror(req, status);
1721                 goto out;
1722         }
1723
1724         status = filename_convert(ctx,
1725                                 conn,
1726                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1727                                 fname,
1728                                 0,
1729                                 NULL,
1730                                 &smb_fname);
1731         if (!NT_STATUS_IS_OK(status)) {
1732                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1733                         reply_botherror(req,
1734                                         NT_STATUS_PATH_NOT_COVERED,
1735                                         ERRSRV, ERRbadpath);
1736                         goto out;
1737                 }
1738                 reply_nterror(req, status);
1739                 goto out;
1740         }
1741
1742         if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
1743                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1744                                          &share_mode, &create_disposition,
1745                                          &create_options)) {
1746                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1747                 goto out;
1748         }
1749
1750         status = SMB_VFS_CREATE_FILE(
1751                 conn,                                   /* conn */
1752                 req,                                    /* req */
1753                 0,                                      /* root_dir_fid */
1754                 smb_fname,                              /* fname */
1755                 access_mask,                            /* access_mask */
1756                 share_mode,                             /* share_access */
1757                 create_disposition,                     /* create_disposition*/
1758                 create_options,                         /* create_options */
1759                 dos_attr,                               /* file_attributes */
1760                 oplock_request,                         /* oplock_request */
1761                 0,                                      /* allocation_size */
1762                 NULL,                                   /* sd */
1763                 NULL,                                   /* ea_list */
1764                 &fsp,                                   /* result */
1765                 &info);                                 /* pinfo */
1766
1767         if (!NT_STATUS_IS_OK(status)) {
1768                 if (open_was_deferred(req->mid)) {
1769                         /* We have re-scheduled this call. */
1770                         goto out;
1771                 }
1772                 reply_openerror(req, status);
1773                 goto out;
1774         }
1775
1776         size = smb_fname->st.st_ex_size;
1777         fattr = dos_mode(conn, smb_fname);
1778
1779         /* Deal with other possible opens having a modified
1780            write time. JRA. */
1781         if (ask_sharemode) {
1782                 struct timespec write_time_ts;
1783
1784                 ZERO_STRUCT(write_time_ts);
1785                 get_file_infos(fsp->file_id, NULL, &write_time_ts);
1786                 if (!null_timespec(write_time_ts)) {
1787                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1788                 }
1789         }
1790
1791         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1792
1793         if (fattr & aDIR) {
1794                 DEBUG(3,("attempt to open a directory %s\n",
1795                          fsp_str_dbg(fsp)));
1796                 close_file(req, fsp, ERROR_CLOSE);
1797                 reply_doserror(req, ERRDOS,ERRnoaccess);
1798                 goto out;
1799         }
1800
1801         reply_outbuf(req, 7, 0);
1802         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1803         SSVAL(req->outbuf,smb_vwv1,fattr);
1804         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1805                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1806         } else {
1807                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1808         }
1809         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1810         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1811
1812         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1813                 SCVAL(req->outbuf,smb_flg,
1814                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1815         }
1816
1817         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1818                 SCVAL(req->outbuf,smb_flg,
1819                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1820         }
1821  out:
1822         TALLOC_FREE(smb_fname);
1823         END_PROFILE(SMBopen);
1824         return;
1825 }
1826
1827 /****************************************************************************
1828  Reply to an open and X.
1829 ****************************************************************************/
1830
1831 void reply_open_and_X(struct smb_request *req)
1832 {
1833         connection_struct *conn = req->conn;
1834         struct smb_filename *smb_fname = NULL;
1835         char *fname = NULL;
1836         uint16 open_flags;
1837         int deny_mode;
1838         uint32 smb_attr;
1839         /* Breakout the oplock request bits so we can set the
1840                 reply bits separately. */
1841         int ex_oplock_request;
1842         int core_oplock_request;
1843         int oplock_request;
1844 #if 0
1845         int smb_sattr = SVAL(req->vwv+4, 0);
1846         uint32 smb_time = make_unix_date3(req->vwv+6);
1847 #endif
1848         int smb_ofun;
1849         uint32 fattr=0;
1850         int mtime=0;
1851         int smb_action = 0;
1852         files_struct *fsp;
1853         NTSTATUS status;
1854         uint64_t allocation_size;
1855         ssize_t retval = -1;
1856         uint32 access_mask;
1857         uint32 share_mode;
1858         uint32 create_disposition;
1859         uint32 create_options = 0;
1860         TALLOC_CTX *ctx = talloc_tos();
1861
1862         START_PROFILE(SMBopenX);
1863
1864         if (req->wct < 15) {
1865                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1866                 goto out;
1867         }
1868
1869         open_flags = SVAL(req->vwv+2, 0);
1870         deny_mode = SVAL(req->vwv+3, 0);
1871         smb_attr = SVAL(req->vwv+5, 0);
1872         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1873         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1874         oplock_request = ex_oplock_request | core_oplock_request;
1875         smb_ofun = SVAL(req->vwv+8, 0);
1876         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1877
1878         /* If it's an IPC, pass off the pipe handler. */
1879         if (IS_IPC(conn)) {
1880                 if (lp_nt_pipe_support()) {
1881                         reply_open_pipe_and_X(conn, req);
1882                 } else {
1883                         reply_doserror(req, ERRSRV, ERRaccess);
1884                 }
1885                 goto out;
1886         }
1887
1888         /* XXXX we need to handle passed times, sattr and flags */
1889         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1890                         STR_TERMINATE, &status);
1891         if (!NT_STATUS_IS_OK(status)) {
1892                 reply_nterror(req, status);
1893                 goto out;
1894         }
1895
1896         status = filename_convert(ctx,
1897                                 conn,
1898                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1899                                 fname,
1900                                 0,
1901                                 NULL,
1902                                 &smb_fname);
1903         if (!NT_STATUS_IS_OK(status)) {
1904                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1905                         reply_botherror(req,
1906                                         NT_STATUS_PATH_NOT_COVERED,
1907                                         ERRSRV, ERRbadpath);
1908                         goto out;
1909                 }
1910                 reply_nterror(req, status);
1911                 goto out;
1912         }
1913
1914         if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
1915                                          &access_mask, &share_mode,
1916                                          &create_disposition,
1917                                          &create_options)) {
1918                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1919                 goto out;
1920         }
1921
1922         status = SMB_VFS_CREATE_FILE(
1923                 conn,                                   /* conn */
1924                 req,                                    /* req */
1925                 0,                                      /* root_dir_fid */
1926                 smb_fname,                              /* fname */
1927                 access_mask,                            /* access_mask */
1928                 share_mode,                             /* share_access */
1929                 create_disposition,                     /* create_disposition*/
1930                 create_options,                         /* create_options */
1931                 smb_attr,                               /* file_attributes */
1932                 oplock_request,                         /* oplock_request */
1933                 0,                                      /* allocation_size */
1934                 NULL,                                   /* sd */
1935                 NULL,                                   /* ea_list */
1936                 &fsp,                                   /* result */
1937                 &smb_action);                           /* pinfo */
1938
1939         if (!NT_STATUS_IS_OK(status)) {
1940                 if (open_was_deferred(req->mid)) {
1941                         /* We have re-scheduled this call. */
1942                         goto out;
1943                 }
1944                 reply_openerror(req, status);
1945                 goto out;
1946         }
1947
1948         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1949            if the file is truncated or created. */
1950         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1951                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1952                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1953                         close_file(req, fsp, ERROR_CLOSE);
1954                         reply_nterror(req, NT_STATUS_DISK_FULL);
1955                         goto out;
1956                 }
1957                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1958                 if (retval < 0) {
1959                         close_file(req, fsp, ERROR_CLOSE);
1960                         reply_nterror(req, NT_STATUS_DISK_FULL);
1961                         goto out;
1962                 }
1963                 smb_fname->st.st_ex_size =
1964                     SMB_VFS_GET_ALLOC_SIZE(conn, fsp, &smb_fname->st);
1965         }
1966
1967         fattr = dos_mode(conn, smb_fname);
1968         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1969         if (fattr & aDIR) {
1970                 close_file(req, fsp, ERROR_CLOSE);
1971                 reply_doserror(req, ERRDOS, ERRnoaccess);
1972                 goto out;
1973         }
1974
1975         /* If the caller set the extended oplock request bit
1976                 and we granted one (by whatever means) - set the
1977                 correct bit for extended oplock reply.
1978         */
1979
1980         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1981                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1982         }
1983
1984         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1985                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1986         }
1987
1988         /* If the caller set the core oplock request bit
1989                 and we granted one (by whatever means) - set the
1990                 correct bit for core oplock reply.
1991         */
1992
1993         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1994                 reply_outbuf(req, 19, 0);
1995         } else {
1996                 reply_outbuf(req, 15, 0);
1997         }
1998
1999         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2000                 SCVAL(req->outbuf, smb_flg,
2001                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2002         }
2003
2004         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2005                 SCVAL(req->outbuf, smb_flg,
2006                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2007         }
2008
2009         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2010         SSVAL(req->outbuf,smb_vwv3,fattr);
2011         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2012                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2013         } else {
2014                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2015         }
2016         SIVAL(req->outbuf,smb_vwv6,(uint32)smb_fname->st.st_ex_size);
2017         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2018         SSVAL(req->outbuf,smb_vwv11,smb_action);
2019
2020         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2021                 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
2022         }
2023
2024         chain_reply(req);
2025  out:
2026         TALLOC_FREE(smb_fname);
2027         END_PROFILE(SMBopenX);
2028         return;
2029 }
2030
2031 /****************************************************************************
2032  Reply to a SMBulogoffX.
2033 ****************************************************************************/
2034
2035 void reply_ulogoffX(struct smb_request *req)
2036 {
2037         struct smbd_server_connection *sconn = smbd_server_conn;
2038         user_struct *vuser;
2039
2040         START_PROFILE(SMBulogoffX);
2041
2042         vuser = get_valid_user_struct(sconn, req->vuid);
2043
2044         if(vuser == NULL) {
2045                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2046                          req->vuid));
2047         }
2048
2049         /* in user level security we are supposed to close any files
2050                 open by this user */
2051         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2052                 file_close_user(req->vuid);
2053         }
2054
2055         invalidate_vuid(sconn, req->vuid);
2056
2057         reply_outbuf(req, 2, 0);
2058
2059         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2060
2061         END_PROFILE(SMBulogoffX);
2062         req->vuid = UID_FIELD_INVALID;
2063         chain_reply(req);
2064 }
2065
2066 /****************************************************************************
2067  Reply to a mknew or a create.
2068 ****************************************************************************/
2069
2070 void reply_mknew(struct smb_request *req)
2071 {
2072         connection_struct *conn = req->conn;
2073         struct smb_filename *smb_fname = NULL;
2074         char *fname = NULL;
2075         uint32 fattr = 0;
2076         struct smb_file_time ft;
2077         files_struct *fsp;
2078         int oplock_request = 0;
2079         NTSTATUS status;
2080         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2081         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2082         uint32 create_disposition;
2083         uint32 create_options = 0;
2084         TALLOC_CTX *ctx = talloc_tos();
2085
2086         START_PROFILE(SMBcreate);
2087         ZERO_STRUCT(ft);
2088
2089         if (req->wct < 3) {
2090                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2091                 goto out;
2092         }
2093
2094         fattr = SVAL(req->vwv+0, 0);
2095         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2096
2097         /* mtime. */
2098         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2099
2100         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2101                             STR_TERMINATE, &status);
2102         if (!NT_STATUS_IS_OK(status)) {
2103                 reply_nterror(req, status);
2104                 goto out;
2105         }
2106
2107         status = filename_convert(ctx,
2108                                 conn,
2109                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2110                                 fname,
2111                                 0,
2112                                 NULL,
2113                                 &smb_fname);
2114         if (!NT_STATUS_IS_OK(status)) {
2115                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2116                         reply_botherror(req,
2117                                         NT_STATUS_PATH_NOT_COVERED,
2118                                         ERRSRV, ERRbadpath);
2119                         goto out;
2120                 }
2121                 reply_nterror(req, status);
2122                 goto out;
2123         }
2124
2125         if (fattr & aVOLID) {
2126                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2127                          "please report this\n",
2128                          smb_fname_str_dbg(smb_fname)));
2129         }
2130
2131         if(req->cmd == SMBmknew) {
2132                 /* We should fail if file exists. */
2133                 create_disposition = FILE_CREATE;
2134         } else {
2135                 /* Create if file doesn't exist, truncate if it does. */
2136                 create_disposition = FILE_OVERWRITE_IF;
2137         }
2138
2139         status = SMB_VFS_CREATE_FILE(
2140                 conn,                                   /* conn */
2141                 req,                                    /* req */
2142                 0,                                      /* root_dir_fid */
2143                 smb_fname,                              /* fname */
2144                 access_mask,                            /* access_mask */
2145                 share_mode,                             /* share_access */
2146                 create_disposition,                     /* create_disposition*/
2147                 create_options,                         /* create_options */
2148                 fattr,                                  /* file_attributes */
2149                 oplock_request,                         /* oplock_request */
2150                 0,                                      /* allocation_size */
2151                 NULL,                                   /* sd */
2152                 NULL,                                   /* ea_list */
2153                 &fsp,                                   /* result */
2154                 NULL);                                  /* pinfo */
2155
2156         if (!NT_STATUS_IS_OK(status)) {
2157                 if (open_was_deferred(req->mid)) {
2158                         /* We have re-scheduled this call. */
2159                         goto out;
2160                 }
2161                 reply_openerror(req, status);
2162                 goto out;
2163         }
2164
2165         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2166         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2167         if (!NT_STATUS_IS_OK(status)) {
2168                 END_PROFILE(SMBcreate);
2169                 goto out;
2170         }
2171
2172         reply_outbuf(req, 1, 0);
2173         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2174
2175         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2176                 SCVAL(req->outbuf,smb_flg,
2177                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2178         }
2179
2180         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2181                 SCVAL(req->outbuf,smb_flg,
2182                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2183         }
2184
2185         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2186         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2187                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2188                   (unsigned int)fattr));
2189
2190  out:
2191         TALLOC_FREE(smb_fname);
2192         END_PROFILE(SMBcreate);
2193         return;
2194 }
2195
2196 /****************************************************************************
2197  Reply to a create temporary file.
2198 ****************************************************************************/
2199
2200 void reply_ctemp(struct smb_request *req)
2201 {
2202         connection_struct *conn = req->conn;
2203         struct smb_filename *smb_fname = NULL;
2204         char *fname = NULL;
2205         uint32 fattr;
2206         files_struct *fsp;
2207         int oplock_request;
2208         int tmpfd;
2209         char *s;
2210         NTSTATUS status;
2211         TALLOC_CTX *ctx = talloc_tos();
2212
2213         START_PROFILE(SMBctemp);
2214
2215         if (req->wct < 3) {
2216                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2217                 goto out;
2218         }
2219
2220         fattr = SVAL(req->vwv+0, 0);
2221         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2222
2223         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
2224                             STR_TERMINATE, &status);
2225         if (!NT_STATUS_IS_OK(status)) {
2226                 reply_nterror(req, status);
2227                 goto out;
2228         }
2229         if (*fname) {
2230                 fname = talloc_asprintf(ctx,
2231                                 "%s/TMXXXXXX",
2232                                 fname);
2233         } else {
2234                 fname = talloc_strdup(ctx, "TMXXXXXX");
2235         }
2236
2237         if (!fname) {
2238                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2239                 goto out;
2240         }
2241
2242         status = filename_convert(ctx, conn,
2243                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2244                                 fname,
2245                                 0,
2246                                 NULL,
2247                                 &smb_fname);
2248         if (!NT_STATUS_IS_OK(status)) {
2249                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2250                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2251                                         ERRSRV, ERRbadpath);
2252                         goto out;
2253                 }
2254                 reply_nterror(req, status);
2255                 goto out;
2256         }
2257
2258         tmpfd = mkstemp(smb_fname->base_name);
2259         if (tmpfd == -1) {
2260                 reply_nterror(req, map_nt_error_from_unix(errno));
2261                 goto out;
2262         }
2263
2264         SMB_VFS_STAT(conn, smb_fname);
2265
2266         /* We should fail if file does not exist. */
2267         status = SMB_VFS_CREATE_FILE(
2268                 conn,                                   /* conn */
2269                 req,                                    /* req */
2270                 0,                                      /* root_dir_fid */
2271                 smb_fname,                              /* fname */
2272                 FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2273                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2274                 FILE_OPEN,                              /* create_disposition*/
2275                 0,                                      /* create_options */
2276                 fattr,                                  /* file_attributes */
2277                 oplock_request,                         /* oplock_request */
2278                 0,                                      /* allocation_size */
2279                 NULL,                                   /* sd */
2280                 NULL,                                   /* ea_list */
2281                 &fsp,                                   /* result */
2282                 NULL);                                  /* pinfo */
2283
2284         /* close fd from mkstemp() */
2285         close(tmpfd);
2286
2287         if (!NT_STATUS_IS_OK(status)) {
2288                 if (open_was_deferred(req->mid)) {
2289                         /* We have re-scheduled this call. */
2290                         goto out;
2291                 }
2292                 reply_openerror(req, status);
2293                 goto out;
2294         }
2295
2296         reply_outbuf(req, 1, 0);
2297         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2298
2299         /* the returned filename is relative to the directory */
2300         s = strrchr_m(fsp->fsp_name->base_name, '/');
2301         if (!s) {
2302                 s = fsp->fsp_name->base_name;
2303         } else {
2304                 s++;
2305         }
2306
2307 #if 0
2308         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2309            thing in the byte section. JRA */
2310         SSVALS(p, 0, -1); /* what is this? not in spec */
2311 #endif
2312         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2313             == -1) {
2314                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2315                 goto out;
2316         }
2317
2318         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2319                 SCVAL(req->outbuf, smb_flg,
2320                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2321         }
2322
2323         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2324                 SCVAL(req->outbuf, smb_flg,
2325                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2326         }
2327
2328         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2329         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2330                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2331  out:
2332         TALLOC_FREE(smb_fname);
2333         END_PROFILE(SMBctemp);
2334         return;
2335 }
2336
2337 /*******************************************************************
2338  Check if a user is allowed to rename a file.
2339 ********************************************************************/
2340
2341 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2342                            uint16 dirtype, SMB_STRUCT_STAT *pst)
2343 {
2344         uint32 fmode;
2345
2346         if (!CAN_WRITE(conn)) {
2347                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2348         }
2349
2350         fmode = dos_mode(conn, fsp->fsp_name);
2351         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2352                 return NT_STATUS_NO_SUCH_FILE;
2353         }
2354
2355         if (S_ISDIR(pst->st_ex_mode)) {
2356                 if (fsp->posix_open) {
2357                         return NT_STATUS_OK;
2358                 }
2359
2360                 /* If no pathnames are open below this
2361                    directory, allow the rename. */
2362
2363                 if (file_find_subpath(fsp)) {
2364                         return NT_STATUS_ACCESS_DENIED;
2365                 }
2366                 return NT_STATUS_OK;
2367         }
2368
2369         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2370                 return NT_STATUS_OK;
2371         }
2372
2373         return NT_STATUS_ACCESS_DENIED;
2374 }
2375
2376 /*******************************************************************
2377  * unlink a file with all relevant access checks
2378  *******************************************************************/
2379
2380 static NTSTATUS do_unlink(connection_struct *conn,
2381                         struct smb_request *req,
2382                         struct smb_filename *smb_fname,
2383                         uint32 dirtype)
2384 {
2385         uint32 fattr;
2386         files_struct *fsp;
2387         uint32 dirtype_orig = dirtype;
2388         NTSTATUS status;
2389
2390         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2391                   smb_fname_str_dbg(smb_fname),
2392                   dirtype));
2393
2394         if (!CAN_WRITE(conn)) {
2395                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2396         }
2397
2398         if (SMB_VFS_LSTAT(conn, smb_fname) != 0) {
2399                 return map_nt_error_from_unix(errno);
2400         }
2401
2402         fattr = dos_mode(conn, smb_fname);
2403
2404         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2405                 dirtype = aDIR|aARCH|aRONLY;
2406         }
2407
2408         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2409         if (!dirtype) {
2410                 return NT_STATUS_NO_SUCH_FILE;
2411         }
2412
2413         if (!dir_check_ftype(conn, fattr, dirtype)) {
2414                 if (fattr & aDIR) {
2415                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2416                 }
2417                 return NT_STATUS_NO_SUCH_FILE;
2418         }
2419
2420         if (dirtype_orig & 0x8000) {
2421                 /* These will never be set for POSIX. */
2422                 return NT_STATUS_NO_SUCH_FILE;
2423         }
2424
2425 #if 0
2426         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2427                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2428         }
2429
2430         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2431                 return NT_STATUS_NO_SUCH_FILE;
2432         }
2433
2434         if (dirtype & 0xFF00) {
2435                 /* These will never be set for POSIX. */
2436                 return NT_STATUS_NO_SUCH_FILE;
2437         }
2438
2439         dirtype &= 0xFF;
2440         if (!dirtype) {
2441                 return NT_STATUS_NO_SUCH_FILE;
2442         }
2443
2444         /* Can't delete a directory. */
2445         if (fattr & aDIR) {
2446                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2447         }
2448 #endif
2449
2450 #if 0 /* JRATEST */
2451         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2452                 return NT_STATUS_OBJECT_NAME_INVALID;
2453 #endif /* JRATEST */
2454
2455         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2456
2457           On a Windows share, a file with read-only dosmode can be opened with
2458           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2459           fails with NT_STATUS_CANNOT_DELETE error.
2460
2461           This semantic causes a problem that a user can not
2462           rename a file with read-only dosmode on a Samba share
2463           from a Windows command prompt (i.e. cmd.exe, but can rename
2464           from Windows Explorer).
2465         */
2466
2467         if (!lp_delete_readonly(SNUM(conn))) {
2468                 if (fattr & aRONLY) {
2469                         return NT_STATUS_CANNOT_DELETE;
2470                 }
2471         }
2472
2473         /* On open checks the open itself will check the share mode, so
2474            don't do it here as we'll get it wrong. */
2475
2476         status = SMB_VFS_CREATE_FILE
2477                 (conn,                  /* conn */
2478                  req,                   /* req */
2479                  0,                     /* root_dir_fid */
2480                  smb_fname,             /* fname */
2481                  DELETE_ACCESS,         /* access_mask */
2482                  FILE_SHARE_NONE,       /* share_access */
2483                  FILE_OPEN,             /* create_disposition*/
2484                  FILE_NON_DIRECTORY_FILE, /* create_options */
2485                  FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2486                  0,                     /* oplock_request */
2487                  0,                     /* allocation_size */
2488                  NULL,                  /* sd */
2489                  NULL,                  /* ea_list */
2490                  &fsp,                  /* result */
2491                  NULL);                 /* pinfo */
2492
2493         if (!NT_STATUS_IS_OK(status)) {
2494                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2495                            nt_errstr(status)));
2496                 return status;
2497         }
2498
2499         /* The set is across all open files on this dev/inode pair. */
2500         if (!set_delete_on_close(fsp, True, &conn->server_info->utok)) {
2501                 close_file(req, fsp, NORMAL_CLOSE);
2502                 return NT_STATUS_ACCESS_DENIED;
2503         }
2504
2505         return close_file(req, fsp, NORMAL_CLOSE);
2506 }
2507
2508 /****************************************************************************
2509  The guts of the unlink command, split out so it may be called by the NT SMB
2510  code.
2511 ****************************************************************************/
2512
2513 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2514                           uint32 dirtype, struct smb_filename *smb_fname,
2515                           bool has_wild)
2516 {
2517         char *fname_dir = NULL;
2518         char *fname_mask = NULL;
2519         int count=0;
2520         NTSTATUS status = NT_STATUS_OK;
2521         TALLOC_CTX *ctx = talloc_tos();
2522
2523         /* Split up the directory from the filename/mask. */
2524         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2525                                       &fname_dir, &fname_mask);
2526         if (!NT_STATUS_IS_OK(status)) {
2527                 goto out;
2528         }
2529
2530         /*
2531          * We should only check the mangled cache
2532          * here if unix_convert failed. This means
2533          * that the path in 'mask' doesn't exist
2534          * on the file system and so we need to look
2535          * for a possible mangle. This patch from
2536          * Tine Smukavec <valentin.smukavec@hermes.si>.
2537          */
2538
2539         if (!VALID_STAT(smb_fname->st) &&
2540             mangle_is_mangled(fname_mask, conn->params)) {
2541                 char *new_mask = NULL;
2542                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2543                                             &new_mask, conn->params);
2544                 if (new_mask) {
2545                         TALLOC_FREE(fname_mask);
2546                         fname_mask = new_mask;
2547                 }
2548         }
2549
2550         if (!has_wild) {
2551
2552                 /*
2553                  * Only one file needs to be unlinked. Append the mask back
2554                  * onto the directory.
2555                  */
2556                 TALLOC_FREE(smb_fname->base_name);
2557                 smb_fname->base_name = talloc_asprintf(smb_fname,
2558                                                        "%s/%s",
2559                                                        fname_dir,
2560                                                        fname_mask);
2561                 if (!smb_fname->base_name) {
2562                         status = NT_STATUS_NO_MEMORY;
2563                         goto out;
2564                 }
2565                 if (dirtype == 0) {
2566                         dirtype = FILE_ATTRIBUTE_NORMAL;
2567                 }
2568
2569                 status = check_name(conn, smb_fname->base_name);
2570                 if (!NT_STATUS_IS_OK(status)) {
2571                         goto out;
2572                 }
2573
2574                 status = do_unlink(conn, req, smb_fname, dirtype);
2575                 if (!NT_STATUS_IS_OK(status)) {
2576                         goto out;
2577                 }
2578
2579                 count++;
2580         } else {
2581                 struct smb_Dir *dir_hnd = NULL;
2582                 long offset = 0;
2583                 const char *dname;
2584
2585                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2586                         status = NT_STATUS_OBJECT_NAME_INVALID;
2587                         goto out;
2588                 }
2589
2590                 if (strequal(fname_mask,"????????.???")) {
2591                         TALLOC_FREE(fname_mask);
2592                         fname_mask = talloc_strdup(ctx, "*");
2593                         if (!fname_mask) {
2594                                 status = NT_STATUS_NO_MEMORY;
2595                                 goto out;
2596                         }
2597                 }
2598
2599                 status = check_name(conn, fname_dir);
2600                 if (!NT_STATUS_IS_OK(status)) {
2601                         goto out;
2602                 }
2603
2604                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2605                                   dirtype);
2606                 if (dir_hnd == NULL) {
2607                         status = map_nt_error_from_unix(errno);
2608                         goto out;
2609                 }
2610
2611                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2612                    the pattern matches against the long name, otherwise the short name
2613                    We don't implement this yet XXXX
2614                 */
2615
2616                 status = NT_STATUS_NO_SUCH_FILE;
2617
2618                 while ((dname = ReadDirName(dir_hnd, &offset,
2619                                             &smb_fname->st))) {
2620                         TALLOC_CTX *frame = talloc_stackframe();
2621
2622                         if (!is_visible_file(conn, fname_dir, dname,
2623                                              &smb_fname->st, true)) {
2624                                 TALLOC_FREE(frame);
2625                                 continue;
2626                         }
2627
2628                         /* Quick check for "." and ".." */
2629                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2630                                 TALLOC_FREE(frame);
2631                                 continue;
2632                         }
2633
2634                         if(!mask_match(dname, fname_mask,
2635                                        conn->case_sensitive)) {
2636                                 TALLOC_FREE(frame);
2637                                 continue;
2638                         }
2639
2640                         TALLOC_FREE(smb_fname->base_name);
2641                         smb_fname->base_name =
2642                             talloc_asprintf(smb_fname, "%s/%s",
2643                                             fname_dir, dname);
2644
2645                         if (!smb_fname->base_name) {
2646                                 TALLOC_FREE(dir_hnd);
2647                                 status = NT_STATUS_NO_MEMORY;
2648                                 TALLOC_FREE(frame);
2649                                 goto out;
2650                         }
2651
2652                         status = check_name(conn, smb_fname->base_name);
2653                         if (!NT_STATUS_IS_OK(status)) {
2654                                 TALLOC_FREE(dir_hnd);
2655                                 TALLOC_FREE(frame);
2656                                 goto out;
2657                         }
2658
2659                         status = do_unlink(conn, req, smb_fname, dirtype);
2660                         if (!NT_STATUS_IS_OK(status)) {
2661                                 TALLOC_FREE(frame);
2662                                 continue;
2663                         }
2664
2665                         count++;
2666                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2667                                  smb_fname->base_name));
2668
2669                         TALLOC_FREE(frame);
2670                 }
2671                 TALLOC_FREE(dir_hnd);
2672         }
2673
2674         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2675                 status = map_nt_error_from_unix(errno);
2676         }
2677
2678  out:
2679         TALLOC_FREE(fname_dir);
2680         TALLOC_FREE(fname_mask);
2681         return status;
2682 }
2683
2684 /****************************************************************************
2685  Reply to a unlink
2686 ****************************************************************************/
2687
2688 void reply_unlink(struct smb_request *req)
2689 {
2690         connection_struct *conn = req->conn;
2691         char *name = NULL;
2692         struct smb_filename *smb_fname = NULL;
2693         uint32 dirtype;
2694         NTSTATUS status;
2695         bool path_contains_wcard = False;
2696         TALLOC_CTX *ctx = talloc_tos();
2697
2698         START_PROFILE(SMBunlink);
2699
2700         if (req->wct < 1) {
2701                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2702                 goto out;
2703         }
2704
2705         dirtype = SVAL(req->vwv+0, 0);
2706
2707         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2708                                   STR_TERMINATE, &status,
2709                                   &path_contains_wcard);
2710         if (!NT_STATUS_IS_OK(status)) {
2711                 reply_nterror(req, status);
2712                 goto out;
2713         }
2714
2715         status = filename_convert(ctx, conn,
2716                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2717                                   name,
2718                                   UCF_COND_ALLOW_WCARD_LCOMP,
2719                                   &path_contains_wcard,
2720                                   &smb_fname);
2721         if (!NT_STATUS_IS_OK(status)) {
2722                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2723                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2724                                         ERRSRV, ERRbadpath);
2725                         goto out;
2726                 }
2727                 reply_nterror(req, status);
2728                 goto out;
2729         }
2730
2731         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2732
2733         status = unlink_internals(conn, req, dirtype, smb_fname,
2734                                   path_contains_wcard);
2735         if (!NT_STATUS_IS_OK(status)) {
2736                 if (open_was_deferred(req->mid)) {
2737                         /* We have re-scheduled this call. */
2738                         goto out;
2739                 }
2740                 reply_nterror(req, status);
2741                 goto out;
2742         }
2743
2744         reply_outbuf(req, 0, 0);
2745  out:
2746         TALLOC_FREE(smb_fname);
2747         END_PROFILE(SMBunlink);
2748         return;
2749 }
2750
2751 /****************************************************************************
2752  Fail for readbraw.
2753 ****************************************************************************/
2754
2755 static void fail_readraw(void)
2756 {
2757         const char *errstr = talloc_asprintf(talloc_tos(),
2758                         "FAIL ! reply_readbraw: socket write fail (%s)",
2759                         strerror(errno));
2760         if (!errstr) {
2761                 errstr = "";
2762         }
2763         exit_server_cleanly(errstr);
2764 }
2765
2766 /****************************************************************************
2767  Fake (read/write) sendfile. Returns -1 on read or write fail.
2768 ****************************************************************************/
2769
2770 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2771                              size_t nread)
2772 {
2773         size_t bufsize;
2774         size_t tosend = nread;
2775         char *buf;
2776
2777         if (nread == 0) {
2778                 return 0;
2779         }
2780
2781         bufsize = MIN(nread, 65536);
2782
2783         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2784                 return -1;
2785         }
2786
2787         while (tosend > 0) {
2788                 ssize_t ret;
2789                 size_t cur_read;
2790
2791                 if (tosend > bufsize) {
2792                         cur_read = bufsize;
2793                 } else {
2794                         cur_read = tosend;
2795                 }
2796                 ret = read_file(fsp,buf,startpos,cur_read);
2797                 if (ret == -1) {
2798                         SAFE_FREE(buf);
2799                         return -1;
2800                 }
2801
2802                 /* If we had a short read, fill with zeros. */
2803                 if (ret < cur_read) {
2804                         memset(buf + ret, '\0', cur_read - ret);
2805                 }
2806
2807                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2808                         SAFE_FREE(buf);
2809                         return -1;
2810                 }
2811                 tosend -= cur_read;
2812                 startpos += cur_read;
2813         }
2814
2815         SAFE_FREE(buf);
2816         return (ssize_t)nread;
2817 }
2818
2819 #if defined(WITH_SENDFILE)
2820 /****************************************************************************
2821  Deal with the case of sendfile reading less bytes from the file than
2822  requested. Fill with zeros (all we can do).
2823 ****************************************************************************/
2824
2825 static void sendfile_short_send(files_struct *fsp,
2826                                 ssize_t nread,
2827                                 size_t headersize,
2828                                 size_t smb_maxcnt)
2829 {
2830 #define SHORT_SEND_BUFSIZE 1024
2831         if (nread < headersize) {
2832                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
2833                         "header for file %s (%s). Terminating\n",
2834                         fsp_str_dbg(fsp), strerror(errno)));
2835                 exit_server_cleanly("sendfile_short_send failed");
2836         }
2837
2838         nread -= headersize;
2839
2840         if (nread < smb_maxcnt) {
2841                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2842                 if (!buf) {
2843                         exit_server_cleanly("sendfile_short_send: "
2844                                 "malloc failed");
2845                 }
2846
2847                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
2848                         "with zeros !\n", fsp_str_dbg(fsp)));
2849
2850                 while (nread < smb_maxcnt) {
2851                         /*
2852                          * We asked for the real file size and told sendfile
2853                          * to not go beyond the end of the file. But it can
2854                          * happen that in between our fstat call and the
2855                          * sendfile call the file was truncated. This is very
2856                          * bad because we have already announced the larger
2857                          * number of bytes to the client.
2858                          *
2859                          * The best we can do now is to send 0-bytes, just as
2860                          * a read from a hole in a sparse file would do.
2861                          *
2862                          * This should happen rarely enough that I don't care
2863                          * about efficiency here :-)
2864                          */
2865                         size_t to_write;
2866
2867                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2868                         if (write_data(smbd_server_fd(), buf, to_write) != to_write) {
2869                                 exit_server_cleanly("sendfile_short_send: "
2870                                         "write_data failed");
2871                         }
2872                         nread += to_write;
2873                 }
2874                 SAFE_FREE(buf);
2875         }
2876 }
2877 #endif /* defined WITH_SENDFILE */
2878
2879 /****************************************************************************
2880  Return a readbraw error (4 bytes of zero).
2881 ****************************************************************************/
2882
2883 static void reply_readbraw_error(void)
2884 {
2885         char header[4];
2886         SIVAL(header,0,0);
2887         if (write_data(smbd_server_fd(),header,4) != 4) {
2888                 fail_readraw();
2889         }
2890 }
2891
2892 /****************************************************************************
2893  Use sendfile in readbraw.
2894 ****************************************************************************/
2895
2896 static void send_file_readbraw(connection_struct *conn,
2897                                struct smb_request *req,
2898                                files_struct *fsp,
2899                                SMB_OFF_T startpos,
2900                                size_t nread,
2901                                ssize_t mincount)
2902 {
2903         char *outbuf = NULL;
2904         ssize_t ret=0;
2905
2906 #if defined(WITH_SENDFILE)
2907         /*
2908          * We can only use sendfile on a non-chained packet
2909          * but we can use on a non-oplocked file. tridge proved this
2910          * on a train in Germany :-). JRA.
2911          * reply_readbraw has already checked the length.
2912          */
2913
2914         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
2915             (fsp->wcp == NULL) &&
2916             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
2917                 ssize_t sendfile_read = -1;
2918                 char header[4];
2919                 DATA_BLOB header_blob;
2920
2921                 _smb_setlen(header,nread);
2922                 header_blob = data_blob_const(header, 4);
2923
2924                 if ((sendfile_read = SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2925                                 &header_blob, startpos, nread)) == -1) {
2926                         /* Returning ENOSYS means no data at all was sent.
2927                          * Do this as a normal read. */
2928                         if (errno == ENOSYS) {
2929                                 goto normal_readbraw;
2930                         }
2931
2932                         /*
2933                          * Special hack for broken Linux with no working sendfile. If we
2934                          * return EINTR we sent the header but not the rest of the data.
2935                          * Fake this up by doing read/write calls.
2936                          */
2937                         if (errno == EINTR) {
2938                                 /* Ensure we don't do this again. */
2939                                 set_use_sendfile(SNUM(conn), False);
2940                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2941
2942                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2943                                         DEBUG(0,("send_file_readbraw: "
2944                                                  "fake_sendfile failed for "
2945                                                  "file %s (%s).\n",
2946                                                  fsp_str_dbg(fsp),
2947                                                  strerror(errno)));
2948                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2949                                 }
2950                                 return;
2951                         }
2952
2953                         DEBUG(0,("send_file_readbraw: sendfile failed for "
2954                                  "file %s (%s). Terminating\n",
2955                                  fsp_str_dbg(fsp), strerror(errno)));
2956                         exit_server_cleanly("send_file_readbraw sendfile failed");
2957                 } else if (sendfile_read == 0) {
2958                         /*
2959                          * Some sendfile implementations return 0 to indicate
2960                          * that there was a short read, but nothing was
2961                          * actually written to the socket.  In this case,
2962                          * fallback to the normal read path so the header gets
2963                          * the correct byte count.
2964                          */
2965                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
2966                                   "bytes falling back to the normal read: "
2967                                   "%s\n", fsp_str_dbg(fsp)));
2968                         goto normal_readbraw;
2969                 }
2970
2971                 /* Deal with possible short send. */
2972                 if (sendfile_read != 4+nread) {
2973                         sendfile_short_send(fsp, sendfile_read, 4, nread);
2974                 }
2975                 return;
2976         }
2977
2978 normal_readbraw:
2979 #endif
2980
2981         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2982         if (!outbuf) {
2983                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2984                         (unsigned)(nread+4)));
2985                 reply_readbraw_error();
2986                 return;
2987         }
2988
2989         if (nread > 0) {
2990                 ret = read_file(fsp,outbuf+4,startpos,nread);
2991 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2992                 if (ret < mincount)
2993                         ret = 0;
2994 #else
2995                 if (ret < nread)
2996                         ret = 0;
2997 #endif
2998         }
2999
3000         _smb_setlen(outbuf,ret);
3001         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
3002                 fail_readraw();
3003
3004         TALLOC_FREE(outbuf);
3005 }
3006
3007 /****************************************************************************
3008  Reply to a readbraw (core+ protocol).
3009 ****************************************************************************/
3010
3011 void reply_readbraw(struct smb_request *req)
3012 {
3013         connection_struct *conn = req->conn;
3014         ssize_t maxcount,mincount;
3015         size_t nread = 0;
3016         SMB_OFF_T startpos;
3017         files_struct *fsp;
3018         struct lock_struct lock;
3019         SMB_STRUCT_STAT st;
3020         SMB_OFF_T size = 0;
3021
3022         START_PROFILE(SMBreadbraw);
3023
3024         if (srv_is_signing_active(smbd_server_conn) ||
3025             is_encrypted_packet(req->inbuf)) {
3026                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3027                         "raw reads/writes are disallowed.");
3028         }
3029
3030         if (req->wct < 8) {
3031                 reply_readbraw_error();
3032                 END_PROFILE(SMBreadbraw);
3033                 return;
3034         }
3035
3036         /*
3037          * Special check if an oplock break has been issued
3038          * and the readraw request croses on the wire, we must
3039          * return a zero length response here.
3040          */
3041
3042         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3043
3044         /*
3045          * We have to do a check_fsp by hand here, as
3046          * we must always return 4 zero bytes on error,
3047          * not a NTSTATUS.
3048          */
3049
3050         if (!fsp || !conn || conn != fsp->conn ||
3051                         req->vuid != fsp->vuid ||
3052                         fsp->is_directory || fsp->fh->fd == -1) {
3053                 /*
3054                  * fsp could be NULL here so use the value from the packet. JRA.
3055                  */
3056                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3057                         "- cache prime?\n",
3058                         (int)SVAL(req->vwv+0, 0)));
3059                 reply_readbraw_error();
3060                 END_PROFILE(SMBreadbraw);
3061                 return;
3062         }
3063
3064         /* Do a "by hand" version of CHECK_READ. */
3065         if (!(fsp->can_read ||
3066                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3067                                 (fsp->access_mask & FILE_EXECUTE)))) {
3068                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3069                                 (int)SVAL(req->vwv+0, 0)));
3070                 reply_readbraw_error();
3071                 END_PROFILE(SMBreadbraw);
3072                 return;
3073         }
3074
3075         flush_write_cache(fsp, READRAW_FLUSH);
3076
3077         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3078         if(req->wct == 10) {
3079                 /*
3080                  * This is a large offset (64 bit) read.
3081                  */
3082 #ifdef LARGE_SMB_OFF_T
3083
3084                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3085
3086 #else /* !LARGE_SMB_OFF_T */
3087
3088                 /*
3089                  * Ensure we haven't been sent a >32 bit offset.
3090                  */
3091
3092                 if(IVAL(req->vwv+8, 0) != 0) {
3093                         DEBUG(0,("reply_readbraw: large offset "
3094                                 "(%x << 32) used and we don't support "
3095                                 "64 bit offsets.\n",
3096                         (unsigned int)IVAL(req->vwv+8, 0) ));
3097                         reply_readbraw_error();
3098                         END_PROFILE(SMBreadbraw);
3099                         return;
3100                 }
3101
3102 #endif /* LARGE_SMB_OFF_T */
3103
3104                 if(startpos < 0) {
3105                         DEBUG(0,("reply_readbraw: negative 64 bit "
3106                                 "readraw offset (%.0f) !\n",
3107                                 (double)startpos ));
3108                         reply_readbraw_error();
3109                         END_PROFILE(SMBreadbraw);
3110                         return;
3111                 }
3112         }
3113
3114         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3115         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3116
3117         /* ensure we don't overrun the packet size */
3118         maxcount = MIN(65535,maxcount);
3119
3120         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3121             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3122             &lock);
3123
3124         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3125                 reply_readbraw_error();
3126                 END_PROFILE(SMBreadbraw);
3127                 return;
3128         }
3129
3130         if (SMB_VFS_FSTAT(fsp, &st) == 0) {
3131                 size = st.st_ex_size;
3132         }
3133
3134         if (startpos >= size) {
3135                 nread = 0;
3136         } else {
3137                 nread = MIN(maxcount,(size - startpos));
3138         }
3139
3140 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3141         if (nread < mincount)
3142                 nread = 0;
3143 #endif
3144
3145         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3146                 "min=%lu nread=%lu\n",
3147                 fsp->fnum, (double)startpos,
3148                 (unsigned long)maxcount,
3149                 (unsigned long)mincount,
3150                 (unsigned long)nread ) );
3151
3152         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3153
3154         DEBUG(5,("reply_readbraw finished\n"));
3155
3156         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3157
3158         END_PROFILE(SMBreadbraw);
3159         return;
3160 }
3161
3162 #undef DBGC_CLASS
3163 #define DBGC_CLASS DBGC_LOCKING
3164
3165 /****************************************************************************
3166  Reply to a lockread (core+ protocol).
3167 ****************************************************************************/
3168
3169 void reply_lockread(struct smb_request *req)
3170 {
3171         connection_struct *conn = req->conn;
3172         ssize_t nread = -1;
3173         char *data;
3174         SMB_OFF_T startpos;
3175         size_t numtoread;
3176         NTSTATUS status;
3177         files_struct *fsp;
3178         struct byte_range_lock *br_lck = NULL;
3179         char *p = NULL;
3180         struct smbd_server_connection *sconn = smbd_server_conn;
3181
3182         START_PROFILE(SMBlockread);
3183
3184         if (req->wct < 5) {
3185                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3186                 END_PROFILE(SMBlockread);
3187                 return;
3188         }
3189
3190         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3191
3192         if (!check_fsp(conn, req, fsp)) {
3193                 END_PROFILE(SMBlockread);
3194                 return;
3195         }
3196
3197         if (!CHECK_READ(fsp,req)) {
3198                 reply_doserror(req, ERRDOS, ERRbadaccess);
3199                 END_PROFILE(SMBlockread);
3200                 return;
3201         }
3202
3203         numtoread = SVAL(req->vwv+1, 0);
3204         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3205
3206         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3207
3208         reply_outbuf(req, 5, numtoread + 3);
3209
3210         data = smb_buf(req->outbuf) + 3;
3211
3212         /*
3213          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3214          * protocol request that predates the read/write lock concept.
3215          * Thus instead of asking for a read lock here we need to ask
3216          * for a write lock. JRA.
3217          * Note that the requested lock size is unaffected by max_recv.
3218          */
3219
3220         br_lck = do_lock(smbd_messaging_context(),
3221                         fsp,
3222                         req->smbpid,
3223                         (uint64_t)numtoread,
3224                         (uint64_t)startpos,
3225                         WRITE_LOCK,
3226                         WINDOWS_LOCK,
3227                         False, /* Non-blocking lock. */
3228                         &status,
3229                         NULL,
3230                         NULL);
3231         TALLOC_FREE(br_lck);
3232
3233         if (NT_STATUS_V(status)) {
3234                 reply_nterror(req, status);
3235                 END_PROFILE(SMBlockread);
3236                 return;
3237         }
3238
3239         /*
3240          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
3241          */
3242
3243         if (numtoread > sconn->smb1.negprot.max_recv) {
3244                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3245 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3246                         (unsigned int)numtoread,
3247                         (unsigned int)sconn->smb1.negprot.max_recv));
3248                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3249         }
3250         nread = read_file(fsp,data,startpos,numtoread);
3251
3252         if (nread < 0) {
3253                 reply_nterror(req, map_nt_error_from_unix(errno));
3254                 END_PROFILE(SMBlockread);
3255                 return;
3256         }
3257
3258         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3259
3260         SSVAL(req->outbuf,smb_vwv0,nread);
3261         SSVAL(req->outbuf,smb_vwv5,nread+3);
3262         p = smb_buf(req->outbuf);
3263         SCVAL(p,0,0); /* pad byte. */
3264         SSVAL(p,1,nread);
3265
3266         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3267                  fsp->fnum, (int)numtoread, (int)nread));
3268
3269         END_PROFILE(SMBlockread);
3270         return;
3271 }
3272
3273 #undef DBGC_CLASS
3274 #define DBGC_CLASS DBGC_ALL
3275
3276 /****************************************************************************
3277  Reply to a read.
3278 ****************************************************************************/
3279
3280 void reply_read(struct smb_request *req)
3281 {
3282         connection_struct *conn = req->conn;
3283         size_t numtoread;
3284         ssize_t nread = 0;
3285         char *data;
3286         SMB_OFF_T startpos;
3287         int outsize = 0;
3288         files_struct *fsp;
3289         struct lock_struct lock;
3290         struct smbd_server_connection *sconn = smbd_server_conn;
3291
3292         START_PROFILE(SMBread);
3293
3294         if (req->wct < 3) {
3295                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3296                 END_PROFILE(SMBread);
3297                 return;
3298         }
3299
3300         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3301
3302         if (!check_fsp(conn, req, fsp)) {
3303                 END_PROFILE(SMBread);
3304                 return;
3305         }
3306
3307         if (!CHECK_READ(fsp,req)) {
3308                 reply_doserror(req, ERRDOS, ERRbadaccess);
3309                 END_PROFILE(SMBread);
3310                 return;
3311         }
3312
3313         numtoread = SVAL(req->vwv+1, 0);
3314         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3315
3316         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3317
3318         /*
3319          * The requested read size cannot be greater than max_recv. JRA.
3320          */
3321         if (numtoread > sconn->smb1.negprot.max_recv) {
3322                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3323 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3324                         (unsigned int)numtoread,
3325                         (unsigned int)sconn->smb1.negprot.max_recv));
3326                 numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3327         }
3328
3329         reply_outbuf(req, 5, numtoread+3);
3330
3331         data = smb_buf(req->outbuf) + 3;
3332
3333         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3334             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3335             &lock);
3336
3337         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3338                 reply_doserror(req, ERRDOS,ERRlock);
3339                 END_PROFILE(SMBread);
3340                 return;
3341         }
3342
3343         if (numtoread > 0)
3344                 nread = read_file(fsp,data,startpos,numtoread);
3345
3346         if (nread < 0) {
3347                 reply_nterror(req, map_nt_error_from_unix(errno));
3348                 goto strict_unlock;
3349         }
3350
3351         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3352
3353         SSVAL(req->outbuf,smb_vwv0,nread);
3354         SSVAL(req->outbuf,smb_vwv5,nread+3);
3355         SCVAL(smb_buf(req->outbuf),0,1);
3356         SSVAL(smb_buf(req->outbuf),1,nread);
3357
3358         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3359                 fsp->fnum, (int)numtoread, (int)nread ) );
3360
3361 strict_unlock:
3362         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3363
3364         END_PROFILE(SMBread);
3365         return;
3366 }
3367
3368 /****************************************************************************
3369  Setup readX header.
3370 ****************************************************************************/
3371
3372 static int setup_readX_header(struct smb_request *req, char *outbuf,
3373                               size_t smb_maxcnt)
3374 {
3375         int outsize;
3376         char *data;
3377
3378         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3379         data = smb_buf(outbuf);
3380
3381         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3382
3383         SCVAL(outbuf,smb_vwv0,0xFF);
3384         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3385         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3386         SSVAL(outbuf,smb_vwv6,
3387               req_wct_ofs(req)
3388               + 1               /* the wct field */
3389               + 12 * sizeof(uint16_t) /* vwv */
3390               + 2);             /* the buflen field */
3391         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3392         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3393         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3394         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3395         return outsize;
3396 }
3397
3398 /****************************************************************************
3399  Reply to a read and X - possibly using sendfile.
3400 ****************************************************************************/
3401
3402 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3403                             files_struct *fsp, SMB_OFF_T startpos,
3404                             size_t smb_maxcnt)
3405 {
3406         SMB_STRUCT_STAT sbuf;
3407         ssize_t nread = -1;
3408         struct lock_struct lock;
3409         int saved_errno = 0;
3410
3411         if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3412                 reply_nterror(req, map_nt_error_from_unix(errno));
3413                 return;
3414         }
3415
3416         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3417             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3418             &lock);
3419
3420         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3421                 reply_doserror(req, ERRDOS, ERRlock);
3422                 return;
3423         }
3424
3425         if (!S_ISREG(sbuf.st_ex_mode) || (startpos > sbuf.st_ex_size)
3426             || (smb_maxcnt > (sbuf.st_ex_size - startpos))) {
3427                 /*
3428                  * We already know that we would do a short read, so don't
3429                  * try the sendfile() path.
3430                  */
3431                 goto nosendfile_read;
3432         }
3433
3434 #if defined(WITH_SENDFILE)
3435         /*
3436          * We can only use sendfile on a non-chained packet
3437          * but we can use on a non-oplocked file. tridge proved this
3438          * on a train in Germany :-). JRA.
3439          */
3440
3441         if (!req_is_in_chain(req) &&
3442             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3443             (fsp->wcp == NULL) &&
3444             lp_use_sendfile(SNUM(conn), smbd_server_conn->smb1.signing_state) ) {
3445                 uint8 headerbuf[smb_size + 12 * 2];
3446                 DATA_BLOB header;
3447
3448                 /*
3449                  * Set up the packet header before send. We
3450                  * assume here the sendfile will work (get the
3451                  * correct amount of data).
3452                  */
3453
3454                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3455
3456                 construct_reply_common_req(req, (char *)headerbuf);
3457                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3458
3459                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3460                         /* Returning ENOSYS means no data at all was sent.
3461                            Do this as a normal read. */
3462                         if (errno == ENOSYS) {
3463                                 goto normal_read;
3464                         }
3465
3466                         /*
3467                          * Special hack for broken Linux with no working sendfile. If we
3468                          * return EINTR we sent the header but not the rest of the data.
3469                          * Fake this up by doing read/write calls.
3470                          */
3471
3472                         if (errno == EINTR) {
3473                                 /* Ensure we don't do this again. */
3474                                 set_use_sendfile(SNUM(conn), False);
3475                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3476                                 nread = fake_sendfile(fsp, startpos,
3477                                                       smb_maxcnt);
3478                                 if (nread == -1) {
3479                                         DEBUG(0,("send_file_readX: "
3480                                                  "fake_sendfile failed for "
3481                                                  "file %s (%s).\n",
3482                                                  fsp_str_dbg(fsp),
3483                                                  strerror(errno)));
3484                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3485                                 }
3486                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3487                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3488                                 /* No outbuf here means successful sendfile. */
3489                                 goto strict_unlock;
3490                         }
3491
3492                         DEBUG(0,("send_file_readX: sendfile failed for file "
3493                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3494                                  strerror(errno)));
3495                         exit_server_cleanly("send_file_readX sendfile failed");
3496                 } else if (nread == 0) {
3497                         /*
3498                          * Some sendfile implementations return 0 to indicate
3499                          * that there was a short read, but nothing was
3500                          * actually written to the socket.  In this case,
3501                          * fallback to the normal read path so the header gets
3502                          * the correct byte count.
3503                          */
3504                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3505                                   "falling back to the normal read: %s\n",
3506                                   fsp_str_dbg(fsp)));
3507                         goto normal_read;
3508                 }
3509
3510                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3511                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3512
3513                 /* Deal with possible short send. */
3514                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3515                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3516                 }
3517                 /* No outbuf here means successful sendfile. */
3518                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3519                 SMB_PERFCOUNT_END(&req->pcd);
3520                 goto strict_unlock;
3521         }
3522
3523 normal_read:
3524
3525 #endif
3526
3527         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3528                 uint8 headerbuf[smb_size + 2*12];
3529
3530                 construct_reply_common_req(req, (char *)headerbuf);
3531                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3532
3533                 /* Send out the header. */
3534                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3535                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3536                         DEBUG(0,("send_file_readX: write_data failed for file "
3537                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3538                                  strerror(errno)));
3539                         exit_server_cleanly("send_file_readX sendfile failed");
3540                 }
3541                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3542                 if (nread == -1) {
3543                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3544                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3545                                  strerror(errno)));
3546                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3547                 }
3548                 goto strict_unlock;
3549         }
3550
3551 nosendfile_read:
3552
3553         reply_outbuf(req, 12, smb_maxcnt);
3554
3555         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3556         saved_errno = errno;
3557
3558         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3559
3560         if (nread < 0) {
3561                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3562                 return;
3563         }
3564
3565         setup_readX_header(req, (char *)req->outbuf, nread);
3566
3567         DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3568                     fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3569
3570         chain_reply(req);
3571         return;
3572
3573  strict_unlock:
3574         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3575         TALLOC_FREE(req->outbuf);
3576         return;
3577 }
3578
3579 /****************************************************************************
3580  Reply to a read and X.
3581 ****************************************************************************/
3582
3583 void reply_read_and_X(struct smb_request *req)
3584 {
3585         connection_struct *conn = req->conn;
3586         files_struct *fsp;
3587         SMB_OFF_T startpos;
3588         size_t smb_maxcnt;
3589         bool big_readX = False;
3590 #if 0
3591         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3592 #endif
3593
3594         START_PROFILE(SMBreadX);
3595
3596         if ((req->wct != 10) && (req->wct != 12)) {
3597                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3598                 return;
3599         }
3600
3601         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3602         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3603         smb_maxcnt = SVAL(req->vwv+5, 0);
3604
3605         /* If it's an IPC, pass off the pipe handler. */
3606         if (IS_IPC(conn)) {
3607                 reply_pipe_read_and_X(req);
3608                 END_PROFILE(SMBreadX);
3609                 return;
3610         }
3611
3612         if (!check_fsp(conn, req, fsp)) {
3613                 END_PROFILE(SMBreadX);
3614                 return;
3615         }
3616
3617         if (!CHECK_READ(fsp,req)) {
3618                 reply_doserror(req, ERRDOS,ERRbadaccess);
3619                 END_PROFILE(SMBreadX);
3620                 return;
3621         }
3622
3623         if (global_client_caps & CAP_LARGE_READX) {
3624                 size_t upper_size = SVAL(req->vwv+7, 0);
3625                 smb_maxcnt |= (upper_size<<16);
3626                 if (upper_size > 1) {
3627                         /* Can't do this on a chained packet. */
3628                         if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3629                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3630                                 END_PROFILE(SMBreadX);
3631                                 return;
3632                         }
3633                         /* We currently don't do this on signed or sealed data. */
3634                         if (srv_is_signing_active(smbd_server_conn) ||
3635                             is_encrypted_packet(req->inbuf)) {
3636                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3637                                 END_PROFILE(SMBreadX);
3638                                 return;
3639                         }
3640                         /* Is there room in the reply for this data ? */
3641                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3642                                 reply_nterror(req,
3643                                               NT_STATUS_INVALID_PARAMETER);
3644                                 END_PROFILE(SMBreadX);
3645                                 return;
3646                         }
3647                         big_readX = True;
3648                 }
3649         }
3650
3651         if (req->wct == 12) {
3652 #ifdef LARGE_SMB_OFF_T
3653                 /*
3654                  * This is a large offset (64 bit) read.
3655                  */
3656                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3657
3658 #else /* !LARGE_SMB_OFF_T */
3659
3660                 /*
3661                  * Ensure we haven't been sent a >32 bit offset.
3662                  */
3663
3664                 if(IVAL(req->vwv+10, 0) != 0) {
3665                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3666                                  "used and we don't support 64 bit offsets.\n",
3667                                  (unsigned int)IVAL(req->vwv+10, 0) ));
3668                         END_PROFILE(SMBreadX);
3669                         reply_doserror(req, ERRDOS, ERRbadaccess);
3670                         return;
3671                 }
3672
3673 #endif /* LARGE_SMB_OFF_T */
3674
3675         }
3676
3677         if (!big_readX &&
3678             schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3679                 goto out;
3680         }
3681
3682         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3683
3684  out:
3685         END_PROFILE(SMBreadX);
3686         return;
3687 }
3688
3689 /****************************************************************************
3690  Error replies to writebraw must have smb_wct == 1. Fix this up.
3691 ****************************************************************************/
3692
3693 void error_to_writebrawerr(struct smb_request *req)
3694 {
3695         uint8 *old_outbuf = req->outbuf;
3696
3697         reply_outbuf(req, 1, 0);
3698
3699         memcpy(req->outbuf, old_outbuf, smb_size);
3700         TALLOC_FREE(old_outbuf);
3701 }
3702
3703 /****************************************************************************
3704  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3705 ****************************************************************************/
3706
3707 void reply_writebraw(struct smb_request *req)
3708 {
3709         connection_struct *conn = req->conn;
3710         char *buf = NULL;
3711         ssize_t nwritten=0;
3712         ssize_t total_written=0;
3713         size_t numtowrite=0;
3714         size_t tcount;
3715         SMB_OFF_T startpos;
3716         char *data=NULL;
3717         bool write_through;
3718         files_struct *fsp;
3719         struct lock_struct lock;
3720         NTSTATUS status;
3721
3722         START_PROFILE(SMBwritebraw);
3723
3724         /*
3725          * If we ever reply with an error, it must have the SMB command
3726          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3727          * we're finished.
3728          */
3729         SCVAL(req->inbuf,smb_com,SMBwritec);
3730
3731         if (srv_is_signing_active(smbd_server_conn)) {
3732                 END_PROFILE(SMBwritebraw);
3733                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3734                                 "raw reads/writes are disallowed.");
3735         }
3736
3737         if (req->wct < 12) {
3738                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3739                 error_to_writebrawerr(req);
3740                 END_PROFILE(SMBwritebraw);
3741                 return;
3742         }
3743
3744         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3745         if (!check_fsp(conn, req, fsp)) {
3746                 error_to_writebrawerr(req);
3747                 END_PROFILE(SMBwritebraw);
3748                 return;
3749         }
3750
3751         if (!CHECK_WRITE(fsp)) {
3752                 reply_doserror(req, ERRDOS, ERRbadaccess);
3753                 error_to_writebrawerr(req);
3754                 END_PROFILE(SMBwritebraw);
3755                 return;
3756         }
3757
3758         tcount = IVAL(req->vwv+1, 0);
3759         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3760         write_through = BITSETW(req->vwv+7,0);
3761
3762         /* We have to deal with slightly different formats depending
3763                 on whether we are using the core+ or lanman1.0 protocol */
3764
3765         if(Protocol <= PROTOCOL_COREPLUS) {
3766                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3767                 data = smb_buf(req->inbuf);
3768         } else {
3769                 numtowrite = SVAL(req->vwv+10, 0);
3770                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3771         }
3772
3773         /* Ensure we don't write bytes past the end of this packet. */
3774         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3775                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3776                 error_to_writebrawerr(req);
3777                 END_PROFILE(SMBwritebraw);
3778                 return;
3779         }
3780
3781         init_strict_lock_struct(fsp, (uint32)req->smbpid,
3782             (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3783             &lock);
3784
3785         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3786                 reply_doserror(req, ERRDOS, ERRlock);
3787                 error_to_writebrawerr(req);
3788                 END_PROFILE(SMBwritebraw);
3789                 return;
3790         }
3791
3792         if (numtowrite>0) {
3793                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3794         }
3795
3796         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3797                         "wrote=%d sync=%d\n",
3798                 fsp->fnum, (double)startpos, (int)numtowrite,
3799                 (int)nwritten, (int)write_through));
3800
3801         if (nwritten < (ssize_t)numtowrite)  {
3802                 reply_doserror(req, ERRHRD, ERRdiskfull);
3803                 error_to_writebrawerr(req);
3804                 goto strict_unlock;
3805         }
3806
3807         total_written = nwritten;
3808
3809         /* Allocate a buffer of 64k + length. */
3810         buf = TALLOC_ARRAY(NULL, char, 65540);
3811         if (!buf) {
3812                 reply_doserror(req, ERRDOS, ERRnomem);
3813                 error_to_writebrawerr(req);
3814                 goto strict_unlock;
3815         }
3816
3817         /* Return a SMBwritebraw message to the redirector to tell
3818          * it to send more bytes */
3819
3820         memcpy(buf, req->inbuf, smb_size);
3821         srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3822         SCVAL(buf,smb_com,SMBwritebraw);
3823         SSVALS(buf,smb_vwv0,0xFFFF);
3824         show_msg(buf);
3825         if (!srv_send_smb(smbd_server_fd(),
3826                           buf,
3827                           false, 0, /* no signing */
3828                           IS_CONN_ENCRYPTED(conn),
3829                           &req->pcd)) {
3830                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3831                         "failed.");
3832         }
3833
3834         /* Now read the raw data into the buffer and write it */
3835         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3836                                  &numtowrite);
3837         if (!NT_STATUS_IS_OK(status)) {
3838                 exit_server_cleanly("secondary writebraw failed");
3839         }
3840
3841         /* Set up outbuf to return the correct size */
3842         reply_outbuf(req, 1, 0);
3843
3844         if (numtowrite != 0) {
3845
3846                 if (numtowrite > 0xFFFF) {
3847                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3848                                 "raw requested (%u). Terminating\n",
3849                                 (unsigned int)numtowrite ));
3850                         exit_server_cleanly("secondary writebraw failed");
3851                 }
3852
3853                 if (tcount > nwritten+numtowrite) {
3854                         DEBUG(3,("reply_writebraw: Client overestimated the "
3855                                 "write %d %d %d\n",
3856                                 (int)tcount,(int)nwritten,(int)numtowrite));
3857                 }
3858
3859                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3860
3861                 if (!NT_STATUS_IS_OK(status)) {
3862                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3863                                  "raw read failed (%s). Terminating\n",
3864                                  nt_errstr(status)));
3865                         exit_server_cleanly("secondary writebraw failed");
3866                 }
3867
3868                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3869                 if (nwritten == -1) {
3870                         TALLOC_FREE(buf);
3871                         reply_nterror(req, map_nt_error_from_unix(errno));
3872                         error_to_writebrawerr(req);
3873                         goto strict_unlock;
3874                 }
3875
3876                 if (nwritten < (ssize_t)numtowrite) {
3877                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3878                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3879                 }
3880
3881                 if (nwritten > 0) {
3882                         total_written += nwritten;
3883                 }
3884         }
3885
3886         TALLOC_FREE(buf);
3887         SSVAL(req->outbuf,smb_vwv0,total_written);
3888
3889         status = sync_file(conn, fsp, write_through);
3890         if (!NT_STATUS_IS_OK(status)) {
3891                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3892                          fsp_str_dbg(fsp), nt_errstr(status)));
3893                 reply_nterror(req, status);
3894                 error_to_writebrawerr(req);
3895                 goto strict_unlock;
3896         }
3897
3898         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3899                 "wrote=%d\n",
3900                 fsp->fnum, (double)startpos, (int)numtowrite,
3901                 (int)total_written));
3902
3903         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3904
3905         /* We won't return a status if write through is not selected - this
3906          * follows what WfWg does */
3907         END_PROFILE(SMBwritebraw);
3908
3909         if (!write_through && total_written==tcount) {
3910
3911 #if RABBIT_PELLET_FIX
3912                 /*
3913                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3914                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3915                  * JRA.
3916                  */
3917                 if (!send_keepalive(smbd_server_fd())) {
3918                         exit_server_cleanly("reply_writebraw: send of "
3919                                 "keepalive failed");
3920                 }
3921 #endif
3922                 TALLOC_FREE(req->outbuf);
3923         }
3924         return;
3925
3926 strict_unlock:
3927         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3928
3929         END_PROFILE(SMBwritebraw);
3930         return;
3931 }
3932
3933 #undef DBGC_CLASS
3934 #define DBGC_CLASS DBGC_LOCKING
3935
3936 /****************************************************************************
3937  Reply to a writeunlock (core+).
3938 ****************************************************************************/
3939
3940 void reply_writeunlock(struct smb_request *req)
3941 {
3942         connection_struct *conn = req->conn;
3943         ssize_t nwritten = -1;
3944         size_t numtowrite;
3945         SMB_OFF_T startpos;
3946         const char *data;
3947         NTSTATUS status = NT_STATUS_OK;
3948         files_struct *fsp;
3949         struct lock_struct lock;
3950         int saved_errno = 0;
3951
3952         START_PROFILE(SMBwriteunlock);
3953
3954         if (req->wct < 5) {
3955                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3956                 END_PROFILE(SMBwriteunlock);
3957                 return;
3958         }
3959
3960         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3961
3962         if (!check_fsp(conn, req, fsp)) {
3963                 END_PROFILE(SMBwriteunlock);
3964                 return;
3965         }
3966
3967         if (!CHECK_WRITE(fsp)) {
3968                 reply_doserror(req, ERRDOS,ERRbadaccess);
3969                 END_PROFILE(SMBwriteunlock);
3970                 return;
3971         }
3972
3973         numtowrite = SVAL(req->vwv+1, 0);
3974         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3975         data = (const char *)req->buf + 3;
3976
3977         if (numtowrite) {
3978                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
3979                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
3980                     &lock);
3981
3982                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3983                         reply_doserror(req, ERRDOS, ERRlock);
3984                         END_PROFILE(SMBwriteunlock);
3985                         return;
3986                 }
3987         }
3988
3989         /* The special X/Open SMB protocol handling of
3990            zero length writes is *NOT* done for
3991            this call */
3992         if(numtowrite == 0) {
3993                 nwritten = 0;
3994         } else {
3995                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3996                 saved_errno = errno;
3997         }
3998
3999         status = sync_file(conn, fsp, False /* write through */);
4000         if (!NT_STATUS_IS_OK(status)) {
4001                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4002                          fsp_str_dbg(fsp), nt_errstr(status)));
4003                 reply_nterror(req, status);
4004                 goto strict_unlock;
4005         }
4006
4007         if(nwritten < 0) {
4008                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4009                 goto strict_unlock;
4010         }
4011
4012         if((nwritten < numtowrite) && (numtowrite != 0)) {
4013                 reply_doserror(req, ERRHRD, ERRdiskfull);
4014                 goto strict_unlock;
4015         }
4016
4017         if (numtowrite) {
4018                 status = do_unlock(smbd_messaging_context(),
4019                                 fsp,
4020                                 req->smbpid,
4021                                 (uint64_t)numtowrite,
4022                                 (uint64_t)startpos,
4023                                 WINDOWS_LOCK);
4024
4025                 if (NT_STATUS_V(status)) {
4026                         reply_nterror(req, status);
4027                         goto strict_unlock;
4028                 }
4029         }
4030
4031         reply_outbuf(req, 1, 0);
4032
4033         SSVAL(req->outbuf,smb_vwv0,nwritten);
4034
4035         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4036                  fsp->fnum, (int)numtowrite, (int)nwritten));
4037
4038 strict_unlock:
4039         if (numtowrite) {
4040                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4041         }
4042
4043         END_PROFILE(SMBwriteunlock);
4044         return;
4045 }
4046
4047 #undef DBGC_CLASS
4048 #define DBGC_CLASS DBGC_ALL
4049
4050 /****************************************************************************
4051  Reply to a write.
4052 ****************************************************************************/
4053
4054 void reply_write(struct smb_request *req)
4055 {
4056         connection_struct *conn = req->conn;
4057         size_t numtowrite;
4058         ssize_t nwritten = -1;
4059         SMB_OFF_T startpos;
4060         const char *data;
4061         files_struct *fsp;
4062         struct lock_struct lock;
4063         NTSTATUS status;
4064         int saved_errno = 0;
4065
4066         START_PROFILE(SMBwrite);
4067
4068         if (req->wct < 5) {
4069                 END_PROFILE(SMBwrite);
4070                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4071                 return;
4072         }
4073
4074         /* If it's an IPC, pass off the pipe handler. */
4075         if (IS_IPC(conn)) {
4076                 reply_pipe_write(req);
4077                 END_PROFILE(SMBwrite);
4078                 return;
4079         }
4080
4081         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4082
4083         if (!check_fsp(conn, req, fsp)) {
4084                 END_PROFILE(SMBwrite);
4085                 return;
4086         }
4087
4088         if (!CHECK_WRITE(fsp)) {
4089                 reply_doserror(req, ERRDOS, ERRbadaccess);
4090                 END_PROFILE(SMBwrite);
4091                 return;
4092         }
4093
4094         numtowrite = SVAL(req->vwv+1, 0);
4095         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4096         data = (const char *)req->buf + 3;
4097
4098         init_strict_lock_struct(fsp, (uint32)req->smbpid,
4099             (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4100             &lock);
4101
4102         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4103                 reply_doserror(req, ERRDOS, ERRlock);
4104                 END_PROFILE(SMBwrite);
4105                 return;
4106         }
4107
4108         /*
4109          * X/Open SMB protocol says that if smb_vwv1 is
4110          * zero then the file size should be extended or
4111          * truncated to the size given in smb_vwv[2-3].
4112          */
4113
4114         if(numtowrite == 0) {
4115                 /*
4116                  * This is actually an allocate call, and set EOF. JRA.
4117                  */
4118                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4119                 if (nwritten < 0) {
4120                         reply_nterror(req, NT_STATUS_DISK_FULL);
4121                         goto strict_unlock;
4122                 }
4123                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4124                 if (nwritten < 0) {
4125                         reply_nterror(req, NT_STATUS_DISK_FULL);
4126                         goto strict_unlock;
4127                 }
4128                 trigger_write_time_update_immediate(fsp);
4129         } else {
4130                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4131         }
4132
4133         status = sync_file(conn, fsp, False);
4134         if (!NT_STATUS_IS_OK(status)) {
4135                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4136                          fsp_str_dbg(fsp), nt_errstr(status)));
4137                 reply_nterror(req, status);
4138                 goto strict_unlock;
4139         }
4140
4141         if(nwritten < 0) {
4142                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4143                 goto strict_unlock;
4144         }
4145
4146         if((nwritten == 0) && (numtowrite != 0)) {
4147                 reply_doserror(req, ERRHRD, ERRdiskfull);
4148                 goto strict_unlock;
4149         }
4150
4151         reply_outbuf(req, 1, 0);
4152
4153         SSVAL(req->outbuf,smb_vwv0,nwritten);
4154
4155         if (nwritten < (ssize_t)numtowrite) {
4156                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4157                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4158         }
4159
4160         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4161
4162 strict_unlock:
4163         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4164
4165         END_PROFILE(SMBwrite);
4166         return;
4167 }
4168
4169 /****************************************************************************
4170  Ensure a buffer is a valid writeX for recvfile purposes.
4171 ****************************************************************************/
4172
4173 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4174                                                 (2*14) + /* word count (including bcc) */ \
4175                                                 1 /* pad byte */)
4176
4177 bool is_valid_writeX_buffer(const uint8_t *inbuf)
4178 {
4179         size_t numtowrite;
4180         connection_struct *conn = NULL;
4181         unsigned int doff = 0;
4182         size_t len = smb_len_large(inbuf);
4183         struct smbd_server_connection *sconn = smbd_server_conn;
4184
4185         if (is_encrypted_packet(inbuf)) {
4186                 /* Can't do this on encrypted
4187                  * connections. */
4188                 return false;
4189         }
4190
4191         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4192                 return false;
4193         }
4194
4195         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4196                         CVAL(inbuf,smb_wct) != 14) {
4197                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4198                         "invalid word length.\n"));
4199                 return false;
4200         }
4201
4202         conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4203         if (conn == NULL) {
4204                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4205                 return false;
4206         }
4207         if (IS_IPC(conn)) {
4208                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4209                 return false;
4210         }
4211         if (IS_PRINT(conn)) {
4212                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4213                 return false;
4214         }
4215         doff = SVAL(inbuf,smb_vwv11);
4216
4217         numtowrite = SVAL(inbuf,smb_vwv10);
4218
4219         if (len > doff && len - doff > 0xFFFF) {
4220                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4221         }
4222
4223         if (numtowrite == 0) {
4224                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4225                 return false;
4226         }
4227
4228         /* Ensure the sizes match up. */
4229         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4230                 /* no pad byte...old smbclient :-( */
4231                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4232                         (unsigned int)doff,
4233                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4234                 return false;
4235         }
4236
4237         if (len - doff != numtowrite) {
4238                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4239                         "len = %u, doff = %u, numtowrite = %u\n",
4240                         (unsigned int)len,
4241                         (unsigned int)doff,
4242                         (unsigned int)numtowrite ));
4243                 return false;
4244         }
4245
4246         DEBUG(10,("is_valid_writeX_buffer: true "
4247                 "len = %u, doff = %u, numtowrite = %u\n",
4248                 (unsigned int)len,
4249                 (unsigned int)doff,
4250                 (unsigned int)numtowrite ));
4251
4252         return true;
4253 }
4254
4255 /****************************************************************************
4256  Reply to a write and X.
4257 ****************************************************************************/
4258
4259 void reply_write_and_X(struct smb_request *req)
4260 {
4261         connection_struct *conn = req->conn;
4262         files_struct *fsp;
4263         struct lock_struct lock;
4264         SMB_OFF_T startpos;
4265         size_t numtowrite;
4266         bool write_through;
4267         ssize_t nwritten;
4268         unsigned int smb_doff;
4269         unsigned int smblen;
4270         char *data;
4271         NTSTATUS status;
4272
4273         START_PROFILE(SMBwriteX);
4274
4275         if ((req->wct != 12) && (req->wct != 14)) {
4276                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4277                 END_PROFILE(SMBwriteX);
4278                 return;
4279         }
4280
4281         numtowrite = SVAL(req->vwv+10, 0);
4282         smb_doff = SVAL(req->vwv+11, 0);
4283         smblen = smb_len(req->inbuf);
4284
4285         if (req->unread_bytes > 0xFFFF ||
4286                         (smblen > smb_doff &&
4287                                 smblen - smb_doff > 0xFFFF)) {
4288                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4289         }
4290
4291         if (req->unread_bytes) {
4292                 /* Can't do a recvfile write on IPC$ */
4293                 if (IS_IPC(conn)) {
4294                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4295                         END_PROFILE(SMBwriteX);
4296                         return;
4297                 }
4298                 if (numtowrite != req->unread_bytes) {
4299                         reply_doserror(req, ERRDOS, ERRbadmem);
4300                         END_PROFILE(SMBwriteX);
4301                         return;
4302                 }
4303         } else {
4304                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4305                                 smb_doff + numtowrite > smblen) {
4306                         reply_doserror(req, ERRDOS, ERRbadmem);
4307                         END_PROFILE(SMBwriteX);
4308                         return;
4309                 }
4310         }
4311
4312         /* If it's an IPC, pass off the pipe handler. */
4313         if (IS_IPC(conn)) {
4314                 if (req->unread_bytes) {
4315                         reply_doserror(req, ERRDOS, ERRbadmem);
4316                         END_PROFILE(SMBwriteX);
4317                         return;
4318                 }
4319                 reply_pipe_write_and_X(req);
4320                 END_PROFILE(SMBwriteX);
4321                 return;
4322         }
4323
4324         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4325         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4326         write_through = BITSETW(req->vwv+7,0);
4327
4328         if (!check_fsp(conn, req, fsp)) {
4329                 END_PROFILE(SMBwriteX);
4330                 return;
4331         }
4332
4333         if (!CHECK_WRITE(fsp)) {
4334                 reply_doserror(req, ERRDOS, ERRbadaccess);
4335                 END_PROFILE(SMBwriteX);
4336                 return;
4337         }
4338
4339         data = smb_base(req->inbuf) + smb_doff;
4340
4341         if(req->wct == 14) {
4342 #ifdef LARGE_SMB_OFF_T
4343                 /*
4344                  * This is a large offset (64 bit) write.
4345                  */
4346                 startpos |= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4347
4348 #else /* !LARGE_SMB_OFF_T */
4349
4350                 /*
4351                  * Ensure we haven't been sent a >32 bit offset.
4352                  */
4353
4354                 if(IVAL(req->vwv+12, 0) != 0) {
4355                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4356                                  "used and we don't support 64 bit offsets.\n",
4357                                  (unsigned int)IVAL(req->vwv+12, 0) ));
4358                         reply_doserror(req, ERRDOS, ERRbadaccess);
4359                         END_PROFILE(SMBwriteX);
4360                         return;
4361                 }
4362
4363 #endif /* LARGE_SMB_OFF_T */
4364         }
4365
4366         init_strict_lock_struct(fsp, (uint32)req->smbpid,
4367             (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4368             &lock);
4369
4370         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4371                 reply_doserror(req, ERRDOS, ERRlock);
4372                 END_PROFILE(SMBwriteX);
4373                 return;
4374         }
4375
4376         /* X/Open SMB protocol says that, unlike SMBwrite
4377         if the length is zero then NO truncation is
4378         done, just a write of zero. To truncate a file,
4379         use SMBwrite. */
4380
4381         if(numtowrite == 0) {
4382                 nwritten = 0;
4383         } else {
4384
4385                 if ((req->unread_bytes == 0) &&
4386                     schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4387                                              numtowrite)) {
4388                         goto strict_unlock;
4389                 }
4390
4391                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4392         }
4393
4394         if(nwritten < 0) {
4395                 reply_nterror(req, map_nt_error_from_unix(errno));
4396                 goto strict_unlock;
4397         }
4398
4399         if((nwritten == 0) && (numtowrite != 0)) {
4400                 reply_doserror(req, ERRHRD, ERRdiskfull);
4401                 goto strict_unlock;
4402         }
4403
4404         reply_outbuf(req, 6, 0);
4405         SSVAL(req->outbuf,smb_vwv2,nwritten);
4406         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4407
4408         if (nwritten < (ssize_t)numtowrite) {
4409                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4410                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4411         }
4412
4413         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4414                 fsp->fnum, (int)numtowrite, (int)nwritten));
4415
4416         status = sync_file(conn, fsp, write_through);
4417         if (!NT_STATUS_IS_OK(status)) {
4418                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4419                          fsp_str_dbg(fsp), nt_errstr(status)));
4420                 reply_nterror(req, status);
4421                 goto strict_unlock;
4422         }
4423
4424         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4425
4426         END_PROFILE(SMBwriteX);
4427         chain_reply(req);
4428         return;
4429
4430 strict_unlock:
4431         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4432
4433         END_PROFILE(SMBwriteX);
4434         return;
4435 }
4436
4437 /****************************************************************************
4438  Reply to a lseek.
4439 ****************************************************************************/
4440
4441 void reply_lseek(struct smb_request *req)
4442 {
4443         connection_struct *conn = req->conn;
4444         SMB_OFF_T startpos;
4445         SMB_OFF_T res= -1;
4446         int mode,umode;
4447         files_struct *fsp;
4448
4449         START_PROFILE(SMBlseek);
4450
4451         if (req->wct < 4) {
4452                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4453                 END_PROFILE(SMBlseek);
4454                 return;
4455         }
4456
4457         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4458
4459         if (!check_fsp(conn, req, fsp)) {
4460                 return;
4461         }
4462
4463         flush_write_cache(fsp, SEEK_FLUSH);
4464
4465         mode = SVAL(req->vwv+1, 0) & 3;
4466         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4467         startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4468
4469         switch (mode) {
4470                 case 0:
4471                         umode = SEEK_SET;
4472                         res = startpos;
4473                         break;
4474                 case 1:
4475                         umode = SEEK_CUR;
4476                         res = fsp->fh->pos + startpos;
4477                         break;
4478                 case 2:
4479                         umode = SEEK_END;
4480                         break;
4481                 default:
4482                         umode = SEEK_SET;
4483                         res = startpos;
4484                         break;
4485         }
4486
4487         if (umode == SEEK_END) {
4488                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4489                         if(errno == EINVAL) {
4490                                 SMB_OFF_T current_pos = startpos;
4491                                 SMB_STRUCT_STAT sbuf;
4492
4493                                 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4494                                         reply_nterror(req,
4495                                                 map_nt_error_from_unix(errno));
4496                                         END_PROFILE(SMBlseek);
4497                                         return;
4498                                 }
4499
4500                                 current_pos += sbuf.st_ex_size;
4501                                 if(current_pos < 0)
4502                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4503                         }
4504                 }
4505
4506                 if(res == -1) {
4507                         reply_nterror(req, map_nt_error_from_unix(errno));
4508                         END_PROFILE(SMBlseek);
4509                         return;
4510                 }
4511         }
4512
4513         fsp->fh->pos = res;
4514
4515         reply_outbuf(req, 2, 0);
4516         SIVAL(req->outbuf,smb_vwv0,res);
4517
4518         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4519                 fsp->fnum, (double)startpos, (double)res, mode));
4520
4521         END_PROFILE(SMBlseek);
4522         return;
4523 }
4524
4525 /****************************************************************************
4526  Reply to a flush.
4527 ****************************************************************************/
4528
4529 void reply_flush(struct smb_request *req)
4530 {
4531         connection_struct *conn = req->conn;
4532         uint16 fnum;
4533         files_struct *fsp;
4534
4535         START_PROFILE(SMBflush);
4536
4537         if (req->wct < 1) {
4538                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4539                 return;
4540         }
4541
4542         fnum = SVAL(req->vwv+0, 0);
4543         fsp = file_fsp(req, fnum);
4544
4545         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4546                 return;
4547         }
4548
4549         if (!fsp) {
4550                 file_sync_all(conn);
4551         } else {
4552                 NTSTATUS status = sync_file(conn, fsp, True);
4553                 if (!NT_STATUS_IS_OK(status)) {
4554                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4555                                 fsp_str_dbg(fsp), nt_errstr(status)));
4556                         reply_nterror(req, status);
4557                         END_PROFILE(SMBflush);
4558                         return;
4559                 }
4560         }
4561
4562         reply_outbuf(req, 0, 0);
4563
4564         DEBUG(3,("flush\n"));
4565         END_PROFILE(SMBflush);
4566         return;
4567 }
4568
4569 /****************************************************************************
4570  Reply to a exit.
4571  conn POINTER CAN BE NULL HERE !
4572 ****************************************************************************/
4573
4574 void reply_exit(struct smb_request *req)
4575 {
4576         START_PROFILE(SMBexit);
4577
4578         file_close_pid(req->smbpid, req->vuid);
4579
4580         reply_outbuf(req, 0, 0);
4581
4582         DEBUG(3,("exit\n"));
4583
4584         END_PROFILE(SMBexit);
4585         return;
4586 }
4587
4588 /****************************************************************************
4589  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4590 ****************************************************************************/
4591
4592 void reply_close(struct smb_request *req)
4593 {
4594         connection_struct *conn = req->conn;
4595         NTSTATUS status = NT_STATUS_OK;
4596         files_struct *fsp = NULL;
4597         START_PROFILE(SMBclose);
4598
4599         if (req->wct < 3) {
4600                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4601                 END_PROFILE(SMBclose);
4602                 return;
4603         }
4604
4605         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4606
4607         /*
4608          * We can only use check_fsp if we know it's not a directory.
4609          */
4610
4611         if(!fsp || (fsp->conn != conn) || (fsp->vuid != req->vuid)) {
4612                 reply_doserror(req, ERRDOS, ERRbadfid);
4613                 END_PROFILE(SMBclose);
4614                 return;
4615         }
4616
4617         if(fsp->is_directory) {
4618                 /*
4619                  * Special case - close NT SMB directory handle.
4620                  */
4621                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4622                 status = close_file(req, fsp, NORMAL_CLOSE);
4623         } else {
4624                 time_t t;
4625                 /*
4626                  * Close ordinary file.
4627                  */
4628
4629                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4630                          fsp->fh->fd, fsp->fnum,
4631                          conn->num_files_open));
4632
4633                 /*
4634                  * Take care of any time sent in the close.
4635                  */
4636
4637                 t = srv_make_unix_date3(req->vwv+1);
4638                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4639
4640                 /*
4641                  * close_file() returns the unix errno if an error
4642                  * was detected on close - normally this is due to
4643                  * a disk full error. If not then it was probably an I/O error.
4644                  */
4645
4646                 status = close_file(req, fsp, NORMAL_CLOSE);
4647         }
4648
4649         if (!NT_STATUS_IS_OK(status)) {
4650                 reply_nterror(req, status);
4651                 END_PROFILE(SMBclose);
4652                 return;
4653         }
4654
4655         reply_outbuf(req, 0, 0);
4656         END_PROFILE(SMBclose);
4657         return;
4658 }
4659
4660 /****************************************************************************
4661  Reply to a writeclose (Core+ protocol).
4662 ****************************************************************************/
4663
4664 void reply_writeclose(struct smb_request *req)
4665 {
4666         connection_struct *conn = req->conn;
4667         size_t numtowrite;
4668         ssize_t nwritten = -1;
4669         NTSTATUS close_status = NT_STATUS_OK;
4670         SMB_OFF_T startpos;
4671         const char *data;
4672         struct timespec mtime;
4673         files_struct *fsp;
4674         struct lock_struct lock;
4675
4676         START_PROFILE(SMBwriteclose);
4677
4678         if (req->wct < 6) {
4679                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4680                 END_PROFILE(SMBwriteclose);
4681                 return;
4682         }
4683
4684         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4685
4686         if (!check_fsp(conn, req, fsp)) {
4687                 END_PROFILE(SMBwriteclose);
4688                 return;
4689         }
4690         if (!CHECK_WRITE(fsp)) {
4691                 reply_doserror(req, ERRDOS,ERRbadaccess);
4692                 END_PROFILE(SMBwriteclose);
4693                 return;
4694         }
4695
4696         numtowrite = SVAL(req->vwv+1, 0);
4697         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4698         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4699         data = (const char *)req->buf + 1;
4700
4701         if (numtowrite) {
4702                 init_strict_lock_struct(fsp, (uint32)req->smbpid,
4703                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4704                     &lock);
4705
4706                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4707                         reply_doserror(req, ERRDOS,ERRlock);
4708                         END_PROFILE(SMBwriteclose);
4709                         return;
4710                 }
4711         }
4712
4713         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4714
4715         set_close_write_time(fsp, mtime);
4716
4717         /*
4718          * More insanity. W2K only closes the file if writelen > 0.
4719          * JRA.
4720          */
4721
4722         if (numtowrite) {
4723                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
4724                          "file %s\n", fsp_str_dbg(fsp)));
4725                 close_status = close_file(req, fsp, NORMAL_CLOSE);
4726         }
4727
4728         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4729                  fsp->fnum, (int)numtowrite, (int)nwritten,
4730                  conn->num_files_open));
4731
4732         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4733                 reply_doserror(req, ERRHRD, ERRdiskfull);
4734                 goto strict_unlock;
4735         }
4736
4737         if(!NT_STATUS_IS_OK(close_status)) {
4738                 reply_nterror(req, close_status);
4739                 goto strict_unlock;
4740         }
4741
4742         reply_outbuf(req, 1, 0);
4743
4744         SSVAL(req->outbuf,smb_vwv0,nwritten);
4745
4746 strict_unlock:
4747         if (numtowrite) {
4748                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4749         }
4750
4751         END_PROFILE(SMBwriteclose);
4752         return;
4753 }
4754
4755 #undef DBGC_CLASS
4756 #define DBGC_CLASS DBGC_LOCKING
4757
4758 /****************************************************************************
4759  Reply to a lock.
4760 ****************************************************************************/
4761
4762 void reply_lock(struct smb_request *req)
4763 {
4764         connection_struct *conn = req->conn;
4765         uint64_t count,offset;
4766         NTSTATUS status;
4767         files_struct *fsp;
4768         struct byte_range_lock *br_lck = NULL;
4769
4770         START_PROFILE(SMBlock);
4771
4772         if (req->wct < 5) {
4773                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4774                 END_PROFILE(SMBlock);
4775                 return;
4776         }
4777
4778         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4779
4780         if (!check_fsp(conn, req, fsp)) {
4781                 END_PROFILE(SMBlock);
4782                 return;
4783         }
4784
4785         count = (uint64_t)IVAL(req->vwv+1, 0);
4786         offset = (uint64_t)IVAL(req->vwv+3, 0);
4787
4788         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4789                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4790
4791         br_lck = do_lock(smbd_messaging_context(),
4792                         fsp,
4793                         req->smbpid,
4794                         count,
4795                         offset,
4796                         WRITE_LOCK,
4797                         WINDOWS_LOCK,
4798                         False, /* Non-blocking lock. */
4799                         &status,
4800                         NULL,
4801                         NULL);
4802
4803         TALLOC_FREE(br_lck);
4804
4805         if (NT_STATUS_V(status)) {
4806                 reply_nterror(req, status);
4807                 END_PROFILE(SMBlock);
4808                 return;
4809         }
4810
4811         reply_outbuf(req, 0, 0);
4812
4813         END_PROFILE(SMBlock);
4814         return;
4815 }
4816
4817 /****************************************************************************
4818  Reply to a unlock.
4819 ****************************************************************************/
4820
4821 void reply_unlock(struct smb_request *req)
4822 {
4823         connection_struct *conn = req->conn;
4824         uint64_t count,offset;
4825         NTSTATUS status;
4826         files_struct *fsp;
4827
4828         START_PROFILE(SMBunlock);
4829
4830         if (req->wct < 5) {
4831                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4832                 END_PROFILE(SMBunlock);
4833                 return;
4834         }
4835
4836         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4837
4838         if (!check_fsp(conn, req, fsp)) {
4839                 END_PROFILE(SMBunlock);
4840                 return;
4841         }
4842
4843         count = (uint64_t)IVAL(req->vwv+1, 0);
4844         offset = (uint64_t)IVAL(req->vwv+3, 0);
4845
4846         status = do_unlock(smbd_messaging_context(),
4847                         fsp,
4848                         req->smbpid,
4849                         count,
4850                         offset,
4851                         WINDOWS_LOCK);
4852
4853         if (NT_STATUS_V(status)) {
4854                 reply_nterror(req, status);
4855                 END_PROFILE(SMBunlock);
4856                 return;
4857         }
4858
4859         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4860                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4861
4862         reply_outbuf(req, 0, 0);
4863
4864         END_PROFILE(SMBunlock);
4865         return;
4866 }
4867
4868 #undef DBGC_CLASS
4869 #define DBGC_CLASS DBGC_ALL
4870
4871 /****************************************************************************
4872  Reply to a tdis.
4873  conn POINTER CAN BE NULL HERE !
4874 ****************************************************************************/
4875
4876 void reply_tdis(struct smb_request *req)
4877 {
4878         connection_struct *conn = req->conn;
4879         START_PROFILE(SMBtdis);
4880
4881         if (!conn) {
4882                 DEBUG(4,("Invalid connection in tdis\n"));
4883                 reply_doserror(req, ERRSRV, ERRinvnid);
4884                 END_PROFILE(SMBtdis);
4885                 return;
4886         }
4887
4888         conn->used = False;
4889
4890         close_cnum(conn,req->vuid);
4891         req->conn = NULL;
4892
4893         reply_outbuf(req, 0, 0);
4894         END_PROFILE(SMBtdis);
4895         return;
4896 }
4897
4898 /****************************************************************************
4899  Reply to a echo.
4900  conn POINTER CAN BE NULL HERE !
4901 ****************************************************************************/
4902
4903 void reply_echo(struct smb_request *req)
4904 {
4905         connection_struct *conn = req->conn;
4906         struct smb_perfcount_data local_pcd;
4907         struct smb_perfcount_data *cur_pcd;
4908         int smb_reverb;
4909         int seq_num;
4910
4911         START_PROFILE(SMBecho);
4912
4913         smb_init_perfcount_data(&local_pcd);
4914
4915         if (req->wct < 1) {
4916                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4917                 END_PROFILE(SMBecho);
4918                 return;
4919         }
4920
4921         smb_reverb = SVAL(req->vwv+0, 0);
4922
4923         reply_outbuf(req, 1, req->buflen);
4924
4925         /* copy any incoming data back out */
4926         if (req->buflen > 0) {
4927                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
4928         }
4929
4930         if (smb_reverb > 100) {
4931                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4932                 smb_reverb = 100;
4933         }
4934
4935         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
4936
4937                 /* this makes sure we catch the request pcd */
4938                 if (seq_num == smb_reverb) {
4939                         cur_pcd = &req->pcd;
4940                 } else {
4941                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
4942                         cur_pcd = &local_pcd;
4943                 }
4944
4945                 SSVAL(req->outbuf,smb_vwv0,seq_num);
4946
4947                 show_msg((char *)req->outbuf);
4948                 if (!srv_send_smb(smbd_server_fd(),
4949                                 (char *)req->outbuf,
4950                                 true, req->seqnum+1,
4951                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
4952                                 cur_pcd))
4953                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
4954         }
4955
4956         DEBUG(3,("echo %d times\n", smb_reverb));
4957
4958         TALLOC_FREE(req->outbuf);
4959
4960         END_PROFILE(SMBecho);
4961         return;
4962 }
4963
4964 /****************************************************************************
4965  Reply to a printopen.
4966 ****************************************************************************/
4967
4968 void reply_printopen(struct smb_request *req)
4969 {
4970         connection_struct *conn = req->conn;
4971         files_struct *fsp;
4972         SMB_STRUCT_STAT sbuf;
4973         NTSTATUS status;
4974
4975         START_PROFILE(SMBsplopen);
4976
4977         if (req->wct < 2) {
4978                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4979                 END_PROFILE(SMBsplopen);
4980                 return;
4981         }
4982
4983         if (!CAN_PRINT(conn)) {
4984                 reply_doserror(req, ERRDOS, ERRnoaccess);
4985                 END_PROFILE(SMBsplopen);
4986                 return;
4987         }
4988
4989         status = file_new(req, conn, &fsp);
4990         if(!NT_STATUS_IS_OK(status)) {
4991                 reply_nterror(req, status);
4992                 END_PROFILE(SMBsplopen);
4993                 return;
4994         }
4995
4996         /* Open for exclusive use, write only. */
4997         status = print_fsp_open(req, conn, NULL, req->vuid, fsp, &sbuf);
4998
4999         if (!NT_STATUS_IS_OK(status)) {
5000                 file_free(req, fsp);
5001                 reply_nterror(req, status);
5002                 END_PROFILE(SMBsplopen);
5003                 return;
5004         }
5005
5006         reply_outbuf(req, 1, 0);
5007         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5008
5009         DEBUG(3,("openprint fd=%d fnum=%d\n",
5010                  fsp->fh->fd, fsp->fnum));
5011
5012         END_PROFILE(SMBsplopen);
5013         return;
5014 }
5015
5016 /****************************************************************************
5017  Reply to a printclose.
5018 ****************************************************************************/
5019
5020 void reply_printclose(struct smb_request *req)
5021 {
5022         connection_struct *conn = req->conn;
5023         files_struct *fsp;
5024         NTSTATUS status;
5025
5026         START_PROFILE(SMBsplclose);
5027
5028         if (req->wct < 1) {
5029                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5030                 END_PROFILE(SMBsplclose);
5031                 return;
5032         }
5033
5034         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5035
5036         if (!check_fsp(conn, req, fsp)) {
5037                 END_PROFILE(SMBsplclose);
5038                 return;
5039         }
5040
5041         if (!CAN_PRINT(conn)) {
5042                 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
5043                 END_PROFILE(SMBsplclose);
5044                 return;
5045         }
5046
5047         DEBUG(3,("printclose fd=%d fnum=%d\n",
5048                  fsp->fh->fd,fsp->fnum));
5049
5050         status = close_file(req, fsp, NORMAL_CLOSE);
5051
5052         if(!NT_STATUS_IS_OK(status)) {
5053                 reply_nterror(req, status);
5054                 END_PROFILE(SMBsplclose);
5055                 return;
5056         }
5057
5058         reply_outbuf(req, 0, 0);
5059
5060         END_PROFILE(SMBsplclose);
5061         return;
5062 }
5063
5064 /****************************************************************************
5065  Reply to a printqueue.
5066 ****************************************************************************/
5067
5068 void reply_printqueue(struct smb_request *req)
5069 {
5070         connection_struct *conn = req->conn;
5071         int max_count;
5072         int start_index;
5073
5074         START_PROFILE(SMBsplretq);
5075
5076         if (req->wct < 2) {
5077                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5078                 END_PROFILE(SMBsplretq);
5079                 return;
5080         }
5081
5082         max_count = SVAL(req->vwv+0, 0);
5083         start_index = SVAL(req->vwv+1, 0);
5084
5085         /* we used to allow the client to get the cnum wrong, but that
5086            is really quite gross and only worked when there was only
5087            one printer - I think we should now only accept it if they
5088            get it right (tridge) */
5089         if (!CAN_PRINT(conn)) {
5090                 reply_doserror(req, ERRDOS, ERRnoaccess);
5091                 END_PROFILE(SMBsplretq);
5092                 return;
5093         }
5094
5095         reply_outbuf(req, 2, 3);
5096         SSVAL(req->outbuf,smb_vwv0,0);
5097         SSVAL(req->outbuf,smb_vwv1,0);
5098         SCVAL(smb_buf(req->outbuf),0,1);
5099         SSVAL(smb_buf(req->outbuf),1,0);
5100
5101         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5102                  start_index, max_count));
5103
5104         {
5105                 print_queue_struct *queue = NULL;
5106                 print_status_struct status;
5107                 int count = print_queue_status(SNUM(conn), &queue, &status);
5108                 int num_to_get = ABS(max_count);
5109                 int first = (max_count>0?start_index:start_index+max_count+1);
5110                 int i;
5111
5112                 if (first >= count)
5113                         num_to_get = 0;
5114                 else
5115                         num_to_get = MIN(num_to_get,count-first);
5116
5117
5118                 for (i=first;i<first+num_to_get;i++) {
5119                         char blob[28];
5120                         char *p = blob;
5121
5122                         srv_put_dos_date2(p,0,queue[i].time);
5123                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
5124                         SSVAL(p,5, queue[i].job);
5125                         SIVAL(p,7,queue[i].size);
5126                         SCVAL(p,11,0);
5127                         srvstr_push(blob, req->flags2, p+12,
5128                                     queue[i].fs_user, 16, STR_ASCII);
5129
5130                         if (message_push_blob(
5131                                     &req->outbuf,
5132                                     data_blob_const(
5133                                             blob, sizeof(blob))) == -1) {
5134                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5135                                 END_PROFILE(SMBsplretq);
5136                                 return;
5137                         }
5138                 }
5139
5140                 if (count > 0) {
5141                         SSVAL(req->outbuf,smb_vwv0,count);
5142                         SSVAL(req->outbuf,smb_vwv1,
5143                               (max_count>0?first+count:first-1));
5144                         SCVAL(smb_buf(req->outbuf),0,1);
5145                         SSVAL(smb_buf(req->outbuf),1,28*count);
5146                 }
5147
5148                 SAFE_FREE(queue);
5149
5150                 DEBUG(3,("%d entries returned in queue\n",count));
5151         }
5152
5153         END_PROFILE(SMBsplretq);
5154         return;
5155 }
5156
5157 /****************************************************************************
5158  Reply to a printwrite.
5159 ****************************************************************************/
5160
5161 void reply_printwrite(struct smb_request *req)
5162 {
5163         connection_struct *conn = req->conn;
5164         int numtowrite;
5165         const char *data;
5166         files_struct *fsp;
5167
5168         START_PROFILE(SMBsplwr);
5169
5170         if (req->wct < 1) {
5171                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5172                 END_PROFILE(SMBsplwr);
5173                 return;
5174         }
5175
5176         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5177
5178         if (!check_fsp(conn, req, fsp)) {
5179                 END_PROFILE(SMBsplwr);
5180                 return;
5181         }
5182
5183         if (!CAN_PRINT(conn)) {
5184                 reply_doserror(req, ERRDOS, ERRnoaccess);
5185                 END_PROFILE(SMBsplwr);
5186                 return;
5187         }
5188
5189         if (!CHECK_WRITE(fsp)) {
5190                 reply_doserror(req, ERRDOS, ERRbadaccess);
5191                 END_PROFILE(SMBsplwr);
5192                 return;
5193         }
5194
5195         numtowrite = SVAL(req->buf, 1);
5196
5197         if (req->buflen < numtowrite + 3) {
5198                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5199                 END_PROFILE(SMBsplwr);
5200                 return;
5201         }
5202
5203         data = (const char *)req->buf + 3;
5204
5205         if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
5206                 reply_nterror(req, map_nt_error_from_unix(errno));
5207                 END_PROFILE(SMBsplwr);
5208                 return;
5209         }
5210
5211         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5212
5213         END_PROFILE(SMBsplwr);
5214         return;
5215 }
5216
5217 /****************************************************************************
5218  Reply to a mkdir.
5219 ****************************************************************************/
5220
5221 void reply_mkdir(struct smb_request *req)
5222 {
5223         connection_struct *conn = req->conn;
5224         struct smb_filename *smb_dname = NULL;
5225         char *directory = NULL;
5226         NTSTATUS status;
5227         TALLOC_CTX *ctx = talloc_tos();
5228
5229         START_PROFILE(SMBmkdir);
5230
5231         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5232                             STR_TERMINATE, &status);
5233         if (!NT_STATUS_IS_OK(status)) {
5234                 reply_nterror(req, status);
5235                 goto out;
5236         }
5237
5238         status = filename_convert(ctx, conn,
5239                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5240                                  directory,
5241                                  0,
5242                                  NULL,
5243                                  &smb_dname);
5244         if (!NT_STATUS_IS_OK(status)) {
5245                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5246                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5247                                         ERRSRV, ERRbadpath);
5248                         goto out;
5249                 }
5250                 reply_nterror(req, status);
5251                 goto out;
5252         }
5253
5254         status = create_directory(conn, req, smb_dname);
5255
5256         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5257
5258         if (!NT_STATUS_IS_OK(status)) {
5259
5260                 if (!use_nt_status()
5261                     && NT_STATUS_EQUAL(status,
5262                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5263                         /*
5264                          * Yes, in the DOS error code case we get a
5265                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5266                          * samba4 torture test.
5267                          */
5268                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5269                 }
5270
5271                 reply_nterror(req, status);
5272                 goto out;
5273         }
5274
5275         reply_outbuf(req, 0, 0);
5276
5277         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5278  out:
5279         TALLOC_FREE(smb_dname);
5280         END_PROFILE(SMBmkdir);
5281         return;
5282 }
5283
5284 /****************************************************************************
5285  Static function used by reply_rmdir to delete an entire directory
5286  tree recursively. Return True on ok, False on fail.
5287 ****************************************************************************/
5288
5289 static bool recursive_rmdir(TALLOC_CTX *ctx,
5290                         connection_struct *conn,
5291                         struct smb_filename *smb_dname)
5292 {
5293         const char *dname = NULL;
5294         bool ret = True;
5295         long offset = 0;
5296         SMB_STRUCT_STAT st;
5297         struct smb_Dir *dir_hnd;
5298
5299         SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5300
5301         dir_hnd = OpenDir(talloc_tos(), conn, smb_dname->base_name, NULL, 0);
5302         if(dir_hnd == NULL)
5303                 return False;
5304
5305         while((dname = ReadDirName(dir_hnd, &offset, &st))) {
5306                 struct smb_filename *smb_dname_full = NULL;
5307                 char *fullname = NULL;
5308                 bool do_break = true;
5309                 NTSTATUS status;
5310
5311                 if (ISDOT(dname) || ISDOTDOT(dname)) {
5312                         continue;
5313                 }
5314
5315                 if (!is_visible_file(conn, smb_dname->base_name, dname, &st,
5316                                      false)) {
5317                         continue;
5318                 }
5319
5320                 /* Construct the full name. */
5321                 fullname = talloc_asprintf(ctx,
5322                                 "%s/%s",
5323                                 smb_dname->base_name,
5324                                 dname);
5325                 if (!fullname) {
5326                         errno = ENOMEM;
5327                         goto err_break;
5328                 }
5329
5330                 status = create_synthetic_smb_fname(talloc_tos(), fullname,
5331                                                     NULL, NULL,
5332                                                     &smb_dname_full);
5333                 if (!NT_STATUS_IS_OK(status)) {
5334                         goto err_break;
5335                 }
5336
5337                 if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5338                         goto err_break;
5339                 }
5340
5341                 if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5342                         if(!recursive_rmdir(ctx, conn, smb_dname_full)) {
5343                                 goto err_break;
5344                         }
5345                         if(SMB_VFS_RMDIR(conn,
5346                                          smb_dname_full->base_name) != 0) {
5347                                 goto err_break;
5348                         }
5349                 } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5350                         goto err_break;
5351                 }
5352
5353                 /* Successful iteration. */
5354                 do_break = false;
5355
5356          err_break:
5357                 TALLOC_FREE(smb_dname_full);
5358                 TALLOC_FREE(fullname);
5359                 if (do_break) {
5360                         ret = false;
5361                         break;
5362                 }
5363         }
5364         TALLOC_FREE(dir_hnd);
5365         return ret;
5366 }
5367
5368 /****************************************************************************
5369  The internals of the rmdir code - called elsewhere.
5370 ****************************************************************************/
5371
5372 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
5373                          connection_struct *conn,
5374                          struct smb_filename *smb_dname)
5375 {
5376         int ret;
5377         SMB_STRUCT_STAT st;
5378
5379         SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
5380
5381         /* Might be a symlink. */
5382         if(SMB_VFS_LSTAT(conn, smb_dname) != 0) {
5383                 return map_nt_error_from_unix(errno);
5384         }
5385
5386         if (S_ISLNK(smb_dname->st.st_ex_mode)) {
5387                 /* Is what it points to a directory ? */
5388                 if(SMB_VFS_STAT(conn, smb_dname) != 0) {
5389                         return map_nt_error_from_unix(errno);
5390                 }
5391                 if (!(S_ISDIR(smb_dname->st.st_ex_mode))) {
5392                         return NT_STATUS_NOT_A_DIRECTORY;
5393                 }
5394                 ret = SMB_VFS_UNLINK(conn, smb_dname);
5395         } else {
5396                 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5397         }
5398         if (ret == 0) {
5399                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5400                              FILE_NOTIFY_CHANGE_DIR_NAME,
5401                              smb_dname->base_name);
5402                 return NT_STATUS_OK;
5403         }
5404
5405         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5406                 /*
5407                  * Check to see if the only thing in this directory are
5408                  * vetoed files/directories. If so then delete them and
5409                  * retry. If we fail to delete any of them (and we *don't*
5410                  * do a recursive delete) then fail the rmdir.
5411                  */
5412                 const char *dname;
5413                 long dirpos = 0;
5414                 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5415                                                   smb_dname->base_name, NULL,
5416                                                   0);
5417
5418                 if(dir_hnd == NULL) {
5419                         errno = ENOTEMPTY;
5420                         goto err;
5421                 }
5422
5423                 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5424                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5425                                 continue;
5426                         if (!is_visible_file(conn, smb_dname->base_name, dname,
5427                                              &st, false))
5428                                 continue;
5429                         if(!IS_VETO_PATH(conn, dname)) {
5430                                 TALLOC_FREE(dir_hnd);
5431                                 errno = ENOTEMPTY;
5432                                 goto err;
5433                         }
5434                 }
5435
5436                 /* We only have veto files/directories.
5437                  * Are we allowed to delete them ? */
5438
5439                 if(!lp_recursive_veto_delete(SNUM(conn))) {
5440                         TALLOC_FREE(dir_hnd);
5441                         errno = ENOTEMPTY;
5442                         goto err;
5443                 }
5444
5445                 /* Do a recursive delete. */
5446                 RewindDir(dir_hnd,&dirpos);
5447                 while ((dname = ReadDirName(dir_hnd, &dirpos, &st))) {
5448                         struct smb_filename *smb_dname_full = NULL;
5449                         char *fullname = NULL;
5450                         bool do_break = true;
5451                         NTSTATUS status;
5452
5453                         if (ISDOT(dname) || ISDOTDOT(dname)) {
5454                                 continue;
5455                         }
5456                         if (!is_visible_file(conn, smb_dname->base_name, dname,
5457                                              &st, false)) {
5458                                 continue;
5459                         }
5460
5461                         fullname = talloc_asprintf(ctx,
5462                                         "%s/%s",
5463                                         smb_dname->base_name,
5464                                         dname);
5465
5466                         if(!fullname) {
5467                                 errno = ENOMEM;
5468                                 goto err_break;
5469                         }
5470
5471                         status = create_synthetic_smb_fname(talloc_tos(),
5472                                                             fullname, NULL,
5473                                                             NULL,
5474                                                             &smb_dname_full);
5475                         if (!NT_STATUS_IS_OK(status)) {
5476                                 errno = map_errno_from_nt_status(status);
5477                                 goto err_break;
5478                         }
5479
5480                         if(SMB_VFS_LSTAT(conn, smb_dname_full) != 0) {
5481                                 goto err_break;
5482                         }
5483                         if(smb_dname_full->st.st_ex_mode & S_IFDIR) {
5484                                 if(!recursive_rmdir(ctx, conn,
5485                                                     smb_dname_full)) {
5486                                         goto err_break;
5487                                 }
5488                                 if(SMB_VFS_RMDIR(conn,
5489                                         smb_dname_full->base_name) != 0) {
5490                                         goto err_break;
5491                                 }
5492                         } else if(SMB_VFS_UNLINK(conn, smb_dname_full) != 0) {
5493                                 goto err_break;
5494                         }
5495
5496                         /* Successful iteration. */
5497                         do_break = false;
5498
5499                  err_break:
5500                         TALLOC_FREE(fullname);
5501                         TALLOC_FREE(smb_dname_full);
5502                         if (do_break)
5503                                 break;
5504                 }
5505                 TALLOC_FREE(dir_hnd);
5506                 /* Retry the rmdir */
5507                 ret = SMB_VFS_RMDIR(conn, smb_dname->base_name);
5508         }
5509
5510   err:
5511
5512         if (ret != 0) {
5513                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5514                          "%s\n", smb_fname_str_dbg(smb_dname),
5515                          strerror(errno)));
5516                 return map_nt_error_from_unix(errno);
5517         }
5518
5519         notify_fname(conn, NOTIFY_ACTION_REMOVED,
5520                      FILE_NOTIFY_CHANGE_DIR_NAME,
5521                      smb_dname->base_name);
5522
5523         return NT_STATUS_OK;
5524 }
5525
5526 /****************************************************************************
5527  Reply to a rmdir.
5528 ****************************************************************************/
5529
5530 void reply_rmdir(struct smb_request *req)
5531 {
5532         connection_struct *conn = req->conn;
5533         struct smb_filename *smb_dname = NULL;
5534         char *directory = NULL;
5535         NTSTATUS status;
5536         TALLOC_CTX *ctx = talloc_tos();
5537         struct smbd_server_connection *sconn = smbd_server_conn;
5538
5539         START_PROFILE(SMBrmdir);
5540
5541         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5542                             STR_TERMINATE, &status);
5543         if (!NT_STATUS_IS_OK(status)) {
5544                 reply_nterror(req, status);
5545                 goto out;
5546         }
5547
5548         status = filename_convert(ctx, conn,
5549                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5550                                  directory,
5551                                  0,
5552                                  NULL,
5553                                  &smb_dname);
5554         if (!NT_STATUS_IS_OK(status)) {
5555                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5556                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5557                                         ERRSRV, ERRbadpath);
5558                         goto out;
5559                 }
5560                 reply_nterror(req, status);
5561                 goto out;
5562         }
5563
5564         if (is_ntfs_stream_smb_fname(smb_dname)) {
5565                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5566                 goto out;
5567         }
5568
5569         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5570         status = rmdir_internals(ctx, conn, smb_dname);
5571         if (!NT_STATUS_IS_OK(status)) {
5572                 reply_nterror(req, status);
5573                 goto out;
5574         }
5575
5576         reply_outbuf(req, 0, 0);
5577
5578         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5579  out:
5580         TALLOC_FREE(smb_dname);
5581         END_PROFILE(SMBrmdir);
5582         return;
5583 }
5584
5585 /*******************************************************************
5586  Resolve wildcards in a filename rename.
5587 ********************************************************************/
5588
5589 static bool resolve_wildcards(TALLOC_CTX *ctx,
5590                                 const char *name1,
5591                                 const char *name2,
5592                                 char **pp_newname)
5593 {
5594         char *name2_copy = NULL;
5595         char *root1 = NULL;
5596         char *root2 = NULL;
5597         char *ext1 = NULL;
5598         char *ext2 = NULL;
5599         char *p,*p2, *pname1, *pname2;
5600
5601         name2_copy = talloc_strdup(ctx, name2);
5602         if (!name2_copy) {
5603                 return False;
5604         }
5605
5606         pname1 = strrchr_m(name1,'/');
5607         pname2 = strrchr_m(name2_copy,'/');
5608
5609         if (!pname1 || !pname2) {
5610                 return False;
5611         }
5612
5613         /* Truncate the copy of name2 at the last '/' */
5614         *pname2 = '\0';
5615
5616         /* Now go past the '/' */
5617         pname1++;
5618         pname2++;
5619
5620         root1 = talloc_strdup(ctx, pname1);
5621         root2 = talloc_strdup(ctx, pname2);
5622
5623         if (!root1 || !root2) {
5624                 return False;
5625         }
5626
5627         p = strrchr_m(root1,'.');
5628         if (p) {
5629                 *p = 0;
5630                 ext1 = talloc_strdup(ctx, p+1);
5631         } else {
5632                 ext1 = talloc_strdup(ctx, "");
5633         }
5634         p = strrchr_m(root2,'.');
5635         if (p) {
5636                 *p = 0;
5637                 ext2 = talloc_strdup(ctx, p+1);
5638         } else {
5639                 ext2 = talloc_strdup(ctx, "");
5640         }
5641
5642         if (!ext1 || !ext2) {
5643                 return False;
5644         }
5645
5646         p = root1;
5647         p2 = root2;
5648         while (*p2) {
5649                 if (*p2 == '?') {
5650                         /* Hmmm. Should this be mb-aware ? */
5651                         *p2 = *p;
5652                         p2++;
5653                 } else if (*p2 == '*') {
5654                         *p2 = '\0';
5655                         root2 = talloc_asprintf(ctx, "%s%s",
5656                                                 root2,
5657                                                 p);
5658                         if (!root2) {
5659                                 return False;
5660                         }
5661                         break;
5662                 } else {
5663                         p2++;
5664                 }
5665                 if (*p) {
5666                         p++;
5667                 }
5668         }
5669
5670         p = ext1;
5671         p2 = ext2;
5672         while (*p2) {
5673                 if (*p2 == '?') {
5674                         /* Hmmm. Should this be mb-aware ? */
5675                         *p2 = *p;
5676                         p2++;
5677                 } else if (*p2 == '*') {
5678                         *p2 = '\0';
5679                         ext2 = talloc_asprintf(ctx, "%s%s",
5680                                                 ext2,
5681                                                 p);
5682                         if (!ext2) {
5683                                 return False;
5684                         }
5685                         break;
5686                 } else {
5687                         p2++;
5688                 }
5689                 if (*p) {
5690                         p++;
5691                 }
5692         }
5693
5694         if (*ext2) {
5695                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5696                                 name2_copy,
5697                                 root2,
5698                                 ext2);
5699         } else {
5700                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5701                                 name2_copy,
5702                                 root2);
5703         }
5704
5705         if (!*pp_newname) {
5706                 return False;
5707         }
5708
5709         return True;
5710 }
5711
5712 /****************************************************************************
5713  Ensure open files have their names updated. Updated to notify other smbd's
5714  asynchronously.
5715 ****************************************************************************/
5716
5717 static void rename_open_files(connection_struct *conn,
5718                               struct share_mode_lock *lck,
5719                               const struct smb_filename *smb_fname_dst)
5720 {
5721         files_struct *fsp;
5722         bool did_rename = False;
5723         NTSTATUS status;
5724
5725         for(fsp = file_find_di_first(lck->id); fsp;
5726             fsp = file_find_di_next(fsp)) {
5727                 /* fsp_name is a relative path under the fsp. To change this for other
5728                    sharepaths we need to manipulate relative paths. */
5729                 /* TODO - create the absolute path and manipulate the newname
5730                    relative to the sharepath. */
5731                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5732                         continue;
5733                 }
5734                 DEBUG(10, ("rename_open_files: renaming file fnum %d "
5735                            "(file_id %s) from %s -> %s\n", fsp->fnum,
5736                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5737                            smb_fname_str_dbg(smb_fname_dst)));
5738
5739                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
5740                 if (NT_STATUS_IS_OK(status)) {
5741                         did_rename = True;
5742                 }
5743         }
5744
5745         if (!did_rename) {
5746                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
5747                            "for %s\n", file_id_string_tos(&lck->id),
5748                            smb_fname_str_dbg(smb_fname_dst)));
5749         }
5750
5751         /* Send messages to all smbd's (not ourself) that the name has changed. */
5752         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5753                               smb_fname_dst);
5754
5755 }
5756
5757 /****************************************************************************
5758  We need to check if the source path is a parent directory of the destination
5759  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5760  refuse the rename with a sharing violation. Under UNIX the above call can
5761  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5762  probably need to check that the client is a Windows one before disallowing
5763  this as a UNIX client (one with UNIX extensions) can know the source is a
5764  symlink and make this decision intelligently. Found by an excellent bug
5765  report from <AndyLiebman@aol.com>.
5766 ****************************************************************************/
5767
5768 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5769                                      const struct smb_filename *smb_fname_dst)
5770 {
5771         const char *psrc = smb_fname_src->base_name;
5772         const char *pdst = smb_fname_dst->base_name;
5773         size_t slen;
5774
5775         if (psrc[0] == '.' && psrc[1] == '/') {
5776                 psrc += 2;
5777         }
5778         if (pdst[0] == '.' && pdst[1] == '/') {
5779                 pdst += 2;
5780         }
5781         if ((slen = strlen(psrc)) > strlen(pdst)) {
5782                 return False;
5783         }
5784         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5785 }
5786
5787 /*
5788  * Do the notify calls from a rename
5789  */
5790
5791 static void notify_rename(connection_struct *conn, bool is_dir,
5792                           const struct smb_filename *smb_fname_src,
5793                           const struct smb_filename *smb_fname_dst)
5794 {
5795         char *parent_dir_src = NULL;
5796         char *parent_dir_dst = NULL;
5797         uint32 mask;
5798
5799         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5800                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5801
5802         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5803                             &parent_dir_src, NULL) ||
5804             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5805                             &parent_dir_dst, NULL)) {
5806                 goto out;
5807         }
5808
5809         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5810                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5811                              smb_fname_src->base_name);
5812                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5813                              smb_fname_dst->base_name);
5814         }
5815         else {
5816                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5817                              smb_fname_src->base_name);
5818                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5819                              smb_fname_dst->base_name);
5820         }
5821
5822         /* this is a strange one. w2k3 gives an additional event for
5823            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5824            files, but not directories */
5825         if (!is_dir) {
5826                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5827                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5828                              |FILE_NOTIFY_CHANGE_CREATION,
5829                              smb_fname_dst->base_name);
5830         }
5831  out:
5832         TALLOC_FREE(parent_dir_src);
5833         TALLOC_FREE(parent_dir_dst);
5834 }
5835
5836 /****************************************************************************
5837  Rename an open file - given an fsp.
5838 ****************************************************************************/
5839
5840 NTSTATUS rename_internals_fsp(connection_struct *conn,
5841                         files_struct *fsp,
5842                         const struct smb_filename *smb_fname_dst_in,
5843                         uint32 attrs,
5844                         bool replace_if_exists)
5845 {
5846         TALLOC_CTX *ctx = talloc_tos();
5847         struct smb_filename *smb_fname_src = NULL;
5848         struct smb_filename *smb_fname_dst = NULL;
5849         SMB_STRUCT_STAT sbuf;
5850         NTSTATUS status = NT_STATUS_OK;
5851         struct share_mode_lock *lck = NULL;
5852         bool dst_exists, old_is_stream, new_is_stream;
5853
5854         ZERO_STRUCT(sbuf);
5855
5856         status = check_name(conn, smb_fname_dst_in->base_name);
5857         if (!NT_STATUS_IS_OK(status)) {
5858                 return status;
5859         }
5860
5861         /* Make a copy of the src and dst smb_fname structs */
5862         status = copy_smb_filename(ctx, fsp->fsp_name, &smb_fname_src);
5863         if (!NT_STATUS_IS_OK(status)) {
5864                 goto out;
5865         }
5866
5867         status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
5868         if (!NT_STATUS_IS_OK(status)) {
5869                 goto out;
5870         }
5871
5872         /* Ensure the dst smb_fname contains a '/' */
5873         if(strrchr_m(smb_fname_dst->base_name,'/') == 0) {
5874                 char * tmp;
5875                 tmp = talloc_asprintf(smb_fname_dst, "./%s",
5876                                       smb_fname_dst->base_name);
5877                 if (!tmp) {
5878                         status = NT_STATUS_NO_MEMORY;
5879                         goto out;
5880                 }
5881                 TALLOC_FREE(smb_fname_dst->base_name);
5882                 smb_fname_dst->base_name = tmp;
5883         }
5884
5885         /*
5886          * Check for special case with case preserving and not
5887          * case sensitive. If the old last component differs from the original
5888          * last component only by case, then we should allow
5889          * the rename (user is trying to change the case of the
5890          * filename).
5891          */
5892         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5893             strequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5894             strequal(smb_fname_src->stream_name, smb_fname_dst->stream_name)) {
5895                 char *last_slash;
5896                 char *fname_dst_lcomp_base_mod = NULL;
5897                 struct smb_filename *smb_fname_orig_lcomp = NULL;
5898
5899                 /*
5900                  * Get the last component of the destination name.  Note that
5901                  * we guarantee that destination name contains a '/' character
5902                  * above.
5903                  */
5904                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
5905                 fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
5906                 if (!fname_dst_lcomp_base_mod) {
5907                         status = NT_STATUS_NO_MEMORY;
5908                         goto out;
5909                 }
5910
5911                 /*
5912                  * Create an smb_filename struct using the original last
5913                  * component of the destination.
5914                  */
5915                 status = create_synthetic_smb_fname_split(ctx,
5916                     smb_fname_dst->original_lcomp, NULL,
5917                     &smb_fname_orig_lcomp);
5918                 if (!NT_STATUS_IS_OK(status)) {
5919                         TALLOC_FREE(fname_dst_lcomp_base_mod);
5920                         goto out;
5921                 }
5922
5923                 /* If the base names only differ by case, use original. */
5924                 if(!strcsequal(fname_dst_lcomp_base_mod,
5925                                smb_fname_orig_lcomp->base_name)) {
5926                         char *tmp;
5927                         /*
5928                          * Replace the modified last component with the
5929                          * original.
5930                          */
5931                         *last_slash = '\0'; /* Truncate at the '/' */
5932                         tmp = talloc_asprintf(smb_fname_dst,
5933                                         "%s/%s",
5934                                         smb_fname_dst->base_name,
5935                                         smb_fname_orig_lcomp->base_name);
5936                         if (tmp == NULL) {
5937                                 status = NT_STATUS_NO_MEMORY;
5938                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5939                                 TALLOC_FREE(smb_fname_orig_lcomp);
5940                                 goto out;
5941                         }
5942                         TALLOC_FREE(smb_fname_dst->base_name);
5943                         smb_fname_dst->base_name = tmp;
5944                 }
5945
5946                 /* If the stream_names only differ by case, use original. */
5947                 if(!strcsequal(smb_fname_dst->stream_name,
5948                                smb_fname_orig_lcomp->stream_name)) {
5949                         char *tmp = NULL;
5950                         /* Use the original stream. */
5951                         tmp = talloc_strdup(smb_fname_dst,
5952                                             smb_fname_orig_lcomp->stream_name);
5953                         if (tmp == NULL) {
5954                                 status = NT_STATUS_NO_MEMORY;
5955                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5956                                 TALLOC_FREE(smb_fname_orig_lcomp);
5957                                 goto out;
5958                         }
5959                         TALLOC_FREE(smb_fname_dst->stream_name);
5960                         smb_fname_dst->stream_name = tmp;
5961                 }
5962                 TALLOC_FREE(fname_dst_lcomp_base_mod);
5963                 TALLOC_FREE(smb_fname_orig_lcomp);
5964         }
5965
5966         /*
5967          * If the src and dest names are identical - including case,
5968          * don't do the rename, just return success.
5969          */
5970
5971         if (strcsequal(smb_fname_src->base_name, smb_fname_dst->base_name) &&
5972             strcsequal(smb_fname_src->stream_name,
5973                        smb_fname_dst->stream_name)) {
5974                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
5975                           "- returning success\n",
5976                           smb_fname_str_dbg(smb_fname_dst)));
5977                 status = NT_STATUS_OK;
5978                 goto out;
5979         }
5980
5981         old_is_stream = is_ntfs_stream_smb_fname(smb_fname_src);
5982         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
5983
5984         /* Return the correct error code if both names aren't streams. */
5985         if (!old_is_stream && new_is_stream) {
5986                 status = NT_STATUS_OBJECT_NAME_INVALID;
5987                 goto out;
5988         }
5989
5990         if (old_is_stream && !new_is_stream) {
5991                 status = NT_STATUS_INVALID_PARAMETER;
5992                 goto out;
5993         }
5994
5995         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
5996
5997         if(!replace_if_exists && dst_exists) {
5998                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
5999                           "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6000                           smb_fname_str_dbg(smb_fname_dst)));
6001                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6002                 goto out;
6003         }
6004
6005         if (dst_exists) {
6006                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6007                     &smb_fname_dst->st);
6008                 files_struct *dst_fsp = file_find_di_first(fileid);
6009                 /* The file can be open when renaming a stream */
6010                 if (dst_fsp && !new_is_stream) {
6011                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6012                         status = NT_STATUS_ACCESS_DENIED;
6013                         goto out;
6014                 }
6015         }
6016
6017         /* Ensure we have a valid stat struct for the source. */
6018         if (fsp->fh->fd != -1) {
6019                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
6020                         status = map_nt_error_from_unix(errno);
6021                         goto out;
6022                 }
6023         } else {
6024                 int ret = -1;
6025                 if (fsp->posix_open) {
6026                         ret = SMB_VFS_LSTAT(conn, smb_fname_src);
6027                 } else {
6028
6029                         ret = SMB_VFS_STAT(conn, smb_fname_src);
6030                 }
6031                 if (ret == -1) {
6032                         status = map_nt_error_from_unix(errno);
6033                         goto out;
6034                 }
6035                 sbuf = smb_fname_src->st;
6036         }
6037
6038         status = can_rename(conn, fsp, attrs, &sbuf);
6039
6040         if (!NT_STATUS_IS_OK(status)) {
6041                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6042                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6043                           smb_fname_str_dbg(smb_fname_dst)));
6044                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6045                         status = NT_STATUS_ACCESS_DENIED;
6046                 goto out;
6047         }
6048
6049         if (rename_path_prefix_equal(smb_fname_src, smb_fname_dst)) {
6050                 status = NT_STATUS_ACCESS_DENIED;
6051         }
6052
6053         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6054                                   NULL);
6055
6056         /*
6057          * We have the file open ourselves, so not being able to get the
6058          * corresponding share mode lock is a fatal error.
6059          */
6060
6061         SMB_ASSERT(lck != NULL);
6062
6063         if(SMB_VFS_RENAME(conn, smb_fname_src, smb_fname_dst) == 0) {
6064                 uint32 create_options = fsp->fh->private_options;
6065
6066                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6067                           "%s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6068                           smb_fname_str_dbg(smb_fname_dst)));
6069
6070                 notify_rename(conn, fsp->is_directory, smb_fname_src,
6071                               smb_fname_dst);
6072
6073                 rename_open_files(conn, lck, smb_fname_dst);
6074
6075                 /*
6076                  * A rename acts as a new file create w.r.t. allowing an initial delete
6077                  * on close, probably because in Windows there is a new handle to the
6078                  * new file. If initial delete on close was requested but not
6079                  * originally set, we need to set it here. This is probably not 100% correct,
6080                  * but will work for the CIFSFS client which in non-posix mode
6081                  * depends on these semantics. JRA.
6082                  */
6083
6084                 if (create_options & FILE_DELETE_ON_CLOSE) {
6085                         status = can_set_delete_on_close(fsp, True, 0);
6086
6087                         if (NT_STATUS_IS_OK(status)) {
6088                                 /* Note that here we set the *inital* delete on close flag,
6089                                  * not the regular one. The magic gets handled in close. */
6090                                 fsp->initial_delete_on_close = True;
6091                         }
6092                 }
6093                 TALLOC_FREE(lck);
6094                 status = NT_STATUS_OK;
6095                 goto out;
6096         }
6097
6098         TALLOC_FREE(lck);
6099
6100         if (errno == ENOTDIR || errno == EISDIR) {
6101                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6102         } else {
6103                 status = map_nt_error_from_unix(errno);
6104         }
6105
6106         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6107                   nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6108                   smb_fname_str_dbg(smb_fname_dst)));
6109
6110  out:
6111         TALLOC_FREE(smb_fname_src);
6112         TALLOC_FREE(smb_fname_dst);
6113
6114         return status;
6115 }
6116
6117 /****************************************************************************
6118  The guts of the rename command, split out so it may be called by the NT SMB
6119  code.
6120 ****************************************************************************/
6121
6122 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6123                         connection_struct *conn,
6124                         struct smb_request *req,
6125                         struct smb_filename *smb_fname_src,
6126                         struct smb_filename *smb_fname_dst,
6127                         uint32 attrs,
6128                         bool replace_if_exists,
6129                         bool src_has_wild,
6130                         bool dest_has_wild,
6131                         uint32_t access_mask)
6132 {
6133         char *fname_src_dir = NULL;
6134         char *fname_src_mask = NULL;
6135         int count=0;
6136         NTSTATUS status = NT_STATUS_OK;
6137         struct smb_Dir *dir_hnd = NULL;
6138         const char *dname;
6139         long offset = 0;
6140         int create_options = 0;
6141         bool posix_pathnames = lp_posix_pathnames();
6142
6143         /*
6144          * Split the old name into directory and last component
6145          * strings. Note that unix_convert may have stripped off a
6146          * leading ./ from both name and newname if the rename is
6147          * at the root of the share. We need to make sure either both
6148          * name and newname contain a / character or neither of them do
6149          * as this is checked in resolve_wildcards().
6150          */
6151
6152         /* Split up the directory from the filename/mask. */
6153         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6154                                       &fname_src_dir, &fname_src_mask);
6155         if (!NT_STATUS_IS_OK(status)) {
6156                 status = NT_STATUS_NO_MEMORY;
6157                 goto out;
6158         }
6159
6160         /*
6161          * We should only check the mangled cache
6162          * here if unix_convert failed. This means
6163          * that the path in 'mask' doesn't exist
6164          * on the file system and so we need to look
6165          * for a possible mangle. This patch from
6166          * Tine Smukavec <valentin.smukavec@hermes.si>.
6167          */
6168
6169         if (!VALID_STAT(smb_fname_src->st) &&
6170             mangle_is_mangled(fname_src_mask, conn->params)) {
6171                 char *new_mask = NULL;
6172                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6173                                             conn->params);
6174                 if (new_mask) {
6175                         TALLOC_FREE(fname_src_mask);
6176                         fname_src_mask = new_mask;
6177                 }
6178         }
6179
6180         if (!src_has_wild) {
6181                 files_struct *fsp;
6182
6183                 /*
6184                  * Only one file needs to be renamed. Append the mask back
6185                  * onto the directory.
6186                  */
6187                 TALLOC_FREE(smb_fname_src->base_name);
6188                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6189                                                            "%s/%s",
6190                                                            fname_src_dir,
6191                                                            fname_src_mask);
6192                 if (!smb_fname_src->base_name) {
6193                         status = NT_STATUS_NO_MEMORY;
6194                         goto out;
6195                 }
6196
6197                 /* Ensure dst fname contains a '/' also */
6198                 if(strrchr_m(smb_fname_dst->base_name, '/') == 0) {
6199                         char *tmp;
6200                         tmp = talloc_asprintf(smb_fname_dst, "./%s",
6201                                               smb_fname_dst->base_name);
6202                         if (!tmp) {
6203                                 status = NT_STATUS_NO_MEMORY;
6204                                 goto out;
6205                         }
6206                         TALLOC_FREE(smb_fname_dst->base_name);
6207                         smb_fname_dst->base_name = tmp;
6208                 }
6209
6210                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6211                           "case_preserve = %d, short case preserve = %d, "
6212                           "directory = %s, newname = %s, "
6213                           "last_component_dest = %s\n",
6214                           conn->case_sensitive, conn->case_preserve,
6215                           conn->short_case_preserve,
6216                           smb_fname_str_dbg(smb_fname_src),
6217                           smb_fname_str_dbg(smb_fname_dst),
6218                           smb_fname_dst->original_lcomp));
6219
6220                 /* The dest name still may have wildcards. */
6221                 if (dest_has_wild) {
6222                         char *fname_dst_mod = NULL;
6223                         if (!resolve_wildcards(smb_fname_dst,
6224                                                smb_fname_src->base_name,
6225                                                smb_fname_dst->base_name,
6226                                                &fname_dst_mod)) {
6227                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6228                                           "%s %s failed\n",
6229                                           smb_fname_src->base_name,
6230                                           smb_fname_dst->base_name));
6231                                 status = NT_STATUS_NO_MEMORY;
6232                                 goto out;
6233                         }
6234                         TALLOC_FREE(smb_fname_dst->base_name);
6235                         smb_fname_dst->base_name = fname_dst_mod;
6236                 }
6237
6238                 ZERO_STRUCT(smb_fname_src->st);
6239                 if (posix_pathnames) {
6240                         SMB_VFS_LSTAT(conn, smb_fname_src);
6241                 } else {
6242                         SMB_VFS_STAT(conn, smb_fname_src);
6243                 }
6244
6245                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6246                         create_options |= FILE_DIRECTORY_FILE;
6247                 }
6248
6249                 status = SMB_VFS_CREATE_FILE(
6250                         conn,                           /* conn */
6251                         req,                            /* req */
6252                         0,                              /* root_dir_fid */
6253                         smb_fname_src,                  /* fname */
6254                         access_mask,                    /* access_mask */
6255                         (FILE_SHARE_READ |              /* share_access */
6256                             FILE_SHARE_WRITE),
6257                         FILE_OPEN,                      /* create_disposition*/
6258                         create_options,                 /* create_options */
6259                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6260                         0,                              /* oplock_request */
6261                         0,                              /* allocation_size */
6262                         NULL,                           /* sd */
6263                         NULL,                           /* ea_list */
6264                         &fsp,                           /* result */
6265                         NULL);                          /* pinfo */
6266
6267                 if (!NT_STATUS_IS_OK(status)) {
6268                         DEBUG(3, ("Could not open rename source %s: %s\n",
6269                                   smb_fname_str_dbg(smb_fname_src),
6270                                   nt_errstr(status)));
6271                         goto out;
6272                 }
6273
6274                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6275                                               attrs, replace_if_exists);
6276
6277                 close_file(req, fsp, NORMAL_CLOSE);
6278
6279                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6280                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6281                           smb_fname_str_dbg(smb_fname_dst)));
6282
6283                 goto out;
6284         }
6285
6286         /*
6287          * Wildcards - process each file that matches.
6288          */
6289         if (strequal(fname_src_mask, "????????.???")) {
6290                 TALLOC_FREE(fname_src_mask);
6291                 fname_src_mask = talloc_strdup(ctx, "*");
6292                 if (!fname_src_mask) {
6293                         status = NT_STATUS_NO_MEMORY;
6294                         goto out;
6295                 }
6296         }
6297
6298         status = check_name(conn, fname_src_dir);
6299         if (!NT_STATUS_IS_OK(status)) {
6300                 goto out;
6301         }
6302
6303         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6304                           attrs);
6305         if (dir_hnd == NULL) {
6306                 status = map_nt_error_from_unix(errno);
6307                 goto out;
6308         }
6309
6310         status = NT_STATUS_NO_SUCH_FILE;
6311         /*
6312          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6313          * - gentest fix. JRA
6314          */
6315
6316         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st))) {
6317                 files_struct *fsp = NULL;
6318                 char *destname = NULL;
6319                 bool sysdir_entry = False;
6320
6321                 /* Quick check for "." and ".." */
6322                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6323                         if (attrs & aDIR) {
6324                                 sysdir_entry = True;
6325                         } else {
6326                                 continue;
6327                         }
6328                 }
6329
6330                 if (!is_visible_file(conn, fname_src_dir, dname,
6331                                      &smb_fname_src->st, false)) {
6332                         continue;
6333                 }
6334
6335                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6336                         continue;
6337                 }
6338
6339                 if (sysdir_entry) {
6340                         status = NT_STATUS_OBJECT_NAME_INVALID;
6341                         break;
6342                 }
6343
6344                 TALLOC_FREE(smb_fname_src->base_name);
6345                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6346                                                            "%s/%s",
6347                                                            fname_src_dir,
6348                                                            dname);
6349                 if (!smb_fname_src->base_name) {
6350                         status = NT_STATUS_NO_MEMORY;
6351                         goto out;
6352                 }
6353
6354                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6355                                        smb_fname_dst->base_name,
6356                                        &destname)) {
6357                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6358                                   smb_fname_src->base_name, destname));
6359                         continue;
6360                 }
6361                 if (!destname) {
6362                         status = NT_STATUS_NO_MEMORY;
6363                         goto out;
6364                 }
6365
6366                 TALLOC_FREE(smb_fname_dst->base_name);
6367                 smb_fname_dst->base_name = destname;
6368
6369                 ZERO_STRUCT(smb_fname_src->st);
6370                 if (posix_pathnames) {
6371                         SMB_VFS_LSTAT(conn, smb_fname_src);
6372                 } else {
6373                         SMB_VFS_STAT(conn, smb_fname_src);
6374                 }
6375
6376                 create_options = 0;
6377
6378                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6379                         create_options |= FILE_DIRECTORY_FILE;
6380                 }
6381
6382                 status = SMB_VFS_CREATE_FILE(
6383                         conn,                           /* conn */
6384                         req,                            /* req */
6385                         0,                              /* root_dir_fid */
6386                         smb_fname_src,                  /* fname */
6387                         access_mask,                    /* access_mask */
6388                         (FILE_SHARE_READ |              /* share_access */
6389                             FILE_SHARE_WRITE),
6390                         FILE_OPEN,                      /* create_disposition*/
6391                         create_options,                 /* create_options */
6392                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6393                         0,                              /* oplock_request */
6394                         0,                              /* allocation_size */
6395                         NULL,                           /* sd */
6396                         NULL,                           /* ea_list */
6397                         &fsp,                           /* result */
6398                         NULL);                          /* pinfo */
6399
6400                 if (!NT_STATUS_IS_OK(status)) {
6401                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6402                                  "returned %s rename %s -> %s\n",
6403                                  nt_errstr(status),
6404                                  smb_fname_str_dbg(smb_fname_src),
6405                                  smb_fname_str_dbg(smb_fname_dst)));
6406                         break;
6407                 }
6408
6409                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6410                                                               dname);
6411                 if (!smb_fname_dst->original_lcomp) {
6412                         status = NT_STATUS_NO_MEMORY;
6413                         goto out;
6414                 }
6415
6416                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6417                                               attrs, replace_if_exists);
6418
6419                 close_file(req, fsp, NORMAL_CLOSE);
6420
6421                 if (!NT_STATUS_IS_OK(status)) {
6422                         DEBUG(3, ("rename_internals_fsp returned %s for "
6423                                   "rename %s -> %s\n", nt_errstr(status),
6424                                   smb_fname_str_dbg(smb_fname_src),
6425                                   smb_fname_str_dbg(smb_fname_dst)));
6426                         break;
6427                 }
6428
6429                 count++;
6430
6431                 DEBUG(3,("rename_internals: doing rename on %s -> "
6432                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6433                          smb_fname_str_dbg(smb_fname_src)));
6434
6435         }
6436         TALLOC_FREE(dir_hnd);
6437
6438         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6439                 status = map_nt_error_from_unix(errno);
6440         }
6441
6442  out:
6443         TALLOC_FREE(fname_src_dir);
6444         TALLOC_FREE(fname_src_mask);
6445         return status;
6446 }
6447
6448 /****************************************************************************
6449  Reply to a mv.
6450 ****************************************************************************/
6451
6452 void reply_mv(struct smb_request *req)
6453 {
6454         connection_struct *conn = req->conn;
6455         char *name = NULL;
6456         char *newname = NULL;
6457         const char *p;
6458         uint32 attrs;
6459         NTSTATUS status;
6460         bool src_has_wcard = False;
6461         bool dest_has_wcard = False;
6462         TALLOC_CTX *ctx = talloc_tos();
6463         struct smb_filename *smb_fname_src = NULL;
6464         struct smb_filename *smb_fname_dst = NULL;
6465
6466         START_PROFILE(SMBmv);
6467
6468         if (req->wct < 1) {
6469                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6470                 goto out;
6471         }
6472
6473         attrs = SVAL(req->vwv+0, 0);
6474
6475         p = (const char *)req->buf + 1;
6476         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6477                                        &status, &src_has_wcard);
6478         if (!NT_STATUS_IS_OK(status)) {
6479                 reply_nterror(req, status);
6480                 goto out;
6481         }
6482         p++;
6483         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6484                                        &status, &dest_has_wcard);
6485         if (!NT_STATUS_IS_OK(status)) {
6486                 reply_nterror(req, status);
6487                 goto out;
6488         }
6489
6490         status = filename_convert(ctx,
6491                                   conn,
6492                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6493                                   name,
6494                                   UCF_COND_ALLOW_WCARD_LCOMP,
6495                                   &src_has_wcard,
6496                                   &smb_fname_src);
6497
6498         if (!NT_STATUS_IS_OK(status)) {
6499                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6500                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6501                                         ERRSRV, ERRbadpath);
6502                         goto out;
6503                 }
6504                 reply_nterror(req, status);
6505                 goto out;
6506         }
6507
6508         status = filename_convert(ctx,
6509                                   conn,
6510                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6511                                   newname,
6512                                   UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
6513                                   &dest_has_wcard,
6514                                   &smb_fname_dst);
6515
6516         if (!NT_STATUS_IS_OK(status)) {
6517                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6518                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6519                                         ERRSRV, ERRbadpath);
6520                         goto out;
6521                 }
6522                 reply_nterror(req, status);
6523                 goto out;
6524         }
6525
6526         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6527                  smb_fname_str_dbg(smb_fname_dst)));
6528
6529         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6530                                   attrs, False, src_has_wcard, dest_has_wcard,
6531                                   DELETE_ACCESS);
6532         if (!NT_STATUS_IS_OK(status)) {
6533                 if (open_was_deferred(req->mid)) {
6534                         /* We have re-scheduled this call. */
6535                         goto out;
6536                 }
6537                 reply_nterror(req, status);
6538                 goto out;
6539         }
6540
6541         reply_outbuf(req, 0, 0);
6542  out:
6543         TALLOC_FREE(smb_fname_src);
6544         TALLOC_FREE(smb_fname_dst);
6545         END_PROFILE(SMBmv);
6546         return;
6547 }
6548
6549 /*******************************************************************
6550  Copy a file as part of a reply_copy.
6551 ******************************************************************/
6552
6553 /*
6554  * TODO: check error codes on all callers
6555  */
6556
6557 NTSTATUS copy_file(TALLOC_CTX *ctx,
6558                         connection_struct *conn,
6559                         struct smb_filename *smb_fname_src,
6560                         struct smb_filename *smb_fname_dst,
6561                         int ofun,
6562                         int count,
6563                         bool target_is_directory)
6564 {
6565         struct smb_filename *smb_fname_dst_tmp = NULL;
6566         SMB_OFF_T ret=-1;
6567         files_struct *fsp1,*fsp2;
6568         uint32 dosattrs;
6569         uint32 new_create_disposition;
6570         NTSTATUS status;
6571
6572
6573         status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6574         if (!NT_STATUS_IS_OK(status)) {
6575                 return status;
6576         }
6577
6578         /*
6579          * If the target is a directory, extract the last component from the
6580          * src filename and append it to the dst filename
6581          */
6582         if (target_is_directory) {
6583                 const char *p;
6584
6585                 /* dest/target can't be a stream if it's a directory. */
6586                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6587
6588                 p = strrchr_m(smb_fname_src->base_name,'/');
6589                 if (p) {
6590                         p++;
6591                 } else {
6592                         p = smb_fname_src->base_name;
6593                 }
6594                 smb_fname_dst_tmp->base_name =
6595                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6596                                            p);
6597                 if (!smb_fname_dst_tmp->base_name) {
6598                         status = NT_STATUS_NO_MEMORY;
6599                         goto out;
6600                 }
6601         }
6602
6603         status = vfs_file_exist(conn, smb_fname_src);
6604         if (!NT_STATUS_IS_OK(status)) {
6605                 goto out;
6606         }
6607
6608         if (!target_is_directory && count) {
6609                 new_create_disposition = FILE_OPEN;
6610         } else {
6611                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
6612                                                  NULL, NULL,
6613                                                  &new_create_disposition,
6614                                                  NULL)) {
6615                         status = NT_STATUS_INVALID_PARAMETER;
6616                         goto out;
6617                 }
6618         }
6619
6620         /* Open the src file for reading. */
6621         status = SMB_VFS_CREATE_FILE(
6622                 conn,                                   /* conn */
6623                 NULL,                                   /* req */
6624                 0,                                      /* root_dir_fid */
6625                 smb_fname_src,                          /* fname */
6626                 FILE_GENERIC_READ,                      /* access_mask */
6627                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6628                 FILE_OPEN,                              /* create_disposition*/
6629                 0,                                      /* create_options */
6630                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
6631                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6632                 0,                                      /* allocation_size */
6633                 NULL,                                   /* sd */
6634                 NULL,                                   /* ea_list */
6635                 &fsp1,                                  /* result */
6636                 NULL);                                  /* psbuf */
6637
6638         if (!NT_STATUS_IS_OK(status)) {
6639                 goto out;
6640         }
6641
6642         dosattrs = dos_mode(conn, smb_fname_src);
6643
6644         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6645                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6646         }
6647
6648         /* Open the dst file for writing. */
6649         status = SMB_VFS_CREATE_FILE(
6650                 conn,                                   /* conn */
6651                 NULL,                                   /* req */
6652                 0,                                      /* root_dir_fid */
6653                 smb_fname_dst,                          /* fname */
6654                 FILE_GENERIC_WRITE,                     /* access_mask */
6655                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
6656                 new_create_disposition,                 /* create_disposition*/
6657                 0,                                      /* create_options */
6658                 dosattrs,                               /* file_attributes */
6659                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
6660                 0,                                      /* allocation_size */
6661                 NULL,                                   /* sd */
6662                 NULL,                                   /* ea_list */
6663                 &fsp2,                                  /* result */
6664                 NULL);                                  /* psbuf */
6665
6666         if (!NT_STATUS_IS_OK(status)) {
6667                 close_file(NULL, fsp1, ERROR_CLOSE);
6668                 goto out;
6669         }
6670
6671         if ((ofun&3) == 1) {
6672                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6673                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6674                         /*
6675                          * Stop the copy from occurring.
6676                          */
6677                         ret = -1;
6678                         smb_fname_src->st.st_ex_size = 0;
6679                 }
6680         }
6681
6682         /* Do the actual copy. */
6683         if (smb_fname_src->st.st_ex_size) {
6684                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6685         }
6686
6687         close_file(NULL, fsp1, NORMAL_CLOSE);
6688
6689         /* Ensure the modtime is set correctly on the destination file. */
6690         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6691
6692         /*
6693          * As we are opening fsp1 read-only we only expect
6694          * an error on close on fsp2 if we are out of space.
6695          * Thus we don't look at the error return from the
6696          * close of fsp1.
6697          */
6698         status = close_file(NULL, fsp2, NORMAL_CLOSE);
6699
6700         if (!NT_STATUS_IS_OK(status)) {
6701                 goto out;
6702         }
6703
6704         if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6705                 status = NT_STATUS_DISK_FULL;
6706                 goto out;
6707         }
6708
6709         status = NT_STATUS_OK;
6710
6711  out:
6712         TALLOC_FREE(smb_fname_dst_tmp);
6713         return status;
6714 }
6715
6716 /****************************************************************************
6717  Reply to a file copy.
6718 ****************************************************************************/
6719
6720 void reply_copy(struct smb_request *req)
6721 {
6722         connection_struct *conn = req->conn;
6723         struct smb_filename *smb_fname_src = NULL;
6724         struct smb_filename *smb_fname_dst = NULL;
6725         char *fname_src = NULL;
6726         char *fname_dst = NULL;
6727         char *fname_src_mask = NULL;
6728         char *fname_src_dir = NULL;
6729         const char *p;
6730         int count=0;
6731         int error = ERRnoaccess;
6732         int tid2;
6733         int ofun;
6734         int flags;
6735         bool target_is_directory=False;
6736         bool source_has_wild = False;
6737         bool dest_has_wild = False;
6738         NTSTATUS status;
6739         TALLOC_CTX *ctx = talloc_tos();
6740
6741         START_PROFILE(SMBcopy);
6742
6743         if (req->wct < 3) {
6744                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6745                 goto out;
6746         }
6747
6748         tid2 = SVAL(req->vwv+0, 0);
6749         ofun = SVAL(req->vwv+1, 0);
6750         flags = SVAL(req->vwv+2, 0);
6751
6752         p = (const char *)req->buf;
6753         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6754                                        &status, &source_has_wild);
6755         if (!NT_STATUS_IS_OK(status)) {
6756                 reply_nterror(req, status);
6757                 goto out;
6758         }
6759         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6760                                        &status, &dest_has_wild);
6761         if (!NT_STATUS_IS_OK(status)) {
6762                 reply_nterror(req, status);
6763                 goto out;
6764         }
6765
6766         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6767
6768         if (tid2 != conn->cnum) {
6769                 /* can't currently handle inter share copies XXXX */
6770                 DEBUG(3,("Rejecting inter-share copy\n"));
6771                 reply_doserror(req, ERRSRV, ERRinvdevice);
6772                 goto out;
6773         }
6774
6775         status = filename_convert(ctx, conn,
6776                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6777                                   fname_src,
6778                                   UCF_COND_ALLOW_WCARD_LCOMP,
6779                                   &source_has_wild,
6780                                   &smb_fname_src);
6781         if (!NT_STATUS_IS_OK(status)) {
6782                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6783                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6784                                         ERRSRV, ERRbadpath);
6785                         goto out;
6786                 }
6787                 reply_nterror(req, status);
6788                 goto out;
6789         }
6790
6791         status = filename_convert(ctx, conn,
6792                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6793                                   fname_dst,
6794                                   UCF_COND_ALLOW_WCARD_LCOMP,
6795                                   &dest_has_wild,
6796                                   &smb_fname_dst);
6797         if (!NT_STATUS_IS_OK(status)) {
6798                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6799                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6800                                         ERRSRV, ERRbadpath);
6801                         goto out;
6802                 }
6803                 reply_nterror(req, status);
6804                 goto out;
6805         }
6806
6807         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
6808
6809         if ((flags&1) && target_is_directory) {
6810                 reply_doserror(req, ERRDOS, ERRbadfile);
6811                 goto out;
6812         }
6813
6814         if ((flags&2) && !target_is_directory) {
6815                 reply_doserror(req, ERRDOS, ERRbadpath);
6816                 goto out;
6817         }
6818
6819         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
6820                 /* wants a tree copy! XXXX */
6821                 DEBUG(3,("Rejecting tree copy\n"));
6822                 reply_doserror(req, ERRSRV, ERRerror);
6823                 goto out;
6824         }
6825
6826         /* Split up the directory from the filename/mask. */
6827         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6828                                       &fname_src_dir, &fname_src_mask);
6829         if (!NT_STATUS_IS_OK(status)) {
6830                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6831                 goto out;
6832         }
6833
6834         /*
6835          * We should only check the mangled cache
6836          * here if unix_convert failed. This means
6837          * that the path in 'mask' doesn't exist
6838          * on the file system and so we need to look
6839          * for a possible mangle. This patch from
6840          * Tine Smukavec <valentin.smukavec@hermes.si>.
6841          */
6842         if (!VALID_STAT(smb_fname_src->st) &&
6843             mangle_is_mangled(fname_src_mask, conn->params)) {
6844                 char *new_mask = NULL;
6845                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
6846                                             &new_mask, conn->params);
6847
6848                 /* Use demangled name if one was successfully found. */
6849                 if (new_mask) {
6850                         TALLOC_FREE(fname_src_mask);
6851                         fname_src_mask = new_mask;
6852                 }
6853         }
6854
6855         if (!source_has_wild) {
6856
6857                 /*
6858                  * Only one file needs to be copied. Append the mask back onto
6859                  * the directory.
6860                  */
6861                 TALLOC_FREE(smb_fname_src->base_name);
6862                 smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6863                                                            "%s/%s",
6864                                                            fname_src_dir,
6865                                                            fname_src_mask);
6866                 if (!smb_fname_src->base_name) {
6867                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6868                         goto out;
6869                 }
6870
6871                 if (dest_has_wild) {
6872                         char *fname_dst_mod = NULL;
6873                         if (!resolve_wildcards(smb_fname_dst,
6874                                                smb_fname_src->base_name,
6875                                                smb_fname_dst->base_name,
6876                                                &fname_dst_mod)) {
6877                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6878                                 goto out;
6879                         }
6880                         TALLOC_FREE(smb_fname_dst->base_name);
6881                         smb_fname_dst->base_name = fname_dst_mod;
6882                 }
6883
6884                 status = check_name(conn, smb_fname_src->base_name);
6885                 if (!NT_STATUS_IS_OK(status)) {
6886                         reply_nterror(req, status);
6887                         goto out;
6888                 }
6889
6890                 status = check_name(conn, smb_fname_dst->base_name);
6891                 if (!NT_STATUS_IS_OK(status)) {
6892                         reply_nterror(req, status);
6893                         goto out;
6894                 }
6895
6896                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
6897                                    ofun, count, target_is_directory);
6898
6899                 if(!NT_STATUS_IS_OK(status)) {
6900                         reply_nterror(req, status);
6901                         goto out;
6902                 } else {
6903                         count++;
6904                 }
6905         } else {
6906                 struct smb_Dir *dir_hnd = NULL;
6907                 const char *dname = NULL;
6908                 long offset = 0;
6909
6910                 /*
6911                  * There is a wildcard that requires us to actually read the
6912                  * src dir and copy each file matching the mask to the dst.
6913                  * Right now streams won't be copied, but this could
6914                  * presumably be added with a nested loop for reach dir entry.
6915                  */
6916                 SMB_ASSERT(!smb_fname_src->stream_name);
6917                 SMB_ASSERT(!smb_fname_dst->stream_name);
6918
6919                 smb_fname_src->stream_name = NULL;
6920                 smb_fname_dst->stream_name = NULL;
6921
6922                 if (strequal(fname_src_mask,"????????.???")) {
6923                         TALLOC_FREE(fname_src_mask);
6924                         fname_src_mask = talloc_strdup(ctx, "*");
6925                         if (!fname_src_mask) {
6926                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6927                                 goto out;
6928                         }
6929                 }
6930
6931                 status = check_name(conn, fname_src_dir);
6932                 if (!NT_STATUS_IS_OK(status)) {
6933                         reply_nterror(req, status);
6934                         goto out;
6935                 }
6936
6937                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
6938                 if (dir_hnd == NULL) {
6939                         status = map_nt_error_from_unix(errno);
6940                         reply_nterror(req, status);
6941                         goto out;
6942                 }
6943
6944                 error = ERRbadfile;
6945
6946                 /* Iterate over the src dir copying each entry to the dst. */
6947                 while ((dname = ReadDirName(dir_hnd, &offset,
6948                                             &smb_fname_src->st))) {
6949                         char *destname = NULL;
6950
6951                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6952                                 continue;
6953                         }
6954
6955                         if (!is_visible_file(conn, fname_src_dir, dname,
6956                                              &smb_fname_src->st, false)) {
6957                                 continue;
6958                         }
6959
6960                         if(!mask_match(dname, fname_src_mask,
6961                                        conn->case_sensitive)) {
6962                                 continue;
6963                         }
6964
6965                         error = ERRnoaccess;
6966
6967                         /* Get the src smb_fname struct setup. */
6968                         TALLOC_FREE(smb_fname_src->base_name);
6969                         smb_fname_src->base_name =
6970                             talloc_asprintf(smb_fname_src, "%s/%s",
6971                                             fname_src_dir, dname);
6972
6973                         if (!smb_fname_src->base_name) {
6974                                 TALLOC_FREE(dir_hnd);
6975                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6976                                 goto out;
6977                         }
6978
6979                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6980                                                smb_fname_dst->base_name,
6981                                                &destname)) {
6982                                 continue;
6983                         }
6984                         if (!destname) {
6985                                 TALLOC_FREE(dir_hnd);
6986                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6987                                 goto out;
6988                         }
6989
6990                         TALLOC_FREE(smb_fname_dst->base_name);
6991                         smb_fname_dst->base_name = destname;
6992
6993                         status = check_name(conn, smb_fname_src->base_name);
6994                         if (!NT_STATUS_IS_OK(status)) {
6995                                 TALLOC_FREE(dir_hnd);
6996                                 reply_nterror(req, status);
6997                                 goto out;
6998                         }
6999
7000                         status = check_name(conn, smb_fname_dst->base_name);
7001                         if (!NT_STATUS_IS_OK(status)) {
7002                                 TALLOC_FREE(dir_hnd);
7003                                 reply_nterror(req, status);
7004                                 goto out;
7005                         }
7006
7007                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7008                                 smb_fname_src->base_name,
7009                                 smb_fname_dst->base_name));
7010
7011                         status = copy_file(ctx, conn, smb_fname_src,
7012                                            smb_fname_dst, ofun, count,
7013                                            target_is_directory);
7014                         if (NT_STATUS_IS_OK(status)) {
7015                                 count++;
7016                         }
7017                 }
7018                 TALLOC_FREE(dir_hnd);
7019         }
7020
7021         if (count == 0) {
7022                 reply_doserror(req, ERRDOS, error);
7023                 goto out;
7024         }
7025
7026         reply_outbuf(req, 1, 0);
7027         SSVAL(req->outbuf,smb_vwv0,count);
7028  out:
7029         TALLOC_FREE(smb_fname_src);
7030         TALLOC_FREE(smb_fname_dst);
7031         TALLOC_FREE(fname_src);
7032         TALLOC_FREE(fname_dst);
7033         TALLOC_FREE(fname_src_mask);
7034         TALLOC_FREE(fname_src_dir);
7035
7036         END_PROFILE(SMBcopy);
7037         return;
7038 }
7039
7040 #undef DBGC_CLASS
7041 #define DBGC_CLASS DBGC_LOCKING
7042
7043 /****************************************************************************
7044  Get a lock pid, dealing with large count requests.
7045 ****************************************************************************/
7046
7047 uint32 get_lock_pid(const uint8_t *data, int data_offset,
7048                     bool large_file_format)
7049 {
7050         if(!large_file_format)
7051                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
7052         else
7053                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7054 }
7055
7056 /****************************************************************************
7057  Get a lock count, dealing with large count requests.
7058 ****************************************************************************/
7059
7060 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7061                         bool large_file_format)
7062 {
7063         uint64_t count = 0;
7064
7065         if(!large_file_format) {
7066                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7067         } else {
7068
7069 #if defined(HAVE_LONGLONG)
7070                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7071                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7072 #else /* HAVE_LONGLONG */
7073
7074                 /*
7075                  * NT4.x seems to be broken in that it sends large file (64 bit)
7076                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7077                  * negotiated. For boxes without large unsigned ints truncate the
7078                  * lock count by dropping the top 32 bits.
7079                  */
7080
7081                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7082                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7083                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7084                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7085                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7086                 }
7087
7088                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7089 #endif /* HAVE_LONGLONG */
7090         }
7091
7092         return count;
7093 }
7094
7095 #if !defined(HAVE_LONGLONG)
7096 /****************************************************************************
7097  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7098 ****************************************************************************/
7099
7100 static uint32 map_lock_offset(uint32 high, uint32 low)
7101 {
7102         unsigned int i;
7103         uint32 mask = 0;
7104         uint32 highcopy = high;
7105
7106         /*
7107          * Try and find out how many significant bits there are in high.
7108          */
7109
7110         for(i = 0; highcopy; i++)
7111                 highcopy >>= 1;
7112
7113         /*
7114          * We use 31 bits not 32 here as POSIX
7115          * lock offsets may not be negative.
7116          */
7117
7118         mask = (~0) << (31 - i);
7119
7120         if(low & mask)
7121                 return 0; /* Fail. */
7122
7123         high <<= (31 - i);
7124
7125         return (high|low);
7126 }
7127 #endif /* !defined(HAVE_LONGLONG) */
7128
7129 /****************************************************************************
7130  Get a lock offset, dealing with large offset requests.
7131 ****************************************************************************/
7132
7133 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7134                          bool large_file_format, bool *err)
7135 {
7136         uint64_t offset = 0;
7137
7138         *err = False;
7139
7140         if(!large_file_format) {
7141                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7142         } else {
7143
7144 #if defined(HAVE_LONGLONG)
7145                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7146                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7147 #else /* HAVE_LONGLONG */
7148
7149                 /*
7150                  * NT4.x seems to be broken in that it sends large file (64 bit)
7151                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7152                  * negotiated. For boxes without large unsigned ints mangle the
7153                  * lock offset by mapping the top 32 bits onto the lower 32.
7154                  */
7155
7156                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7157                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7158                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7159                         uint32 new_low = 0;
7160
7161                         if((new_low = map_lock_offset(high, low)) == 0) {
7162                                 *err = True;
7163                                 return (uint64_t)-1;
7164                         }
7165
7166                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7167                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7168                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7169                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7170                 }
7171
7172                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7173 #endif /* HAVE_LONGLONG */
7174         }
7175
7176         return offset;
7177 }
7178
7179 NTSTATUS smbd_do_locking(struct smb_request *req,
7180                          files_struct *fsp,
7181                          uint8_t type,
7182                          int32_t timeout,
7183                          uint16_t num_ulocks,
7184                          struct smbd_lock_element *ulocks,
7185                          uint16_t num_locks,
7186                          struct smbd_lock_element *locks,
7187                          bool *async)
7188 {
7189         connection_struct *conn = req->conn;
7190         int i;
7191         NTSTATUS status = NT_STATUS_OK;
7192
7193         *async = false;
7194
7195         /* Data now points at the beginning of the list
7196            of smb_unlkrng structs */
7197         for(i = 0; i < (int)num_ulocks; i++) {
7198                 struct smbd_lock_element *e = &ulocks[i];
7199
7200                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7201                           "pid %u, file %s\n",
7202                           (double)e->offset,
7203                           (double)e->count,
7204                           (unsigned int)e->smbpid,
7205                           fsp_str_dbg(fsp)));
7206
7207                 if (e->brltype != UNLOCK_LOCK) {
7208                         /* this can only happen with SMB2 */
7209                         return NT_STATUS_INVALID_PARAMETER;
7210                 }
7211
7212                 status = do_unlock(smbd_messaging_context(),
7213                                 fsp,
7214                                 e->smbpid,
7215                                 e->count,
7216                                 e->offset,
7217                                 WINDOWS_LOCK);
7218
7219                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7220                     nt_errstr(status)));
7221
7222                 if (!NT_STATUS_IS_OK(status)) {
7223                         return status;
7224                 }
7225         }
7226
7227         /* Setup the timeout in seconds. */
7228
7229         if (!lp_blocking_locks(SNUM(conn))) {
7230                 timeout = 0;
7231         }
7232
7233         /* Data now points at the beginning of the list
7234            of smb_lkrng structs */
7235
7236         for(i = 0; i < (int)num_locks; i++) {
7237                 struct smbd_lock_element *e = &locks[i];
7238
7239                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for pid "
7240                           "%u, file %s timeout = %d\n",
7241                           (double)e->offset,
7242                           (double)e->count,
7243                           (unsigned int)e->smbpid,
7244                           fsp_str_dbg(fsp),
7245                           (int)timeout));
7246
7247                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7248                         struct blocking_lock_record *blr = NULL;
7249
7250                         if (lp_blocking_locks(SNUM(conn))) {
7251
7252                                 /* Schedule a message to ourselves to
7253                                    remove the blocking lock record and
7254                                    return the right error. */
7255
7256                                 blr = blocking_lock_cancel(fsp,
7257                                                 e->smbpid,
7258                                                 e->offset,
7259                                                 e->count,
7260                                                 WINDOWS_LOCK,
7261                                                 type,
7262                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7263                                 if (blr == NULL) {
7264                                         return NT_STATUS_DOS(
7265                                                         ERRDOS,
7266                                                         ERRcancelviolation);
7267                                 }
7268                         }
7269                         /* Remove a matching pending lock. */
7270                         status = do_lock_cancel(fsp,
7271                                                 e->smbpid,
7272                                                 e->count,
7273                                                 e->offset,
7274                                                 WINDOWS_LOCK,
7275                                                 blr);
7276                 } else {
7277                         bool blocking_lock = timeout ? true : false;
7278                         bool defer_lock = false;
7279                         struct byte_range_lock *br_lck;
7280                         uint32_t block_smbpid;
7281
7282                         br_lck = do_lock(smbd_messaging_context(),
7283                                         fsp,
7284                                         e->smbpid,
7285                                         e->count,
7286                                         e->offset,
7287                                         e->brltype,
7288                                         WINDOWS_LOCK,
7289                                         blocking_lock,
7290                                         &status,
7291                                         &block_smbpid,
7292                                         NULL);
7293
7294                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7295                                 /* Windows internal resolution for blocking locks seems
7296                                    to be about 200ms... Don't wait for less than that. JRA. */
7297                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7298                                         timeout = lp_lock_spin_time();
7299                                 }
7300                                 defer_lock = true;
7301                         }
7302
7303                         /* This heuristic seems to match W2K3 very well. If a
7304                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
7305                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
7306                            far as I can tell. Replacement for do_lock_spin(). JRA. */
7307
7308                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
7309                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
7310                                 defer_lock = true;
7311                                 timeout = lp_lock_spin_time();
7312                         }
7313
7314                         if (br_lck && defer_lock) {
7315                                 /*
7316                                  * A blocking lock was requested. Package up
7317                                  * this smb into a queued request and push it
7318                                  * onto the blocking lock queue.
7319                                  */
7320                                 if(push_blocking_lock_request(br_lck,
7321                                                         req,
7322                                                         fsp,
7323                                                         timeout,
7324                                                         i,
7325                                                         e->smbpid,
7326                                                         e->brltype,
7327                                                         WINDOWS_LOCK,
7328                                                         e->offset,
7329                                                         e->count,
7330                                                         block_smbpid)) {
7331                                         TALLOC_FREE(br_lck);
7332                                         *async = true;
7333                                         return NT_STATUS_OK;
7334                                 }
7335                         }
7336
7337                         TALLOC_FREE(br_lck);
7338                 }
7339
7340                 if (!NT_STATUS_IS_OK(status)) {
7341                         break;
7342                 }
7343         }
7344
7345         /* If any of the above locks failed, then we must unlock
7346            all of the previous locks (X/Open spec). */
7347
7348         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7349
7350                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7351                         i = -1; /* we want to skip the for loop */
7352                 }
7353
7354                 /*
7355                  * Ensure we don't do a remove on the lock that just failed,
7356                  * as under POSIX rules, if we have a lock already there, we
7357                  * will delete it (and we shouldn't) .....
7358                  */
7359                 for(i--; i >= 0; i--) {
7360                         struct smbd_lock_element *e = &locks[i];
7361
7362                         do_unlock(smbd_messaging_context(),
7363                                 fsp,
7364                                 e->smbpid,
7365                                 e->count,
7366                                 e->offset,
7367                                 WINDOWS_LOCK);
7368                 }
7369                 return status;
7370         }
7371
7372         DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7373                   fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7374
7375         return NT_STATUS_OK;
7376 }
7377
7378 /****************************************************************************
7379  Reply to a lockingX request.
7380 ****************************************************************************/
7381
7382 void reply_lockingX(struct smb_request *req)
7383 {
7384         connection_struct *conn = req->conn;
7385         files_struct *fsp;
7386         unsigned char locktype;
7387         unsigned char oplocklevel;
7388         uint16 num_ulocks;
7389         uint16 num_locks;
7390         int32 lock_timeout;
7391         int i;
7392         const uint8_t *data;
7393         bool large_file_format;
7394         bool err;
7395         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7396         struct smbd_lock_element *ulocks;
7397         struct smbd_lock_element *locks;
7398         bool async = false;
7399
7400         START_PROFILE(SMBlockingX);
7401
7402         if (req->wct < 8) {
7403                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7404                 END_PROFILE(SMBlockingX);
7405                 return;
7406         }
7407
7408         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7409         locktype = CVAL(req->vwv+3, 0);
7410         oplocklevel = CVAL(req->vwv+3, 1);
7411         num_ulocks = SVAL(req->vwv+6, 0);
7412         num_locks = SVAL(req->vwv+7, 0);
7413         lock_timeout = IVAL(req->vwv+4, 0);
7414         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7415
7416         if (!check_fsp(conn, req, fsp)) {
7417                 END_PROFILE(SMBlockingX);
7418                 return;
7419         }
7420
7421         data = req->buf;
7422
7423         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7424                 /* we don't support these - and CANCEL_LOCK makes w2k
7425                    and XP reboot so I don't really want to be
7426                    compatible! (tridge) */
7427                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
7428                 END_PROFILE(SMBlockingX);
7429                 return;
7430         }
7431
7432         /* Check if this is an oplock break on a file
7433            we have granted an oplock on.
7434         */
7435         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7436                 /* Client can insist on breaking to none. */
7437                 bool break_to_none = (oplocklevel == 0);
7438                 bool result;
7439
7440                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7441                          "for fnum = %d\n", (unsigned int)oplocklevel,
7442                          fsp->fnum ));
7443
7444                 /*
7445                  * Make sure we have granted an exclusive or batch oplock on
7446                  * this file.
7447                  */
7448
7449                 if (fsp->oplock_type == 0) {
7450
7451                         /* The Samba4 nbench simulator doesn't understand
7452                            the difference between break to level2 and break
7453                            to none from level2 - it sends oplock break
7454                            replies in both cases. Don't keep logging an error
7455                            message here - just ignore it. JRA. */
7456
7457                         DEBUG(5,("reply_lockingX: Error : oplock break from "
7458                                  "client for fnum = %d (oplock=%d) and no "
7459                                  "oplock granted on this file (%s).\n",
7460                                  fsp->fnum, fsp->oplock_type,
7461                                  fsp_str_dbg(fsp)));
7462
7463                         /* if this is a pure oplock break request then don't
7464                          * send a reply */
7465                         if (num_locks == 0 && num_ulocks == 0) {
7466                                 END_PROFILE(SMBlockingX);
7467                                 return;
7468                         } else {
7469                                 END_PROFILE(SMBlockingX);
7470                                 reply_doserror(req, ERRDOS, ERRlock);
7471                                 return;
7472                         }
7473                 }
7474
7475                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
7476                     (break_to_none)) {
7477                         result = remove_oplock(fsp);
7478                 } else {
7479                         result = downgrade_oplock(fsp);
7480                 }
7481
7482                 if (!result) {
7483                         DEBUG(0, ("reply_lockingX: error in removing "
7484                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
7485                         /* Hmmm. Is this panic justified? */
7486                         smb_panic("internal tdb error");
7487                 }
7488
7489                 reply_to_oplock_break_requests(fsp);
7490
7491                 /* if this is a pure oplock break request then don't send a
7492                  * reply */
7493                 if (num_locks == 0 && num_ulocks == 0) {
7494                         /* Sanity check - ensure a pure oplock break is not a
7495                            chained request. */
7496                         if(CVAL(req->vwv+0, 0) != 0xff)
7497                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
7498                                          "break is a chained %d request !\n",
7499                                          (unsigned int)CVAL(req->vwv+0, 0)));
7500                         END_PROFILE(SMBlockingX);
7501                         return;
7502                 }
7503         }
7504
7505         if (req->buflen <
7506             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7507                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7508                 END_PROFILE(SMBlockingX);
7509                 return;
7510         }
7511
7512         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7513         if (ulocks == NULL) {
7514                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7515                 END_PROFILE(SMBlockingX);
7516                 return;
7517         }
7518
7519         locks = talloc_array(req, struct smbd_lock_element, num_locks);
7520         if (locks == NULL) {
7521                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7522                 END_PROFILE(SMBlockingX);
7523                 return;
7524         }
7525
7526         /* Data now points at the beginning of the list
7527            of smb_unlkrng structs */
7528         for(i = 0; i < (int)num_ulocks; i++) {
7529                 ulocks[i].smbpid = get_lock_pid(data, i, large_file_format);
7530                 ulocks[i].count = get_lock_count(data, i, large_file_format);
7531                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7532                 ulocks[i].brltype = UNLOCK_LOCK;
7533
7534                 /*
7535                  * There is no error code marked "stupid client bug".... :-).
7536                  */
7537                 if(err) {
7538                         END_PROFILE(SMBlockingX);
7539                         reply_doserror(req, ERRDOS, ERRnoaccess);
7540                         return;
7541                 }
7542         }
7543
7544         /* Now do any requested locks */
7545         data += ((large_file_format ? 20 : 10)*num_ulocks);
7546
7547         /* Data now points at the beginning of the list
7548            of smb_lkrng structs */
7549
7550         for(i = 0; i < (int)num_locks; i++) {
7551                 locks[i].smbpid = get_lock_pid(data, i, large_file_format);
7552                 locks[i].count = get_lock_count(data, i, large_file_format);
7553                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7554
7555                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7556                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7557                                 locks[i].brltype = PENDING_READ_LOCK;
7558                         } else {
7559                                 locks[i].brltype = READ_LOCK;
7560                         }
7561                 } else {
7562                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7563                                 locks[i].brltype = PENDING_WRITE_LOCK;
7564                         } else {
7565                                 locks[i].brltype = WRITE_LOCK;
7566                         }
7567                 }
7568
7569                 /*
7570                  * There is no error code marked "stupid client bug".... :-).
7571                  */
7572                 if(err) {
7573                         END_PROFILE(SMBlockingX);
7574                         reply_doserror(req, ERRDOS, ERRnoaccess);
7575                         return;
7576                 }
7577         }
7578
7579         status = smbd_do_locking(req, fsp,
7580                                  locktype, lock_timeout,
7581                                  num_ulocks, ulocks,
7582                                  num_locks, locks,
7583                                  &async);
7584         if (!NT_STATUS_IS_OK(status)) {
7585                 END_PROFILE(SMBlockingX);
7586                 reply_nterror(req, status);
7587                 return;
7588         }
7589         if (async) {
7590                 END_PROFILE(SMBlockingX);
7591                 return;
7592         }
7593
7594         reply_outbuf(req, 2, 0);
7595
7596         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7597                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7598
7599         END_PROFILE(SMBlockingX);
7600         chain_reply(req);
7601 }
7602
7603 #undef DBGC_CLASS
7604 #define DBGC_CLASS DBGC_ALL
7605
7606 /****************************************************************************
7607  Reply to a SMBreadbmpx (read block multiplex) request.
7608  Always reply with an error, if someone has a platform really needs this,
7609  please contact vl@samba.org
7610 ****************************************************************************/
7611
7612 void reply_readbmpx(struct smb_request *req)
7613 {
7614         START_PROFILE(SMBreadBmpx);
7615         reply_doserror(req, ERRSRV, ERRuseSTD);
7616         END_PROFILE(SMBreadBmpx);
7617         return;
7618 }
7619
7620 /****************************************************************************
7621  Reply to a SMBreadbs (read block multiplex secondary) request.
7622  Always reply with an error, if someone has a platform really needs this,
7623  please contact vl@samba.org
7624 ****************************************************************************/
7625
7626 void reply_readbs(struct smb_request *req)
7627 {
7628         START_PROFILE(SMBreadBs);
7629         reply_doserror(req, ERRSRV, ERRuseSTD);
7630         END_PROFILE(SMBreadBs);
7631         return;
7632 }
7633
7634 /****************************************************************************
7635  Reply to a SMBsetattrE.
7636 ****************************************************************************/
7637
7638 void reply_setattrE(struct smb_request *req)
7639 {
7640         connection_struct *conn = req->conn;
7641         struct smb_file_time ft;
7642         files_struct *fsp;
7643         NTSTATUS status;
7644
7645         START_PROFILE(SMBsetattrE);
7646         ZERO_STRUCT(ft);
7647
7648         if (req->wct < 7) {
7649                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7650                 goto out;
7651         }
7652
7653         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7654
7655         if(!fsp || (fsp->conn != conn)) {
7656                 reply_doserror(req, ERRDOS, ERRbadfid);
7657                 goto out;
7658         }
7659
7660         /*
7661          * Convert the DOS times into unix times.
7662          */
7663
7664         ft.atime = convert_time_t_to_timespec(
7665             srv_make_unix_date2(req->vwv+3));
7666         ft.mtime = convert_time_t_to_timespec(
7667             srv_make_unix_date2(req->vwv+5));
7668         ft.create_time = convert_time_t_to_timespec(
7669             srv_make_unix_date2(req->vwv+1));
7670
7671         reply_outbuf(req, 0, 0);
7672
7673         /*
7674          * Patch from Ray Frush <frush@engr.colostate.edu>
7675          * Sometimes times are sent as zero - ignore them.
7676          */
7677
7678         /* Ensure we have a valid stat struct for the source. */
7679         if (fsp->fh->fd != -1) {
7680                 if (SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) == -1) {
7681                         status = map_nt_error_from_unix(errno);
7682                         reply_nterror(req, status);
7683                         goto out;
7684                 }
7685         } else {
7686                 int ret = -1;
7687
7688                 if (fsp->posix_open) {
7689                         ret = SMB_VFS_LSTAT(conn, fsp->fsp_name);
7690                 } else {
7691                         ret = SMB_VFS_STAT(conn, fsp->fsp_name);
7692                 }
7693                 if (ret == -1) {
7694                         status = map_nt_error_from_unix(errno);
7695                         reply_nterror(req, status);
7696                         goto out;
7697                 }
7698         }
7699
7700         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7701         if (!NT_STATUS_IS_OK(status)) {
7702                 reply_doserror(req, ERRDOS, ERRnoaccess);
7703                 goto out;
7704         }
7705
7706         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7707                " createtime=%u\n",
7708                 fsp->fnum,
7709                 (unsigned int)ft.atime.tv_sec,
7710                 (unsigned int)ft.mtime.tv_sec,
7711                 (unsigned int)ft.create_time.tv_sec
7712                 ));
7713  out:
7714         END_PROFILE(SMBsetattrE);
7715         return;
7716 }
7717
7718
7719 /* Back from the dead for OS/2..... JRA. */
7720
7721 /****************************************************************************
7722  Reply to a SMBwritebmpx (write block multiplex primary) request.
7723  Always reply with an error, if someone has a platform really needs this,
7724  please contact vl@samba.org
7725 ****************************************************************************/
7726
7727 void reply_writebmpx(struct smb_request *req)
7728 {
7729         START_PROFILE(SMBwriteBmpx);
7730         reply_doserror(req, ERRSRV, ERRuseSTD);
7731         END_PROFILE(SMBwriteBmpx);
7732         return;
7733 }
7734
7735 /****************************************************************************
7736  Reply to a SMBwritebs (write block multiplex secondary) request.
7737  Always reply with an error, if someone has a platform really needs this,
7738  please contact vl@samba.org
7739 ****************************************************************************/
7740
7741 void reply_writebs(struct smb_request *req)
7742 {
7743         START_PROFILE(SMBwriteBs);
7744         reply_doserror(req, ERRSRV, ERRuseSTD);
7745         END_PROFILE(SMBwriteBs);
7746         return;
7747 }
7748
7749 /****************************************************************************
7750  Reply to a SMBgetattrE.
7751 ****************************************************************************/
7752
7753 void reply_getattrE(struct smb_request *req)
7754 {
7755         connection_struct *conn = req->conn;
7756         SMB_STRUCT_STAT sbuf;
7757         int mode;
7758         files_struct *fsp;
7759         struct timespec create_ts;
7760
7761         START_PROFILE(SMBgetattrE);
7762
7763         if (req->wct < 1) {
7764                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7765                 END_PROFILE(SMBgetattrE);
7766                 return;
7767         }
7768
7769         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7770
7771         if(!fsp || (fsp->conn != conn)) {
7772                 reply_doserror(req, ERRDOS, ERRbadfid);
7773                 END_PROFILE(SMBgetattrE);
7774                 return;
7775         }
7776
7777         /* Do an fstat on this file */
7778         if(fsp_stat(fsp, &sbuf)) {
7779                 reply_nterror(req, map_nt_error_from_unix(errno));
7780                 END_PROFILE(SMBgetattrE);
7781                 return;
7782         }
7783
7784         fsp->fsp_name->st = sbuf;
7785
7786         mode = dos_mode(conn, fsp->fsp_name);
7787
7788         /*
7789          * Convert the times into dos times. Set create
7790          * date to be last modify date as UNIX doesn't save
7791          * this.
7792          */
7793
7794         reply_outbuf(req, 11, 0);
7795
7796         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
7797         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
7798         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
7799                           convert_timespec_to_time_t(sbuf.st_ex_atime));
7800         /* Should we check pending modtime here ? JRA */
7801         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
7802                           convert_timespec_to_time_t(sbuf.st_ex_mtime));
7803
7804         if (mode & aDIR) {
7805                 SIVAL(req->outbuf, smb_vwv6, 0);
7806                 SIVAL(req->outbuf, smb_vwv8, 0);
7807         } else {
7808                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &sbuf);
7809                 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_ex_size);
7810                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7811         }
7812         SSVAL(req->outbuf,smb_vwv10, mode);
7813
7814         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7815
7816         END_PROFILE(SMBgetattrE);
7817         return;
7818 }