source/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28
  29 /* look in server.c for some explanation of these variables */
  30 extern enum protocol_types Protocol;
  31 extern int max_recv;
  32 unsigned int smb_echo_count = 0;
  33 extern uint32 global_client_caps;
  34
  35 extern struct current_user current_user;
  36 extern bool global_encrypted_passwords_negotiated;
  37
  38 /****************************************************************************
  39  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  40  path or anything including wildcards.
  41  We're assuming here that '/' is not the second byte in any multibyte char
  42  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  43  set.
  44 ****************************************************************************/
  45
  46 /* Custom version for processing POSIX paths. */
  47 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  48
  49 static NTSTATUS check_path_syntax_internal(char *path,
  50                                            bool posix_path,
  51                                            bool *p_last_component_contains_wcard)
  52 {
  53         char *d = path;
  54         const char *s = path;
  55         NTSTATUS ret = NT_STATUS_OK;
  56         bool start_of_name_component = True;
  57
  58         *p_last_component_contains_wcard = False;
  59
  60         while (*s) {
  61                 if (IS_PATH_SEP(*s,posix_path)) {
  62                         /*
  63                          * Safe to assume is not the second part of a mb char
  64                          * as this is handled below.
  65                          */
  66                         /* Eat multiple '/' or '\\' */
  67                         while (IS_PATH_SEP(*s,posix_path)) {
  68                                 s++;
  69                         }
  70                         if ((d != path) && (*s != '\0')) {
  71                                 /* We only care about non-leading or trailing '/' or '\\' */
  72                                 *d++ = '/';
  73                         }
  74
  75                         start_of_name_component = True;
  76                         /* New component. */
  77                         *p_last_component_contains_wcard = False;
  78                         continue;
  79                 }
  80
  81                 if (start_of_name_component) {
  82                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
  83                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
  84
  85                                 /*
  86                                  * No mb char starts with '.' so we're safe checking the directory separator here.
  87                                  */
  88
  89                                 /* If  we just added a '/' - delete it */
  90                                 if ((d > path) && (*(d-1) == '/')) {
  91                                         *(d-1) = '\0';
  92                                         d--;
  93                                 }
  94
  95                                 /* Are we at the start ? Can't go back further if so. */
  96                                 if (d <= path) {
  97                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
  98                                         break;
  99                                 }
 100                                 /* Go back one level... */
 101                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 102                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 103                                 /* Decrement d first as d points to the *next* char to write into. */
 104                                 for (d--; d > path; d--) {
 105                                         if (*d == '/')
 106                                                 break;
 107                                 }
 108                                 s += 2; /* Else go past the .. */
 109                                 /* We're still at the start of a name component, just the previous one. */
 110                                 continue;
 111
 112                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 113                                 if (posix_path) {
 114                                         /* Eat the '.' */
 115                                         s++;
 116                                         continue;
 117                                 }
 118                         }
 119
 120                 }
 121
 122                 if (!(*s & 0x80)) {
 123                         if (!posix_path) {
 124                                 if (*s <= 0x1f) {
 125                                         return NT_STATUS_OBJECT_NAME_INVALID;
 126                                 }
 127                                 switch (*s) {
 128                                         case '*':
 129                                         case '?':
 130                                         case '<':
 131                                         case '>':
 132                                         case '"':
 133                                                 *p_last_component_contains_wcard = True;
 134                                                 break;
 135                                         default:
 136                                                 break;
 137                                 }
 138                         }
 139                         *d++ = *s++;
 140                 } else {
 141                         size_t siz;
 142                         /* Get the size of the next MB character. */
 143                         next_codepoint(s,&siz);
 144                         switch(siz) {
 145                                 case 5:
 146                                         *d++ = *s++;
 147                                         /*fall through*/
 148                                 case 4:
 149                                         *d++ = *s++;
 150                                         /*fall through*/
 151                                 case 3:
 152                                         *d++ = *s++;
 153                                         /*fall through*/
 154                                 case 2:
 155                                         *d++ = *s++;
 156                                         /*fall through*/
 157                                 case 1:
 158                                         *d++ = *s++;
 159                                         break;
 160                                 default:
 161                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 162                                         *d = '\0';
 163                                         return NT_STATUS_INVALID_PARAMETER;
 164                         }
 165                 }
 166                 start_of_name_component = False;
 167         }
 168
 169         *d = '\0';
 170
 171         return ret;
 172 }
 173
 174 /****************************************************************************
 175  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 176  No wildcards allowed.
 177 ****************************************************************************/
 178
 179 NTSTATUS check_path_syntax(char *path)
 180 {
 181         bool ignore;
 182         return check_path_syntax_internal(path, False, &ignore);
 183 }
 184
 185 /****************************************************************************
 186  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 187  Wildcards allowed - p_contains_wcard returns true if the last component contained
 188  a wildcard.
 189 ****************************************************************************/
 190
 191 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 192 {
 193         return check_path_syntax_internal(path, False, p_contains_wcard);
 194 }
 195
 196 /****************************************************************************
 197  Check the path for a POSIX client.
 198  We're assuming here that '/' is not the second byte in any multibyte char
 199  set (a safe assumption).
 200 ****************************************************************************/
 201
 202 NTSTATUS check_path_syntax_posix(char *path)
 203 {
 204         bool ignore;
 205         return check_path_syntax_internal(path, True, &ignore);
 206 }
 207
 208 /****************************************************************************
 209  Pull a string and check the path allowing a wilcard - provide for error return.
 210 ****************************************************************************/
 211
 212 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 213                         const char *inbuf,
 214                         uint16 smb_flags2,
 215                         char **pp_dest,
 216                         const char *src,
 217                         size_t src_len,
 218                         int flags,
 219                         NTSTATUS *err,
 220                         bool *contains_wcard)
 221 {
 222         size_t ret;
 223
 224         *pp_dest = NULL;
 225
 226         if (src_len == 0) {
 227                 ret = srvstr_pull_buf_talloc(ctx,
 228                                 inbuf,
 229                                 smb_flags2,
 230                                 pp_dest,
 231                                 src,
 232                                 flags);
 233         } else {
 234                 ret = srvstr_pull_talloc(ctx,
 235                                 inbuf,
 236                                 smb_flags2,
 237                                 pp_dest,
 238                                 src,
 239                                 src_len,
 240                                 flags);
 241         }
 242
 243         if (!*pp_dest) {
 244                 *err = NT_STATUS_INVALID_PARAMETER;
 245                 return ret;
 246         }
 247
 248         *contains_wcard = False;
 249
 250         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 251                 /*
 252                  * For a DFS path the function parse_dfs_path()
 253                  * will do the path processing, just make a copy.
 254                  */
 255                 *err = NT_STATUS_OK;
 256                 return ret;
 257         }
 258
 259         if (lp_posix_pathnames()) {
 260                 *err = check_path_syntax_posix(*pp_dest);
 261         } else {
 262                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 263         }
 264
 265         return ret;
 266 }
 267
 268 /****************************************************************************
 269  Pull a string and check the path - provide for error return.
 270 ****************************************************************************/
 271
 272 size_t srvstr_get_path(TALLOC_CTX *ctx,
 273                         const char *inbuf,
 274                         uint16 smb_flags2,
 275                         char **pp_dest,
 276                         const char *src,
 277                         size_t src_len,
 278                         int flags,
 279                         NTSTATUS *err)
 280 {
 281         size_t ret;
 282
 283         *pp_dest = NULL;
 284
 285         if (src_len == 0) {
 286                 ret = srvstr_pull_buf_talloc(ctx,
 287                                         inbuf,
 288                                         smb_flags2,
 289                                         pp_dest,
 290                                         src,
 291                                         flags);
 292         } else {
 293                 ret = srvstr_pull_talloc(ctx,
 294                                 inbuf,
 295                                 smb_flags2,
 296                                 pp_dest,
 297                                 src,
 298                                 src_len,
 299                                 flags);
 300         }
 301
 302         if (!*pp_dest) {
 303                 *err = NT_STATUS_INVALID_PARAMETER;
 304                 return ret;
 305         }
 306
 307         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 308                 /*
 309                  * For a DFS path the function parse_dfs_path()
 310                  * will do the path processing, just make a copy.
 311                  */
 312                 *err = NT_STATUS_OK;
 313                 return ret;
 314         }
 315
 316         if (lp_posix_pathnames()) {
 317                 *err = check_path_syntax_posix(*pp_dest);
 318         } else {
 319                 *err = check_path_syntax(*pp_dest);
 320         }
 321
 322         return ret;
 323 }
 324
 325 /****************************************************************************
 326  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 327 ****************************************************************************/
 328
 329 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 330                files_struct *fsp, struct current_user *user)
 331 {
 332         if (!(fsp) || !(conn)) {
 333                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 334                 return False;
 335         }
 336         if (((conn) != (fsp)->conn) || user->vuid != (fsp)->vuid) {
 337                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 338                 return False;
 339         }
 340         return True;
 341 }
 342
 343 /****************************************************************************
 344  Check if we have a correct fsp pointing to a file. Replacement for the
 345  CHECK_FSP macro.
 346 ****************************************************************************/
 347
 348 bool check_fsp(connection_struct *conn, struct smb_request *req,
 349                files_struct *fsp, struct current_user *user)
 350 {
 351         if (!check_fsp_open(conn, req, fsp, user)) {
 352                 return False;
 353         }
 354         if ((fsp)->is_directory) {
 355                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 356                 return False;
 357         }
 358         if ((fsp)->fh->fd == -1) {
 359                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 360                 return False;
 361         }
 362         (fsp)->num_smb_operations++;
 363         return True;
 364 }
 365
 366 /****************************************************************************
 367  Check if we have a correct fsp. Replacement for the FSP_BELONGS_CONN macro
 368 ****************************************************************************/
 369
 370 bool fsp_belongs_conn(connection_struct *conn, struct smb_request *req,
 371                       files_struct *fsp, struct current_user *user)
 372 {
 373         if ((fsp) && (conn) && ((conn)==(fsp)->conn)
 374             && (current_user.vuid==(fsp)->vuid)) {
 375                 return True;
 376         }
 377
 378         reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 379         return False;
 380 }
 381
 382 /****************************************************************************
 383  Reply to a (netbios-level) special message.
 384 ****************************************************************************/
 385
 386 void reply_special(char *inbuf)
 387 {
 388         int msg_type = CVAL(inbuf,0);
 389         int msg_flags = CVAL(inbuf,1);
 390         fstring name1,name2;
 391         char name_type = 0;
 392
 393         /*
 394          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 395          * calculation & friends (srv_send_smb uses that) we need the full smb
 396          * header.
 397          */
 398         char outbuf[smb_size];
 399
 400         static bool already_got_session = False;
 401
 402         *name1 = *name2 = 0;
 403
 404         memset(outbuf, '\0', sizeof(outbuf));
 405
 406         smb_setlen(outbuf,0);
 407
 408         switch (msg_type) {
 409         case 0x81: /* session request */
 410
 411                 if (already_got_session) {
 412                         exit_server_cleanly("multiple session request not permitted");
 413                 }
 414
 415                 SCVAL(outbuf,0,0x82);
 416                 SCVAL(outbuf,3,0);
 417                 if (name_len(inbuf+4) > 50 ||
 418                     name_len(inbuf+4 + name_len(inbuf + 4)) > 50) {
 419                         DEBUG(0,("Invalid name length in session request\n"));
 420                         return;
 421                 }
 422                 name_extract(inbuf,4,name1);
 423                 name_type = name_extract(inbuf,4 + name_len(inbuf + 4),name2);
 424                 DEBUG(2,("netbios connect: name1=%s name2=%s\n",
 425                          name1,name2));
 426
 427                 set_local_machine_name(name1, True);
 428                 set_remote_machine_name(name2, True);
 429
 430                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 431                          get_local_machine_name(), get_remote_machine_name(),
 432                          name_type));
 433
 434                 if (name_type == 'R') {
 435                         /* We are being asked for a pathworks session ---
 436                            no thanks! */
 437                         SCVAL(outbuf, 0,0x83);
 438                         break;
 439                 }
 440
 441                 /* only add the client's machine name to the list
 442                    of possibly valid usernames if we are operating
 443                    in share mode security */
 444                 if (lp_security() == SEC_SHARE) {
 445                         add_session_user(get_remote_machine_name());
 446                 }
 447
 448                 reload_services(True);
 449                 reopen_logs();
 450
 451                 already_got_session = True;
 452                 break;
 453
 454         case 0x89: /* session keepalive request
 455                       (some old clients produce this?) */
 456                 SCVAL(outbuf,0,SMBkeepalive);
 457                 SCVAL(outbuf,3,0);
 458                 break;
 459
 460         case 0x82: /* positive session response */
 461         case 0x83: /* negative session response */
 462         case 0x84: /* retarget session response */
 463                 DEBUG(0,("Unexpected session response\n"));
 464                 break;
 465
 466         case SMBkeepalive: /* session keepalive */
 467         default:
 468                 return;
 469         }
 470
 471         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 472                     msg_type, msg_flags));
 473
 474         srv_send_smb(smbd_server_fd(), outbuf, false);
 475         return;
 476 }
 477
 478 /****************************************************************************
 479  Reply to a tcon.
 480  conn POINTER CAN BE NULL HERE !
 481 ****************************************************************************/
 482
 483 void reply_tcon(struct smb_request *req)
 484 {
 485         connection_struct *conn = req->conn;
 486         const char *service;
 487         char *service_buf = NULL;
 488         char *password = NULL;
 489         char *dev = NULL;
 490         int pwlen=0;
 491         NTSTATUS nt_status;
 492         char *p;
 493         DATA_BLOB password_blob;
 494         TALLOC_CTX *ctx = talloc_tos();
 495
 496         START_PROFILE(SMBtcon);
 497
 498         if (smb_buflen(req->inbuf) < 4) {
 499                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 500                 END_PROFILE(SMBtcon);
 501                 return;
 502         }
 503
 504         p = smb_buf(req->inbuf)+1;
 505         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 506                                     &service_buf, p, STR_TERMINATE) + 1;
 507         pwlen = srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 508                                        &password, p, STR_TERMINATE) + 1;
 509         p += pwlen;
 510         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2,
 511                                     &dev, p, STR_TERMINATE) + 1;
 512
 513         if (service_buf == NULL || password == NULL || dev == NULL) {
 514                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 515                 END_PROFILE(SMBtcon);
 516                 return;
 517         }
 518         p = strrchr_m(service_buf,'\\');
 519         if (p) {
 520                 service = p+1;
 521         } else {
 522                 service = service_buf;
 523         }
 524
 525         password_blob = data_blob(password, pwlen+1);
 526
 527         conn = make_connection(service,password_blob,dev,req->vuid,&nt_status);
 528         req->conn = conn;
 529
 530         data_blob_clear_free(&password_blob);
 531
 532         if (!conn) {
 533                 reply_nterror(req, nt_status);
 534                 END_PROFILE(SMBtcon);
 535                 return;
 536         }
 537
 538         reply_outbuf(req, 2, 0);
 539         SSVAL(req->outbuf,smb_vwv0,max_recv);
 540         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 541         SSVAL(req->outbuf,smb_tid,conn->cnum);
 542
 543         DEBUG(3,("tcon service=%s cnum=%d\n",
 544                  service, conn->cnum));
 545
 546         END_PROFILE(SMBtcon);
 547         return;
 548 }
 549
 550 /****************************************************************************
 551  Reply to a tcon and X.
 552  conn POINTER CAN BE NULL HERE !
 553 ****************************************************************************/
 554
 555 void reply_tcon_and_X(struct smb_request *req)
 556 {
 557         connection_struct *conn = req->conn;
 558         char *service = NULL;
 559         DATA_BLOB password;
 560         TALLOC_CTX *ctx = talloc_tos();
 561         /* what the cleint thinks the device is */
 562         char *client_devicetype = NULL;
 563         /* what the server tells the client the share represents */
 564         const char *server_devicetype;
 565         NTSTATUS nt_status;
 566         int passlen;
 567         char *path = NULL;
 568         char *p, *q;
 569         uint16 tcon_flags;
 570
 571         START_PROFILE(SMBtconX);
 572
 573         if (req->wct < 4) {
 574                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 575                 END_PROFILE(SMBtconX);
 576                 return;
 577         }
 578
 579         passlen = SVAL(req->inbuf,smb_vwv3);
 580         tcon_flags = SVAL(req->inbuf,smb_vwv2);
 581
 582         /* we might have to close an old one */
 583         if ((tcon_flags & 0x1) && conn) {
 584                 close_cnum(conn,req->vuid);
 585                 req->conn = NULL;
 586                 conn = NULL;
 587         }
 588
 589         if ((passlen > MAX_PASS_LEN) || (passlen >= smb_buflen(req->inbuf))) {
 590                 reply_doserror(req, ERRDOS, ERRbuftoosmall);
 591                 END_PROFILE(SMBtconX);
 592                 return;
 593         }
 594
 595         if (global_encrypted_passwords_negotiated) {
 596                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 597                                             passlen);
 598                 if (lp_security() == SEC_SHARE) {
 599                         /*
 600                          * Security = share always has a pad byte
 601                          * after the password.
 602                          */
 603                         p = smb_buf(req->inbuf) + passlen + 1;
 604                 } else {
 605                         p = smb_buf(req->inbuf) + passlen;
 606                 }
 607         } else {
 608                 password = data_blob_talloc(talloc_tos(), smb_buf(req->inbuf),
 609                                             passlen+1);
 610                 /* Ensure correct termination */
 611                 password.data[passlen]=0;
 612                 p = smb_buf(req->inbuf) + passlen + 1;
 613         }
 614
 615         p += srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &path, p,
 616                              STR_TERMINATE);
 617
 618         if (path == NULL) {
 619                 data_blob_clear_free(&password);
 620                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 621                 END_PROFILE(SMBtconX);
 622                 return;
 623         }
 624
 625         /*
 626          * the service name can be either: \\server\share
 627          * or share directly like on the DELL PowerVault 705
 628          */
 629         if (*path=='\\') {
 630                 q = strchr_m(path+2,'\\');
 631                 if (!q) {
 632                         data_blob_clear_free(&password);
 633                         reply_doserror(req, ERRDOS, ERRnosuchshare);
 634                         END_PROFILE(SMBtconX);
 635                         return;
 636                 }
 637                 service = q+1;
 638         } else {
 639                 service = path;
 640         }
 641
 642         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 643                                 &client_devicetype, p,
 644                                 MIN(6,smb_bufrem(req->inbuf, p)), STR_ASCII);
 645
 646         if (client_devicetype == NULL) {
 647                 data_blob_clear_free(&password);
 648                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 649                 END_PROFILE(SMBtconX);
 650                 return;
 651         }
 652
 653         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 654
 655         conn = make_connection(service, password, client_devicetype,
 656                                req->vuid, &nt_status);
 657         req->conn =conn;
 658
 659         data_blob_clear_free(&password);
 660
 661         if (!conn) {
 662                 reply_nterror(req, nt_status);
 663                 END_PROFILE(SMBtconX);
 664                 return;
 665         }
 666
 667         if ( IS_IPC(conn) )
 668                 server_devicetype = "IPC";
 669         else if ( IS_PRINT(conn) )
 670                 server_devicetype = "LPT1:";
 671         else
 672                 server_devicetype = "A:";
 673
 674         if (Protocol < PROTOCOL_NT1) {
 675                 reply_outbuf(req, 2, 0);
 676                 if (message_push_string(&req->outbuf, server_devicetype,
 677                                         STR_TERMINATE|STR_ASCII) == -1) {
 678                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 679                         END_PROFILE(SMBtconX);
 680                         return;
 681                 }
 682         } else {
 683                 /* NT sets the fstype of IPC$ to the null string */
 684                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
 685
 686                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 687                         /* Return permissions. */
 688                         uint32 perm1 = 0;
 689                         uint32 perm2 = 0;
 690
 691                         reply_outbuf(req, 7, 0);
 692
 693                         if (IS_IPC(conn)) {
 694                                 perm1 = FILE_ALL_ACCESS;
 695                                 perm2 = FILE_ALL_ACCESS;
 696                         } else {
 697                                 perm1 = CAN_WRITE(conn) ?
 698                                                 SHARE_ALL_ACCESS :
 699                                                 SHARE_READ_ONLY;
 700                         }
 701
 702                         SIVAL(req->outbuf, smb_vwv3, perm1);
 703                         SIVAL(req->outbuf, smb_vwv5, perm2);
 704                 } else {
 705                         reply_outbuf(req, 3, 0);
 706                 }
 707
 708                 if ((message_push_string(&req->outbuf, server_devicetype,
 709                                          STR_TERMINATE|STR_ASCII) == -1)
 710                     || (message_push_string(&req->outbuf, fstype,
 711                                             STR_TERMINATE) == -1)) {
 712                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 713                         END_PROFILE(SMBtconX);
 714                         return;
 715                 }
 716
 717                 /* what does setting this bit do? It is set by NT4 and
 718                    may affect the ability to autorun mounted cdroms */
 719                 SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS|
 720                       (lp_csc_policy(SNUM(conn)) << 2));
 721
 722                 init_dfsroot(conn, req->inbuf, req->outbuf);
 723         }
 724
 725
 726         DEBUG(3,("tconX service=%s \n",
 727                  service));
 728
 729         /* set the incoming and outgoing tid to the just created one */
 730         SSVAL(req->inbuf,smb_tid,conn->cnum);
 731         SSVAL(req->outbuf,smb_tid,conn->cnum);
 732
 733         END_PROFILE(SMBtconX);
 734
 735         chain_reply(req);
 736         return;
 737 }
 738
 739 /****************************************************************************
 740  Reply to an unknown type.
 741 ****************************************************************************/
 742
 743 void reply_unknown_new(struct smb_request *req, uint8 type)
 744 {
 745         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
 746                   smb_fn_name(type), type, type));
 747         reply_doserror(req, ERRSRV, ERRunknownsmb);
 748         return;
 749 }
 750
 751 /****************************************************************************
 752  Reply to an ioctl.
 753  conn POINTER CAN BE NULL HERE !
 754 ****************************************************************************/
 755
 756 void reply_ioctl(struct smb_request *req)
 757 {
 758         connection_struct *conn = req->conn;
 759         uint16 device;
 760         uint16 function;
 761         uint32 ioctl_code;
 762         int replysize;
 763         char *p;
 764
 765         START_PROFILE(SMBioctl);
 766
 767         if (req->wct < 3) {
 768                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 769                 END_PROFILE(SMBioctl);
 770                 return;
 771         }
 772
 773         device     = SVAL(req->inbuf,smb_vwv1);
 774         function   = SVAL(req->inbuf,smb_vwv2);
 775         ioctl_code = (device << 16) + function;
 776
 777         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
 778
 779         switch (ioctl_code) {
 780             case IOCTL_QUERY_JOB_INFO:
 781                     replysize = 32;
 782                     break;
 783             default:
 784                     reply_doserror(req, ERRSRV, ERRnosupport);
 785                     END_PROFILE(SMBioctl);
 786                     return;
 787         }
 788
 789         reply_outbuf(req, 8, replysize+1);
 790         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
 791         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
 792         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
 793         p = smb_buf(req->outbuf);
 794         memset(p, '\0', replysize+1); /* valgrind-safe. */
 795         p += 1;          /* Allow for alignment */
 796
 797         switch (ioctl_code) {
 798                 case IOCTL_QUERY_JOB_INFO:
 799                 {
 800                         files_struct *fsp = file_fsp(SVAL(req->inbuf,
 801                                                           smb_vwv0));
 802                         if (!fsp) {
 803                                 reply_doserror(req, ERRDOS, ERRbadfid);
 804                                 END_PROFILE(SMBioctl);
 805                                 return;
 806                         }
 807                         SSVAL(p,0,fsp->rap_print_jobid);             /* Job number */
 808                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
 809                                     global_myname(), 15,
 810                                     STR_TERMINATE|STR_ASCII);
 811                         if (conn) {
 812                                 srvstr_push((char *)req->outbuf, req->flags2,
 813                                             p+18, lp_servicename(SNUM(conn)),
 814                                             13, STR_TERMINATE|STR_ASCII);
 815                         } else {
 816                                 memset(p+18, 0, 13);
 817                         }
 818                         break;
 819                 }
 820         }
 821
 822         END_PROFILE(SMBioctl);
 823         return;
 824 }
 825
 826 /****************************************************************************
 827  Strange checkpath NTSTATUS mapping.
 828 ****************************************************************************/
 829
 830 static NTSTATUS map_checkpath_error(const char *inbuf, NTSTATUS status)
 831 {
 832         /* Strange DOS error code semantics only for checkpath... */
 833         if (!(SVAL(inbuf,smb_flg2) & FLAGS2_32_BIT_ERROR_CODES)) {
 834                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
 835                         /* We need to map to ERRbadpath */
 836                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
 837                 }
 838         }
 839         return status;
 840 }
 841
 842 /****************************************************************************
 843  Reply to a checkpath.
 844 ****************************************************************************/
 845
 846 void reply_checkpath(struct smb_request *req)
 847 {
 848         connection_struct *conn = req->conn;
 849         char *name = NULL;
 850         SMB_STRUCT_STAT sbuf;
 851         NTSTATUS status;
 852         TALLOC_CTX *ctx = talloc_tos();
 853
 854         START_PROFILE(SMBcheckpath);
 855
 856         srvstr_get_path(ctx,(char *)req->inbuf, req->flags2, &name,
 857                         smb_buf(req->inbuf) + 1, 0,
 858                         STR_TERMINATE, &status);
 859         if (!NT_STATUS_IS_OK(status)) {
 860                 status = map_checkpath_error((char *)req->inbuf, status);
 861                 reply_nterror(req, status);
 862                 END_PROFILE(SMBcheckpath);
 863                 return;
 864         }
 865
 866         status = resolve_dfspath(ctx, conn,
 867                         req->flags2 & FLAGS2_DFS_PATHNAMES,
 868                         name,
 869                         &name);
 870         if (!NT_STATUS_IS_OK(status)) {
 871                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 872                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 873                                         ERRSRV, ERRbadpath);
 874                         END_PROFILE(SMBcheckpath);
 875                         return;
 876                 }
 877                 goto path_err;
 878         }
 879
 880         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->inbuf,smb_vwv0)));
 881
 882         status = unix_convert(ctx, conn, name, False, &name, NULL, &sbuf);
 883         if (!NT_STATUS_IS_OK(status)) {
 884                 goto path_err;
 885         }
 886
 887         status = check_name(conn, name);
 888         if (!NT_STATUS_IS_OK(status)) {
 889                 DEBUG(3,("reply_checkpath: check_name of %s failed (%s)\n",name,nt_errstr(status)));
 890                 goto path_err;
 891         }
 892
 893         if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,name,&sbuf) != 0)) {
 894                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",name,strerror(errno)));
 895                 status = map_nt_error_from_unix(errno);
 896                 goto path_err;
 897         }
 898
 899         if (!S_ISDIR(sbuf.st_mode)) {
 900                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
 901                                 ERRDOS, ERRbadpath);
 902                 END_PROFILE(SMBcheckpath);
 903                 return;
 904         }
 905
 906         reply_outbuf(req, 0, 0);
 907
 908         END_PROFILE(SMBcheckpath);
 909         return;
 910
 911   path_err:
 912
 913         END_PROFILE(SMBcheckpath);
 914
 915         /* We special case this - as when a Windows machine
 916                 is parsing a path is steps through the components
 917                 one at a time - if a component fails it expects
 918                 ERRbadpath, not ERRbadfile.
 919         */
 920         status = map_checkpath_error((char *)req->inbuf, status);
 921         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 922                 /*
 923                  * Windows returns different error codes if
 924                  * the parent directory is valid but not the
 925                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
 926                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
 927                  * if the path is invalid.
 928                  */
 929                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
 930                                 ERRDOS, ERRbadpath);
 931                 return;
 932         }
 933
 934         reply_nterror(req, status);
 935 }
 936
 937 /****************************************************************************
 938  Reply to a getatr.
 939 ****************************************************************************/
 940
 941 void reply_getatr(struct smb_request *req)
 942 {
 943         connection_struct *conn = req->conn;
 944         char *fname = NULL;
 945         SMB_STRUCT_STAT sbuf;
 946         int mode=0;
 947         SMB_OFF_T size=0;
 948         time_t mtime=0;
 949         char *p;
 950         NTSTATUS status;
 951         TALLOC_CTX *ctx = talloc_tos();
 952
 953         START_PROFILE(SMBgetatr);
 954
 955         p = smb_buf(req->inbuf) + 1;
 956         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
 957                              0, STR_TERMINATE, &status);
 958         if (!NT_STATUS_IS_OK(status)) {
 959                 reply_nterror(req, status);
 960                 END_PROFILE(SMBgetatr);
 961                 return;
 962         }
 963
 964         status = resolve_dfspath(ctx, conn,
 965                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
 966                                 fname,
 967                                 &fname);
 968         if (!NT_STATUS_IS_OK(status)) {
 969                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
 970                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
 971                                         ERRSRV, ERRbadpath);
 972                         END_PROFILE(SMBgetatr);
 973                         return;
 974                 }
 975                 reply_nterror(req, status);
 976                 END_PROFILE(SMBgetatr);
 977                 return;
 978         }
 979
 980         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
 981                 under WfWg - weird! */
 982         if (*fname == '\0') {
 983                 mode = aHIDDEN | aDIR;
 984                 if (!CAN_WRITE(conn)) {
 985                         mode |= aRONLY;
 986                 }
 987                 size = 0;
 988                 mtime = 0;
 989         } else {
 990                 status = unix_convert(ctx, conn, fname, False, &fname, NULL,&sbuf);
 991                 if (!NT_STATUS_IS_OK(status)) {
 992                         reply_nterror(req, status);
 993                         END_PROFILE(SMBgetatr);
 994                         return;
 995                 }
 996                 status = check_name(conn, fname);
 997                 if (!NT_STATUS_IS_OK(status)) {
 998                         DEBUG(3,("reply_getatr: check_name of %s failed (%s)\n",fname,nt_errstr(status)));
 999                         reply_nterror(req, status);
1000                         END_PROFILE(SMBgetatr);
1001                         return;
1002                 }
1003                 if (!VALID_STAT(sbuf) && (SMB_VFS_STAT(conn,fname,&sbuf) != 0)) {
1004                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",fname,strerror(errno)));
1005                         reply_unixerror(req, ERRDOS,ERRbadfile);
1006                         END_PROFILE(SMBgetatr);
1007                         return;
1008                 }
1009
1010                 mode = dos_mode(conn,fname,&sbuf);
1011                 size = sbuf.st_size;
1012                 mtime = sbuf.st_mtime;
1013                 if (mode & aDIR) {
1014                         size = 0;
1015                 }
1016         }
1017
1018         reply_outbuf(req, 10, 0);
1019
1020         SSVAL(req->outbuf,smb_vwv0,mode);
1021         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1022                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1023         } else {
1024                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1025         }
1026         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1027
1028         if (Protocol >= PROTOCOL_NT1) {
1029                 SSVAL(req->outbuf, smb_flg2,
1030                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1031         }
1032
1033         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n", fname, mode, (unsigned int)size ) );
1034
1035         END_PROFILE(SMBgetatr);
1036         return;
1037 }
1038
1039 /****************************************************************************
1040  Reply to a setatr.
1041 ****************************************************************************/
1042
1043 void reply_setatr(struct smb_request *req)
1044 {
1045         struct timespec ts[2];
1046         connection_struct *conn = req->conn;
1047         char *fname = NULL;
1048         int mode;
1049         time_t mtime;
1050         SMB_STRUCT_STAT sbuf;
1051         char *p;
1052         NTSTATUS status;
1053         TALLOC_CTX *ctx = talloc_tos();
1054
1055         START_PROFILE(SMBsetatr);
1056
1057         ZERO_STRUCT(ts);
1058
1059         if (req->wct < 2) {
1060                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1061                 return;
1062         }
1063
1064         p = smb_buf(req->inbuf) + 1;
1065         p += srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname, p,
1066                                 0, STR_TERMINATE, &status);
1067         if (!NT_STATUS_IS_OK(status)) {
1068                 reply_nterror(req, status);
1069                 END_PROFILE(SMBsetatr);
1070                 return;
1071         }
1072
1073         status = resolve_dfspath(ctx, conn,
1074                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1075                                 fname,
1076                                 &fname);
1077         if (!NT_STATUS_IS_OK(status)) {
1078                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1079                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1080                                         ERRSRV, ERRbadpath);
1081                         END_PROFILE(SMBsetatr);
1082                         return;
1083                 }
1084                 reply_nterror(req, status);
1085                 END_PROFILE(SMBsetatr);
1086                 return;
1087         }
1088
1089         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
1090         if (!NT_STATUS_IS_OK(status)) {
1091                 reply_nterror(req, status);
1092                 END_PROFILE(SMBsetatr);
1093                 return;
1094         }
1095
1096         status = check_name(conn, fname);
1097         if (!NT_STATUS_IS_OK(status)) {
1098                 reply_nterror(req, status);
1099                 END_PROFILE(SMBsetatr);
1100                 return;
1101         }
1102
1103         if (fname[0] == '.' && fname[1] == '\0') {
1104                 /*
1105                  * Not sure here is the right place to catch this
1106                  * condition. Might be moved to somewhere else later -- vl
1107                  */
1108                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1109                 END_PROFILE(SMBsetatr);
1110                 return;
1111         }
1112
1113         mode = SVAL(req->inbuf,smb_vwv0);
1114         mtime = srv_make_unix_date3(req->inbuf+smb_vwv1);
1115
1116         ts[1] = convert_time_t_to_timespec(mtime);
1117         status = smb_set_file_time(conn, NULL, fname,
1118                                    &sbuf, ts, true);
1119         if (!NT_STATUS_IS_OK(status)) {
1120                 reply_unixerror(req, ERRDOS, ERRnoaccess);
1121                 END_PROFILE(SMBsetatr);
1122                 return;
1123         }
1124
1125         if (mode != FILE_ATTRIBUTE_NORMAL) {
1126                 if (VALID_STAT_OF_DIR(sbuf))
1127                         mode |= aDIR;
1128                 else
1129                         mode &= ~aDIR;
1130
1131                 if (file_set_dosmode(conn,fname,mode,&sbuf,NULL,false) != 0) {
1132                         reply_unixerror(req, ERRDOS, ERRnoaccess);
1133                         END_PROFILE(SMBsetatr);
1134                         return;
1135                 }
1136         }
1137
1138         reply_outbuf(req, 0, 0);
1139
1140         DEBUG( 3, ( "setatr name=%s mode=%d\n", fname, mode ) );
1141
1142         END_PROFILE(SMBsetatr);
1143         return;
1144 }
1145
1146 /****************************************************************************
1147  Reply to a dskattr.
1148 ****************************************************************************/
1149
1150 void reply_dskattr(struct smb_request *req)
1151 {
1152         connection_struct *conn = req->conn;
1153         SMB_BIG_UINT dfree,dsize,bsize;
1154         START_PROFILE(SMBdskattr);
1155
1156         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (SMB_BIG_UINT)-1) {
1157                 reply_unixerror(req, ERRHRD, ERRgeneral);
1158                 END_PROFILE(SMBdskattr);
1159                 return;
1160         }
1161
1162         reply_outbuf(req, 5, 0);
1163
1164         if (Protocol <= PROTOCOL_LANMAN2) {
1165                 double total_space, free_space;
1166                 /* we need to scale this to a number that DOS6 can handle. We
1167                    use floating point so we can handle large drives on systems
1168                    that don't have 64 bit integers
1169
1170                    we end up displaying a maximum of 2G to DOS systems
1171                 */
1172                 total_space = dsize * (double)bsize;
1173                 free_space = dfree * (double)bsize;
1174
1175                 dsize = (SMB_BIG_UINT)((total_space+63*512) / (64*512));
1176                 dfree = (SMB_BIG_UINT)((free_space+63*512) / (64*512));
1177
1178                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1179                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1180
1181                 SSVAL(req->outbuf,smb_vwv0,dsize);
1182                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1183                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1184                 SSVAL(req->outbuf,smb_vwv3,dfree);
1185         } else {
1186                 SSVAL(req->outbuf,smb_vwv0,dsize);
1187                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1188                 SSVAL(req->outbuf,smb_vwv2,512);
1189                 SSVAL(req->outbuf,smb_vwv3,dfree);
1190         }
1191
1192         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1193
1194         END_PROFILE(SMBdskattr);
1195         return;
1196 }
1197
1198 /****************************************************************************
1199  Reply to a search.
1200  Can be called from SMBsearch, SMBffirst or SMBfunique.
1201 ****************************************************************************/
1202
1203 void reply_search(struct smb_request *req)
1204 {
1205         connection_struct *conn = req->conn;
1206         char *mask = NULL;
1207         char *directory = NULL;
1208         char *fname = NULL;
1209         SMB_OFF_T size;
1210         uint32 mode;
1211         time_t date;
1212         uint32 dirtype;
1213         unsigned int numentries = 0;
1214         unsigned int maxentries = 0;
1215         bool finished = False;
1216         char *p;
1217         int status_len;
1218         char *path = NULL;
1219         char status[21];
1220         int dptr_num= -1;
1221         bool check_descend = False;
1222         bool expect_close = False;
1223         NTSTATUS nt_status;
1224         bool mask_contains_wcard = False;
1225         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1226         TALLOC_CTX *ctx = talloc_tos();
1227
1228         START_PROFILE(SMBsearch);
1229
1230         if (req->wct < 2) {
1231                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1232                 END_PROFILE(SMBsearch);
1233                 return;
1234         }
1235
1236         if (lp_posix_pathnames()) {
1237                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1238                 END_PROFILE(SMBsearch);
1239                 return;
1240         }
1241
1242         /* If we were called as SMBffirst then we must expect close. */
1243         if(CVAL(req->inbuf,smb_com) == SMBffirst) {
1244                 expect_close = True;
1245         }
1246
1247         reply_outbuf(req, 1, 3);
1248         maxentries = SVAL(req->inbuf,smb_vwv0);
1249         dirtype = SVAL(req->inbuf,smb_vwv1);
1250         p = smb_buf(req->inbuf) + 1;
1251         p += srvstr_get_path_wcard(ctx,
1252                                 (char *)req->inbuf,
1253                                 req->flags2,
1254                                 &path,
1255                                 p,
1256                                 0,
1257                                 STR_TERMINATE,
1258                                 &nt_status,
1259                                 &mask_contains_wcard);
1260         if (!NT_STATUS_IS_OK(nt_status)) {
1261                 reply_nterror(req, nt_status);
1262                 END_PROFILE(SMBsearch);
1263                 return;
1264         }
1265
1266         nt_status = resolve_dfspath_wcard(ctx, conn,
1267                                           req->flags2 & FLAGS2_DFS_PATHNAMES,
1268                                           path,
1269                                           &path,
1270                                           &mask_contains_wcard);
1271         if (!NT_STATUS_IS_OK(nt_status)) {
1272                 if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1273                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1274                                         ERRSRV, ERRbadpath);
1275                         END_PROFILE(SMBsearch);
1276                         return;
1277                 }
1278                 reply_nterror(req, nt_status);
1279                 END_PROFILE(SMBsearch);
1280                 return;
1281         }
1282
1283         p++;
1284         status_len = SVAL(p, 0);
1285         p += 2;
1286
1287         /* dirtype &= ~aDIR; */
1288
1289         if (status_len == 0) {
1290                 SMB_STRUCT_STAT sbuf;
1291
1292                 nt_status = unix_convert(ctx, conn, path, True,
1293                                 &directory, NULL, &sbuf);
1294                 if (!NT_STATUS_IS_OK(nt_status)) {
1295                         reply_nterror(req, nt_status);
1296                         END_PROFILE(SMBsearch);
1297                         return;
1298                 }
1299
1300                 nt_status = check_name(conn, directory);
1301                 if (!NT_STATUS_IS_OK(nt_status)) {
1302                         reply_nterror(req, nt_status);
1303                         END_PROFILE(SMBsearch);
1304                         return;
1305                 }
1306
1307                 p = strrchr_m(directory,'/');
1308                 if (!p) {
1309                         mask = directory;
1310                         directory = talloc_strdup(ctx,".");
1311                         if (!directory) {
1312                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1313                                 END_PROFILE(SMBsearch);
1314                                 return;
1315                         }
1316                 } else {
1317                         *p = 0;
1318                         mask = p+1;
1319                 }
1320
1321                 if (*directory == '\0') {
1322                         directory = talloc_strdup(ctx,".");
1323                         if (!directory) {
1324                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
1325                                 END_PROFILE(SMBsearch);
1326                                 return;
1327                         }
1328                 }
1329                 memset((char *)status,'\0',21);
1330                 SCVAL(status,0,(dirtype & 0x1F));
1331
1332                 nt_status = dptr_create(conn,
1333                                         directory,
1334                                         True,
1335                                         expect_close,
1336                                         req->smbpid,
1337                                         mask,
1338                                         mask_contains_wcard,
1339                                         dirtype,
1340                                         &conn->dirptr);
1341                 if (!NT_STATUS_IS_OK(nt_status)) {
1342                         reply_nterror(req, nt_status);
1343                         END_PROFILE(SMBsearch);
1344                         return;
1345                 }
1346                 dptr_num = dptr_dnum(conn->dirptr);
1347         } else {
1348                 int status_dirtype;
1349
1350                 memcpy(status,p,21);
1351                 status_dirtype = CVAL(status,0) & 0x1F;
1352                 if (status_dirtype != (dirtype & 0x1F)) {
1353                         dirtype = status_dirtype;
1354                 }
1355
1356                 conn->dirptr = dptr_fetch(status+12,&dptr_num);
1357                 if (!conn->dirptr) {
1358                         goto SearchEmpty;
1359                 }
1360                 string_set(&conn->dirpath,dptr_path(dptr_num));
1361                 mask = dptr_wcard(dptr_num);
1362                 if (!mask) {
1363                         goto SearchEmpty;
1364                 }
1365                 /*
1366                  * For a 'continue' search we have no string. So
1367                  * check from the initial saved string.
1368                  */
1369                 mask_contains_wcard = ms_has_wild(mask);
1370                 dirtype = dptr_attr(dptr_num);
1371         }
1372
1373         DEBUG(4,("dptr_num is %d\n",dptr_num));
1374
1375         if ((dirtype&0x1F) == aVOLID) {
1376                 char buf[DIR_STRUCT_SIZE];
1377                 memcpy(buf,status,21);
1378                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1379                                 0,aVOLID,0,!allow_long_path_components)) {
1380                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1381                         END_PROFILE(SMBsearch);
1382                         return;
1383                 }
1384                 dptr_fill(buf+12,dptr_num);
1385                 if (dptr_zero(buf+12) && (status_len==0)) {
1386                         numentries = 1;
1387                 } else {
1388                         numentries = 0;
1389                 }
1390                 if (message_push_blob(&req->outbuf,
1391                                       data_blob_const(buf, sizeof(buf)))
1392                     == -1) {
1393                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1394                         END_PROFILE(SMBsearch);
1395                         return;
1396                 }
1397         } else {
1398                 unsigned int i;
1399                 maxentries = MIN(
1400                         maxentries,
1401                         ((BUFFER_SIZE -
1402                           ((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1403                          /DIR_STRUCT_SIZE));
1404
1405                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1406                         conn->dirpath,lp_dontdescend(SNUM(conn))));
1407                 if (in_list(conn->dirpath, lp_dontdescend(SNUM(conn)),True)) {
1408                         check_descend = True;
1409                 }
1410
1411                 for (i=numentries;(i<maxentries) && !finished;i++) {
1412                         finished = !get_dir_entry(ctx,conn,mask,dirtype,&fname,
1413                                         &size,&mode,&date,check_descend);
1414                         if (!finished) {
1415                                 char buf[DIR_STRUCT_SIZE];
1416                                 memcpy(buf,status,21);
1417                                 if (!make_dir_struct(ctx,
1418                                                 buf,
1419                                                 mask,
1420                                                 fname,
1421                                                 size,
1422                                                 mode,
1423                                                 date,
1424                                                 !allow_long_path_components)) {
1425                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1426                                         END_PROFILE(SMBsearch);
1427                                         return;
1428                                 }
1429                                 if (!dptr_fill(buf+12,dptr_num)) {
1430                                         break;
1431                                 }
1432                                 if (message_push_blob(&req->outbuf,
1433                                                       data_blob_const(buf, sizeof(buf)))
1434                                     == -1) {
1435                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1436                                         END_PROFILE(SMBsearch);
1437                                         return;
1438                                 }
1439                                 numentries++;
1440                         }
1441                 }
1442         }
1443
1444   SearchEmpty:
1445
1446         /* If we were called as SMBffirst with smb_search_id == NULL
1447                 and no entries were found then return error and close dirptr
1448                 (X/Open spec) */
1449
1450         if (numentries == 0) {
1451                 dptr_close(&dptr_num);
1452         } else if(expect_close && status_len == 0) {
1453                 /* Close the dptr - we know it's gone */
1454                 dptr_close(&dptr_num);
1455         }
1456
1457         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1458         if(dptr_num >= 0 && CVAL(req->inbuf,smb_com) == SMBfunique) {
1459                 dptr_close(&dptr_num);
1460         }
1461
1462         if ((numentries == 0) && !mask_contains_wcard) {
1463                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1464                 END_PROFILE(SMBsearch);
1465                 return;
1466         }
1467
1468         SSVAL(req->outbuf,smb_vwv0,numentries);
1469         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1470         SCVAL(smb_buf(req->outbuf),0,5);
1471         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1472
1473         /* The replies here are never long name. */
1474         SSVAL(req->outbuf, smb_flg2,
1475               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1476         if (!allow_long_path_components) {
1477                 SSVAL(req->outbuf, smb_flg2,
1478                       SVAL(req->outbuf, smb_flg2)
1479                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1480         }
1481
1482         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1483         SSVAL(req->outbuf, smb_flg2,
1484               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1485
1486         if (!directory) {
1487                 directory = dptr_path(dptr_num);
1488         }
1489
1490         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1491                 smb_fn_name(CVAL(req->inbuf,smb_com)),
1492                 mask,
1493                 directory ? directory : "./",
1494                 dirtype,
1495                 numentries,
1496                 maxentries ));
1497
1498         END_PROFILE(SMBsearch);
1499         return;
1500 }
1501
1502 /****************************************************************************
1503  Reply to a fclose (stop directory search).
1504 ****************************************************************************/
1505
1506 void reply_fclose(struct smb_request *req)
1507 {
1508         int status_len;
1509         char status[21];
1510         int dptr_num= -2;
1511         char *p;
1512         char *path = NULL;
1513         NTSTATUS err;
1514         bool path_contains_wcard = False;
1515         TALLOC_CTX *ctx = talloc_tos();
1516
1517         START_PROFILE(SMBfclose);
1518
1519         if (lp_posix_pathnames()) {
1520                 reply_unknown_new(req, CVAL(req->inbuf, smb_com));
1521                 END_PROFILE(SMBfclose);
1522                 return;
1523         }
1524
1525         p = smb_buf(req->inbuf) + 1;
1526         p += srvstr_get_path_wcard(ctx,
1527                                 (char *)req->inbuf,
1528                                 req->flags2,
1529                                 &path,
1530                                 p,
1531                                 0,
1532                                 STR_TERMINATE,
1533                                 &err,
1534                                 &path_contains_wcard);
1535         if (!NT_STATUS_IS_OK(err)) {
1536                 reply_nterror(req, err);
1537                 END_PROFILE(SMBfclose);
1538                 return;
1539         }
1540         p++;
1541         status_len = SVAL(p,0);
1542         p += 2;
1543
1544         if (status_len == 0) {
1545                 reply_doserror(req, ERRSRV, ERRsrverror);
1546                 END_PROFILE(SMBfclose);
1547                 return;
1548         }
1549
1550         memcpy(status,p,21);
1551
1552         if(dptr_fetch(status+12,&dptr_num)) {
1553                 /*  Close the dptr - we know it's gone */
1554                 dptr_close(&dptr_num);
1555         }
1556
1557         reply_outbuf(req, 1, 0);
1558         SSVAL(req->outbuf,smb_vwv0,0);
1559
1560         DEBUG(3,("search close\n"));
1561
1562         END_PROFILE(SMBfclose);
1563         return;
1564 }
1565
1566 /****************************************************************************
1567  Reply to an open.
1568 ****************************************************************************/
1569
1570 void reply_open(struct smb_request *req)
1571 {
1572         connection_struct *conn = req->conn;
1573         char *fname = NULL;
1574         uint32 fattr=0;
1575         SMB_OFF_T size = 0;
1576         time_t mtime=0;
1577         int info;
1578         SMB_STRUCT_STAT sbuf;
1579         files_struct *fsp;
1580         int oplock_request;
1581         int deny_mode;
1582         uint32 dos_attr;
1583         uint32 access_mask;
1584         uint32 share_mode;
1585         uint32 create_disposition;
1586         uint32 create_options = 0;
1587         NTSTATUS status;
1588         TALLOC_CTX *ctx = talloc_tos();
1589
1590         START_PROFILE(SMBopen);
1591
1592         if (req->wct < 2) {
1593                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1594                 END_PROFILE(SMBopen);
1595                 return;
1596         }
1597
1598         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1599         deny_mode = SVAL(req->inbuf,smb_vwv0);
1600         dos_attr = SVAL(req->inbuf,smb_vwv1);
1601
1602         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1603                         smb_buf(req->inbuf)+1, 0,
1604                         STR_TERMINATE, &status);
1605         if (!NT_STATUS_IS_OK(status)) {
1606                 reply_nterror(req, status);
1607                 END_PROFILE(SMBopen);
1608                 return;
1609         }
1610
1611         if (!map_open_params_to_ntcreate(
1612                     fname, deny_mode, OPENX_FILE_EXISTS_OPEN, &access_mask,
1613                     &share_mode, &create_disposition, &create_options)) {
1614                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1615                 END_PROFILE(SMBopen);
1616                 return;
1617         }
1618
1619         status = create_file(conn,                      /* conn */
1620                              req,                       /* req */
1621                              0,                         /* root_dir_fid */
1622                              fname,                     /* fname */
1623                              access_mask,               /* access_mask */
1624                              share_mode,                /* share_access */
1625                              create_disposition,        /* create_disposition*/
1626                              create_options,            /* create_options */
1627                              dos_attr,                  /* file_attributes */
1628                              oplock_request,            /* oplock_request */
1629                              0,                         /* allocation_size */
1630                              NULL,                      /* sd */
1631                              NULL,                      /* ea_list */
1632                              &fsp,                      /* result */
1633                              &info,                     /* pinfo */
1634                              &sbuf);                    /* psbuf */
1635
1636         if (!NT_STATUS_IS_OK(status)) {
1637                 if (open_was_deferred(req->mid)) {
1638                         /* We have re-scheduled this call. */
1639                         END_PROFILE(SMBopen);
1640                         return;
1641                 }
1642                 reply_openerror(req, status);
1643                 END_PROFILE(SMBopen);
1644                 return;
1645         }
1646
1647         size = sbuf.st_size;
1648         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1649         mtime = sbuf.st_mtime;
1650
1651         if (fattr & aDIR) {
1652                 DEBUG(3,("attempt to open a directory %s\n",fsp->fsp_name));
1653                 close_file(fsp,ERROR_CLOSE);
1654                 reply_doserror(req, ERRDOS,ERRnoaccess);
1655                 END_PROFILE(SMBopen);
1656                 return;
1657         }
1658
1659         reply_outbuf(req, 7, 0);
1660         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1661         SSVAL(req->outbuf,smb_vwv1,fattr);
1662         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1663                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1664         } else {
1665                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1666         }
1667         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1668         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1669
1670         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1671                 SCVAL(req->outbuf,smb_flg,
1672                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1673         }
1674
1675         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1676                 SCVAL(req->outbuf,smb_flg,
1677                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1678         }
1679         END_PROFILE(SMBopen);
1680         return;
1681 }
1682
1683 /****************************************************************************
1684  Reply to an open and X.
1685 ****************************************************************************/
1686
1687 void reply_open_and_X(struct smb_request *req)
1688 {
1689         connection_struct *conn = req->conn;
1690         char *fname = NULL;
1691         uint16 open_flags;
1692         int deny_mode;
1693         uint32 smb_attr;
1694         /* Breakout the oplock request bits so we can set the
1695                 reply bits separately. */
1696         int ex_oplock_request;
1697         int core_oplock_request;
1698         int oplock_request;
1699 #if 0
1700         int smb_sattr = SVAL(req->inbuf,smb_vwv4);
1701         uint32 smb_time = make_unix_date3(req->inbuf+smb_vwv6);
1702 #endif
1703         int smb_ofun;
1704         uint32 fattr=0;
1705         int mtime=0;
1706         SMB_STRUCT_STAT sbuf;
1707         int smb_action = 0;
1708         files_struct *fsp;
1709         NTSTATUS status;
1710         SMB_BIG_UINT allocation_size;
1711         ssize_t retval = -1;
1712         uint32 access_mask;
1713         uint32 share_mode;
1714         uint32 create_disposition;
1715         uint32 create_options = 0;
1716         TALLOC_CTX *ctx = talloc_tos();
1717
1718         START_PROFILE(SMBopenX);
1719
1720         if (req->wct < 15) {
1721                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1722                 END_PROFILE(SMBopenX);
1723                 return;
1724         }
1725
1726         open_flags = SVAL(req->inbuf,smb_vwv2);
1727         deny_mode = SVAL(req->inbuf,smb_vwv3);
1728         smb_attr = SVAL(req->inbuf,smb_vwv5);
1729         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1730         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1731         oplock_request = ex_oplock_request | core_oplock_request;
1732         smb_ofun = SVAL(req->inbuf,smb_vwv8);
1733         allocation_size = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv9);
1734
1735         /* If it's an IPC, pass off the pipe handler. */
1736         if (IS_IPC(conn)) {
1737                 if (lp_nt_pipe_support()) {
1738                         reply_open_pipe_and_X(conn, req);
1739                 } else {
1740                         reply_doserror(req, ERRSRV, ERRaccess);
1741                 }
1742                 END_PROFILE(SMBopenX);
1743                 return;
1744         }
1745
1746         /* XXXX we need to handle passed times, sattr and flags */
1747         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1748                         smb_buf(req->inbuf), 0, STR_TERMINATE,
1749                         &status);
1750         if (!NT_STATUS_IS_OK(status)) {
1751                 reply_nterror(req, status);
1752                 END_PROFILE(SMBopenX);
1753                 return;
1754         }
1755
1756         if (!map_open_params_to_ntcreate(
1757                     fname, deny_mode, smb_ofun, &access_mask,
1758                     &share_mode, &create_disposition, &create_options)) {
1759                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRbadaccess));
1760                 END_PROFILE(SMBopenX);
1761                 return;
1762         }
1763
1764         status = create_file(conn,                      /* conn */
1765                              req,                       /* req */
1766                              0,                         /* root_dir_fid */
1767                              fname,                     /* fname */
1768                              access_mask,               /* access_mask */
1769                              share_mode,                /* share_access */
1770                              create_disposition,        /* create_disposition*/
1771                              create_options,            /* create_options */
1772                              smb_attr,                  /* file_attributes */
1773                              oplock_request,            /* oplock_request */
1774                              0,                         /* allocation_size */
1775                              NULL,                      /* sd */
1776                              NULL,                      /* ea_list */
1777                              &fsp,                      /* result */
1778                              &smb_action,               /* pinfo */
1779                              &sbuf);                    /* psbuf */
1780
1781         if (!NT_STATUS_IS_OK(status)) {
1782                 END_PROFILE(SMBopenX);
1783                 if (open_was_deferred(req->mid)) {
1784                         /* We have re-scheduled this call. */
1785                         return;
1786                 }
1787                 reply_openerror(req, status);
1788                 return;
1789         }
1790
1791         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1792            if the file is truncated or created. */
1793         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1794                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1795                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1796                         close_file(fsp,ERROR_CLOSE);
1797                         reply_nterror(req, NT_STATUS_DISK_FULL);
1798                         END_PROFILE(SMBopenX);
1799                         return;
1800                 }
1801                 retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1802                 if (retval < 0) {
1803                         close_file(fsp,ERROR_CLOSE);
1804                         reply_nterror(req, NT_STATUS_DISK_FULL);
1805                         END_PROFILE(SMBopenX);
1806                         return;
1807                 }
1808                 sbuf.st_size = get_allocation_size(conn,fsp,&sbuf);
1809         }
1810
1811         fattr = dos_mode(conn,fsp->fsp_name,&sbuf);
1812         mtime = sbuf.st_mtime;
1813         if (fattr & aDIR) {
1814                 close_file(fsp,ERROR_CLOSE);
1815                 reply_doserror(req, ERRDOS, ERRnoaccess);
1816                 END_PROFILE(SMBopenX);
1817                 return;
1818         }
1819
1820         /* If the caller set the extended oplock request bit
1821                 and we granted one (by whatever means) - set the
1822                 correct bit for extended oplock reply.
1823         */
1824
1825         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1826                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1827         }
1828
1829         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1830                 smb_action |= EXTENDED_OPLOCK_GRANTED;
1831         }
1832
1833         /* If the caller set the core oplock request bit
1834                 and we granted one (by whatever means) - set the
1835                 correct bit for core oplock reply.
1836         */
1837
1838         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1839                 reply_outbuf(req, 19, 0);
1840         } else {
1841                 reply_outbuf(req, 15, 0);
1842         }
1843
1844         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
1845                 SCVAL(req->outbuf, smb_flg,
1846                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1847         }
1848
1849         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1850                 SCVAL(req->outbuf, smb_flg,
1851                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
1852         }
1853
1854         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
1855         SSVAL(req->outbuf,smb_vwv3,fattr);
1856         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1857                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
1858         } else {
1859                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
1860         }
1861         SIVAL(req->outbuf,smb_vwv6,(uint32)sbuf.st_size);
1862         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
1863         SSVAL(req->outbuf,smb_vwv11,smb_action);
1864
1865         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
1866                 SIVAL(req->outbuf, smb_vwv15, STD_RIGHT_ALL_ACCESS);
1867         }
1868
1869         END_PROFILE(SMBopenX);
1870         chain_reply(req);
1871         return;
1872 }
1873
1874 /****************************************************************************
1875  Reply to a SMBulogoffX.
1876 ****************************************************************************/
1877
1878 void reply_ulogoffX(struct smb_request *req)
1879 {
1880         user_struct *vuser;
1881
1882         START_PROFILE(SMBulogoffX);
1883
1884         vuser = get_valid_user_struct(req->vuid);
1885
1886         if(vuser == NULL) {
1887                 DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
1888                          req->vuid));
1889         }
1890
1891         /* in user level security we are supposed to close any files
1892                 open by this user */
1893         if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
1894                 file_close_user(req->vuid);
1895         }
1896
1897         invalidate_vuid(req->vuid);
1898
1899         reply_outbuf(req, 2, 0);
1900
1901         DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
1902
1903         END_PROFILE(SMBulogoffX);
1904         chain_reply(req);
1905 }
1906
1907 /****************************************************************************
1908  Reply to a mknew or a create.
1909 ****************************************************************************/
1910
1911 void reply_mknew(struct smb_request *req)
1912 {
1913         connection_struct *conn = req->conn;
1914         char *fname = NULL;
1915         int com;
1916         uint32 fattr = 0;
1917         struct timespec ts[2];
1918         files_struct *fsp;
1919         int oplock_request = 0;
1920         SMB_STRUCT_STAT sbuf;
1921         NTSTATUS status;
1922         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
1923         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
1924         uint32 create_disposition;
1925         uint32 create_options = 0;
1926         TALLOC_CTX *ctx = talloc_tos();
1927
1928         START_PROFILE(SMBcreate);
1929
1930         if (req->wct < 3) {
1931                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1932                 END_PROFILE(SMBcreate);
1933                 return;
1934         }
1935
1936         fattr = SVAL(req->inbuf,smb_vwv0);
1937         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1938         com = SVAL(req->inbuf,smb_com);
1939
1940         ts[1] =convert_time_t_to_timespec(
1941                         srv_make_unix_date3(req->inbuf + smb_vwv1));
1942                         /* mtime. */
1943
1944         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
1945                         smb_buf(req->inbuf) + 1, 0,
1946                         STR_TERMINATE, &status);
1947         if (!NT_STATUS_IS_OK(status)) {
1948                 reply_nterror(req, status);
1949                 END_PROFILE(SMBcreate);
1950                 return;
1951         }
1952
1953         if (fattr & aVOLID) {
1954                 DEBUG(0,("Attempt to create file (%s) with volid set - "
1955                         "please report this\n", fname));
1956         }
1957
1958         if(com == SMBmknew) {
1959                 /* We should fail if file exists. */
1960                 create_disposition = FILE_CREATE;
1961         } else {
1962                 /* Create if file doesn't exist, truncate if it does. */
1963                 create_disposition = FILE_OVERWRITE_IF;
1964         }
1965
1966         status = create_file(conn,                      /* conn */
1967                              req,                       /* req */
1968                              0,                         /* root_dir_fid */
1969                              fname,                     /* fname */
1970                              access_mask,               /* access_mask */
1971                              share_mode,                /* share_access */
1972                              create_disposition,        /* create_disposition*/
1973                              create_options,            /* create_options */
1974                              fattr,                     /* file_attributes */
1975                              oplock_request,            /* oplock_request */
1976                              0,                         /* allocation_size */
1977                              NULL,                      /* sd */
1978                              NULL,                      /* ea_list */
1979                              &fsp,                      /* result */
1980                              NULL,                      /* pinfo */
1981                              &sbuf);                    /* psbuf */
1982
1983         if (!NT_STATUS_IS_OK(status)) {
1984                 END_PROFILE(SMBcreate);
1985                 if (open_was_deferred(req->mid)) {
1986                         /* We have re-scheduled this call. */
1987                         return;
1988                 }
1989                 reply_openerror(req, status);
1990                 return;
1991         }
1992
1993         ts[0] = get_atimespec(&sbuf); /* atime. */
1994         status = smb_set_file_time(conn, fsp, fname, &sbuf, ts, true);
1995         if (!NT_STATUS_IS_OK(status)) {
1996                 END_PROFILE(SMBcreate);
1997                 reply_openerror(req, status);
1998                 return;
1999         }
2000
2001         reply_outbuf(req, 1, 0);
2002         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2003
2004         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2005                 SCVAL(req->outbuf,smb_flg,
2006                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2007         }
2008
2009         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2010                 SCVAL(req->outbuf,smb_flg,
2011                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2012         }
2013
2014         DEBUG( 2, ( "reply_mknew: file %s\n", fsp->fsp_name ) );
2015         DEBUG( 3, ( "reply_mknew %s fd=%d dmode=0x%x\n",
2016                     fsp->fsp_name, fsp->fh->fd, (unsigned int)fattr ) );
2017
2018         END_PROFILE(SMBcreate);
2019         return;
2020 }
2021
2022 /****************************************************************************
2023  Reply to a create temporary file.
2024 ****************************************************************************/
2025
2026 void reply_ctemp(struct smb_request *req)
2027 {
2028         connection_struct *conn = req->conn;
2029         char *fname = NULL;
2030         uint32 fattr;
2031         files_struct *fsp;
2032         int oplock_request;
2033         int tmpfd;
2034         SMB_STRUCT_STAT sbuf;
2035         char *s;
2036         NTSTATUS status;
2037         TALLOC_CTX *ctx = talloc_tos();
2038
2039         START_PROFILE(SMBctemp);
2040
2041         if (req->wct < 3) {
2042                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2043                 END_PROFILE(SMBctemp);
2044                 return;
2045         }
2046
2047         fattr = SVAL(req->inbuf,smb_vwv0);
2048         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2049
2050         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &fname,
2051                         smb_buf(req->inbuf)+1, 0, STR_TERMINATE,
2052                         &status);
2053         if (!NT_STATUS_IS_OK(status)) {
2054                 reply_nterror(req, status);
2055                 END_PROFILE(SMBctemp);
2056                 return;
2057         }
2058         if (*fname) {
2059                 fname = talloc_asprintf(ctx,
2060                                 "%s/TMXXXXXX",
2061                                 fname);
2062         } else {
2063                 fname = talloc_strdup(ctx, "TMXXXXXX");
2064         }
2065
2066         if (!fname) {
2067                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2068                 END_PROFILE(SMBctemp);
2069                 return;
2070         }
2071
2072         status = resolve_dfspath(ctx, conn,
2073                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2074                                 fname,
2075                                 &fname);
2076         if (!NT_STATUS_IS_OK(status)) {
2077                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2078                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2079                                         ERRSRV, ERRbadpath);
2080                         END_PROFILE(SMBctemp);
2081                         return;
2082                 }
2083                 reply_nterror(req, status);
2084                 END_PROFILE(SMBctemp);
2085                 return;
2086         }
2087
2088         status = unix_convert(ctx, conn, fname, False, &fname, NULL, &sbuf);
2089         if (!NT_STATUS_IS_OK(status)) {
2090                 reply_nterror(req, status);
2091                 END_PROFILE(SMBctemp);
2092                 return;
2093         }
2094
2095         status = check_name(conn, CONST_DISCARD(char *,fname));
2096         if (!NT_STATUS_IS_OK(status)) {
2097                 reply_nterror(req, status);
2098                 END_PROFILE(SMBctemp);
2099                 return;
2100         }
2101
2102         tmpfd = smb_mkstemp(fname);
2103         if (tmpfd == -1) {
2104                 reply_unixerror(req, ERRDOS, ERRnoaccess);
2105                 END_PROFILE(SMBctemp);
2106                 return;
2107         }
2108
2109         SMB_VFS_STAT(conn,fname,&sbuf);
2110
2111         /* We should fail if file does not exist. */
2112         status = open_file_ntcreate(conn, req, fname, &sbuf,
2113                                 FILE_GENERIC_READ | FILE_GENERIC_WRITE,
2114                                 FILE_SHARE_READ|FILE_SHARE_WRITE,
2115                                 FILE_OPEN,
2116                                 0,
2117                                 fattr,
2118                                 oplock_request,
2119                                 NULL, &fsp);
2120
2121         /* close fd from smb_mkstemp() */
2122         close(tmpfd);
2123
2124         if (!NT_STATUS_IS_OK(status)) {
2125                 if (open_was_deferred(req->mid)) {
2126                         /* We have re-scheduled this call. */
2127                         END_PROFILE(SMBctemp);
2128                         return;
2129                 }
2130                 reply_openerror(req, status);
2131                 END_PROFILE(SMBctemp);
2132                 return;
2133         }
2134
2135         reply_outbuf(req, 1, 0);
2136         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2137
2138         /* the returned filename is relative to the directory */
2139         s = strrchr_m(fsp->fsp_name, '/');
2140         if (!s) {
2141                 s = fsp->fsp_name;
2142         } else {
2143                 s++;
2144         }
2145
2146 #if 0
2147         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2148            thing in the byte section. JRA */
2149         SSVALS(p, 0, -1); /* what is this? not in spec */
2150 #endif
2151         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2152             == -1) {
2153                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2154                 END_PROFILE(SMBctemp);
2155                 return;
2156         }
2157
2158         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2159                 SCVAL(req->outbuf, smb_flg,
2160                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2161         }
2162
2163         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2164                 SCVAL(req->outbuf, smb_flg,
2165                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2166         }
2167
2168         DEBUG( 2, ( "reply_ctemp: created temp file %s\n", fsp->fsp_name ) );
2169         DEBUG( 3, ( "reply_ctemp %s fd=%d umode=0%o\n", fsp->fsp_name,
2170                     fsp->fh->fd, (unsigned int)sbuf.st_mode ) );
2171
2172         END_PROFILE(SMBctemp);
2173         return;
2174 }
2175
2176 /*******************************************************************
2177  Check if a user is allowed to rename a file.
2178 ********************************************************************/
2179
2180 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2181                            uint16 dirtype, SMB_STRUCT_STAT *pst)
2182 {
2183         uint32 fmode;
2184
2185         if (!CAN_WRITE(conn)) {
2186                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2187         }
2188
2189         fmode = dos_mode(conn, fsp->fsp_name, pst);
2190         if ((fmode & ~dirtype) & (aHIDDEN | aSYSTEM)) {
2191                 return NT_STATUS_NO_SUCH_FILE;
2192         }
2193
2194         if (S_ISDIR(pst->st_mode)) {
2195                 return NT_STATUS_OK;
2196         }
2197
2198         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2199                 return NT_STATUS_OK;
2200         }
2201
2202         return NT_STATUS_ACCESS_DENIED;
2203 }
2204
2205 /*******************************************************************
2206  * unlink a file with all relevant access checks
2207  *******************************************************************/
2208
2209 static NTSTATUS do_unlink(connection_struct *conn,
2210                         struct smb_request *req,
2211                         const char *fname,
2212                         uint32 dirtype)
2213 {
2214         SMB_STRUCT_STAT sbuf;
2215         uint32 fattr;
2216         files_struct *fsp;
2217         uint32 dirtype_orig = dirtype;
2218         NTSTATUS status;
2219
2220         DEBUG(10,("do_unlink: %s, dirtype = %d\n", fname, dirtype ));
2221
2222         if (!CAN_WRITE(conn)) {
2223                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2224         }
2225
2226         if (SMB_VFS_LSTAT(conn,fname,&sbuf) != 0) {
2227                 return map_nt_error_from_unix(errno);
2228         }
2229
2230         fattr = dos_mode(conn,fname,&sbuf);
2231
2232         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2233                 dirtype = aDIR|aARCH|aRONLY;
2234         }
2235
2236         dirtype &= (aDIR|aARCH|aRONLY|aHIDDEN|aSYSTEM);
2237         if (!dirtype) {
2238                 return NT_STATUS_NO_SUCH_FILE;
2239         }
2240
2241         if (!dir_check_ftype(conn, fattr, dirtype)) {
2242                 if (fattr & aDIR) {
2243                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2244                 }
2245                 return NT_STATUS_NO_SUCH_FILE;
2246         }
2247
2248         if (dirtype_orig & 0x8000) {
2249                 /* These will never be set for POSIX. */
2250                 return NT_STATUS_NO_SUCH_FILE;
2251         }
2252
2253 #if 0
2254         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2255                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2256         }
2257
2258         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2259                 return NT_STATUS_NO_SUCH_FILE;
2260         }
2261
2262         if (dirtype & 0xFF00) {
2263                 /* These will never be set for POSIX. */
2264                 return NT_STATUS_NO_SUCH_FILE;
2265         }
2266
2267         dirtype &= 0xFF;
2268         if (!dirtype) {
2269                 return NT_STATUS_NO_SUCH_FILE;
2270         }
2271
2272         /* Can't delete a directory. */
2273         if (fattr & aDIR) {
2274                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2275         }
2276 #endif
2277
2278 #if 0 /* JRATEST */
2279         else if (dirtype & aDIR) /* Asked for a directory and it isn't. */
2280                 return NT_STATUS_OBJECT_NAME_INVALID;
2281 #endif /* JRATEST */
2282
2283         /* Fix for bug #3035 from SATOH Fumiyasu <fumiyas@miraclelinux.com>
2284
2285           On a Windows share, a file with read-only dosmode can be opened with
2286           DELETE_ACCESS. But on a Samba share (delete readonly = no), it
2287           fails with NT_STATUS_CANNOT_DELETE error.
2288
2289           This semantic causes a problem that a user can not
2290           rename a file with read-only dosmode on a Samba share
2291           from a Windows command prompt (i.e. cmd.exe, but can rename
2292           from Windows Explorer).
2293         */
2294
2295         if (!lp_delete_readonly(SNUM(conn))) {
2296                 if (fattr & aRONLY) {
2297                         return NT_STATUS_CANNOT_DELETE;
2298                 }
2299         }
2300
2301         /* On open checks the open itself will check the share mode, so
2302            don't do it here as we'll get it wrong. */
2303
2304         status = create_file_unixpath
2305                 (conn,                  /* conn */
2306                  req,                   /* req */
2307                  fname,                 /* fname */
2308                  DELETE_ACCESS,         /* access_mask */
2309                  FILE_SHARE_NONE,       /* share_access */
2310                  FILE_OPEN,             /* create_disposition*/
2311                  FILE_NON_DIRECTORY_FILE, /* create_options */
2312                  FILE_ATTRIBUTE_NORMAL, /* file_attributes */
2313                  0,                     /* oplock_request */
2314                  0,                     /* allocation_size */
2315                  NULL,                  /* sd */
2316                  NULL,                  /* ea_list */
2317                  &fsp,                  /* result */
2318                  NULL,                  /* pinfo */
2319                  &sbuf);                /* psbuf */
2320
2321         if (!NT_STATUS_IS_OK(status)) {
2322                 DEBUG(10, ("open_file_ntcreate failed: %s\n",
2323                            nt_errstr(status)));
2324                 return status;
2325         }
2326
2327         /* The set is across all open files on this dev/inode pair. */
2328         if (!set_delete_on_close(fsp, True, &current_user.ut)) {
2329                 close_file(fsp, NORMAL_CLOSE);
2330                 return NT_STATUS_ACCESS_DENIED;
2331         }
2332
2333         return close_file(fsp,NORMAL_CLOSE);
2334 }
2335
2336 /****************************************************************************
2337  The guts of the unlink command, split out so it may be called by the NT SMB
2338  code.
2339 ****************************************************************************/
2340
2341 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2342                           uint32 dirtype, const char *name_in, bool has_wild)
2343 {
2344         const char *directory = NULL;
2345         char *mask = NULL;
2346         char *name = NULL;
2347         char *p = NULL;
2348         int count=0;
2349         NTSTATUS status = NT_STATUS_OK;
2350         SMB_STRUCT_STAT sbuf;
2351         TALLOC_CTX *ctx = talloc_tos();
2352
2353         status = unix_convert(ctx, conn, name_in, has_wild, &name, NULL, &sbuf);
2354         if (!NT_STATUS_IS_OK(status)) {
2355                 return status;
2356         }
2357
2358         p = strrchr_m(name,'/');
2359         if (!p) {
2360                 directory = talloc_strdup(ctx, ".");
2361                 if (!directory) {
2362                         return NT_STATUS_NO_MEMORY;
2363                 }
2364                 mask = name;
2365         } else {
2366                 *p = 0;
2367                 directory = name;
2368                 mask = p+1;
2369         }
2370
2371         /*
2372          * We should only check the mangled cache
2373          * here if unix_convert failed. This means
2374          * that the path in 'mask' doesn't exist
2375          * on the file system and so we need to look
2376          * for a possible mangle. This patch from
2377          * Tine Smukavec <valentin.smukavec@hermes.si>.
2378          */
2379
2380         if (!VALID_STAT(sbuf) && mangle_is_mangled(mask,conn->params)) {
2381                 char *new_mask = NULL;
2382                 mangle_lookup_name_from_8_3(ctx,
2383                                 mask,
2384                                 &new_mask,
2385                                 conn->params );
2386                 if (new_mask) {
2387                         mask = new_mask;
2388                 }
2389         }
2390
2391         if (!has_wild) {
2392                 directory = talloc_asprintf(ctx,
2393                                 "%s/%s",
2394                                 directory,
2395                                 mask);
2396                 if (!directory) {
2397                         return NT_STATUS_NO_MEMORY;
2398                 }
2399                 if (dirtype == 0) {
2400                         dirtype = FILE_ATTRIBUTE_NORMAL;
2401                 }
2402
2403                 status = check_name(conn, directory);
2404                 if (!NT_STATUS_IS_OK(status)) {
2405                         return status;
2406                 }
2407
2408                 status = do_unlink(conn, req, directory, dirtype);
2409                 if (!NT_STATUS_IS_OK(status)) {
2410                         return status;
2411                 }
2412
2413                 count++;
2414         } else {
2415                 struct smb_Dir *dir_hnd = NULL;
2416                 long offset = 0;
2417                 const char *dname;
2418
2419                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == aDIR) {
2420                         return NT_STATUS_OBJECT_NAME_INVALID;
2421                 }
2422
2423                 if (strequal(mask,"????????.???")) {
2424                         mask[0] = '*';
2425                         mask[1] = '\0';
2426                 }
2427
2428                 status = check_name(conn, directory);
2429                 if (!NT_STATUS_IS_OK(status)) {
2430                         return status;
2431                 }
2432
2433                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask,
2434                                   dirtype);
2435                 if (dir_hnd == NULL) {
2436                         return map_nt_error_from_unix(errno);
2437                 }
2438
2439                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2440                    the pattern matches against the long name, otherwise the short name
2441                    We don't implement this yet XXXX
2442                 */
2443
2444                 status = NT_STATUS_NO_SUCH_FILE;
2445
2446                 while ((dname = ReadDirName(dir_hnd, &offset))) {
2447                         SMB_STRUCT_STAT st;
2448                         char *fname = NULL;
2449
2450                         if (!is_visible_file(conn, directory, dname, &st, True)) {
2451                                 continue;
2452                         }
2453
2454                         /* Quick check for "." and ".." */
2455                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2456                                 continue;
2457                         }
2458
2459                         if(!mask_match(dname, mask, conn->case_sensitive)) {
2460                                 continue;
2461                         }
2462
2463                         fname = talloc_asprintf(ctx, "%s/%s",
2464                                         directory,
2465                                         dname);
2466                         if (!fname) {
2467                                 return NT_STATUS_NO_MEMORY;
2468                         }
2469
2470                         status = check_name(conn, fname);
2471                         if (!NT_STATUS_IS_OK(status)) {
2472                                 TALLOC_FREE(dir_hnd);
2473                                 return status;
2474                         }
2475
2476                         status = do_unlink(conn, req, fname, dirtype);
2477                         if (!NT_STATUS_IS_OK(status)) {
2478                                 TALLOC_FREE(fname);
2479                                 continue;
2480                         }
2481
2482                         count++;
2483                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2484                                  fname));
2485
2486                         TALLOC_FREE(fname);
2487                 }
2488                 TALLOC_FREE(dir_hnd);
2489         }
2490
2491         if (count == 0 && NT_STATUS_IS_OK(status)) {
2492                 status = map_nt_error_from_unix(errno);
2493         }
2494
2495         return status;
2496 }
2497
2498 /****************************************************************************
2499  Reply to a unlink
2500 ****************************************************************************/
2501
2502 void reply_unlink(struct smb_request *req)
2503 {
2504         connection_struct *conn = req->conn;
2505         char *name = NULL;
2506         uint32 dirtype;
2507         NTSTATUS status;
2508         bool path_contains_wcard = False;
2509         TALLOC_CTX *ctx = talloc_tos();
2510
2511         START_PROFILE(SMBunlink);
2512
2513         if (req->wct < 1) {
2514                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2515                 END_PROFILE(SMBunlink);
2516                 return;
2517         }
2518
2519         dirtype = SVAL(req->inbuf,smb_vwv0);
2520
2521         srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name,
2522                               smb_buf(req->inbuf) + 1, 0,
2523                               STR_TERMINATE, &status, &path_contains_wcard);
2524         if (!NT_STATUS_IS_OK(status)) {
2525                 reply_nterror(req, status);
2526                 END_PROFILE(SMBunlink);
2527                 return;
2528         }
2529
2530         status = resolve_dfspath_wcard(ctx, conn,
2531                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
2532                                        name,
2533                                        &name,
2534                                        &path_contains_wcard);
2535         if (!NT_STATUS_IS_OK(status)) {
2536                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2537                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2538                                         ERRSRV, ERRbadpath);
2539                         END_PROFILE(SMBunlink);
2540                         return;
2541                 }
2542                 reply_nterror(req, status);
2543                 END_PROFILE(SMBunlink);
2544                 return;
2545         }
2546
2547         DEBUG(3,("reply_unlink : %s\n",name));
2548
2549         status = unlink_internals(conn, req, dirtype, name,
2550                                   path_contains_wcard);
2551         if (!NT_STATUS_IS_OK(status)) {
2552                 if (open_was_deferred(req->mid)) {
2553                         /* We have re-scheduled this call. */
2554                         END_PROFILE(SMBunlink);
2555                         return;
2556                 }
2557                 reply_nterror(req, status);
2558                 END_PROFILE(SMBunlink);
2559                 return;
2560         }
2561
2562         reply_outbuf(req, 0, 0);
2563         END_PROFILE(SMBunlink);
2564
2565         return;
2566 }
2567
2568 /****************************************************************************
2569  Fail for readbraw.
2570 ****************************************************************************/
2571
2572 static void fail_readraw(void)
2573 {
2574         const char *errstr = talloc_asprintf(talloc_tos(),
2575                         "FAIL ! reply_readbraw: socket write fail (%s)",
2576                         strerror(errno));
2577         if (!errstr) {
2578                 errstr = "";
2579         }
2580         exit_server_cleanly(errstr);
2581 }
2582
2583 /****************************************************************************
2584  Fake (read/write) sendfile. Returns -1 on read or write fail.
2585 ****************************************************************************/
2586
2587 static ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos,
2588                              size_t nread)
2589 {
2590         size_t bufsize;
2591         size_t tosend = nread;
2592         char *buf;
2593
2594         if (nread == 0) {
2595                 return 0;
2596         }
2597
2598         bufsize = MIN(nread, 65536);
2599
2600         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2601                 return -1;
2602         }
2603
2604         while (tosend > 0) {
2605                 ssize_t ret;
2606                 size_t cur_read;
2607
2608                 if (tosend > bufsize) {
2609                         cur_read = bufsize;
2610                 } else {
2611                         cur_read = tosend;
2612                 }
2613                 ret = read_file(fsp,buf,startpos,cur_read);
2614                 if (ret == -1) {
2615                         SAFE_FREE(buf);
2616                         return -1;
2617                 }
2618
2619                 /* If we had a short read, fill with zeros. */
2620                 if (ret < cur_read) {
2621                         memset(buf, '\0', cur_read - ret);
2622                 }
2623
2624                 if (write_data(smbd_server_fd(),buf,cur_read) != cur_read) {
2625                         SAFE_FREE(buf);
2626                         return -1;
2627                 }
2628                 tosend -= cur_read;
2629                 startpos += cur_read;
2630         }
2631
2632         SAFE_FREE(buf);
2633         return (ssize_t)nread;
2634 }
2635
2636 /****************************************************************************
2637  Return a readbraw error (4 bytes of zero).
2638 ****************************************************************************/
2639
2640 static void reply_readbraw_error(void)
2641 {
2642         char header[4];
2643         SIVAL(header,0,0);
2644         if (write_data(smbd_server_fd(),header,4) != 4) {
2645                 fail_readraw();
2646         }
2647 }
2648
2649 /****************************************************************************
2650  Use sendfile in readbraw.
2651 ****************************************************************************/
2652
2653 void send_file_readbraw(connection_struct *conn,
2654                         files_struct *fsp,
2655                         SMB_OFF_T startpos,
2656                         size_t nread,
2657                         ssize_t mincount)
2658 {
2659         char *outbuf = NULL;
2660         ssize_t ret=0;
2661
2662 #if defined(WITH_SENDFILE)
2663         /*
2664          * We can only use sendfile on a non-chained packet
2665          * but we can use on a non-oplocked file. tridge proved this
2666          * on a train in Germany :-). JRA.
2667          * reply_readbraw has already checked the length.
2668          */
2669
2670         if ( (chain_size == 0) && (nread > 0) && (fsp->base_fsp == NULL) &&
2671             (fsp->wcp == NULL) && lp_use_sendfile(SNUM(conn)) ) {
2672                 char header[4];
2673                 DATA_BLOB header_blob;
2674
2675                 _smb_setlen(header,nread);
2676                 header_blob = data_blob_const(header, 4);
2677
2678                 if (SMB_VFS_SENDFILE(smbd_server_fd(), fsp,
2679                                 &header_blob, startpos, nread) == -1) {
2680                         /* Returning ENOSYS means no data at all was sent.
2681                          * Do this as a normal read. */
2682                         if (errno == ENOSYS) {
2683                                 goto normal_readbraw;
2684                         }
2685
2686                         /*
2687                          * Special hack for broken Linux with no working sendfile. If we
2688                          * return EINTR we sent the header but not the rest of the data.
2689                          * Fake this up by doing read/write calls.
2690                          */
2691                         if (errno == EINTR) {
2692                                 /* Ensure we don't do this again. */
2693                                 set_use_sendfile(SNUM(conn), False);
2694                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
2695
2696                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
2697                                         DEBUG(0,("send_file_readbraw: fake_sendfile failed for file %s (%s).\n",
2698                                                 fsp->fsp_name, strerror(errno) ));
2699                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
2700                                 }
2701                                 return;
2702                         }
2703
2704                         DEBUG(0,("send_file_readbraw: sendfile failed for file %s (%s). Terminating\n",
2705                                 fsp->fsp_name, strerror(errno) ));
2706                         exit_server_cleanly("send_file_readbraw sendfile failed");
2707                 }
2708
2709                 return;
2710         }
2711 #endif
2712
2713 normal_readbraw:
2714
2715         outbuf = TALLOC_ARRAY(NULL, char, nread+4);
2716         if (!outbuf) {
2717                 DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
2718                         (unsigned)(nread+4)));
2719                 reply_readbraw_error();
2720                 return;
2721         }
2722
2723         if (nread > 0) {
2724                 ret = read_file(fsp,outbuf+4,startpos,nread);
2725 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2726                 if (ret < mincount)
2727                         ret = 0;
2728 #else
2729                 if (ret < nread)
2730                         ret = 0;
2731 #endif
2732         }
2733
2734         _smb_setlen(outbuf,ret);
2735         if (write_data(smbd_server_fd(),outbuf,4+ret) != 4+ret)
2736                 fail_readraw();
2737
2738         TALLOC_FREE(outbuf);
2739 }
2740
2741 /****************************************************************************
2742  Reply to a readbraw (core+ protocol).
2743 ****************************************************************************/
2744
2745 void reply_readbraw(struct smb_request *req)
2746 {
2747         connection_struct *conn = req->conn;
2748         ssize_t maxcount,mincount;
2749         size_t nread = 0;
2750         SMB_OFF_T startpos;
2751         files_struct *fsp;
2752         SMB_STRUCT_STAT st;
2753         SMB_OFF_T size = 0;
2754
2755         START_PROFILE(SMBreadbraw);
2756
2757         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
2758                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
2759                         "raw reads/writes are disallowed.");
2760         }
2761
2762         if (req->wct < 8) {
2763                 reply_readbraw_error();
2764                 END_PROFILE(SMBreadbraw);
2765                 return;
2766         }
2767
2768         /*
2769          * Special check if an oplock break has been issued
2770          * and the readraw request croses on the wire, we must
2771          * return a zero length response here.
2772          */
2773
2774         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2775
2776         /*
2777          * We have to do a check_fsp by hand here, as
2778          * we must always return 4 zero bytes on error,
2779          * not a NTSTATUS.
2780          */
2781
2782         if (!fsp || !conn || conn != fsp->conn ||
2783                         current_user.vuid != fsp->vuid ||
2784                         fsp->is_directory || fsp->fh->fd == -1) {
2785                 /*
2786                  * fsp could be NULL here so use the value from the packet. JRA.
2787                  */
2788                 DEBUG(3,("reply_readbraw: fnum %d not valid "
2789                         "- cache prime?\n",
2790                         (int)SVAL(req->inbuf,smb_vwv0)));
2791                 reply_readbraw_error();
2792                 END_PROFILE(SMBreadbraw);
2793                 return;
2794         }
2795
2796         /* Do a "by hand" version of CHECK_READ. */
2797         if (!(fsp->can_read ||
2798                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
2799                                 (fsp->access_mask & FILE_EXECUTE)))) {
2800                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
2801                                 (int)SVAL(req->inbuf,smb_vwv0)));
2802                 reply_readbraw_error();
2803                 END_PROFILE(SMBreadbraw);
2804                 return;
2805         }
2806
2807         flush_write_cache(fsp, READRAW_FLUSH);
2808
2809         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv1);
2810         if(req->wct == 10) {
2811                 /*
2812                  * This is a large offset (64 bit) read.
2813                  */
2814 #ifdef LARGE_SMB_OFF_T
2815
2816                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv8)) << 32);
2817
2818 #else /* !LARGE_SMB_OFF_T */
2819
2820                 /*
2821                  * Ensure we haven't been sent a >32 bit offset.
2822                  */
2823
2824                 if(IVAL(req->inbuf,smb_vwv8) != 0) {
2825                         DEBUG(0,("reply_readbraw: large offset "
2826                                 "(%x << 32) used and we don't support "
2827                                 "64 bit offsets.\n",
2828                         (unsigned int)IVAL(req->inbuf,smb_vwv8) ));
2829                         reply_readbraw_error();
2830                         END_PROFILE(SMBreadbraw);
2831                         return;
2832                 }
2833
2834 #endif /* LARGE_SMB_OFF_T */
2835
2836                 if(startpos < 0) {
2837                         DEBUG(0,("reply_readbraw: negative 64 bit "
2838                                 "readraw offset (%.0f) !\n",
2839                                 (double)startpos ));
2840                         reply_readbraw_error();
2841                         END_PROFILE(SMBreadbraw);
2842                         return;
2843                 }
2844         }
2845
2846         maxcount = (SVAL(req->inbuf,smb_vwv3) & 0xFFFF);
2847         mincount = (SVAL(req->inbuf,smb_vwv4) & 0xFFFF);
2848
2849         /* ensure we don't overrun the packet size */
2850         maxcount = MIN(65535,maxcount);
2851
2852         if (is_locked(fsp,(uint32)req->smbpid,
2853                         (SMB_BIG_UINT)maxcount,
2854                         (SMB_BIG_UINT)startpos,
2855                         READ_LOCK)) {
2856                 reply_readbraw_error();
2857                 END_PROFILE(SMBreadbraw);
2858                 return;
2859         }
2860
2861         if (SMB_VFS_FSTAT(fsp, &st) == 0) {
2862                 size = st.st_size;
2863         }
2864
2865         if (startpos >= size) {
2866                 nread = 0;
2867         } else {
2868                 nread = MIN(maxcount,(size - startpos));
2869         }
2870
2871 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
2872         if (nread < mincount)
2873                 nread = 0;
2874 #endif
2875
2876         DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
2877                 "min=%lu nread=%lu\n",
2878                 fsp->fnum, (double)startpos,
2879                 (unsigned long)maxcount,
2880                 (unsigned long)mincount,
2881                 (unsigned long)nread ) );
2882
2883         send_file_readbraw(conn, fsp, startpos, nread, mincount);
2884
2885         DEBUG(5,("reply_readbraw finished\n"));
2886         END_PROFILE(SMBreadbraw);
2887 }
2888
2889 #undef DBGC_CLASS
2890 #define DBGC_CLASS DBGC_LOCKING
2891
2892 /****************************************************************************
2893  Reply to a lockread (core+ protocol).
2894 ****************************************************************************/
2895
2896 void reply_lockread(struct smb_request *req)
2897 {
2898         connection_struct *conn = req->conn;
2899         ssize_t nread = -1;
2900         char *data;
2901         SMB_OFF_T startpos;
2902         size_t numtoread;
2903         NTSTATUS status;
2904         files_struct *fsp;
2905         struct byte_range_lock *br_lck = NULL;
2906         char *p = NULL;
2907
2908         START_PROFILE(SMBlockread);
2909
2910         if (req->wct < 5) {
2911                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2912                 END_PROFILE(SMBlockread);
2913                 return;
2914         }
2915
2916         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
2917
2918         if (!check_fsp(conn, req, fsp, &current_user)) {
2919                 END_PROFILE(SMBlockread);
2920                 return;
2921         }
2922
2923         if (!CHECK_READ(fsp,req->inbuf)) {
2924                 reply_doserror(req, ERRDOS, ERRbadaccess);
2925                 END_PROFILE(SMBlockread);
2926                 return;
2927         }
2928
2929         release_level_2_oplocks_on_change(fsp);
2930
2931         numtoread = SVAL(req->inbuf,smb_vwv1);
2932         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
2933
2934         numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
2935
2936         reply_outbuf(req, 5, numtoread + 3);
2937
2938         data = smb_buf(req->outbuf) + 3;
2939
2940         /*
2941          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
2942          * protocol request that predates the read/write lock concept.
2943          * Thus instead of asking for a read lock here we need to ask
2944          * for a write lock. JRA.
2945          * Note that the requested lock size is unaffected by max_recv.
2946          */
2947
2948         br_lck = do_lock(smbd_messaging_context(),
2949                         fsp,
2950                         req->smbpid,
2951                         (SMB_BIG_UINT)numtoread,
2952                         (SMB_BIG_UINT)startpos,
2953                         WRITE_LOCK,
2954                         WINDOWS_LOCK,
2955                         False, /* Non-blocking lock. */
2956                         &status,
2957                         NULL);
2958         TALLOC_FREE(br_lck);
2959
2960         if (NT_STATUS_V(status)) {
2961                 reply_nterror(req, status);
2962                 END_PROFILE(SMBlockread);
2963                 return;
2964         }
2965
2966         /*
2967          * However the requested READ size IS affected by max_recv. Insanity.... JRA.
2968          */
2969
2970         if (numtoread > max_recv) {
2971                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
2972 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
2973                         (unsigned int)numtoread, (unsigned int)max_recv ));
2974                 numtoread = MIN(numtoread,max_recv);
2975         }
2976         nread = read_file(fsp,data,startpos,numtoread);
2977
2978         if (nread < 0) {
2979                 reply_unixerror(req, ERRDOS, ERRnoaccess);
2980                 END_PROFILE(SMBlockread);
2981                 return;
2982         }
2983
2984         srv_set_message((char *)req->outbuf, 5, nread+3, False);
2985
2986         SSVAL(req->outbuf,smb_vwv0,nread);
2987         SSVAL(req->outbuf,smb_vwv5,nread+3);
2988         p = smb_buf(req->outbuf);
2989         SCVAL(p,0,0); /* pad byte. */
2990         SSVAL(p,1,nread);
2991
2992         DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
2993                  fsp->fnum, (int)numtoread, (int)nread));
2994
2995         END_PROFILE(SMBlockread);
2996         return;
2997 }
2998
2999 #undef DBGC_CLASS
3000 #define DBGC_CLASS DBGC_ALL
3001
3002 /****************************************************************************
3003  Reply to a read.
3004 ****************************************************************************/
3005
3006 void reply_read(struct smb_request *req)
3007 {
3008         connection_struct *conn = req->conn;
3009         size_t numtoread;
3010         ssize_t nread = 0;
3011         char *data;
3012         SMB_OFF_T startpos;
3013         int outsize = 0;
3014         files_struct *fsp;
3015
3016         START_PROFILE(SMBread);
3017
3018         if (req->wct < 3) {
3019                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3020                 END_PROFILE(SMBread);
3021                 return;
3022         }
3023
3024         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3025
3026         if (!check_fsp(conn, req, fsp, &current_user)) {
3027                 END_PROFILE(SMBread);
3028                 return;
3029         }
3030
3031         if (!CHECK_READ(fsp,req->inbuf)) {
3032                 reply_doserror(req, ERRDOS, ERRbadaccess);
3033                 END_PROFILE(SMBread);
3034                 return;
3035         }
3036
3037         numtoread = SVAL(req->inbuf,smb_vwv1);
3038         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3039
3040         numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3041
3042         /*
3043          * The requested read size cannot be greater than max_recv. JRA.
3044          */
3045         if (numtoread > max_recv) {
3046                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3047 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3048                         (unsigned int)numtoread, (unsigned int)max_recv ));
3049                 numtoread = MIN(numtoread,max_recv);
3050         }
3051
3052         reply_outbuf(req, 5, numtoread+3);
3053
3054         data = smb_buf(req->outbuf) + 3;
3055
3056         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtoread,
3057                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3058                 reply_doserror(req, ERRDOS,ERRlock);
3059                 END_PROFILE(SMBread);
3060                 return;
3061         }
3062
3063         if (numtoread > 0)
3064                 nread = read_file(fsp,data,startpos,numtoread);
3065
3066         if (nread < 0) {
3067                 reply_unixerror(req, ERRDOS,ERRnoaccess);
3068                 END_PROFILE(SMBread);
3069                 return;
3070         }
3071
3072         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3073
3074         SSVAL(req->outbuf,smb_vwv0,nread);
3075         SSVAL(req->outbuf,smb_vwv5,nread+3);
3076         SCVAL(smb_buf(req->outbuf),0,1);
3077         SSVAL(smb_buf(req->outbuf),1,nread);
3078
3079         DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3080                 fsp->fnum, (int)numtoread, (int)nread ) );
3081
3082         END_PROFILE(SMBread);
3083         return;
3084 }
3085
3086 /****************************************************************************
3087  Setup readX header.
3088 ****************************************************************************/
3089
3090 static int setup_readX_header(char *outbuf, size_t smb_maxcnt)
3091 {
3092         int outsize;
3093         char *data;
3094
3095         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3096         data = smb_buf(outbuf);
3097
3098         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3099
3100         SCVAL(outbuf,smb_vwv0,0xFF);
3101         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3102         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3103         SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf));
3104         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3105         SSVAL(smb_buf(outbuf),-2,smb_maxcnt);
3106         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3107         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3108         return outsize;
3109 }
3110
3111 /****************************************************************************
3112  Reply to a read and X - possibly using sendfile.
3113 ****************************************************************************/
3114
3115 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3116                             files_struct *fsp, SMB_OFF_T startpos,
3117                             size_t smb_maxcnt)
3118 {
3119         SMB_STRUCT_STAT sbuf;
3120         ssize_t nread = -1;
3121
3122         if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
3123                 reply_unixerror(req, ERRDOS, ERRnoaccess);
3124                 return;
3125         }
3126
3127         if (startpos > sbuf.st_size) {
3128                 smb_maxcnt = 0;
3129         } else if (smb_maxcnt > (sbuf.st_size - startpos)) {
3130                 smb_maxcnt = (sbuf.st_size - startpos);
3131         }
3132
3133         if (smb_maxcnt == 0) {
3134                 goto normal_read;
3135         }
3136
3137 #if defined(WITH_SENDFILE)
3138         /*
3139          * We can only use sendfile on a non-chained packet
3140          * but we can use on a non-oplocked file. tridge proved this
3141          * on a train in Germany :-). JRA.
3142          */
3143
3144         if ((chain_size == 0) && (CVAL(req->inbuf,smb_vwv0) == 0xFF) &&
3145             !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
3146             lp_use_sendfile(SNUM(conn)) && (fsp->wcp == NULL) ) {
3147                 uint8 headerbuf[smb_size + 12 * 2];
3148                 DATA_BLOB header;
3149
3150                 /*
3151                  * Set up the packet header before send. We
3152                  * assume here the sendfile will work (get the
3153                  * correct amount of data).
3154                  */
3155
3156                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3157
3158                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3159                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3160
3161                 if ((nread = SMB_VFS_SENDFILE(smbd_server_fd(), fsp, &header, startpos, smb_maxcnt)) == -1) {
3162                         /* Returning ENOSYS means no data at all was sent. Do this as a normal read. */
3163                         if (errno == ENOSYS) {
3164                                 goto normal_read;
3165                         }
3166
3167                         /*
3168                          * Special hack for broken Linux with no working sendfile. If we
3169                          * return EINTR we sent the header but not the rest of the data.
3170                          * Fake this up by doing read/write calls.
3171                          */
3172
3173                         if (errno == EINTR) {
3174                                 /* Ensure we don't do this again. */
3175                                 set_use_sendfile(SNUM(conn), False);
3176                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3177                                 nread = fake_sendfile(fsp, startpos,
3178                                                       smb_maxcnt);
3179                                 if (nread == -1) {
3180                                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3181                                                 fsp->fsp_name, strerror(errno) ));
3182                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3183                                 }
3184                                 DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3185                                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3186                                 /* No outbuf here means successful sendfile. */
3187                                 TALLOC_FREE(req->outbuf);
3188                                 return;
3189                         }
3190
3191                         DEBUG(0,("send_file_readX: sendfile failed for file %s (%s). Terminating\n",
3192                                 fsp->fsp_name, strerror(errno) ));
3193                         exit_server_cleanly("send_file_readX sendfile failed");
3194                 }
3195
3196                 DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3197                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3198                 /* No outbuf here means successful sendfile. */
3199                 TALLOC_FREE(req->outbuf);
3200                 return;
3201         }
3202 #endif
3203
3204 normal_read:
3205
3206         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3207                 uint8 headerbuf[smb_size + 2*12];
3208
3209                 construct_reply_common((char *)req->inbuf, (char *)headerbuf);
3210                 setup_readX_header((char *)headerbuf, smb_maxcnt);
3211
3212                 /* Send out the header. */
3213                 if (write_data(smbd_server_fd(), (char *)headerbuf,
3214                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3215                         DEBUG(0,("send_file_readX: write_data failed for file %s (%s). Terminating\n",
3216                                 fsp->fsp_name, strerror(errno) ));
3217                         exit_server_cleanly("send_file_readX sendfile failed");
3218                 }
3219                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3220                 if (nread == -1) {
3221                         DEBUG(0,("send_file_readX: fake_sendfile failed for file %s (%s).\n",
3222                                 fsp->fsp_name, strerror(errno) ));
3223                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3224                 }
3225                 TALLOC_FREE(req->outbuf);
3226                 return;
3227         } else {
3228                 reply_outbuf(req, 12, smb_maxcnt);
3229
3230                 nread = read_file(fsp, smb_buf(req->outbuf), startpos,
3231                                   smb_maxcnt);
3232                 if (nread < 0) {
3233                         reply_unixerror(req, ERRDOS, ERRnoaccess);
3234                         return;
3235                 }
3236
3237                 setup_readX_header((char *)req->outbuf, nread);
3238
3239                 DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3240                         fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3241
3242                 chain_reply(req);
3243
3244                 return;
3245         }
3246 }
3247
3248 /****************************************************************************
3249  Reply to a read and X.
3250 ****************************************************************************/
3251
3252 void reply_read_and_X(struct smb_request *req)
3253 {
3254         connection_struct *conn = req->conn;
3255         files_struct *fsp;
3256         SMB_OFF_T startpos;
3257         size_t smb_maxcnt;
3258         bool big_readX = False;
3259 #if 0
3260         size_t smb_mincnt = SVAL(req->inbuf,smb_vwv6);
3261 #endif
3262
3263         START_PROFILE(SMBreadX);
3264
3265         if ((req->wct != 10) && (req->wct != 12)) {
3266                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3267                 return;
3268         }
3269
3270         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3271         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3272         smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
3273
3274         /* If it's an IPC, pass off the pipe handler. */
3275         if (IS_IPC(conn)) {
3276                 reply_pipe_read_and_X(req);
3277                 END_PROFILE(SMBreadX);
3278                 return;
3279         }
3280
3281         if (!check_fsp(conn, req, fsp, &current_user)) {
3282                 END_PROFILE(SMBreadX);
3283                 return;
3284         }
3285
3286         if (!CHECK_READ(fsp,req->inbuf)) {
3287                 reply_doserror(req, ERRDOS,ERRbadaccess);
3288                 END_PROFILE(SMBreadX);
3289                 return;
3290         }
3291
3292         if (global_client_caps & CAP_LARGE_READX) {
3293                 size_t upper_size = SVAL(req->inbuf,smb_vwv7);
3294                 smb_maxcnt |= (upper_size<<16);
3295                 if (upper_size > 1) {
3296                         /* Can't do this on a chained packet. */
3297                         if ((CVAL(req->inbuf,smb_vwv0) != 0xFF)) {
3298                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3299                                 END_PROFILE(SMBreadX);
3300                                 return;
3301                         }
3302                         /* We currently don't do this on signed or sealed data. */
3303                         if (srv_is_signing_active() || is_encrypted_packet(req->inbuf)) {
3304                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3305                                 END_PROFILE(SMBreadX);
3306                                 return;
3307                         }
3308                         /* Is there room in the reply for this data ? */
3309                         if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2)))  {
3310                                 reply_nterror(req,
3311                                               NT_STATUS_INVALID_PARAMETER);
3312                                 END_PROFILE(SMBreadX);
3313                                 return;
3314                         }
3315                         big_readX = True;
3316                 }
3317         }
3318
3319         if (req->wct == 12) {
3320 #ifdef LARGE_SMB_OFF_T
3321                 /*
3322                  * This is a large offset (64 bit) read.
3323                  */
3324                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv10)) << 32);
3325
3326 #else /* !LARGE_SMB_OFF_T */
3327
3328                 /*
3329                  * Ensure we haven't been sent a >32 bit offset.
3330                  */
3331
3332                 if(IVAL(req->inbuf,smb_vwv10) != 0) {
3333                         DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3334                                  "used and we don't support 64 bit offsets.\n",
3335                                  (unsigned int)IVAL(req->inbuf,smb_vwv10) ));
3336                         END_PROFILE(SMBreadX);
3337                         reply_doserror(req, ERRDOS, ERRbadaccess);
3338                         return;
3339                 }
3340
3341 #endif /* LARGE_SMB_OFF_T */
3342
3343         }
3344
3345         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)smb_maxcnt,
3346                       (SMB_BIG_UINT)startpos, READ_LOCK)) {
3347                 END_PROFILE(SMBreadX);
3348                 reply_doserror(req, ERRDOS, ERRlock);
3349                 return;
3350         }
3351
3352         if (!big_readX &&
3353             schedule_aio_read_and_X(conn, req, fsp, startpos, smb_maxcnt)) {
3354                 END_PROFILE(SMBreadX);
3355                 return;
3356         }
3357
3358         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3359
3360         END_PROFILE(SMBreadX);
3361         return;
3362 }
3363
3364 /****************************************************************************
3365  Error replies to writebraw must have smb_wct == 1. Fix this up.
3366 ****************************************************************************/
3367
3368 void error_to_writebrawerr(struct smb_request *req)
3369 {
3370         uint8 *old_outbuf = req->outbuf;
3371
3372         reply_outbuf(req, 1, 0);
3373
3374         memcpy(req->outbuf, old_outbuf, smb_size);
3375         TALLOC_FREE(old_outbuf);
3376 }
3377
3378 /****************************************************************************
3379  Reply to a writebraw (core+ or LANMAN1.0 protocol).
3380 ****************************************************************************/
3381
3382 void reply_writebraw(struct smb_request *req)
3383 {
3384         connection_struct *conn = req->conn;
3385         char *buf = NULL;
3386         ssize_t nwritten=0;
3387         ssize_t total_written=0;
3388         size_t numtowrite=0;
3389         size_t tcount;
3390         SMB_OFF_T startpos;
3391         char *data=NULL;
3392         bool write_through;
3393         files_struct *fsp;
3394         NTSTATUS status;
3395
3396         START_PROFILE(SMBwritebraw);
3397
3398         /*
3399          * If we ever reply with an error, it must have the SMB command
3400          * type of SMBwritec, not SMBwriteBraw, as this tells the client
3401          * we're finished.
3402          */
3403         SCVAL(req->inbuf,smb_com,SMBwritec);
3404
3405         if (srv_is_signing_active()) {
3406                 END_PROFILE(SMBwritebraw);
3407                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
3408                                 "raw reads/writes are disallowed.");
3409         }
3410
3411         if (req->wct < 12) {
3412                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3413                 error_to_writebrawerr(req);
3414                 END_PROFILE(SMBwritebraw);
3415                 return;
3416         }
3417
3418         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3419         if (!check_fsp(conn, req, fsp, &current_user)) {
3420                 error_to_writebrawerr(req);
3421                 END_PROFILE(SMBwritebraw);
3422                 return;
3423         }
3424
3425         if (!CHECK_WRITE(fsp)) {
3426                 reply_doserror(req, ERRDOS, ERRbadaccess);
3427                 error_to_writebrawerr(req);
3428                 END_PROFILE(SMBwritebraw);
3429                 return;
3430         }
3431
3432         tcount = IVAL(req->inbuf,smb_vwv1);
3433         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3434         write_through = BITSETW(req->inbuf+smb_vwv7,0);
3435
3436         /* We have to deal with slightly different formats depending
3437                 on whether we are using the core+ or lanman1.0 protocol */
3438
3439         if(Protocol <= PROTOCOL_COREPLUS) {
3440                 numtowrite = SVAL(smb_buf(req->inbuf),-2);
3441                 data = smb_buf(req->inbuf);
3442         } else {
3443                 numtowrite = SVAL(req->inbuf,smb_vwv10);
3444                 data = smb_base(req->inbuf) + SVAL(req->inbuf, smb_vwv11);
3445         }
3446
3447         /* Ensure we don't write bytes past the end of this packet. */
3448         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3449                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3450                 error_to_writebrawerr(req);
3451                 END_PROFILE(SMBwritebraw);
3452                 return;
3453         }
3454
3455         if (is_locked(fsp,(uint32)req->smbpid,(SMB_BIG_UINT)tcount,
3456                                 (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3457                 reply_doserror(req, ERRDOS, ERRlock);
3458                 error_to_writebrawerr(req);
3459                 END_PROFILE(SMBwritebraw);
3460                 return;
3461         }
3462
3463         if (numtowrite>0) {
3464                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3465         }
3466
3467         DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
3468                         "wrote=%d sync=%d\n",
3469                 fsp->fnum, (double)startpos, (int)numtowrite,
3470                 (int)nwritten, (int)write_through));
3471
3472         if (nwritten < (ssize_t)numtowrite)  {
3473                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3474                 error_to_writebrawerr(req);
3475                 END_PROFILE(SMBwritebraw);
3476                 return;
3477         }
3478
3479         total_written = nwritten;
3480
3481         /* Allocate a buffer of 64k + length. */
3482         buf = TALLOC_ARRAY(NULL, char, 65540);
3483         if (!buf) {
3484                 reply_doserror(req, ERRDOS, ERRnomem);
3485                 error_to_writebrawerr(req);
3486                 END_PROFILE(SMBwritebraw);
3487                 return;
3488         }
3489
3490         /* Return a SMBwritebraw message to the redirector to tell
3491          * it to send more bytes */
3492
3493         memcpy(buf, req->inbuf, smb_size);
3494         srv_set_message(buf,Protocol>PROTOCOL_COREPLUS?1:0,0,True);
3495         SCVAL(buf,smb_com,SMBwritebraw);
3496         SSVALS(buf,smb_vwv0,0xFFFF);
3497         show_msg(buf);
3498         if (!srv_send_smb(smbd_server_fd(),
3499                         buf,
3500                         IS_CONN_ENCRYPTED(conn))) {
3501                 exit_server_cleanly("reply_writebraw: srv_send_smb "
3502                         "failed.");
3503         }
3504
3505         /* Now read the raw data into the buffer and write it */
3506         status = read_smb_length(smbd_server_fd(), buf, SMB_SECONDARY_WAIT,
3507                                  &numtowrite);
3508         if (!NT_STATUS_IS_OK(status)) {
3509                 exit_server_cleanly("secondary writebraw failed");
3510         }
3511
3512         /* Set up outbuf to return the correct size */
3513         reply_outbuf(req, 1, 0);
3514
3515         if (numtowrite != 0) {
3516
3517                 if (numtowrite > 0xFFFF) {
3518                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3519                                 "raw requested (%u). Terminating\n",
3520                                 (unsigned int)numtowrite ));
3521                         exit_server_cleanly("secondary writebraw failed");
3522                 }
3523
3524                 if (tcount > nwritten+numtowrite) {
3525                         DEBUG(3,("reply_writebraw: Client overestimated the "
3526                                 "write %d %d %d\n",
3527                                 (int)tcount,(int)nwritten,(int)numtowrite));
3528                 }
3529
3530                 status = read_data(smbd_server_fd(), buf+4, numtowrite);
3531
3532                 if (!NT_STATUS_IS_OK(status)) {
3533                         DEBUG(0,("reply_writebraw: Oversize secondary write "
3534                                  "raw read failed (%s). Terminating\n",
3535                                  nt_errstr(status)));
3536                         exit_server_cleanly("secondary writebraw failed");
3537                 }
3538
3539                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
3540                 if (nwritten == -1) {
3541                         TALLOC_FREE(buf);
3542                         reply_unixerror(req, ERRHRD, ERRdiskfull);
3543                         error_to_writebrawerr(req);
3544                         END_PROFILE(SMBwritebraw);
3545                         return;
3546                 }
3547
3548                 if (nwritten < (ssize_t)numtowrite) {
3549                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
3550                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
3551                 }
3552
3553                 if (nwritten > 0) {
3554                         total_written += nwritten;
3555                 }
3556         }
3557
3558         TALLOC_FREE(buf);
3559         SSVAL(req->outbuf,smb_vwv0,total_written);
3560
3561         status = sync_file(conn, fsp, write_through);
3562         if (!NT_STATUS_IS_OK(status)) {
3563                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
3564                         fsp->fsp_name, nt_errstr(status) ));
3565                 reply_nterror(req, status);
3566                 error_to_writebrawerr(req);
3567                 END_PROFILE(SMBwritebraw);
3568                 return;
3569         }
3570
3571         DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
3572                 "wrote=%d\n",
3573                 fsp->fnum, (double)startpos, (int)numtowrite,
3574                 (int)total_written));
3575
3576         /* We won't return a status if write through is not selected - this
3577          * follows what WfWg does */
3578         END_PROFILE(SMBwritebraw);
3579
3580         if (!write_through && total_written==tcount) {
3581
3582 #if RABBIT_PELLET_FIX
3583                 /*
3584                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
3585                  * sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
3586                  * JRA.
3587                  */
3588                 if (!send_keepalive(smbd_server_fd())) {
3589                         exit_server_cleanly("reply_writebraw: send of "
3590                                 "keepalive failed");
3591                 }
3592 #endif
3593                 TALLOC_FREE(req->outbuf);
3594         }
3595         return;
3596 }
3597
3598 #undef DBGC_CLASS
3599 #define DBGC_CLASS DBGC_LOCKING
3600
3601 /****************************************************************************
3602  Reply to a writeunlock (core+).
3603 ****************************************************************************/
3604
3605 void reply_writeunlock(struct smb_request *req)
3606 {
3607         connection_struct *conn = req->conn;
3608         ssize_t nwritten = -1;
3609         size_t numtowrite;
3610         SMB_OFF_T startpos;
3611         char *data;
3612         NTSTATUS status = NT_STATUS_OK;
3613         files_struct *fsp;
3614
3615         START_PROFILE(SMBwriteunlock);
3616
3617         if (req->wct < 5) {
3618                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3619                 END_PROFILE(SMBwriteunlock);
3620                 return;
3621         }
3622
3623         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3624
3625         if (!check_fsp(conn, req, fsp, &current_user)) {
3626                 END_PROFILE(SMBwriteunlock);
3627                 return;
3628         }
3629
3630         if (!CHECK_WRITE(fsp)) {
3631                 reply_doserror(req, ERRDOS,ERRbadaccess);
3632                 END_PROFILE(SMBwriteunlock);
3633                 return;
3634         }
3635
3636         numtowrite = SVAL(req->inbuf,smb_vwv1);
3637         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3638         data = smb_buf(req->inbuf) + 3;
3639
3640         if (numtowrite
3641             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3642                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3643                 reply_doserror(req, ERRDOS, ERRlock);
3644                 END_PROFILE(SMBwriteunlock);
3645                 return;
3646         }
3647
3648         /* The special X/Open SMB protocol handling of
3649            zero length writes is *NOT* done for
3650            this call */
3651         if(numtowrite == 0) {
3652                 nwritten = 0;
3653         } else {
3654                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3655         }
3656
3657         status = sync_file(conn, fsp, False /* write through */);
3658         if (!NT_STATUS_IS_OK(status)) {
3659                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
3660                         fsp->fsp_name, nt_errstr(status) ));
3661                 reply_nterror(req, status);
3662                 END_PROFILE(SMBwriteunlock);
3663                 return;
3664         }
3665
3666         if(((nwritten < numtowrite) && (numtowrite != 0))||(nwritten < 0)) {
3667                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3668                 END_PROFILE(SMBwriteunlock);
3669                 return;
3670         }
3671
3672         if (numtowrite) {
3673                 status = do_unlock(smbd_messaging_context(),
3674                                 fsp,
3675                                 req->smbpid,
3676                                 (SMB_BIG_UINT)numtowrite,
3677                                 (SMB_BIG_UINT)startpos,
3678                                 WINDOWS_LOCK);
3679
3680                 if (NT_STATUS_V(status)) {
3681                         reply_nterror(req, status);
3682                         END_PROFILE(SMBwriteunlock);
3683                         return;
3684                 }
3685         }
3686
3687         reply_outbuf(req, 1, 0);
3688
3689         SSVAL(req->outbuf,smb_vwv0,nwritten);
3690
3691         DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
3692                  fsp->fnum, (int)numtowrite, (int)nwritten));
3693
3694         END_PROFILE(SMBwriteunlock);
3695         return;
3696 }
3697
3698 #undef DBGC_CLASS
3699 #define DBGC_CLASS DBGC_ALL
3700
3701 /****************************************************************************
3702  Reply to a write.
3703 ****************************************************************************/
3704
3705 void reply_write(struct smb_request *req)
3706 {
3707         connection_struct *conn = req->conn;
3708         size_t numtowrite;
3709         ssize_t nwritten = -1;
3710         SMB_OFF_T startpos;
3711         char *data;
3712         files_struct *fsp;
3713         NTSTATUS status;
3714
3715         START_PROFILE(SMBwrite);
3716
3717         if (req->wct < 5) {
3718                 END_PROFILE(SMBwrite);
3719                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3720                 return;
3721         }
3722
3723         /* If it's an IPC, pass off the pipe handler. */
3724         if (IS_IPC(conn)) {
3725                 reply_pipe_write(req);
3726                 END_PROFILE(SMBwrite);
3727                 return;
3728         }
3729
3730         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
3731
3732         if (!check_fsp(conn, req, fsp, &current_user)) {
3733                 END_PROFILE(SMBwrite);
3734                 return;
3735         }
3736
3737         if (!CHECK_WRITE(fsp)) {
3738                 reply_doserror(req, ERRDOS, ERRbadaccess);
3739                 END_PROFILE(SMBwrite);
3740                 return;
3741         }
3742
3743         numtowrite = SVAL(req->inbuf,smb_vwv1);
3744         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
3745         data = smb_buf(req->inbuf) + 3;
3746
3747         if (is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
3748                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
3749                 reply_doserror(req, ERRDOS, ERRlock);
3750                 END_PROFILE(SMBwrite);
3751                 return;
3752         }
3753
3754         /*
3755          * X/Open SMB protocol says that if smb_vwv1 is
3756          * zero then the file size should be extended or
3757          * truncated to the size given in smb_vwv[2-3].
3758          */
3759
3760         if(numtowrite == 0) {
3761                 /*
3762                  * This is actually an allocate call, and set EOF. JRA.
3763                  */
3764                 nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
3765                 if (nwritten < 0) {
3766                         reply_nterror(req, NT_STATUS_DISK_FULL);
3767                         END_PROFILE(SMBwrite);
3768                         return;
3769                 }
3770                 nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
3771                 if (nwritten < 0) {
3772                         reply_nterror(req, NT_STATUS_DISK_FULL);
3773                         END_PROFILE(SMBwrite);
3774                         return;
3775                 }
3776         } else
3777                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
3778
3779         status = sync_file(conn, fsp, False);
3780         if (!NT_STATUS_IS_OK(status)) {
3781                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
3782                         fsp->fsp_name, nt_errstr(status) ));
3783                 reply_nterror(req, status);
3784                 END_PROFILE(SMBwrite);
3785                 return;
3786         }
3787
3788         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
3789                 reply_unixerror(req, ERRHRD, ERRdiskfull);
3790                 END_PROFILE(SMBwrite);
3791                 return;
3792         }
3793
3794         reply_outbuf(req, 1, 0);
3795
3796         SSVAL(req->outbuf,smb_vwv0,nwritten);
3797
3798         if (nwritten < (ssize_t)numtowrite) {
3799                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
3800                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
3801         }
3802
3803         DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
3804
3805         END_PROFILE(SMBwrite);
3806         return;
3807 }
3808
3809 /****************************************************************************
3810  Ensure a buffer is a valid writeX for recvfile purposes.
3811 ****************************************************************************/
3812
3813 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
3814                                                 (2*14) + /* word count (including bcc) */ \
3815                                                 1 /* pad byte */)
3816
3817 bool is_valid_writeX_buffer(const uint8_t *inbuf)
3818 {
3819         size_t numtowrite;
3820         connection_struct *conn = NULL;
3821         unsigned int doff = 0;
3822         size_t len = smb_len_large(inbuf);
3823
3824         if (is_encrypted_packet(inbuf)) {
3825                 /* Can't do this on encrypted
3826                  * connections. */
3827                 return false;
3828         }
3829
3830         if (CVAL(inbuf,smb_com) != SMBwriteX) {
3831                 return false;
3832         }
3833
3834         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
3835                         CVAL(inbuf,smb_wct) != 14) {
3836                 DEBUG(10,("is_valid_writeX_buffer: chained or "
3837                         "invalid word length.\n"));
3838                 return false;
3839         }
3840
3841         conn = conn_find(SVAL(inbuf, smb_tid));
3842         if (conn == NULL) {
3843                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
3844                 return false;
3845         }
3846         if (IS_IPC(conn)) {
3847                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
3848                 return false;
3849         }
3850         doff = SVAL(inbuf,smb_vwv11);
3851
3852         numtowrite = SVAL(inbuf,smb_vwv10);
3853
3854         if (len > doff && len - doff > 0xFFFF) {
3855                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
3856         }
3857
3858         if (numtowrite == 0) {
3859                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
3860                 return false;
3861         }
3862
3863         /* Ensure the sizes match up. */
3864         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
3865                 /* no pad byte...old smbclient :-( */
3866                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
3867                         (unsigned int)doff,
3868                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
3869                 return false;
3870         }
3871
3872         if (len - doff != numtowrite) {
3873                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
3874                         "len = %u, doff = %u, numtowrite = %u\n",
3875                         (unsigned int)len,
3876                         (unsigned int)doff,
3877                         (unsigned int)numtowrite ));
3878                 return false;
3879         }
3880
3881         DEBUG(10,("is_valid_writeX_buffer: true "
3882                 "len = %u, doff = %u, numtowrite = %u\n",
3883                 (unsigned int)len,
3884                 (unsigned int)doff,
3885                 (unsigned int)numtowrite ));
3886
3887         return true;
3888 }
3889
3890 /****************************************************************************
3891  Reply to a write and X.
3892 ****************************************************************************/
3893
3894 void reply_write_and_X(struct smb_request *req)
3895 {
3896         connection_struct *conn = req->conn;
3897         files_struct *fsp;
3898         SMB_OFF_T startpos;
3899         size_t numtowrite;
3900         bool write_through;
3901         ssize_t nwritten;
3902         unsigned int smb_doff;
3903         unsigned int smblen;
3904         char *data;
3905         NTSTATUS status;
3906
3907         START_PROFILE(SMBwriteX);
3908
3909         if ((req->wct != 12) && (req->wct != 14)) {
3910                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3911                 END_PROFILE(SMBwriteX);
3912                 return;
3913         }
3914
3915         numtowrite = SVAL(req->inbuf,smb_vwv10);
3916         smb_doff = SVAL(req->inbuf,smb_vwv11);
3917         smblen = smb_len(req->inbuf);
3918
3919         if (req->unread_bytes > 0xFFFF ||
3920                         (smblen > smb_doff &&
3921                                 smblen - smb_doff > 0xFFFF)) {
3922                 numtowrite |= (((size_t)SVAL(req->inbuf,smb_vwv9))<<16);
3923         }
3924
3925         if (req->unread_bytes) {
3926                 /* Can't do a recvfile write on IPC$ */
3927                 if (IS_IPC(conn)) {
3928                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3929                         END_PROFILE(SMBwriteX);
3930                         return;
3931                 }
3932                 if (numtowrite != req->unread_bytes) {
3933                         reply_doserror(req, ERRDOS, ERRbadmem);
3934                         END_PROFILE(SMBwriteX);
3935                         return;
3936                 }
3937         } else {
3938                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
3939                                 smb_doff + numtowrite > smblen) {
3940                         reply_doserror(req, ERRDOS, ERRbadmem);
3941                         END_PROFILE(SMBwriteX);
3942                         return;
3943                 }
3944         }
3945
3946         /* If it's an IPC, pass off the pipe handler. */
3947         if (IS_IPC(conn)) {
3948                 if (req->unread_bytes) {
3949                         reply_doserror(req, ERRDOS, ERRbadmem);
3950                         END_PROFILE(SMBwriteX);
3951                         return;
3952                 }
3953                 reply_pipe_write_and_X(req);
3954                 END_PROFILE(SMBwriteX);
3955                 return;
3956         }
3957
3958         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
3959         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv3);
3960         write_through = BITSETW(req->inbuf+smb_vwv7,0);
3961
3962         if (!check_fsp(conn, req, fsp, &current_user)) {
3963                 END_PROFILE(SMBwriteX);
3964                 return;
3965         }
3966
3967         if (!CHECK_WRITE(fsp)) {
3968                 reply_doserror(req, ERRDOS, ERRbadaccess);
3969                 END_PROFILE(SMBwriteX);
3970                 return;
3971         }
3972
3973         data = smb_base(req->inbuf) + smb_doff;
3974
3975         if(req->wct == 14) {
3976 #ifdef LARGE_SMB_OFF_T
3977                 /*
3978                  * This is a large offset (64 bit) write.
3979                  */
3980                 startpos |= (((SMB_OFF_T)IVAL(req->inbuf,smb_vwv12)) << 32);
3981
3982 #else /* !LARGE_SMB_OFF_T */
3983
3984                 /*
3985                  * Ensure we haven't been sent a >32 bit offset.
3986                  */
3987
3988                 if(IVAL(req->inbuf,smb_vwv12) != 0) {
3989                         DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
3990                                  "used and we don't support 64 bit offsets.\n",
3991                                  (unsigned int)IVAL(req->inbuf,smb_vwv12) ));
3992                         reply_doserror(req, ERRDOS, ERRbadaccess);
3993                         END_PROFILE(SMBwriteX);
3994                         return;
3995                 }
3996
3997 #endif /* LARGE_SMB_OFF_T */
3998         }
3999
4000         if (is_locked(fsp,(uint32)req->smbpid,
4001                       (SMB_BIG_UINT)numtowrite,
4002                       (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4003                 reply_doserror(req, ERRDOS, ERRlock);
4004                 END_PROFILE(SMBwriteX);
4005                 return;
4006         }
4007
4008         /* X/Open SMB protocol says that, unlike SMBwrite
4009         if the length is zero then NO truncation is
4010         done, just a write of zero. To truncate a file,
4011         use SMBwrite. */
4012
4013         if(numtowrite == 0) {
4014                 nwritten = 0;
4015         } else {
4016
4017                 if ((req->unread_bytes == 0) &&
4018                     schedule_aio_write_and_X(conn, req, fsp, data, startpos,
4019                                              numtowrite)) {
4020                         END_PROFILE(SMBwriteX);
4021                         return;
4022                 }
4023
4024                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4025         }
4026
4027         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4028                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4029                 END_PROFILE(SMBwriteX);
4030                 return;
4031         }
4032
4033         reply_outbuf(req, 6, 0);
4034         SSVAL(req->outbuf,smb_vwv2,nwritten);
4035         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4036
4037         if (nwritten < (ssize_t)numtowrite) {
4038                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4039                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4040         }
4041
4042         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4043                 fsp->fnum, (int)numtowrite, (int)nwritten));
4044
4045         status = sync_file(conn, fsp, write_through);
4046         if (!NT_STATUS_IS_OK(status)) {
4047                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4048                         fsp->fsp_name, nt_errstr(status) ));
4049                 reply_nterror(req, status);
4050                 END_PROFILE(SMBwriteX);
4051                 return;
4052         }
4053
4054         END_PROFILE(SMBwriteX);
4055         chain_reply(req);
4056         return;
4057 }
4058
4059 /****************************************************************************
4060  Reply to a lseek.
4061 ****************************************************************************/
4062
4063 void reply_lseek(struct smb_request *req)
4064 {
4065         connection_struct *conn = req->conn;
4066         SMB_OFF_T startpos;
4067         SMB_OFF_T res= -1;
4068         int mode,umode;
4069         files_struct *fsp;
4070
4071         START_PROFILE(SMBlseek);
4072
4073         if (req->wct < 4) {
4074                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4075                 END_PROFILE(SMBlseek);
4076                 return;
4077         }
4078
4079         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4080
4081         if (!check_fsp(conn, req, fsp, &current_user)) {
4082                 return;
4083         }
4084
4085         flush_write_cache(fsp, SEEK_FLUSH);
4086
4087         mode = SVAL(req->inbuf,smb_vwv1) & 3;
4088         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4089         startpos = (SMB_OFF_T)IVALS(req->inbuf,smb_vwv2);
4090
4091         switch (mode) {
4092                 case 0:
4093                         umode = SEEK_SET;
4094                         res = startpos;
4095                         break;
4096                 case 1:
4097                         umode = SEEK_CUR;
4098                         res = fsp->fh->pos + startpos;
4099                         break;
4100                 case 2:
4101                         umode = SEEK_END;
4102                         break;
4103                 default:
4104                         umode = SEEK_SET;
4105                         res = startpos;
4106                         break;
4107         }
4108
4109         if (umode == SEEK_END) {
4110                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4111                         if(errno == EINVAL) {
4112                                 SMB_OFF_T current_pos = startpos;
4113                                 SMB_STRUCT_STAT sbuf;
4114
4115                                 if(SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
4116                                         reply_unixerror(req, ERRDOS,
4117                                                         ERRnoaccess);
4118                                         END_PROFILE(SMBlseek);
4119                                         return;
4120                                 }
4121
4122                                 current_pos += sbuf.st_size;
4123                                 if(current_pos < 0)
4124                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4125                         }
4126                 }
4127
4128                 if(res == -1) {
4129                         reply_unixerror(req, ERRDOS, ERRnoaccess);
4130                         END_PROFILE(SMBlseek);
4131                         return;
4132                 }
4133         }
4134
4135         fsp->fh->pos = res;
4136
4137         reply_outbuf(req, 2, 0);
4138         SIVAL(req->outbuf,smb_vwv0,res);
4139
4140         DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4141                 fsp->fnum, (double)startpos, (double)res, mode));
4142
4143         END_PROFILE(SMBlseek);
4144         return;
4145 }
4146
4147 /****************************************************************************
4148  Reply to a flush.
4149 ****************************************************************************/
4150
4151 void reply_flush(struct smb_request *req)
4152 {
4153         connection_struct *conn = req->conn;
4154         uint16 fnum;
4155         files_struct *fsp;
4156
4157         START_PROFILE(SMBflush);
4158
4159         if (req->wct < 1) {
4160                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4161                 return;
4162         }
4163
4164         fnum = SVAL(req->inbuf,smb_vwv0);
4165         fsp = file_fsp(fnum);
4166
4167         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp, &current_user)) {
4168                 return;
4169         }
4170
4171         if (!fsp) {
4172                 file_sync_all(conn);
4173         } else {
4174                 NTSTATUS status = sync_file(conn, fsp, True);
4175                 if (!NT_STATUS_IS_OK(status)) {
4176                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4177                                 fsp->fsp_name, nt_errstr(status) ));
4178                         reply_nterror(req, status);
4179                         END_PROFILE(SMBflush);
4180                         return;
4181                 }
4182         }
4183
4184         reply_outbuf(req, 0, 0);
4185
4186         DEBUG(3,("flush\n"));
4187         END_PROFILE(SMBflush);
4188         return;
4189 }
4190
4191 /****************************************************************************
4192  Reply to a exit.
4193  conn POINTER CAN BE NULL HERE !
4194 ****************************************************************************/
4195
4196 void reply_exit(struct smb_request *req)
4197 {
4198         START_PROFILE(SMBexit);
4199
4200         file_close_pid(req->smbpid, req->vuid);
4201
4202         reply_outbuf(req, 0, 0);
4203
4204         DEBUG(3,("exit\n"));
4205
4206         END_PROFILE(SMBexit);
4207         return;
4208 }
4209
4210 /****************************************************************************
4211  Reply to a close - has to deal with closing a directory opened by NT SMB's.
4212 ****************************************************************************/
4213
4214 void reply_close(struct smb_request *req)
4215 {
4216         connection_struct *conn = req->conn;
4217         NTSTATUS status = NT_STATUS_OK;
4218         files_struct *fsp = NULL;
4219         START_PROFILE(SMBclose);
4220
4221         if (req->wct < 3) {
4222                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4223                 END_PROFILE(SMBclose);
4224                 return;
4225         }
4226
4227         /* If it's an IPC, pass off to the pipe handler. */
4228         if (IS_IPC(conn)) {
4229                 reply_pipe_close(conn, req);
4230                 END_PROFILE(SMBclose);
4231                 return;
4232         }
4233
4234         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4235
4236         /*
4237          * We can only use CHECK_FSP if we know it's not a directory.
4238          */
4239
4240         if(!fsp || (fsp->conn != conn) || (fsp->vuid != current_user.vuid)) {
4241                 reply_doserror(req, ERRDOS, ERRbadfid);
4242                 END_PROFILE(SMBclose);
4243                 return;
4244         }
4245
4246         if(fsp->is_directory) {
4247                 /*
4248                  * Special case - close NT SMB directory handle.
4249                  */
4250                 DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4251                 status = close_file(fsp,NORMAL_CLOSE);
4252         } else {
4253                 time_t t;
4254                 /*
4255                  * Close ordinary file.
4256                  */
4257
4258                 DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4259                          fsp->fh->fd, fsp->fnum,
4260                          conn->num_files_open));
4261
4262                 /*
4263                  * Take care of any time sent in the close.
4264                  */
4265
4266                 t = srv_make_unix_date3(req->inbuf+smb_vwv1);
4267                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
4268
4269                 /*
4270                  * close_file() returns the unix errno if an error
4271                  * was detected on close - normally this is due to
4272                  * a disk full error. If not then it was probably an I/O error.
4273                  */
4274
4275                 status = close_file(fsp,NORMAL_CLOSE);
4276         }
4277
4278         if (!NT_STATUS_IS_OK(status)) {
4279                 reply_nterror(req, status);
4280                 END_PROFILE(SMBclose);
4281                 return;
4282         }
4283
4284         reply_outbuf(req, 0, 0);
4285         END_PROFILE(SMBclose);
4286         return;
4287 }
4288
4289 /****************************************************************************
4290  Reply to a writeclose (Core+ protocol).
4291 ****************************************************************************/
4292
4293 void reply_writeclose(struct smb_request *req)
4294 {
4295         connection_struct *conn = req->conn;
4296         size_t numtowrite;
4297         ssize_t nwritten = -1;
4298         NTSTATUS close_status = NT_STATUS_OK;
4299         SMB_OFF_T startpos;
4300         char *data;
4301         struct timespec mtime;
4302         files_struct *fsp;
4303
4304         START_PROFILE(SMBwriteclose);
4305
4306         if (req->wct < 6) {
4307                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4308                 END_PROFILE(SMBwriteclose);
4309                 return;
4310         }
4311
4312         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4313
4314         if (!check_fsp(conn, req, fsp, &current_user)) {
4315                 END_PROFILE(SMBwriteclose);
4316                 return;
4317         }
4318         if (!CHECK_WRITE(fsp)) {
4319                 reply_doserror(req, ERRDOS,ERRbadaccess);
4320                 END_PROFILE(SMBwriteclose);
4321                 return;
4322         }
4323
4324         numtowrite = SVAL(req->inbuf,smb_vwv1);
4325         startpos = IVAL_TO_SMB_OFF_T(req->inbuf,smb_vwv2);
4326         mtime = convert_time_t_to_timespec(srv_make_unix_date3(
4327                                                    req->inbuf+smb_vwv4));
4328         data = smb_buf(req->inbuf) + 1;
4329
4330         if (numtowrite
4331             && is_locked(fsp, (uint32)req->smbpid, (SMB_BIG_UINT)numtowrite,
4332                          (SMB_BIG_UINT)startpos, WRITE_LOCK)) {
4333                 reply_doserror(req, ERRDOS,ERRlock);
4334                 END_PROFILE(SMBwriteclose);
4335                 return;
4336         }
4337
4338         nwritten = write_file(req,fsp,data,startpos,numtowrite);
4339
4340         set_close_write_time(fsp, mtime);
4341
4342         /*
4343          * More insanity. W2K only closes the file if writelen > 0.
4344          * JRA.
4345          */
4346
4347         if (numtowrite) {
4348                 DEBUG(3,("reply_writeclose: zero length write doesn't close file %s\n",
4349                         fsp->fsp_name ));
4350                 close_status = close_file(fsp,NORMAL_CLOSE);
4351         }
4352
4353         DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4354                  fsp->fnum, (int)numtowrite, (int)nwritten,
4355                  conn->num_files_open));
4356
4357         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
4358                 reply_doserror(req, ERRHRD, ERRdiskfull);
4359                 END_PROFILE(SMBwriteclose);
4360                 return;
4361         }
4362
4363         if(!NT_STATUS_IS_OK(close_status)) {
4364                 reply_nterror(req, close_status);
4365                 END_PROFILE(SMBwriteclose);
4366                 return;
4367         }
4368
4369         reply_outbuf(req, 1, 0);
4370
4371         SSVAL(req->outbuf,smb_vwv0,nwritten);
4372         END_PROFILE(SMBwriteclose);
4373         return;
4374 }
4375
4376 #undef DBGC_CLASS
4377 #define DBGC_CLASS DBGC_LOCKING
4378
4379 /****************************************************************************
4380  Reply to a lock.
4381 ****************************************************************************/
4382
4383 void reply_lock(struct smb_request *req)
4384 {
4385         connection_struct *conn = req->conn;
4386         SMB_BIG_UINT count,offset;
4387         NTSTATUS status;
4388         files_struct *fsp;
4389         struct byte_range_lock *br_lck = NULL;
4390
4391         START_PROFILE(SMBlock);
4392
4393         if (req->wct < 5) {
4394                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4395                 END_PROFILE(SMBlock);
4396                 return;
4397         }
4398
4399         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4400
4401         if (!check_fsp(conn, req, fsp, &current_user)) {
4402                 END_PROFILE(SMBlock);
4403                 return;
4404         }
4405
4406         release_level_2_oplocks_on_change(fsp);
4407
4408         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4409         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4410
4411         DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4412                  fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
4413
4414         br_lck = do_lock(smbd_messaging_context(),
4415                         fsp,
4416                         req->smbpid,
4417                         count,
4418                         offset,
4419                         WRITE_LOCK,
4420                         WINDOWS_LOCK,
4421                         False, /* Non-blocking lock. */
4422                         &status,
4423                         NULL);
4424
4425         TALLOC_FREE(br_lck);
4426
4427         if (NT_STATUS_V(status)) {
4428                 reply_nterror(req, status);
4429                 END_PROFILE(SMBlock);
4430                 return;
4431         }
4432
4433         reply_outbuf(req, 0, 0);
4434
4435         END_PROFILE(SMBlock);
4436         return;
4437 }
4438
4439 /****************************************************************************
4440  Reply to a unlock.
4441 ****************************************************************************/
4442
4443 void reply_unlock(struct smb_request *req)
4444 {
4445         connection_struct *conn = req->conn;
4446         SMB_BIG_UINT count,offset;
4447         NTSTATUS status;
4448         files_struct *fsp;
4449
4450         START_PROFILE(SMBunlock);
4451
4452         if (req->wct < 5) {
4453                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4454                 END_PROFILE(SMBunlock);
4455                 return;
4456         }
4457
4458         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4459
4460         if (!check_fsp(conn, req, fsp, &current_user)) {
4461                 END_PROFILE(SMBunlock);
4462                 return;
4463         }
4464
4465         count = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv1);
4466         offset = (SMB_BIG_UINT)IVAL(req->inbuf,smb_vwv3);
4467
4468         status = do_unlock(smbd_messaging_context(),
4469                         fsp,
4470                         req->smbpid,
4471                         count,
4472                         offset,
4473                         WINDOWS_LOCK);
4474
4475         if (NT_STATUS_V(status)) {
4476                 reply_nterror(req, status);
4477                 END_PROFILE(SMBunlock);
4478                 return;
4479         }
4480
4481         DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
4482                     fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
4483
4484         reply_outbuf(req, 0, 0);
4485
4486         END_PROFILE(SMBunlock);
4487         return;
4488 }
4489
4490 #undef DBGC_CLASS
4491 #define DBGC_CLASS DBGC_ALL
4492
4493 /****************************************************************************
4494  Reply to a tdis.
4495  conn POINTER CAN BE NULL HERE !
4496 ****************************************************************************/
4497
4498 void reply_tdis(struct smb_request *req)
4499 {
4500         connection_struct *conn = req->conn;
4501         START_PROFILE(SMBtdis);
4502
4503         if (!conn) {
4504                 DEBUG(4,("Invalid connection in tdis\n"));
4505                 reply_doserror(req, ERRSRV, ERRinvnid);
4506                 END_PROFILE(SMBtdis);
4507                 return;
4508         }
4509
4510         conn->used = False;
4511
4512         close_cnum(conn,req->vuid);
4513         req->conn = NULL;
4514
4515         reply_outbuf(req, 0, 0);
4516         END_PROFILE(SMBtdis);
4517         return;
4518 }
4519
4520 /****************************************************************************
4521  Reply to a echo.
4522  conn POINTER CAN BE NULL HERE !
4523 ****************************************************************************/
4524
4525 void reply_echo(struct smb_request *req)
4526 {
4527         connection_struct *conn = req->conn;
4528         int smb_reverb;
4529         int seq_num;
4530         unsigned int data_len = smb_buflen(req->inbuf);
4531
4532         START_PROFILE(SMBecho);
4533
4534         if (req->wct < 1) {
4535                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4536                 END_PROFILE(SMBecho);
4537                 return;
4538         }
4539
4540         if (data_len > BUFFER_SIZE) {
4541                 DEBUG(0,("reply_echo: data_len too large.\n"));
4542                 reply_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
4543                 END_PROFILE(SMBecho);
4544                 return;
4545         }
4546
4547         smb_reverb = SVAL(req->inbuf,smb_vwv0);
4548
4549         reply_outbuf(req, 1, data_len);
4550
4551         /* copy any incoming data back out */
4552         if (data_len > 0) {
4553                 memcpy(smb_buf(req->outbuf),smb_buf(req->inbuf),data_len);
4554         }
4555
4556         if (smb_reverb > 100) {
4557                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
4558                 smb_reverb = 100;
4559         }
4560
4561         for (seq_num =1 ; seq_num <= smb_reverb ; seq_num++) {
4562                 SSVAL(req->outbuf,smb_vwv0,seq_num);
4563
4564                 show_msg((char *)req->outbuf);
4565                 if (!srv_send_smb(smbd_server_fd(),
4566                                 (char *)req->outbuf,
4567                                 IS_CONN_ENCRYPTED(conn)||req->encrypted))
4568                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
4569         }
4570
4571         DEBUG(3,("echo %d times\n", smb_reverb));
4572
4573         TALLOC_FREE(req->outbuf);
4574
4575         smb_echo_count++;
4576
4577         END_PROFILE(SMBecho);
4578         return;
4579 }
4580
4581 /****************************************************************************
4582  Reply to a printopen.
4583 ****************************************************************************/
4584
4585 void reply_printopen(struct smb_request *req)
4586 {
4587         connection_struct *conn = req->conn;
4588         files_struct *fsp;
4589         NTSTATUS status;
4590
4591         START_PROFILE(SMBsplopen);
4592
4593         if (req->wct < 2) {
4594                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4595                 END_PROFILE(SMBsplopen);
4596                 return;
4597         }
4598
4599         if (!CAN_PRINT(conn)) {
4600                 reply_doserror(req, ERRDOS, ERRnoaccess);
4601                 END_PROFILE(SMBsplopen);
4602                 return;
4603         }
4604
4605         /* Open for exclusive use, write only. */
4606         status = print_fsp_open(conn, NULL, &fsp);
4607
4608         if (!NT_STATUS_IS_OK(status)) {
4609                 reply_nterror(req, status);
4610                 END_PROFILE(SMBsplopen);
4611                 return;
4612         }
4613
4614         reply_outbuf(req, 1, 0);
4615         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
4616
4617         DEBUG(3,("openprint fd=%d fnum=%d\n",
4618                  fsp->fh->fd, fsp->fnum));
4619
4620         END_PROFILE(SMBsplopen);
4621         return;
4622 }
4623
4624 /****************************************************************************
4625  Reply to a printclose.
4626 ****************************************************************************/
4627
4628 void reply_printclose(struct smb_request *req)
4629 {
4630         connection_struct *conn = req->conn;
4631         files_struct *fsp;
4632         NTSTATUS status;
4633
4634         START_PROFILE(SMBsplclose);
4635
4636         if (req->wct < 1) {
4637                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4638                 END_PROFILE(SMBsplclose);
4639                 return;
4640         }
4641
4642         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4643
4644         if (!check_fsp(conn, req, fsp, &current_user)) {
4645                 END_PROFILE(SMBsplclose);
4646                 return;
4647         }
4648
4649         if (!CAN_PRINT(conn)) {
4650                 reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
4651                 END_PROFILE(SMBsplclose);
4652                 return;
4653         }
4654
4655         DEBUG(3,("printclose fd=%d fnum=%d\n",
4656                  fsp->fh->fd,fsp->fnum));
4657
4658         status = close_file(fsp,NORMAL_CLOSE);
4659
4660         if(!NT_STATUS_IS_OK(status)) {
4661                 reply_nterror(req, status);
4662                 END_PROFILE(SMBsplclose);
4663                 return;
4664         }
4665
4666         END_PROFILE(SMBsplclose);
4667         return;
4668 }
4669
4670 /****************************************************************************
4671  Reply to a printqueue.
4672 ****************************************************************************/
4673
4674 void reply_printqueue(struct smb_request *req)
4675 {
4676         connection_struct *conn = req->conn;
4677         int max_count;
4678         int start_index;
4679
4680         START_PROFILE(SMBsplretq);
4681
4682         if (req->wct < 2) {
4683                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4684                 END_PROFILE(SMBsplretq);
4685                 return;
4686         }
4687
4688         max_count = SVAL(req->inbuf,smb_vwv0);
4689         start_index = SVAL(req->inbuf,smb_vwv1);
4690
4691         /* we used to allow the client to get the cnum wrong, but that
4692            is really quite gross and only worked when there was only
4693            one printer - I think we should now only accept it if they
4694            get it right (tridge) */
4695         if (!CAN_PRINT(conn)) {
4696                 reply_doserror(req, ERRDOS, ERRnoaccess);
4697                 END_PROFILE(SMBsplretq);
4698                 return;
4699         }
4700
4701         reply_outbuf(req, 2, 3);
4702         SSVAL(req->outbuf,smb_vwv0,0);
4703         SSVAL(req->outbuf,smb_vwv1,0);
4704         SCVAL(smb_buf(req->outbuf),0,1);
4705         SSVAL(smb_buf(req->outbuf),1,0);
4706
4707         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
4708                  start_index, max_count));
4709
4710         {
4711                 print_queue_struct *queue = NULL;
4712                 print_status_struct status;
4713                 int count = print_queue_status(SNUM(conn), &queue, &status);
4714                 int num_to_get = ABS(max_count);
4715                 int first = (max_count>0?start_index:start_index+max_count+1);
4716                 int i;
4717
4718                 if (first >= count)
4719                         num_to_get = 0;
4720                 else
4721                         num_to_get = MIN(num_to_get,count-first);
4722
4723
4724                 for (i=first;i<first+num_to_get;i++) {
4725                         char blob[28];
4726                         char *p = blob;
4727
4728                         srv_put_dos_date2(p,0,queue[i].time);
4729                         SCVAL(p,4,(queue[i].status==LPQ_PRINTING?2:3));
4730                         SSVAL(p,5, queue[i].job);
4731                         SIVAL(p,7,queue[i].size);
4732                         SCVAL(p,11,0);
4733                         srvstr_push(blob, req->flags2, p+12,
4734                                     queue[i].fs_user, 16, STR_ASCII);
4735
4736                         if (message_push_blob(
4737                                     &req->outbuf,
4738                                     data_blob_const(
4739                                             blob, sizeof(blob))) == -1) {
4740                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4741                                 END_PROFILE(SMBsplretq);
4742                                 return;
4743                         }
4744                 }
4745
4746                 if (count > 0) {
4747                         SSVAL(req->outbuf,smb_vwv0,count);
4748                         SSVAL(req->outbuf,smb_vwv1,
4749                               (max_count>0?first+count:first-1));
4750                         SCVAL(smb_buf(req->outbuf),0,1);
4751                         SSVAL(smb_buf(req->outbuf),1,28*count);
4752                 }
4753
4754                 SAFE_FREE(queue);
4755
4756                 DEBUG(3,("%d entries returned in queue\n",count));
4757         }
4758
4759         END_PROFILE(SMBsplretq);
4760         return;
4761 }
4762
4763 /****************************************************************************
4764  Reply to a printwrite.
4765 ****************************************************************************/
4766
4767 void reply_printwrite(struct smb_request *req)
4768 {
4769         connection_struct *conn = req->conn;
4770         int numtowrite;
4771         char *data;
4772         files_struct *fsp;
4773
4774         START_PROFILE(SMBsplwr);
4775
4776         if (req->wct < 1) {
4777                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4778                 END_PROFILE(SMBsplwr);
4779                 return;
4780         }
4781
4782         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
4783
4784         if (!check_fsp(conn, req, fsp, &current_user)) {
4785                 END_PROFILE(SMBsplwr);
4786                 return;
4787         }
4788
4789         if (!CAN_PRINT(conn)) {
4790                 reply_doserror(req, ERRDOS, ERRnoaccess);
4791                 END_PROFILE(SMBsplwr);
4792                 return;
4793         }
4794
4795         if (!CHECK_WRITE(fsp)) {
4796                 reply_doserror(req, ERRDOS, ERRbadaccess);
4797                 END_PROFILE(SMBsplwr);
4798                 return;
4799         }
4800
4801         numtowrite = SVAL(smb_buf(req->inbuf),1);
4802
4803         if (smb_buflen(req->inbuf) < numtowrite + 3) {
4804                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4805                 END_PROFILE(SMBsplwr);
4806                 return;
4807         }
4808
4809         data = smb_buf(req->inbuf) + 3;
4810
4811         if (write_file(req,fsp,data,-1,numtowrite) != numtowrite) {
4812                 reply_unixerror(req, ERRHRD, ERRdiskfull);
4813                 END_PROFILE(SMBsplwr);
4814                 return;
4815         }
4816
4817         DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
4818
4819         END_PROFILE(SMBsplwr);
4820         return;
4821 }
4822
4823 /****************************************************************************
4824  Reply to a mkdir.
4825 ****************************************************************************/
4826
4827 void reply_mkdir(struct smb_request *req)
4828 {
4829         connection_struct *conn = req->conn;
4830         char *directory = NULL;
4831         NTSTATUS status;
4832         SMB_STRUCT_STAT sbuf;
4833         TALLOC_CTX *ctx = talloc_tos();
4834
4835         START_PROFILE(SMBmkdir);
4836
4837         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
4838                         smb_buf(req->inbuf) + 1, 0,
4839                         STR_TERMINATE, &status);
4840         if (!NT_STATUS_IS_OK(status)) {
4841                 reply_nterror(req, status);
4842                 END_PROFILE(SMBmkdir);
4843                 return;
4844         }
4845
4846         status = resolve_dfspath(ctx, conn,
4847                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
4848                                  directory,
4849                                  &directory);
4850         if (!NT_STATUS_IS_OK(status)) {
4851                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
4852                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
4853                                         ERRSRV, ERRbadpath);
4854                         END_PROFILE(SMBmkdir);
4855                         return;
4856                 }
4857                 reply_nterror(req, status);
4858                 END_PROFILE(SMBmkdir);
4859                 return;
4860         }
4861
4862         status = unix_convert(ctx, conn, directory, False, &directory, NULL, &sbuf);
4863         if (!NT_STATUS_IS_OK(status)) {
4864                 reply_nterror(req, status);
4865                 END_PROFILE(SMBmkdir);
4866                 return;
4867         }
4868
4869         status = check_name(conn, directory);
4870         if (!NT_STATUS_IS_OK(status)) {
4871                 reply_nterror(req, status);
4872                 END_PROFILE(SMBmkdir);
4873                 return;
4874         }
4875
4876         status = create_directory(conn, req, directory);
4877
4878         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
4879
4880         if (!NT_STATUS_IS_OK(status)) {
4881
4882                 if (!use_nt_status()
4883                     && NT_STATUS_EQUAL(status,
4884                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
4885                         /*
4886                          * Yes, in the DOS error code case we get a
4887                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
4888                          * samba4 torture test.
4889                          */
4890                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
4891                 }
4892
4893                 reply_nterror(req, status);
4894                 END_PROFILE(SMBmkdir);
4895                 return;
4896         }
4897
4898         reply_outbuf(req, 0, 0);
4899
4900         DEBUG( 3, ( "mkdir %s\n", directory ) );
4901
4902         END_PROFILE(SMBmkdir);
4903         return;
4904 }
4905
4906 /****************************************************************************
4907  Static function used by reply_rmdir to delete an entire directory
4908  tree recursively. Return True on ok, False on fail.
4909 ****************************************************************************/
4910
4911 static bool recursive_rmdir(TALLOC_CTX *ctx,
4912                         connection_struct *conn,
4913                         char *directory)
4914 {
4915         const char *dname = NULL;
4916         bool ret = True;
4917         long offset = 0;
4918         struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn, directory,
4919                                           NULL, 0);
4920
4921         if(dir_hnd == NULL)
4922                 return False;
4923
4924         while((dname = ReadDirName(dir_hnd, &offset))) {
4925                 char *fullname = NULL;
4926                 SMB_STRUCT_STAT st;
4927
4928                 if (ISDOT(dname) || ISDOTDOT(dname)) {
4929                         continue;
4930                 }
4931
4932                 if (!is_visible_file(conn, directory, dname, &st, False)) {
4933                         continue;
4934                 }
4935
4936                 /* Construct the full name. */
4937                 fullname = talloc_asprintf(ctx,
4938                                 "%s/%s",
4939                                 directory,
4940                                 dname);
4941                 if (!fullname) {
4942                         errno = ENOMEM;
4943                         ret = False;
4944                         break;
4945                 }
4946
4947                 if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
4948                         ret = False;
4949                         break;
4950                 }
4951
4952                 if(st.st_mode & S_IFDIR) {
4953                         if(!recursive_rmdir(ctx, conn, fullname)) {
4954                                 ret = False;
4955                                 break;
4956                         }
4957                         if(SMB_VFS_RMDIR(conn,fullname) != 0) {
4958                                 ret = False;
4959                                 break;
4960                         }
4961                 } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
4962                         ret = False;
4963                         break;
4964                 }
4965                 TALLOC_FREE(fullname);
4966         }
4967         TALLOC_FREE(dir_hnd);
4968         return ret;
4969 }
4970
4971 /****************************************************************************
4972  The internals of the rmdir code - called elsewhere.
4973 ****************************************************************************/
4974
4975 NTSTATUS rmdir_internals(TALLOC_CTX *ctx,
4976                         connection_struct *conn,
4977                         const char *directory)
4978 {
4979         int ret;
4980         SMB_STRUCT_STAT st;
4981
4982         /* Might be a symlink. */
4983         if(SMB_VFS_LSTAT(conn, directory, &st) != 0) {
4984                 return map_nt_error_from_unix(errno);
4985         }
4986
4987         if (S_ISLNK(st.st_mode)) {
4988                 /* Is what it points to a directory ? */
4989                 if(SMB_VFS_STAT(conn, directory, &st) != 0) {
4990                         return map_nt_error_from_unix(errno);
4991                 }
4992                 if (!(S_ISDIR(st.st_mode))) {
4993                         return NT_STATUS_NOT_A_DIRECTORY;
4994                 }
4995                 ret = SMB_VFS_UNLINK(conn,directory);
4996         } else {
4997                 ret = SMB_VFS_RMDIR(conn,directory);
4998         }
4999         if (ret == 0) {
5000                 notify_fname(conn, NOTIFY_ACTION_REMOVED,
5001                              FILE_NOTIFY_CHANGE_DIR_NAME,
5002                              directory);
5003                 return NT_STATUS_OK;
5004         }
5005
5006         if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
5007                 /*
5008                  * Check to see if the only thing in this directory are
5009                  * vetoed files/directories. If so then delete them and
5010                  * retry. If we fail to delete any of them (and we *don't*
5011                  * do a recursive delete) then fail the rmdir.
5012                  */
5013                 const char *dname;
5014                 long dirpos = 0;
5015                 struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
5016                                                   directory, NULL, 0);
5017
5018                 if(dir_hnd == NULL) {
5019                         errno = ENOTEMPTY;
5020                         goto err;
5021                 }
5022
5023                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5024                         if((strcmp(dname, ".") == 0) || (strcmp(dname, "..")==0))
5025                                 continue;
5026                         if (!is_visible_file(conn, directory, dname, &st, False))
5027                                 continue;
5028                         if(!IS_VETO_PATH(conn, dname)) {
5029                                 TALLOC_FREE(dir_hnd);
5030                                 errno = ENOTEMPTY;
5031                                 goto err;
5032                         }
5033                 }
5034
5035                 /* We only have veto files/directories. Recursive delete. */
5036
5037                 RewindDir(dir_hnd,&dirpos);
5038                 while ((dname = ReadDirName(dir_hnd,&dirpos))) {
5039                         char *fullname = NULL;
5040
5041                         if (ISDOT(dname) || ISDOTDOT(dname)) {
5042                                 continue;
5043                         }
5044                         if (!is_visible_file(conn, directory, dname, &st, False)) {
5045                                 continue;
5046                         }
5047
5048                         fullname = talloc_asprintf(ctx,
5049                                         "%s/%s",
5050                                         directory,
5051                                         dname);
5052
5053                         if(!fullname) {
5054                                 errno = ENOMEM;
5055                                 break;
5056                         }
5057
5058                         if(SMB_VFS_LSTAT(conn,fullname, &st) != 0) {
5059                                 break;
5060                         }
5061                         if(st.st_mode & S_IFDIR) {
5062                                 if(lp_recursive_veto_delete(SNUM(conn))) {
5063                                         if(!recursive_rmdir(ctx, conn, fullname))
5064                                                 break;
5065                                 }
5066                                 if(SMB_VFS_RMDIR(conn,fullname) != 0) {
5067                                         break;
5068                                 }
5069                         } else if(SMB_VFS_UNLINK(conn,fullname) != 0) {
5070                                 break;
5071                         }
5072                         TALLOC_FREE(fullname);
5073                 }
5074                 TALLOC_FREE(dir_hnd);
5075                 /* Retry the rmdir */
5076                 ret = SMB_VFS_RMDIR(conn,directory);
5077         }
5078
5079   err:
5080
5081         if (ret != 0) {
5082                 DEBUG(3,("rmdir_internals: couldn't remove directory %s : "
5083                          "%s\n", directory,strerror(errno)));
5084                 return map_nt_error_from_unix(errno);
5085         }
5086
5087         notify_fname(conn, NOTIFY_ACTION_REMOVED,
5088                      FILE_NOTIFY_CHANGE_DIR_NAME,
5089                      directory);
5090
5091         return NT_STATUS_OK;
5092 }
5093
5094 /****************************************************************************
5095  Reply to a rmdir.
5096 ****************************************************************************/
5097
5098 void reply_rmdir(struct smb_request *req)
5099 {
5100         connection_struct *conn = req->conn;
5101         char *directory = NULL;
5102         SMB_STRUCT_STAT sbuf;
5103         NTSTATUS status;
5104         TALLOC_CTX *ctx = talloc_tos();
5105
5106         START_PROFILE(SMBrmdir);
5107
5108         srvstr_get_path(ctx, (char *)req->inbuf, req->flags2, &directory,
5109                         smb_buf(req->inbuf) + 1, 0,
5110                         STR_TERMINATE, &status);
5111         if (!NT_STATUS_IS_OK(status)) {
5112                 reply_nterror(req, status);
5113                 END_PROFILE(SMBrmdir);
5114                 return;
5115         }
5116
5117         status = resolve_dfspath(ctx, conn,
5118                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5119                                  directory,
5120                                  &directory);
5121         if (!NT_STATUS_IS_OK(status)) {
5122                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5123                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5124                                         ERRSRV, ERRbadpath);
5125                         END_PROFILE(SMBrmdir);
5126                         return;
5127                 }
5128                 reply_nterror(req, status);
5129                 END_PROFILE(SMBrmdir);
5130                 return;
5131         }
5132
5133         status = unix_convert(ctx, conn, directory, False, &directory,
5134                         NULL, &sbuf);
5135         if (!NT_STATUS_IS_OK(status)) {
5136                 reply_nterror(req, status);
5137                 END_PROFILE(SMBrmdir);
5138                 return;
5139         }
5140
5141         status = check_name(conn, directory);
5142         if (!NT_STATUS_IS_OK(status)) {
5143                 reply_nterror(req, status);
5144                 END_PROFILE(SMBrmdir);
5145                 return;
5146         }
5147
5148         dptr_closepath(directory, req->smbpid);
5149         status = rmdir_internals(ctx, conn, directory);
5150         if (!NT_STATUS_IS_OK(status)) {
5151                 reply_nterror(req, status);
5152                 END_PROFILE(SMBrmdir);
5153                 return;
5154         }
5155
5156         reply_outbuf(req, 0, 0);
5157
5158         DEBUG( 3, ( "rmdir %s\n", directory ) );
5159
5160         END_PROFILE(SMBrmdir);
5161         return;
5162 }
5163
5164 /*******************************************************************
5165  Resolve wildcards in a filename rename.
5166 ********************************************************************/
5167
5168 static bool resolve_wildcards(TALLOC_CTX *ctx,
5169                                 const char *name1,
5170                                 const char *name2,
5171                                 char **pp_newname)
5172 {
5173         char *name2_copy = NULL;
5174         char *root1 = NULL;
5175         char *root2 = NULL;
5176         char *ext1 = NULL;
5177         char *ext2 = NULL;
5178         char *p,*p2, *pname1, *pname2;
5179
5180         name2_copy = talloc_strdup(ctx, name2);
5181         if (!name2_copy) {
5182                 return False;
5183         }
5184
5185         pname1 = strrchr_m(name1,'/');
5186         pname2 = strrchr_m(name2_copy,'/');
5187
5188         if (!pname1 || !pname2) {
5189                 return False;
5190         }
5191
5192         /* Truncate the copy of name2 at the last '/' */
5193         *pname2 = '\0';
5194
5195         /* Now go past the '/' */
5196         pname1++;
5197         pname2++;
5198
5199         root1 = talloc_strdup(ctx, pname1);
5200         root2 = talloc_strdup(ctx, pname2);
5201
5202         if (!root1 || !root2) {
5203                 return False;
5204         }
5205
5206         p = strrchr_m(root1,'.');
5207         if (p) {
5208                 *p = 0;
5209                 ext1 = talloc_strdup(ctx, p+1);
5210         } else {
5211                 ext1 = talloc_strdup(ctx, "");
5212         }
5213         p = strrchr_m(root2,'.');
5214         if (p) {
5215                 *p = 0;
5216                 ext2 = talloc_strdup(ctx, p+1);
5217         } else {
5218                 ext2 = talloc_strdup(ctx, "");
5219         }
5220
5221         if (!ext1 || !ext2) {
5222                 return False;
5223         }
5224
5225         p = root1;
5226         p2 = root2;
5227         while (*p2) {
5228                 if (*p2 == '?') {
5229                         /* Hmmm. Should this be mb-aware ? */
5230                         *p2 = *p;
5231                         p2++;
5232                 } else if (*p2 == '*') {
5233                         *p2 = '\0';
5234                         root2 = talloc_asprintf(ctx, "%s%s",
5235                                                 root2,
5236                                                 p);
5237                         if (!root2) {
5238                                 return False;
5239                         }
5240                         break;
5241                 } else {
5242                         p2++;
5243                 }
5244                 if (*p) {
5245                         p++;
5246                 }
5247         }
5248
5249         p = ext1;
5250         p2 = ext2;
5251         while (*p2) {
5252                 if (*p2 == '?') {
5253                         /* Hmmm. Should this be mb-aware ? */
5254                         *p2 = *p;
5255                         p2++;
5256                 } else if (*p2 == '*') {
5257                         *p2 = '\0';
5258                         ext2 = talloc_asprintf(ctx, "%s%s",
5259                                                 ext2,
5260                                                 p);
5261                         if (!ext2) {
5262                                 return False;
5263                         }
5264                         break;
5265                 } else {
5266                         p2++;
5267                 }
5268                 if (*p) {
5269                         p++;
5270                 }
5271         }
5272
5273         if (*ext2) {
5274                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5275                                 name2_copy,
5276                                 root2,
5277                                 ext2);
5278         } else {
5279                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
5280                                 name2_copy,
5281                                 root2);
5282         }
5283
5284         if (!*pp_newname) {
5285                 return False;
5286         }
5287
5288         return True;
5289 }
5290
5291 /****************************************************************************
5292  Ensure open files have their names updated. Updated to notify other smbd's
5293  asynchronously.
5294 ****************************************************************************/
5295
5296 static void rename_open_files(connection_struct *conn,
5297                               struct share_mode_lock *lck,
5298                               const char *newname)
5299 {
5300         files_struct *fsp;
5301         bool did_rename = False;
5302
5303         for(fsp = file_find_di_first(lck->id); fsp;
5304             fsp = file_find_di_next(fsp)) {
5305                 /* fsp_name is a relative path under the fsp. To change this for other
5306                    sharepaths we need to manipulate relative paths. */
5307                 /* TODO - create the absolute path and manipulate the newname
5308                    relative to the sharepath. */
5309                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5310                         continue;
5311                 }
5312                 DEBUG(10,("rename_open_files: renaming file fnum %d (file_id %s) from %s -> %s\n",
5313                           fsp->fnum, file_id_string_tos(&fsp->file_id),
5314                         fsp->fsp_name, newname ));
5315                 string_set(&fsp->fsp_name, newname);
5316                 did_rename = True;
5317         }
5318
5319         if (!did_rename) {
5320                 DEBUG(10,("rename_open_files: no open files on file_id %s for %s\n",
5321                           file_id_string_tos(&lck->id), newname ));
5322         }
5323
5324         /* Send messages to all smbd's (not ourself) that the name has changed. */
5325         rename_share_filename(smbd_messaging_context(), lck, conn->connectpath,
5326                               newname);
5327 }
5328
5329 /****************************************************************************
5330  We need to check if the source path is a parent directory of the destination
5331  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5332  refuse the rename with a sharing violation. Under UNIX the above call can
5333  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
5334  probably need to check that the client is a Windows one before disallowing
5335  this as a UNIX client (one with UNIX extensions) can know the source is a
5336  symlink and make this decision intelligently. Found by an excellent bug
5337  report from <AndyLiebman@aol.com>.
5338 ****************************************************************************/
5339
5340 static bool rename_path_prefix_equal(const char *src, const char *dest)
5341 {
5342         const char *psrc = src;
5343         const char *pdst = dest;
5344         size_t slen;
5345
5346         if (psrc[0] == '.' && psrc[1] == '/') {
5347                 psrc += 2;
5348         }
5349         if (pdst[0] == '.' && pdst[1] == '/') {
5350                 pdst += 2;
5351         }
5352         if ((slen = strlen(psrc)) > strlen(pdst)) {
5353                 return False;
5354         }
5355         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5356 }
5357
5358 /*
5359  * Do the notify calls from a rename
5360  */
5361
5362 static void notify_rename(connection_struct *conn, bool is_dir,
5363                           const char *oldpath, const char *newpath)
5364 {
5365         char *olddir, *newdir;
5366         const char *oldname, *newname;
5367         uint32 mask;
5368
5369         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5370                 : FILE_NOTIFY_CHANGE_FILE_NAME;
5371
5372         if (!parent_dirname_talloc(NULL, oldpath, &olddir, &oldname)
5373             || !parent_dirname_talloc(NULL, newpath, &newdir, &newname)) {
5374                 TALLOC_FREE(olddir);
5375                 return;
5376         }
5377
5378         if (strcmp(olddir, newdir) == 0) {
5379                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask, oldpath);
5380                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask, newpath);
5381         }
5382         else {
5383                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask, oldpath);
5384                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask, newpath);
5385         }
5386         TALLOC_FREE(olddir);
5387         TALLOC_FREE(newdir);
5388
5389         /* this is a strange one. w2k3 gives an additional event for
5390            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5391            files, but not directories */
5392         if (!is_dir) {
5393                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5394                              FILE_NOTIFY_CHANGE_ATTRIBUTES
5395                              |FILE_NOTIFY_CHANGE_CREATION,
5396                              newpath);
5397         }
5398 }
5399
5400 /****************************************************************************
5401  Rename an open file - given an fsp.
5402 ****************************************************************************/
5403
5404 NTSTATUS rename_internals_fsp(connection_struct *conn,
5405                         files_struct *fsp,
5406                         char *newname,
5407                         const char *newname_last_component,
5408                         uint32 attrs,
5409                         bool replace_if_exists)
5410 {
5411         TALLOC_CTX *ctx = talloc_tos();
5412         SMB_STRUCT_STAT sbuf, sbuf1;
5413         NTSTATUS status = NT_STATUS_OK;
5414         struct share_mode_lock *lck = NULL;
5415         bool dst_exists;
5416
5417         ZERO_STRUCT(sbuf);
5418
5419         status = check_name(conn, newname);
5420         if (!NT_STATUS_IS_OK(status)) {
5421                 return status;
5422         }
5423
5424         /* Ensure newname contains a '/' */
5425         if(strrchr_m(newname,'/') == 0) {
5426                 newname = talloc_asprintf(ctx,
5427                                         "./%s",
5428                                         newname);
5429                 if (!newname) {
5430                         return NT_STATUS_NO_MEMORY;
5431                 }
5432         }
5433
5434         /*
5435          * Check for special case with case preserving and not
5436          * case sensitive. If the old last component differs from the original
5437          * last component only by case, then we should allow
5438          * the rename (user is trying to change the case of the
5439          * filename).
5440          */
5441
5442         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
5443                         strequal(newname, fsp->fsp_name)) {
5444                 char *p;
5445                 char *newname_modified_last_component = NULL;
5446
5447                 /*
5448                  * Get the last component of the modified name.
5449                  * Note that we guarantee that newname contains a '/'
5450                  * character above.
5451                  */
5452                 p = strrchr_m(newname,'/');
5453                 newname_modified_last_component = talloc_strdup(ctx,
5454                                                 p+1);
5455                 if (!newname_modified_last_component) {
5456                         return NT_STATUS_NO_MEMORY;
5457                 }
5458
5459                 if(strcsequal(newname_modified_last_component,
5460                               newname_last_component) == False) {
5461                         /*
5462                          * Replace the modified last component with
5463                          * the original.
5464                          */
5465                         *p = '\0'; /* Truncate at the '/' */
5466                         newname = talloc_asprintf(ctx,
5467                                         "%s/%s",
5468                                         newname,
5469                                         newname_last_component);
5470                 }
5471         }
5472
5473         /*
5474          * If the src and dest names are identical - including case,
5475          * don't do the rename, just return success.
5476          */
5477
5478         if (strcsequal(fsp->fsp_name, newname)) {
5479                 DEBUG(3,("rename_internals_fsp: identical names in rename %s - returning success\n",
5480                         newname));
5481                 return NT_STATUS_OK;
5482         }
5483
5484         /*
5485          * Have vfs_object_exist also fill sbuf1
5486          */
5487         dst_exists = vfs_object_exist(conn, newname, &sbuf1);
5488
5489         if(!replace_if_exists && dst_exists) {
5490                 DEBUG(3,("rename_internals_fsp: dest exists doing rename %s -> %s\n",
5491                         fsp->fsp_name,newname));
5492                 return NT_STATUS_OBJECT_NAME_COLLISION;
5493         }
5494
5495         if (dst_exists) {
5496                 struct file_id fileid = vfs_file_id_from_sbuf(conn, &sbuf1);
5497                 files_struct *dst_fsp = file_find_di_first(fileid);
5498                 if (dst_fsp) {
5499                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
5500                         return NT_STATUS_ACCESS_DENIED;
5501                 }
5502         }
5503
5504         /* Ensure we have a valid stat struct for the source. */
5505         if (fsp->fh->fd != -1) {
5506                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
5507                         return map_nt_error_from_unix(errno);
5508                 }
5509         } else {
5510                 if (SMB_VFS_STAT(conn,fsp->fsp_name,&sbuf) == -1) {
5511                         return map_nt_error_from_unix(errno);
5512                 }
5513         }
5514
5515         status = can_rename(conn, fsp, attrs, &sbuf);
5516
5517         if (!NT_STATUS_IS_OK(status)) {
5518                 DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5519                         nt_errstr(status), fsp->fsp_name,newname));
5520                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
5521                         status = NT_STATUS_ACCESS_DENIED;
5522                 return status;
5523         }
5524
5525         if (rename_path_prefix_equal(fsp->fsp_name, newname)) {
5526                 return NT_STATUS_ACCESS_DENIED;
5527         }
5528
5529         lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
5530                                   NULL);
5531
5532         /*
5533          * We have the file open ourselves, so not being able to get the
5534          * corresponding share mode lock is a fatal error.
5535          */
5536
5537         SMB_ASSERT(lck != NULL);
5538
5539         if(SMB_VFS_RENAME(conn,fsp->fsp_name, newname) == 0) {
5540                 uint32 create_options = fsp->fh->private_options;
5541
5542                 DEBUG(3,("rename_internals_fsp: succeeded doing rename on %s -> %s\n",
5543                         fsp->fsp_name,newname));
5544
5545                 rename_open_files(conn, lck, newname);
5546
5547                 notify_rename(conn, fsp->is_directory, fsp->fsp_name, newname);
5548
5549                 /*
5550                  * A rename acts as a new file create w.r.t. allowing an initial delete
5551                  * on close, probably because in Windows there is a new handle to the
5552                  * new file. If initial delete on close was requested but not
5553                  * originally set, we need to set it here. This is probably not 100% correct,
5554                  * but will work for the CIFSFS client which in non-posix mode
5555                  * depends on these semantics. JRA.
5556                  */
5557
5558                 set_allow_initial_delete_on_close(lck, fsp, True);
5559
5560                 if (create_options & FILE_DELETE_ON_CLOSE) {
5561                         status = can_set_delete_on_close(fsp, True, 0);
5562
5563                         if (NT_STATUS_IS_OK(status)) {
5564                                 /* Note that here we set the *inital* delete on close flag,
5565                                  * not the regular one. The magic gets handled in close. */
5566                                 fsp->initial_delete_on_close = True;
5567                         }
5568                 }
5569                 TALLOC_FREE(lck);
5570                 return NT_STATUS_OK;
5571         }
5572
5573         TALLOC_FREE(lck);
5574
5575         if (errno == ENOTDIR || errno == EISDIR) {
5576                 status = NT_STATUS_OBJECT_NAME_COLLISION;
5577         } else {
5578                 status = map_nt_error_from_unix(errno);
5579         }
5580
5581         DEBUG(3,("rename_internals_fsp: Error %s rename %s -> %s\n",
5582                 nt_errstr(status), fsp->fsp_name,newname));
5583
5584         return status;
5585 }
5586
5587 /****************************************************************************
5588  The guts of the rename command, split out so it may be called by the NT SMB
5589  code.
5590 ****************************************************************************/
5591
5592 NTSTATUS rename_internals(TALLOC_CTX *ctx,
5593                         connection_struct *conn,
5594                         struct smb_request *req,
5595                         const char *name_in,
5596                         const char *newname_in,
5597                         uint32 attrs,
5598                         bool replace_if_exists,
5599                         bool src_has_wild,
5600                         bool dest_has_wild,
5601                         uint32_t access_mask)
5602 {
5603         char *directory = NULL;
5604         char *mask = NULL;
5605         char *last_component_src = NULL;
5606         char *last_component_dest = NULL;
5607         char *name = NULL;
5608         char *newname = NULL;
5609         char *p;
5610         int count=0;
5611         NTSTATUS status = NT_STATUS_OK;
5612         SMB_STRUCT_STAT sbuf1, sbuf2;
5613         struct smb_Dir *dir_hnd = NULL;
5614         const char *dname;
5615         long offset = 0;
5616
5617         ZERO_STRUCT(sbuf1);
5618         ZERO_STRUCT(sbuf2);
5619
5620         status = unix_convert(ctx, conn, name_in, src_has_wild, &name,
5621                         &last_component_src, &sbuf1);
5622         if (!NT_STATUS_IS_OK(status)) {
5623                 return status;
5624         }
5625
5626         status = unix_convert(ctx, conn, newname_in, dest_has_wild, &newname,
5627                         &last_component_dest, &sbuf2);
5628         if (!NT_STATUS_IS_OK(status)) {
5629                 return status;
5630         }
5631
5632         /*
5633          * Split the old name into directory and last component
5634          * strings. Note that unix_convert may have stripped off a
5635          * leading ./ from both name and newname if the rename is
5636          * at the root of the share. We need to make sure either both
5637          * name and newname contain a / character or neither of them do
5638          * as this is checked in resolve_wildcards().
5639          */
5640
5641         p = strrchr_m(name,'/');
5642         if (!p) {
5643                 directory = talloc_strdup(ctx, ".");
5644                 if (!directory) {
5645                         return NT_STATUS_NO_MEMORY;
5646                 }
5647                 mask = name;
5648         } else {
5649                 *p = 0;
5650                 directory = talloc_strdup(ctx, name);
5651                 if (!directory) {
5652                         return NT_STATUS_NO_MEMORY;
5653                 }
5654                 mask = p+1;
5655                 *p = '/'; /* Replace needed for exceptional test below. */
5656         }
5657
5658         /*
5659          * We should only check the mangled cache
5660          * here if unix_convert failed. This means
5661          * that the path in 'mask' doesn't exist
5662          * on the file system and so we need to look
5663          * for a possible mangle. This patch from
5664          * Tine Smukavec <valentin.smukavec@hermes.si>.
5665          */
5666
5667         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
5668                 char *new_mask = NULL;
5669                 mangle_lookup_name_from_8_3(ctx,
5670                                         mask,
5671                                         &new_mask,
5672                                         conn->params );
5673                 if (new_mask) {
5674                         mask = new_mask;
5675                 }
5676         }
5677
5678         if (!src_has_wild) {
5679                 files_struct *fsp;
5680
5681                 /*
5682                  * No wildcards - just process the one file.
5683                  */
5684                 bool is_short_name = mangle_is_8_3(name, True, conn->params);
5685
5686                 /* Add a terminating '/' to the directory name. */
5687                 directory = talloc_asprintf_append(directory,
5688                                 "/%s",
5689                                 mask);
5690                 if (!directory) {
5691                         return NT_STATUS_NO_MEMORY;
5692                 }
5693
5694                 /* Ensure newname contains a '/' also */
5695                 if(strrchr_m(newname,'/') == 0) {
5696                         newname = talloc_asprintf(ctx,
5697                                                 "./%s",
5698                                                 newname);
5699                         if (!newname) {
5700                                 return NT_STATUS_NO_MEMORY;
5701                         }
5702                 }
5703
5704                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
5705                           "case_preserve = %d, short case preserve = %d, "
5706                           "directory = %s, newname = %s, "
5707                           "last_component_dest = %s, is_8_3 = %d\n",
5708                           conn->case_sensitive, conn->case_preserve,
5709                           conn->short_case_preserve, directory,
5710                           newname, last_component_dest, is_short_name));
5711
5712                 /* The dest name still may have wildcards. */
5713                 if (dest_has_wild) {
5714                         char *mod_newname = NULL;
5715                         if (!resolve_wildcards(ctx,
5716                                         directory,newname,&mod_newname)) {
5717                                 DEBUG(6, ("rename_internals: resolve_wildcards "
5718                                         "%s %s failed\n",
5719                                         directory,
5720                                         newname));
5721                                 return NT_STATUS_NO_MEMORY;
5722                         }
5723                         newname = mod_newname;
5724                 }
5725
5726                 ZERO_STRUCT(sbuf1);
5727                 SMB_VFS_STAT(conn, directory, &sbuf1);
5728
5729                 status = S_ISDIR(sbuf1.st_mode) ?
5730                         open_directory(conn, req, directory, &sbuf1,
5731                                        access_mask,
5732                                        FILE_SHARE_READ|FILE_SHARE_WRITE,
5733                                        FILE_OPEN, 0, 0, NULL,
5734                                        &fsp)
5735                         : open_file_ntcreate(conn, req, directory, &sbuf1,
5736                                              access_mask,
5737                                              FILE_SHARE_READ|FILE_SHARE_WRITE,
5738                                              FILE_OPEN, 0, 0, 0, NULL,
5739                                              &fsp);
5740
5741                 if (!NT_STATUS_IS_OK(status)) {
5742                         DEBUG(3, ("Could not open rename source %s: %s\n",
5743                                   directory, nt_errstr(status)));
5744                         return status;
5745                 }
5746
5747                 status = rename_internals_fsp(conn, fsp, newname,
5748                                               last_component_dest,
5749                                               attrs, replace_if_exists);
5750
5751                 close_file(fsp, NORMAL_CLOSE);
5752
5753                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
5754                           nt_errstr(status), directory,newname));
5755
5756                 return status;
5757         }
5758
5759         /*
5760          * Wildcards - process each file that matches.
5761          */
5762         if (strequal(mask,"????????.???")) {
5763                 mask[0] = '*';
5764                 mask[1] = '\0';
5765         }
5766
5767         status = check_name(conn, directory);
5768         if (!NT_STATUS_IS_OK(status)) {
5769                 return status;
5770         }
5771
5772         dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, attrs);
5773         if (dir_hnd == NULL) {
5774                 return map_nt_error_from_unix(errno);
5775         }
5776
5777         status = NT_STATUS_NO_SUCH_FILE;
5778         /*
5779          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
5780          * - gentest fix. JRA
5781          */
5782
5783         while ((dname = ReadDirName(dir_hnd, &offset))) {
5784                 files_struct *fsp = NULL;
5785                 char *fname = NULL;
5786                 char *destname = NULL;
5787                 bool sysdir_entry = False;
5788
5789                 /* Quick check for "." and ".." */
5790                 if (ISDOT(dname) || ISDOTDOT(dname)) {
5791                         if (attrs & aDIR) {
5792                                 sysdir_entry = True;
5793                         } else {
5794                                 continue;
5795                         }
5796                 }
5797
5798                 if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
5799                         continue;
5800                 }
5801
5802                 if(!mask_match(dname, mask, conn->case_sensitive)) {
5803                         continue;
5804                 }
5805
5806                 if (sysdir_entry) {
5807                         status = NT_STATUS_OBJECT_NAME_INVALID;
5808                         break;
5809                 }
5810
5811                 fname = talloc_asprintf(ctx,
5812                                 "%s/%s",
5813                                 directory,
5814                                 dname);
5815                 if (!fname) {
5816                         return NT_STATUS_NO_MEMORY;
5817                 }
5818
5819                 if (!resolve_wildcards(ctx,
5820                                 fname,newname,&destname)) {
5821                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
5822                                   fname, destname));
5823                         TALLOC_FREE(fname);
5824                         continue;
5825                 }
5826                 if (!destname) {
5827                         return NT_STATUS_NO_MEMORY;
5828                 }
5829
5830                 ZERO_STRUCT(sbuf1);
5831                 SMB_VFS_STAT(conn, fname, &sbuf1);
5832
5833                 status = S_ISDIR(sbuf1.st_mode) ?
5834                         open_directory(conn, req, fname, &sbuf1,
5835                                        access_mask,
5836                                        FILE_SHARE_READ|FILE_SHARE_WRITE,
5837                                        FILE_OPEN, 0, 0, NULL,
5838                                        &fsp)
5839                         : open_file_ntcreate(conn, req, fname, &sbuf1,
5840                                              access_mask,
5841                                              FILE_SHARE_READ|FILE_SHARE_WRITE,
5842                                              FILE_OPEN, 0, 0, 0, NULL,
5843                                              &fsp);
5844
5845                 if (!NT_STATUS_IS_OK(status)) {
5846                         DEBUG(3,("rename_internals: open_file_ntcreate "
5847                                  "returned %s rename %s -> %s\n",
5848                                  nt_errstr(status), directory, newname));
5849                         break;
5850                 }
5851
5852                 status = rename_internals_fsp(conn, fsp, destname, dname,
5853                                               attrs, replace_if_exists);
5854
5855                 close_file(fsp, NORMAL_CLOSE);
5856
5857                 if (!NT_STATUS_IS_OK(status)) {
5858                         DEBUG(3, ("rename_internals_fsp returned %s for "
5859                                   "rename %s -> %s\n", nt_errstr(status),
5860                                   directory, newname));
5861                         break;
5862                 }
5863
5864                 count++;
5865
5866                 DEBUG(3,("rename_internals: doing rename on %s -> "
5867                          "%s\n",fname,destname));
5868
5869                 TALLOC_FREE(fname);
5870                 TALLOC_FREE(destname);
5871         }
5872         TALLOC_FREE(dir_hnd);
5873
5874         if (count == 0 && NT_STATUS_IS_OK(status)) {
5875                 status = map_nt_error_from_unix(errno);
5876         }
5877
5878         return status;
5879 }
5880
5881 /****************************************************************************
5882  Reply to a mv.
5883 ****************************************************************************/
5884
5885 void reply_mv(struct smb_request *req)
5886 {
5887         connection_struct *conn = req->conn;
5888         char *name = NULL;
5889         char *newname = NULL;
5890         char *p;
5891         uint32 attrs;
5892         NTSTATUS status;
5893         bool src_has_wcard = False;
5894         bool dest_has_wcard = False;
5895         TALLOC_CTX *ctx = talloc_tos();
5896
5897         START_PROFILE(SMBmv);
5898
5899         if (req->wct < 1) {
5900                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5901                 END_PROFILE(SMBmv);
5902                 return;
5903         }
5904
5905         attrs = SVAL(req->inbuf,smb_vwv0);
5906
5907         p = smb_buf(req->inbuf) + 1;
5908         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
5909                                    0, STR_TERMINATE, &status,
5910                                    &src_has_wcard);
5911         if (!NT_STATUS_IS_OK(status)) {
5912                 reply_nterror(req, status);
5913                 END_PROFILE(SMBmv);
5914                 return;
5915         }
5916         p++;
5917         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
5918                                    0, STR_TERMINATE, &status,
5919                                    &dest_has_wcard);
5920         if (!NT_STATUS_IS_OK(status)) {
5921                 reply_nterror(req, status);
5922                 END_PROFILE(SMBmv);
5923                 return;
5924         }
5925
5926         status = resolve_dfspath_wcard(ctx, conn,
5927                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
5928                                        name,
5929                                        &name,
5930                                        &src_has_wcard);
5931         if (!NT_STATUS_IS_OK(status)) {
5932                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5933                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5934                                         ERRSRV, ERRbadpath);
5935                         END_PROFILE(SMBmv);
5936                         return;
5937                 }
5938                 reply_nterror(req, status);
5939                 END_PROFILE(SMBmv);
5940                 return;
5941         }
5942
5943         status = resolve_dfspath_wcard(ctx, conn,
5944                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
5945                                        newname,
5946                                        &newname,
5947                                        &dest_has_wcard);
5948         if (!NT_STATUS_IS_OK(status)) {
5949                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5950                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5951                                         ERRSRV, ERRbadpath);
5952                         END_PROFILE(SMBmv);
5953                         return;
5954                 }
5955                 reply_nterror(req, status);
5956                 END_PROFILE(SMBmv);
5957                 return;
5958         }
5959
5960         DEBUG(3,("reply_mv : %s -> %s\n",name,newname));
5961
5962         status = rename_internals(ctx, conn, req, name, newname, attrs, False,
5963                                   src_has_wcard, dest_has_wcard, DELETE_ACCESS);
5964         if (!NT_STATUS_IS_OK(status)) {
5965                 if (open_was_deferred(req->mid)) {
5966                         /* We have re-scheduled this call. */
5967                         END_PROFILE(SMBmv);
5968                         return;
5969                 }
5970                 reply_nterror(req, status);
5971                 END_PROFILE(SMBmv);
5972                 return;
5973         }
5974
5975         reply_outbuf(req, 0, 0);
5976
5977         END_PROFILE(SMBmv);
5978         return;
5979 }
5980
5981 /*******************************************************************
5982  Copy a file as part of a reply_copy.
5983 ******************************************************************/
5984
5985 /*
5986  * TODO: check error codes on all callers
5987  */
5988
5989 NTSTATUS copy_file(TALLOC_CTX *ctx,
5990                         connection_struct *conn,
5991                         const char *src,
5992                         const char *dest1,
5993                         int ofun,
5994                         int count,
5995                         bool target_is_directory)
5996 {
5997         SMB_STRUCT_STAT src_sbuf, sbuf2;
5998         SMB_OFF_T ret=-1;
5999         files_struct *fsp1,*fsp2;
6000         char *dest = NULL;
6001         uint32 dosattrs;
6002         uint32 new_create_disposition;
6003         NTSTATUS status;
6004
6005         dest = talloc_strdup(ctx, dest1);
6006         if (!dest) {
6007                 return NT_STATUS_NO_MEMORY;
6008         }
6009         if (target_is_directory) {
6010                 const char *p = strrchr_m(src,'/');
6011                 if (p) {
6012                         p++;
6013                 } else {
6014                         p = src;
6015                 }
6016                 dest = talloc_asprintf_append(dest,
6017                                 "/%s",
6018                                 p);
6019                 if (!dest) {
6020                         return NT_STATUS_NO_MEMORY;
6021                 }
6022         }
6023
6024         if (!vfs_file_exist(conn,src,&src_sbuf)) {
6025                 TALLOC_FREE(dest);
6026                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
6027         }
6028
6029         if (!target_is_directory && count) {
6030                 new_create_disposition = FILE_OPEN;
6031         } else {
6032                 if (!map_open_params_to_ntcreate(dest1,0,ofun,
6033                                 NULL, NULL, &new_create_disposition, NULL)) {
6034                         TALLOC_FREE(dest);
6035                         return NT_STATUS_INVALID_PARAMETER;
6036                 }
6037         }
6038
6039         status = open_file_ntcreate(conn, NULL, src, &src_sbuf,
6040                         FILE_GENERIC_READ,
6041                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6042                         FILE_OPEN,
6043                         0,
6044                         FILE_ATTRIBUTE_NORMAL,
6045                         INTERNAL_OPEN_ONLY,
6046                         NULL, &fsp1);
6047
6048         if (!NT_STATUS_IS_OK(status)) {
6049                 TALLOC_FREE(dest);
6050                 return status;
6051         }
6052
6053         dosattrs = dos_mode(conn, src, &src_sbuf);
6054         if (SMB_VFS_STAT(conn,dest,&sbuf2) == -1) {
6055                 ZERO_STRUCTP(&sbuf2);
6056         }
6057
6058         status = open_file_ntcreate(conn, NULL, dest, &sbuf2,
6059                         FILE_GENERIC_WRITE,
6060                         FILE_SHARE_READ|FILE_SHARE_WRITE,
6061                         new_create_disposition,
6062                         0,
6063                         dosattrs,
6064                         INTERNAL_OPEN_ONLY,
6065                         NULL, &fsp2);
6066
6067         TALLOC_FREE(dest);
6068
6069         if (!NT_STATUS_IS_OK(status)) {
6070                 close_file(fsp1,ERROR_CLOSE);
6071                 return status;
6072         }
6073
6074         if ((ofun&3) == 1) {
6075                 if(SMB_VFS_LSEEK(fsp2,0,SEEK_END) == -1) {
6076                         DEBUG(0,("copy_file: error - vfs lseek returned error %s\n", strerror(errno) ));
6077                         /*
6078                          * Stop the copy from occurring.
6079                          */
6080                         ret = -1;
6081                         src_sbuf.st_size = 0;
6082                 }
6083         }
6084
6085         if (src_sbuf.st_size) {
6086                 ret = vfs_transfer_file(fsp1, fsp2, src_sbuf.st_size);
6087         }
6088
6089         close_file(fsp1,NORMAL_CLOSE);
6090
6091         /* Ensure the modtime is set correctly on the destination file. */
6092         set_close_write_time(fsp2, get_mtimespec(&src_sbuf));
6093
6094         /*
6095          * As we are opening fsp1 read-only we only expect
6096          * an error on close on fsp2 if we are out of space.
6097          * Thus we don't look at the error return from the
6098          * close of fsp1.
6099          */
6100         status = close_file(fsp2,NORMAL_CLOSE);
6101
6102         if (!NT_STATUS_IS_OK(status)) {
6103                 return status;
6104         }
6105
6106         if (ret != (SMB_OFF_T)src_sbuf.st_size) {
6107                 return NT_STATUS_DISK_FULL;
6108         }
6109
6110         return NT_STATUS_OK;
6111 }
6112
6113 /****************************************************************************
6114  Reply to a file copy.
6115 ****************************************************************************/
6116
6117 void reply_copy(struct smb_request *req)
6118 {
6119         connection_struct *conn = req->conn;
6120         char *name = NULL;
6121         char *newname = NULL;
6122         char *directory = NULL;
6123         char *mask = NULL;
6124         char *p;
6125         int count=0;
6126         int error = ERRnoaccess;
6127         int err = 0;
6128         int tid2;
6129         int ofun;
6130         int flags;
6131         bool target_is_directory=False;
6132         bool source_has_wild = False;
6133         bool dest_has_wild = False;
6134         SMB_STRUCT_STAT sbuf1, sbuf2;
6135         NTSTATUS status;
6136         TALLOC_CTX *ctx = talloc_tos();
6137
6138         START_PROFILE(SMBcopy);
6139
6140         if (req->wct < 3) {
6141                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6142                 END_PROFILE(SMBcopy);
6143                 return;
6144         }
6145
6146         tid2 = SVAL(req->inbuf,smb_vwv0);
6147         ofun = SVAL(req->inbuf,smb_vwv1);
6148         flags = SVAL(req->inbuf,smb_vwv2);
6149
6150         p = smb_buf(req->inbuf);
6151         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &name, p,
6152                                    0, STR_TERMINATE, &status,
6153                                    &source_has_wild);
6154         if (!NT_STATUS_IS_OK(status)) {
6155                 reply_nterror(req, status);
6156                 END_PROFILE(SMBcopy);
6157                 return;
6158         }
6159         p += srvstr_get_path_wcard(ctx, (char *)req->inbuf, req->flags2, &newname, p,
6160                                    0, STR_TERMINATE, &status,
6161                                    &dest_has_wild);
6162         if (!NT_STATUS_IS_OK(status)) {
6163                 reply_nterror(req, status);
6164                 END_PROFILE(SMBcopy);
6165                 return;
6166         }
6167
6168         DEBUG(3,("reply_copy : %s -> %s\n",name,newname));
6169
6170         if (tid2 != conn->cnum) {
6171                 /* can't currently handle inter share copies XXXX */
6172                 DEBUG(3,("Rejecting inter-share copy\n"));
6173                 reply_doserror(req, ERRSRV, ERRinvdevice);
6174                 END_PROFILE(SMBcopy);
6175                 return;
6176         }
6177
6178         status = resolve_dfspath_wcard(ctx, conn,
6179                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6180                                        name,
6181                                        &name,
6182                                        &source_has_wild);
6183         if (!NT_STATUS_IS_OK(status)) {
6184                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6185                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6186                                         ERRSRV, ERRbadpath);
6187                         END_PROFILE(SMBcopy);
6188                         return;
6189                 }
6190                 reply_nterror(req, status);
6191                 END_PROFILE(SMBcopy);
6192                 return;
6193         }
6194
6195         status = resolve_dfspath_wcard(ctx, conn,
6196                                        req->flags2 & FLAGS2_DFS_PATHNAMES,
6197                                        newname,
6198                                        &newname,
6199                                        &dest_has_wild);
6200         if (!NT_STATUS_IS_OK(status)) {
6201                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6202                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6203                                         ERRSRV, ERRbadpath);
6204                         END_PROFILE(SMBcopy);
6205                         return;
6206                 }
6207                 reply_nterror(req, status);
6208                 END_PROFILE(SMBcopy);
6209                 return;
6210         }
6211
6212         status = unix_convert(ctx, conn, name, source_has_wild,
6213                         &name, NULL, &sbuf1);
6214         if (!NT_STATUS_IS_OK(status)) {
6215                 reply_nterror(req, status);
6216                 END_PROFILE(SMBcopy);
6217                 return;
6218         }
6219
6220         status = unix_convert(ctx, conn, newname, dest_has_wild,
6221                         &newname, NULL, &sbuf2);
6222         if (!NT_STATUS_IS_OK(status)) {
6223                 reply_nterror(req, status);
6224                 END_PROFILE(SMBcopy);
6225                 return;
6226         }
6227
6228         target_is_directory = VALID_STAT_OF_DIR(sbuf2);
6229
6230         if ((flags&1) && target_is_directory) {
6231                 reply_doserror(req, ERRDOS, ERRbadfile);
6232                 END_PROFILE(SMBcopy);
6233                 return;
6234         }
6235
6236         if ((flags&2) && !target_is_directory) {
6237                 reply_doserror(req, ERRDOS, ERRbadpath);
6238                 END_PROFILE(SMBcopy);
6239                 return;
6240         }
6241
6242         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(sbuf1)) {
6243                 /* wants a tree copy! XXXX */
6244                 DEBUG(3,("Rejecting tree copy\n"));
6245                 reply_doserror(req, ERRSRV, ERRerror);
6246                 END_PROFILE(SMBcopy);
6247                 return;
6248         }
6249
6250         p = strrchr_m(name,'/');
6251         if (!p) {
6252                 directory = talloc_strdup(ctx, "./");
6253                 if (!directory) {
6254                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6255                         END_PROFILE(SMBcopy);
6256                         return;
6257                 }
6258                 mask = name;
6259         } else {
6260                 *p = 0;
6261                 directory = talloc_strdup(ctx, name);
6262                 if (!directory) {
6263                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6264                         END_PROFILE(SMBcopy);
6265                         return;
6266                 }
6267                 mask = p+1;
6268         }
6269
6270         /*
6271          * We should only check the mangled cache
6272          * here if unix_convert failed. This means
6273          * that the path in 'mask' doesn't exist
6274          * on the file system and so we need to look
6275          * for a possible mangle. This patch from
6276          * Tine Smukavec <valentin.smukavec@hermes.si>.
6277          */
6278
6279         if (!VALID_STAT(sbuf1) && mangle_is_mangled(mask, conn->params)) {
6280                 char *new_mask = NULL;
6281                 mangle_lookup_name_from_8_3(ctx,
6282                                         mask,
6283                                         &new_mask,
6284                                         conn->params );
6285                 if (new_mask) {
6286                         mask = new_mask;
6287                 }
6288         }
6289
6290         if (!source_has_wild) {
6291                 directory = talloc_asprintf_append(directory,
6292                                 "/%s",
6293                                 mask);
6294                 if (dest_has_wild) {
6295                         char *mod_newname = NULL;
6296                         if (!resolve_wildcards(ctx,
6297                                         directory,newname,&mod_newname)) {
6298                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6299                                 END_PROFILE(SMBcopy);
6300                                 return;
6301                         }
6302                         newname = mod_newname;
6303                 }
6304
6305                 status = check_name(conn, directory);
6306                 if (!NT_STATUS_IS_OK(status)) {
6307                         reply_nterror(req, status);
6308                         END_PROFILE(SMBcopy);
6309                         return;
6310                 }
6311
6312                 status = check_name(conn, newname);
6313                 if (!NT_STATUS_IS_OK(status)) {
6314                         reply_nterror(req, status);
6315                         END_PROFILE(SMBcopy);
6316                         return;
6317                 }
6318
6319                 status = copy_file(ctx,conn,directory,newname,ofun,
6320                                 count,target_is_directory);
6321
6322                 if(!NT_STATUS_IS_OK(status)) {
6323                         reply_nterror(req, status);
6324                         END_PROFILE(SMBcopy);
6325                         return;
6326                 } else {
6327                         count++;
6328                 }
6329         } else {
6330                 struct smb_Dir *dir_hnd = NULL;
6331                 const char *dname = NULL;
6332                 long offset = 0;
6333
6334                 if (strequal(mask,"????????.???")) {
6335                         mask[0] = '*';
6336                         mask[1] = '\0';
6337                 }
6338
6339                 status = check_name(conn, directory);
6340                 if (!NT_STATUS_IS_OK(status)) {
6341                         reply_nterror(req, status);
6342                         END_PROFILE(SMBcopy);
6343                         return;
6344                 }
6345
6346                 dir_hnd = OpenDir(talloc_tos(), conn, directory, mask, 0);
6347                 if (dir_hnd == NULL) {
6348                         status = map_nt_error_from_unix(errno);
6349                         reply_nterror(req, status);
6350                         END_PROFILE(SMBcopy);
6351                         return;
6352                 }
6353
6354                 error = ERRbadfile;
6355
6356                 while ((dname = ReadDirName(dir_hnd, &offset))) {
6357                         char *destname = NULL;
6358                         char *fname = NULL;
6359
6360                         if (ISDOT(dname) || ISDOTDOT(dname)) {
6361                                 continue;
6362                         }
6363
6364                         if (!is_visible_file(conn, directory, dname, &sbuf1, False)) {
6365                                 continue;
6366                         }
6367
6368                         if(!mask_match(dname, mask, conn->case_sensitive)) {
6369                                 continue;
6370                         }
6371
6372                         error = ERRnoaccess;
6373                         fname = talloc_asprintf(ctx,
6374                                         "%s/%s",
6375                                         directory,
6376                                         dname);
6377                         if (!fname) {
6378                                 TALLOC_FREE(dir_hnd);
6379                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6380                                 END_PROFILE(SMBcopy);
6381                                 return;
6382                         }
6383
6384                         if (!resolve_wildcards(ctx,
6385                                         fname,newname,&destname)) {
6386                                 continue;
6387                         }
6388                         if (!destname) {
6389                                 TALLOC_FREE(dir_hnd);
6390                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
6391                                 END_PROFILE(SMBcopy);
6392                                 return;
6393                         }
6394
6395                         status = check_name(conn, fname);
6396                         if (!NT_STATUS_IS_OK(status)) {
6397                                 TALLOC_FREE(dir_hnd);
6398                                 reply_nterror(req, status);
6399                                 END_PROFILE(SMBcopy);
6400                                 return;
6401                         }
6402
6403                         status = check_name(conn, destname);
6404                         if (!NT_STATUS_IS_OK(status)) {
6405                                 TALLOC_FREE(dir_hnd);
6406                                 reply_nterror(req, status);
6407                                 END_PROFILE(SMBcopy);
6408                                 return;
6409                         }
6410
6411                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",fname, destname));
6412
6413                         status = copy_file(ctx,conn,fname,destname,ofun,
6414                                         count,target_is_directory);
6415                         if (NT_STATUS_IS_OK(status)) {
6416                                 count++;
6417                         }
6418                         TALLOC_FREE(fname);
6419                         TALLOC_FREE(destname);
6420                 }
6421                 TALLOC_FREE(dir_hnd);
6422         }
6423
6424         if (count == 0) {
6425                 if(err) {
6426                         /* Error on close... */
6427                         errno = err;
6428                         reply_unixerror(req, ERRHRD, ERRgeneral);
6429                         END_PROFILE(SMBcopy);
6430                         return;
6431                 }
6432
6433                 reply_doserror(req, ERRDOS, error);
6434                 END_PROFILE(SMBcopy);
6435                 return;
6436         }
6437
6438         reply_outbuf(req, 1, 0);
6439         SSVAL(req->outbuf,smb_vwv0,count);
6440
6441         END_PROFILE(SMBcopy);
6442         return;
6443 }
6444
6445 #undef DBGC_CLASS
6446 #define DBGC_CLASS DBGC_LOCKING
6447
6448 /****************************************************************************
6449  Get a lock pid, dealing with large count requests.
6450 ****************************************************************************/
6451
6452 uint32 get_lock_pid( char *data, int data_offset, bool large_file_format)
6453 {
6454         if(!large_file_format)
6455                 return (uint32)SVAL(data,SMB_LPID_OFFSET(data_offset));
6456         else
6457                 return (uint32)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
6458 }
6459
6460 /****************************************************************************
6461  Get a lock count, dealing with large count requests.
6462 ****************************************************************************/
6463
6464 SMB_BIG_UINT get_lock_count( char *data, int data_offset, bool large_file_format)
6465 {
6466         SMB_BIG_UINT count = 0;
6467
6468         if(!large_file_format) {
6469                 count = (SMB_BIG_UINT)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
6470         } else {
6471
6472 #if defined(HAVE_LONGLONG)
6473                 count = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
6474                         ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
6475 #else /* HAVE_LONGLONG */
6476
6477                 /*
6478                  * NT4.x seems to be broken in that it sends large file (64 bit)
6479                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6480                  * negotiated. For boxes without large unsigned ints truncate the
6481                  * lock count by dropping the top 32 bits.
6482                  */
6483
6484                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
6485                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
6486                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
6487                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
6488                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
6489                 }
6490
6491                 count = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
6492 #endif /* HAVE_LONGLONG */
6493         }
6494
6495         return count;
6496 }
6497
6498 #if !defined(HAVE_LONGLONG)
6499 /****************************************************************************
6500  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
6501 ****************************************************************************/
6502
6503 static uint32 map_lock_offset(uint32 high, uint32 low)
6504 {
6505         unsigned int i;
6506         uint32 mask = 0;
6507         uint32 highcopy = high;
6508
6509         /*
6510          * Try and find out how many significant bits there are in high.
6511          */
6512
6513         for(i = 0; highcopy; i++)
6514                 highcopy >>= 1;
6515
6516         /*
6517          * We use 31 bits not 32 here as POSIX
6518          * lock offsets may not be negative.
6519          */
6520
6521         mask = (~0) << (31 - i);
6522
6523         if(low & mask)
6524                 return 0; /* Fail. */
6525
6526         high <<= (31 - i);
6527
6528         return (high|low);
6529 }
6530 #endif /* !defined(HAVE_LONGLONG) */
6531
6532 /****************************************************************************
6533  Get a lock offset, dealing with large offset requests.
6534 ****************************************************************************/
6535
6536 SMB_BIG_UINT get_lock_offset( char *data, int data_offset, bool large_file_format, bool *err)
6537 {
6538         SMB_BIG_UINT offset = 0;
6539
6540         *err = False;
6541
6542         if(!large_file_format) {
6543                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
6544         } else {
6545
6546 #if defined(HAVE_LONGLONG)
6547                 offset = (((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
6548                                 ((SMB_BIG_UINT) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
6549 #else /* HAVE_LONGLONG */
6550
6551                 /*
6552                  * NT4.x seems to be broken in that it sends large file (64 bit)
6553                  * lockingX calls even if the CAP_LARGE_FILES was *not*
6554                  * negotiated. For boxes without large unsigned ints mangle the
6555                  * lock offset by mapping the top 32 bits onto the lower 32.
6556                  */
6557
6558                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
6559                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6560                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
6561                         uint32 new_low = 0;
6562
6563                         if((new_low = map_lock_offset(high, low)) == 0) {
6564                                 *err = True;
6565                                 return (SMB_BIG_UINT)-1;
6566                         }
6567
6568                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
6569                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
6570                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
6571                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
6572                 }
6573
6574                 offset = (SMB_BIG_UINT)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
6575 #endif /* HAVE_LONGLONG */
6576         }
6577
6578         return offset;
6579 }
6580
6581 /****************************************************************************
6582  Reply to a lockingX request.
6583 ****************************************************************************/
6584
6585 void reply_lockingX(struct smb_request *req)
6586 {
6587         connection_struct *conn = req->conn;
6588         files_struct *fsp;
6589         unsigned char locktype;
6590         unsigned char oplocklevel;
6591         uint16 num_ulocks;
6592         uint16 num_locks;
6593         SMB_BIG_UINT count = 0, offset = 0;
6594         uint32 lock_pid;
6595         int32 lock_timeout;
6596         int i;
6597         char *data;
6598         bool large_file_format;
6599         bool err;
6600         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
6601
6602         START_PROFILE(SMBlockingX);
6603
6604         if (req->wct < 8) {
6605                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6606                 END_PROFILE(SMBlockingX);
6607                 return;
6608         }
6609
6610         fsp = file_fsp(SVAL(req->inbuf,smb_vwv2));
6611         locktype = CVAL(req->inbuf,smb_vwv3);
6612         oplocklevel = CVAL(req->inbuf,smb_vwv3+1);
6613         num_ulocks = SVAL(req->inbuf,smb_vwv6);
6614         num_locks = SVAL(req->inbuf,smb_vwv7);
6615         lock_timeout = IVAL(req->inbuf,smb_vwv4);
6616         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
6617
6618         if (!check_fsp(conn, req, fsp, &current_user)) {
6619                 END_PROFILE(SMBlockingX);
6620                 return;
6621         }
6622
6623         data = smb_buf(req->inbuf);
6624
6625         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
6626                 /* we don't support these - and CANCEL_LOCK makes w2k
6627                    and XP reboot so I don't really want to be
6628                    compatible! (tridge) */
6629                 reply_nterror(req, NT_STATUS_DOS(ERRDOS, ERRnoatomiclocks));
6630                 END_PROFILE(SMBlockingX);
6631                 return;
6632         }
6633
6634         /* Check if this is an oplock break on a file
6635            we have granted an oplock on.
6636         */
6637         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
6638                 /* Client can insist on breaking to none. */
6639                 bool break_to_none = (oplocklevel == 0);
6640                 bool result;
6641
6642                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
6643                          "for fnum = %d\n", (unsigned int)oplocklevel,
6644                          fsp->fnum ));
6645
6646                 /*
6647                  * Make sure we have granted an exclusive or batch oplock on
6648                  * this file.
6649                  */
6650
6651                 if (fsp->oplock_type == 0) {
6652
6653                         /* The Samba4 nbench simulator doesn't understand
6654                            the difference between break to level2 and break
6655                            to none from level2 - it sends oplock break
6656                            replies in both cases. Don't keep logging an error
6657                            message here - just ignore it. JRA. */
6658
6659                         DEBUG(5,("reply_lockingX: Error : oplock break from "
6660                                  "client for fnum = %d (oplock=%d) and no "
6661                                  "oplock granted on this file (%s).\n",
6662                                  fsp->fnum, fsp->oplock_type, fsp->fsp_name));
6663
6664                         /* if this is a pure oplock break request then don't
6665                          * send a reply */
6666                         if (num_locks == 0 && num_ulocks == 0) {
6667                                 END_PROFILE(SMBlockingX);
6668                                 return;
6669                         } else {
6670                                 END_PROFILE(SMBlockingX);
6671                                 reply_doserror(req, ERRDOS, ERRlock);
6672                                 return;
6673                         }
6674                 }
6675
6676                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
6677                     (break_to_none)) {
6678                         result = remove_oplock(fsp);
6679                 } else {
6680                         result = downgrade_oplock(fsp);
6681                 }
6682
6683                 if (!result) {
6684                         DEBUG(0, ("reply_lockingX: error in removing "
6685                                   "oplock on file %s\n", fsp->fsp_name));
6686                         /* Hmmm. Is this panic justified? */
6687                         smb_panic("internal tdb error");
6688                 }
6689
6690                 reply_to_oplock_break_requests(fsp);
6691
6692                 /* if this is a pure oplock break request then don't send a
6693                  * reply */
6694                 if (num_locks == 0 && num_ulocks == 0) {
6695                         /* Sanity check - ensure a pure oplock break is not a
6696                            chained request. */
6697                         if(CVAL(req->inbuf,smb_vwv0) != 0xff)
6698                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
6699                                          "break is a chained %d request !\n",
6700                                          (unsigned int)CVAL(req->inbuf,
6701                                                             smb_vwv0) ));
6702                         END_PROFILE(SMBlockingX);
6703                         return;
6704                 }
6705         }
6706
6707         /*
6708          * We do this check *after* we have checked this is not a oplock break
6709          * response message. JRA.
6710          */
6711
6712         release_level_2_oplocks_on_change(fsp);
6713
6714         if (smb_buflen(req->inbuf) <
6715             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
6716                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6717                 END_PROFILE(SMBlockingX);
6718                 return;
6719         }
6720
6721         /* Data now points at the beginning of the list
6722            of smb_unlkrng structs */
6723         for(i = 0; i < (int)num_ulocks; i++) {
6724                 lock_pid = get_lock_pid( data, i, large_file_format);
6725                 count = get_lock_count( data, i, large_file_format);
6726                 offset = get_lock_offset( data, i, large_file_format, &err);
6727
6728                 /*
6729                  * There is no error code marked "stupid client bug".... :-).
6730                  */
6731                 if(err) {
6732                         END_PROFILE(SMBlockingX);
6733                         reply_doserror(req, ERRDOS, ERRnoaccess);
6734                         return;
6735                 }
6736
6737                 DEBUG(10,("reply_lockingX: unlock start=%.0f, len=%.0f for "
6738                           "pid %u, file %s\n", (double)offset, (double)count,
6739                           (unsigned int)lock_pid, fsp->fsp_name ));
6740
6741                 status = do_unlock(smbd_messaging_context(),
6742                                 fsp,
6743                                 lock_pid,
6744                                 count,
6745                                 offset,
6746                                 WINDOWS_LOCK);
6747
6748                 if (NT_STATUS_V(status)) {
6749                         END_PROFILE(SMBlockingX);
6750                         reply_nterror(req, status);
6751                         return;
6752                 }
6753         }
6754
6755         /* Setup the timeout in seconds. */
6756
6757         if (!lp_blocking_locks(SNUM(conn))) {
6758                 lock_timeout = 0;
6759         }
6760
6761         /* Now do any requested locks */
6762         data += ((large_file_format ? 20 : 10)*num_ulocks);
6763
6764         /* Data now points at the beginning of the list
6765            of smb_lkrng structs */
6766
6767         for(i = 0; i < (int)num_locks; i++) {
6768                 enum brl_type lock_type = ((locktype & LOCKING_ANDX_SHARED_LOCK) ?
6769                                 READ_LOCK:WRITE_LOCK);
6770                 lock_pid = get_lock_pid( data, i, large_file_format);
6771                 count = get_lock_count( data, i, large_file_format);
6772                 offset = get_lock_offset( data, i, large_file_format, &err);
6773
6774                 /*
6775                  * There is no error code marked "stupid client bug".... :-).
6776                  */
6777                 if(err) {
6778                         END_PROFILE(SMBlockingX);
6779                         reply_doserror(req, ERRDOS, ERRnoaccess);
6780                         return;
6781                 }
6782
6783                 DEBUG(10,("reply_lockingX: lock start=%.0f, len=%.0f for pid "
6784                           "%u, file %s timeout = %d\n", (double)offset,
6785                           (double)count, (unsigned int)lock_pid,
6786                           fsp->fsp_name, (int)lock_timeout ));
6787
6788                 if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
6789                         if (lp_blocking_locks(SNUM(conn))) {
6790
6791                                 /* Schedule a message to ourselves to
6792                                    remove the blocking lock record and
6793                                    return the right error. */
6794
6795                                 if (!blocking_lock_cancel(fsp,
6796                                                 lock_pid,
6797                                                 offset,
6798                                                 count,
6799                                                 WINDOWS_LOCK,
6800                                                 locktype,
6801                                                 NT_STATUS_FILE_LOCK_CONFLICT)) {
6802                                         END_PROFILE(SMBlockingX);
6803                                         reply_nterror(
6804                                                 req,
6805                                                 NT_STATUS_DOS(
6806                                                         ERRDOS,
6807                                                         ERRcancelviolation));
6808                                         return;
6809                                 }
6810                         }
6811                         /* Remove a matching pending lock. */
6812                         status = do_lock_cancel(fsp,
6813                                                 lock_pid,
6814                                                 count,
6815                                                 offset,
6816                                                 WINDOWS_LOCK);
6817                 } else {
6818                         bool blocking_lock = lock_timeout ? True : False;
6819                         bool defer_lock = False;
6820                         struct byte_range_lock *br_lck;
6821                         uint32 block_smbpid;
6822
6823                         br_lck = do_lock(smbd_messaging_context(),
6824                                         fsp,
6825                                         lock_pid,
6826                                         count,
6827                                         offset,
6828                                         lock_type,
6829                                         WINDOWS_LOCK,
6830                                         blocking_lock,
6831                                         &status,
6832                                         &block_smbpid);
6833
6834                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
6835                                 /* Windows internal resolution for blocking locks seems
6836                                    to be about 200ms... Don't wait for less than that. JRA. */
6837                                 if (lock_timeout != -1 && lock_timeout < lp_lock_spin_time()) {
6838                                         lock_timeout = lp_lock_spin_time();
6839                                 }
6840                                 defer_lock = True;
6841                         }
6842
6843                         /* This heuristic seems to match W2K3 very well. If a
6844                            lock sent with timeout of zero would fail with NT_STATUS_FILE_LOCK_CONFLICT
6845                            it pretends we asked for a timeout of between 150 - 300 milliseconds as
6846                            far as I can tell. Replacement for do_lock_spin(). JRA. */
6847
6848                         if (br_lck && lp_blocking_locks(SNUM(conn)) && !blocking_lock &&
6849                                         NT_STATUS_EQUAL((status), NT_STATUS_FILE_LOCK_CONFLICT)) {
6850                                 defer_lock = True;
6851                                 lock_timeout = lp_lock_spin_time();
6852                         }
6853
6854                         if (br_lck && defer_lock) {
6855                                 /*
6856                                  * A blocking lock was requested. Package up
6857                                  * this smb into a queued request and push it
6858                                  * onto the blocking lock queue.
6859                                  */
6860                                 if(push_blocking_lock_request(br_lck,
6861                                                         req,
6862                                                         fsp,
6863                                                         lock_timeout,
6864                                                         i,
6865                                                         lock_pid,
6866                                                         lock_type,
6867                                                         WINDOWS_LOCK,
6868                                                         offset,
6869                                                         count,
6870                                                         block_smbpid)) {
6871                                         TALLOC_FREE(br_lck);
6872                                         END_PROFILE(SMBlockingX);
6873                                         return;
6874                                 }
6875                         }
6876
6877                         TALLOC_FREE(br_lck);
6878                 }
6879
6880                 if (NT_STATUS_V(status)) {
6881                         END_PROFILE(SMBlockingX);
6882                         reply_nterror(req, status);
6883                         return;
6884                 }
6885         }
6886
6887         /* If any of the above locks failed, then we must unlock
6888            all of the previous locks (X/Open spec). */
6889
6890         if (!(locktype & LOCKING_ANDX_CANCEL_LOCK) &&
6891                         (i != num_locks) &&
6892                         (num_locks != 0)) {
6893                 /*
6894                  * Ensure we don't do a remove on the lock that just failed,
6895                  * as under POSIX rules, if we have a lock already there, we
6896                  * will delete it (and we shouldn't) .....
6897                  */
6898                 for(i--; i >= 0; i--) {
6899                         lock_pid = get_lock_pid( data, i, large_file_format);
6900                         count = get_lock_count( data, i, large_file_format);
6901                         offset = get_lock_offset( data, i, large_file_format,
6902                                                   &err);
6903
6904                         /*
6905                          * There is no error code marked "stupid client
6906                          * bug".... :-).
6907                          */
6908                         if(err) {
6909                                 END_PROFILE(SMBlockingX);
6910                                 reply_doserror(req, ERRDOS, ERRnoaccess);
6911                                 return;
6912                         }
6913
6914                         do_unlock(smbd_messaging_context(),
6915                                 fsp,
6916                                 lock_pid,
6917                                 count,
6918                                 offset,
6919                                 WINDOWS_LOCK);
6920                 }
6921                 END_PROFILE(SMBlockingX);
6922                 reply_nterror(req, status);
6923                 return;
6924         }
6925
6926         reply_outbuf(req, 2, 0);
6927
6928         DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
6929                   fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
6930
6931         END_PROFILE(SMBlockingX);
6932         chain_reply(req);
6933 }
6934
6935 #undef DBGC_CLASS
6936 #define DBGC_CLASS DBGC_ALL
6937
6938 /****************************************************************************
6939  Reply to a SMBreadbmpx (read block multiplex) request.
6940  Always reply with an error, if someone has a platform really needs this,
6941  please contact vl@samba.org
6942 ****************************************************************************/
6943
6944 void reply_readbmpx(struct smb_request *req)
6945 {
6946         START_PROFILE(SMBreadBmpx);
6947         reply_doserror(req, ERRSRV, ERRuseSTD);
6948         END_PROFILE(SMBreadBmpx);
6949         return;
6950 }
6951
6952 /****************************************************************************
6953  Reply to a SMBreadbs (read block multiplex secondary) request.
6954  Always reply with an error, if someone has a platform really needs this,
6955  please contact vl@samba.org
6956 ****************************************************************************/
6957
6958 void reply_readbs(struct smb_request *req)
6959 {
6960         START_PROFILE(SMBreadBs);
6961         reply_doserror(req, ERRSRV, ERRuseSTD);
6962         END_PROFILE(SMBreadBs);
6963         return;
6964 }
6965
6966 /****************************************************************************
6967  Reply to a SMBsetattrE.
6968 ****************************************************************************/
6969
6970 void reply_setattrE(struct smb_request *req)
6971 {
6972         connection_struct *conn = req->conn;
6973         struct timespec ts[2];
6974         files_struct *fsp;
6975         SMB_STRUCT_STAT sbuf;
6976         NTSTATUS status;
6977
6978         START_PROFILE(SMBsetattrE);
6979
6980         if (req->wct < 7) {
6981                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6982                 END_PROFILE(SMBsetattrE);
6983                 return;
6984         }
6985
6986         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
6987
6988         if(!fsp || (fsp->conn != conn)) {
6989                 reply_doserror(req, ERRDOS, ERRbadfid);
6990                 END_PROFILE(SMBsetattrE);
6991                 return;
6992         }
6993
6994
6995         /*
6996          * Convert the DOS times into unix times. Ignore create
6997          * time as UNIX can't set this.
6998          */
6999
7000         ts[0] = convert_time_t_to_timespec(
7001                 srv_make_unix_date2(req->inbuf+smb_vwv3)); /* atime. */
7002         ts[1] = convert_time_t_to_timespec(
7003                 srv_make_unix_date2(req->inbuf+smb_vwv5)); /* mtime. */
7004
7005         reply_outbuf(req, 0, 0);
7006
7007         /*
7008          * Patch from Ray Frush <frush@engr.colostate.edu>
7009          * Sometimes times are sent as zero - ignore them.
7010          */
7011
7012         /* Ensure we have a valid stat struct for the source. */
7013         if (fsp->fh->fd != -1) {
7014                 if (SMB_VFS_FSTAT(fsp, &sbuf) == -1) {
7015                         status = map_nt_error_from_unix(errno);
7016                         reply_nterror(req, status);
7017                         END_PROFILE(SMBsetattrE);
7018                         return;
7019                 }
7020         } else {
7021                 if (SMB_VFS_STAT(conn, fsp->fsp_name, &sbuf) == -1) {
7022                         status = map_nt_error_from_unix(errno);
7023                         reply_nterror(req, status)
7024                         END_PROFILE(SMBsetattrE);
7025                         return;
7026                 }
7027         }
7028
7029         status = smb_set_file_time(conn, fsp, fsp->fsp_name,
7030                                    &sbuf, ts, true);
7031         if (!NT_STATUS_IS_OK(status)) {
7032                 reply_doserror(req, ERRDOS, ERRnoaccess)
7033                 END_PROFILE(SMBsetattrE);
7034                 return;
7035         }
7036
7037         DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u\n",
7038                 fsp->fnum,
7039                 (unsigned int)ts[0].tv_sec,
7040                 (unsigned int)ts[1].tv_sec));
7041
7042         END_PROFILE(SMBsetattrE);
7043         return;
7044 }
7045
7046
7047 /* Back from the dead for OS/2..... JRA. */
7048
7049 /****************************************************************************
7050  Reply to a SMBwritebmpx (write block multiplex primary) request.
7051  Always reply with an error, if someone has a platform really needs this,
7052  please contact vl@samba.org
7053 ****************************************************************************/
7054
7055 void reply_writebmpx(struct smb_request *req)
7056 {
7057         START_PROFILE(SMBwriteBmpx);
7058         reply_doserror(req, ERRSRV, ERRuseSTD);
7059         END_PROFILE(SMBwriteBmpx);
7060         return;
7061 }
7062
7063 /****************************************************************************
7064  Reply to a SMBwritebs (write block multiplex secondary) request.
7065  Always reply with an error, if someone has a platform really needs this,
7066  please contact vl@samba.org
7067 ****************************************************************************/
7068
7069 void reply_writebs(struct smb_request *req)
7070 {
7071         START_PROFILE(SMBwriteBs);
7072         reply_doserror(req, ERRSRV, ERRuseSTD);
7073         END_PROFILE(SMBwriteBs);
7074         return;
7075 }
7076
7077 /****************************************************************************
7078  Reply to a SMBgetattrE.
7079 ****************************************************************************/
7080
7081 void reply_getattrE(struct smb_request *req)
7082 {
7083         connection_struct *conn = req->conn;
7084         SMB_STRUCT_STAT sbuf;
7085         int mode;
7086         files_struct *fsp;
7087
7088         START_PROFILE(SMBgetattrE);
7089
7090         if (req->wct < 1) {
7091                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7092                 END_PROFILE(SMBgetattrE);
7093                 return;
7094         }
7095
7096         fsp = file_fsp(SVAL(req->inbuf,smb_vwv0));
7097
7098         if(!fsp || (fsp->conn != conn)) {
7099                 reply_doserror(req, ERRDOS, ERRbadfid);
7100                 END_PROFILE(SMBgetattrE);
7101                 return;
7102         }
7103
7104         /* Do an fstat on this file */
7105         if(fsp_stat(fsp, &sbuf)) {
7106                 reply_unixerror(req, ERRDOS, ERRnoaccess);
7107                 END_PROFILE(SMBgetattrE);
7108                 return;
7109         }
7110
7111         mode = dos_mode(conn,fsp->fsp_name,&sbuf);
7112
7113         /*
7114          * Convert the times into dos times. Set create
7115          * date to be last modify date as UNIX doesn't save
7116          * this.
7117          */
7118
7119         reply_outbuf(req, 11, 0);
7120
7121         srv_put_dos_date2((char *)req->outbuf, smb_vwv0,
7122                           get_create_time(&sbuf,
7123                                           lp_fake_dir_create_times(SNUM(conn))));
7124         srv_put_dos_date2((char *)req->outbuf, smb_vwv2, sbuf.st_atime);
7125         /* Should we check pending modtime here ? JRA */
7126         srv_put_dos_date2((char *)req->outbuf, smb_vwv4, sbuf.st_mtime);
7127
7128         if (mode & aDIR) {
7129                 SIVAL(req->outbuf, smb_vwv6, 0);
7130                 SIVAL(req->outbuf, smb_vwv8, 0);
7131         } else {
7132                 uint32 allocation_size = get_allocation_size(conn,fsp, &sbuf);
7133                 SIVAL(req->outbuf, smb_vwv6, (uint32)sbuf.st_size);
7134                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
7135         }
7136         SSVAL(req->outbuf,smb_vwv10, mode);
7137
7138         DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
7139
7140         END_PROFILE(SMBgetattrE);
7141         return;
7142 }