s3:smbd: remove code duplication in smb2_create_send()
[obnox/samba/samba-obnox.git] / source3 / smbd / smb2_create.c
index b4b265b9f5eb3d532338bf9405e2fc90df3c8764..11b3b7f4389a5dae6a4e9acaa0cb44bb0e4407ff 100644 (file)
 */
 
 #include "includes.h"
+#include "printing.h"
+#include "smbd/smbd.h"
 #include "smbd/globals.h"
 #include "../libcli/smb/smb_common.h"
+#include "../librpc/gen_ndr/ndr_security.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "messages.h"
 
 int map_smb2_oplock_levels_to_samba(uint8_t in_oplock_level)
 {
@@ -95,9 +100,7 @@ static void smbd_smb2_request_create_done(struct tevent_req *tsubreq);
 NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
 {
        const uint8_t *inbody;
-       int i = smb2req->current_idx;
-       size_t expected_body_size = 0x39;
-       size_t body_size;
+       const struct iovec *indyniov;
        uint8_t in_oplock_level;
        uint32_t in_impersonation_level;
        uint32_t in_desired_access;
@@ -123,16 +126,11 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
        bool ok;
        struct tevent_req *tsubreq;
 
-       if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-       }
-
-       inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
-
-       body_size = SVAL(inbody, 0x00);
-       if (body_size != expected_body_size) {
-               return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
+       status = smbd_smb2_request_verify_sizes(smb2req, 0x39);
+       if (!NT_STATUS_IS_OK(status)) {
+               return smbd_smb2_request_error(smb2req, status);
        }
+       inbody = SMBD_SMB2_IN_BODY_PTR(smb2req);
 
        in_oplock_level         = CVAL(inbody, 0x03);
        in_impersonation_level  = IVAL(inbody, 0x04);
@@ -154,7 +152,7 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
         *       overlap
         */
 
-       dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
+       dyn_offset = SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(smb2req);
 
        if (in_name_offset == 0 && in_name_length == 0) {
                /* This is ok */
@@ -165,18 +163,19 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
                name_offset = in_name_offset - dyn_offset;
        }
 
-       if (name_offset > smb2req->in.vector[i+2].iov_len) {
+       indyniov = SMBD_SMB2_IN_DYN_IOV(smb2req);
+
+       if (name_offset > indyniov->iov_len) {
                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       name_available_length = smb2req->in.vector[i+2].iov_len - name_offset;
+       name_available_length = indyniov->iov_len - name_offset;
 
        if (in_name_length > name_available_length) {
                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       in_name_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
-                             name_offset;
+       in_name_buffer.data = (uint8_t *)indyniov->iov_base + name_offset;
        in_name_buffer.length = in_name_length;
 
        if (in_context_offset == 0 && in_context_length == 0) {
@@ -188,18 +187,18 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
                context_offset = in_context_offset - dyn_offset;
        }
 
-       if (context_offset > smb2req->in.vector[i+2].iov_len) {
+       if (context_offset > indyniov->iov_len) {
                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       context_available_length = smb2req->in.vector[i+2].iov_len - context_offset;
+       context_available_length = indyniov->iov_len - context_offset;
 
        if (in_context_length > context_available_length) {
                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
        }
 
-       in_context_buffer.data = (uint8_t *)smb2req->in.vector[i+2].iov_base +
-                                 context_offset;
+       in_context_buffer.data = (uint8_t *)indyniov->iov_base +
+               context_offset;
        in_context_buffer.length = in_context_length;
 
        /*
@@ -210,11 +209,19 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
                                   in_name_buffer.data,
                                   in_name_buffer.length,
                                   &in_name_string,
-                                  &in_name_string_size, false);
+                                  &in_name_string_size);
        if (!ok) {
                return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
        }
 
+       if (in_name_buffer.length == 0) {
+               in_name_string_size = 0;
+       }
+
+       if (strlen(in_name_string) != in_name_string_size) {
+               return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
+       }
+
        ZERO_STRUCT(in_context_blobs);
        status = smb2_create_blob_parse(smb2req, in_context_buffer, &in_context_blobs);
        if (!NT_STATUS_IS_OK(status)) {
@@ -222,7 +229,7 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
        }
 
        tsubreq = smbd_smb2_create_send(smb2req,
-                                      smb2req->sconn->smb2.event_ctx,
+                                      smb2req->sconn->ev_ctx,
                                       smb2req,
                                       in_oplock_level,
                                       in_impersonation_level,
@@ -239,12 +246,18 @@ NTSTATUS smbd_smb2_request_process_create(struct smbd_smb2_request *smb2req)
        }
        tevent_req_set_callback(tsubreq, smbd_smb2_request_create_done, smb2req);
 
-       return smbd_smb2_request_pending_queue(smb2req, tsubreq);
+       /*
+        * For now we keep the logic that we do not send STATUS_PENDING
+        * for sharing violations, so we just wait 2 seconds.
+        *
+        * TODO: we need more tests for this.
+        */
+       return smbd_smb2_request_pending_queue(smb2req, tsubreq, 2000000);
 }
 
 static uint64_t get_mid_from_smb2req(struct smbd_smb2_request *smb2req)
 {
-       uint8_t *reqhdr = (uint8_t *)smb2req->out.vector[smb2req->current_idx].iov_base;
+       uint8_t *reqhdr = SMBD_SMB2_OUT_HDR_PTR(smb2req);
        return BVAL(reqhdr, SMB2_HDR_MESSAGE_ID);
 }
 
@@ -252,8 +265,6 @@ static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
 {
        struct smbd_smb2_request *smb2req = tevent_req_callback_data(tsubreq,
                                        struct smbd_smb2_request);
-       int i = smb2req->current_idx;
-       uint8_t *outhdr;
        DATA_BLOB outbody;
        DATA_BLOB outdyn;
        uint8_t out_oplock_level = 0;
@@ -273,19 +284,6 @@ static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
        NTSTATUS status;
        NTSTATUS error; /* transport error */
 
-       if (smb2req->cancelled) {
-               uint64_t mid = get_mid_from_smb2req(smb2req);
-               DEBUG(10,("smbd_smb2_request_create_done: cancelled mid %llu\n",
-                       (unsigned long long)mid ));
-               error = smbd_smb2_request_error(smb2req, NT_STATUS_CANCELLED);
-               if (!NT_STATUS_IS_OK(error)) {
-                       smbd_server_connection_terminate(smb2req->sconn,
-                               nt_errstr(error));
-                       return;
-               }
-               return;
-       }
-
        status = smbd_smb2_create_recv(tsubreq,
                                       smb2req,
                                       &out_oplock_level,
@@ -325,8 +323,6 @@ static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
                out_context_buffer_offset = SMB2_HDR_BODY + 0x58;
        }
 
-       outhdr = (uint8_t *)smb2req->out.vector[i].iov_base;
-
        outbody = data_blob_talloc(smb2req->out.vector, NULL, 0x58);
        if (outbody.data == NULL) {
                error = smbd_smb2_request_error(smb2req, NT_STATUS_NO_MEMORY);
@@ -381,7 +377,8 @@ static void smbd_smb2_request_create_done(struct tevent_req *tsubreq)
 struct smbd_smb2_create_state {
        struct smbd_smb2_request *smb2req;
        struct smb_request *smb1req;
-       struct timed_event *te;
+       bool open_was_deferred;
+       struct tevent_timer *te;
        struct tevent_immediate *im;
        struct timeval request_time;
        struct file_id id;
@@ -422,17 +419,20 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
        struct timespec write_time_ts;
        struct smb2_create_blobs out_context_blobs;
        int requested_oplock_level;
+       struct smb2_create_blob *dhnc = NULL;
+       struct smb2_create_blob *dh2c = NULL;
+       struct smbXsrv_open *op = NULL;
 
        ZERO_STRUCT(out_context_blobs);
 
-       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat_conn))) {
-               requested_oplock_level = NO_OPLOCK;
+       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat))) {
+               requested_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
        } else {
                requested_oplock_level = in_oplock_level;
        }
 
 
-       if (!smb2req->async) {
+       if (smb2req->subreq == NULL) {
                /* New create call. */
                req = tevent_req_create(mem_ctx, &state,
                                struct smbd_smb2_create_state);
@@ -440,13 +440,13 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        return NULL;
                }
                state->smb2req = smb2req;
-               smb2req->subreq = req; /* So we can find this when going async. */
 
                smb1req = smbd_smb2_fake_smb_request(smb2req);
                if (tevent_req_nomem(smb1req, req)) {
                        return tevent_req_post(req, ev);
                }
                state->smb1req = smb1req;
+               smb2req->subreq = req;
                DEBUG(10,("smbd_smb2_create: name[%s]\n",
                        in_name));
        } else {
@@ -459,17 +459,51 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        in_name ));
        }
 
+       dhnc = smb2_create_blob_find(&in_context_blobs,
+                                    SMB2_CREATE_TAG_DHNC);
+
+       if (dhnc) {
+               if (dhnc->data.length != 16) {
+                       tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                       return tevent_req_post(req, ev);
+               }
+               if (in_context_blobs.num_blobs != 1) {
+                       /*
+                        * DHNC should be the only one.
+                        */
+                       tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+                       return tevent_req_post(req, ev);
+               }
+       }
+
+       dh2c = smb2_create_blob_find(&in_context_blobs,
+                                    SMB2_CREATE_TAG_DH2C);
+       if (dh2c) {
+               if (dh2c->data.length != 36) {
+                       tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                       return tevent_req_post(req, ev);
+               }
+               if (in_context_blobs.num_blobs != 1) {
+                       /*
+                        * DH2C should be the only one.
+                        */
+                       tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+                       return tevent_req_post(req, ev);
+               }
+       }
+
        if (IS_IPC(smb1req->conn)) {
                const char *pipe_name = in_name;
 
-               if (!lp_nt_pipe_support()) {
-                       tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
+               if (dhnc || dh2c) {
+                       /* durable handles are not supported on IPC$ */
+                       tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                        return tevent_req_post(req, ev);
                }
 
-               /* Strip \\ off the name. */
-               if (pipe_name[0] == '\\') {
-                       pipe_name++;
+               if (!lp_nt_pipe_support()) {
+                       tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
+                       return tevent_req_post(req, ev);
                }
 
                status = open_np_file(smb1req, pipe_name, &result);
@@ -479,17 +513,20 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                }
                info = FILE_WAS_OPENED;
        } else if (CAN_PRINT(smb1req->conn)) {
+               if (dhnc || dh2c) {
+                       /* durable handles are not supported on printers */
+                       tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
+                       return tevent_req_post(req, ev);
+               }
+
                status = file_new(smb1req, smb1req->conn, &result);
                if(!NT_STATUS_IS_OK(status)) {
                        tevent_req_nterror(req, status);
                        return tevent_req_post(req, ev);
                }
 
-               status = print_fsp_open(smb1req,
-                                       smb1req->conn,
-                                       in_name,
-                                       smb1req->vuid,
-                                       result);
+               status = print_spool_open(result, in_name,
+                                         smb1req->vuid);
                if (!NT_STATUS_IS_OK(status)) {
                        file_free(smb1req, result);
                        tevent_req_nterror(req, status);
@@ -498,7 +535,6 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                info = FILE_WAS_CREATED;
        } else {
                char *fname;
-               struct smb_filename *smb_fname = NULL;
                struct smb2_create_blob *exta = NULL;
                struct ea_list *ea_list = NULL;
                struct smb2_create_blob *mxac = NULL;
@@ -506,11 +542,17 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                struct smb2_create_blob *secd = NULL;
                struct security_descriptor *sec_desc = NULL;
                struct smb2_create_blob *dhnq = NULL;
-               struct smb2_create_blob *dhnc = NULL;
                struct smb2_create_blob *alsi = NULL;
                uint64_t allocation_size = 0;
                struct smb2_create_blob *twrp = NULL;
                struct smb2_create_blob *qfid = NULL;
+               struct GUID create_guid = GUID_zero();
+               bool update_open = false;
+               bool durable_requested = false;
+               uint32_t durable_timeout_msec = 0;
+               bool do_durable_reconnect = false;
+               struct smb2_create_blob *dh2q = NULL;
+               uint64_t persistent_id = 0;
 
                exta = smb2_create_blob_find(&in_context_blobs,
                                             SMB2_CREATE_TAG_EXTA);
@@ -520,14 +562,14 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                             SMB2_CREATE_TAG_SECD);
                dhnq = smb2_create_blob_find(&in_context_blobs,
                                             SMB2_CREATE_TAG_DHNQ);
-               dhnc = smb2_create_blob_find(&in_context_blobs,
-                                            SMB2_CREATE_TAG_DHNC);
                alsi = smb2_create_blob_find(&in_context_blobs,
                                             SMB2_CREATE_TAG_ALSI);
                twrp = smb2_create_blob_find(&in_context_blobs,
                                             SMB2_CREATE_TAG_TWRP);
                qfid = smb2_create_blob_find(&in_context_blobs,
                                             SMB2_CREATE_TAG_QFID);
+               dh2q = smb2_create_blob_find(&in_context_blobs,
+                                            SMB2_CREATE_TAG_DH2Q);
 
                fname = talloc_strdup(state, in_name);
                if (tevent_req_nomem(fname, req)) {
@@ -535,11 +577,6 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                }
 
                if (exta) {
-                       if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                               return tevent_req_post(req, ev);
-                       }
-
                        ea_list = read_nttrans_ea_list(mem_ctx,
                                (const char *)exta->data.data, exta->data.length);
                        if (!ea_list) {
@@ -550,11 +587,6 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                }
 
                if (mxac) {
-                       if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                               return tevent_req_post(req, ev);
-                       }
-
                        if (mxac->data.length == 0) {
                                max_access_time = 0;
                        } else if (mxac->data.length == 8) {
@@ -568,11 +600,6 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                if (secd) {
                        enum ndr_err_code ndr_err;
 
-                       if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                               return tevent_req_post(req, ev);
-                       }
-
                        sec_desc = talloc_zero(state, struct security_descriptor);
                        if (tevent_req_nomem(sec_desc, req)) {
                                return tevent_req_post(req, ev);
@@ -590,37 +617,95 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                }
 
                if (dhnq) {
-                       if (dhnc) {
+                       if (dhnq->data.length != 16) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
                        }
 
-                       if (dhnq->data.length != 16) {
+                       if (dh2q) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
                        }
+
+                       /*
+                        * durable handle request is processed below.
+                        */
+                       durable_requested = true;
                        /*
-                        * we don't support durable handles yet
-                        * and have to ignore this
+                        * Set the timeout to 16 mins.
+                        *
+                        * TODO: test this against Windows 2012
+                        *       as the default for durable v2 is 1 min.
                         */
+                       durable_timeout_msec = (16*60*1000);
                }
 
-               if (dhnc) {
-                       if (dhnc->data.length != 16) {
+               if (dh2q) {
+                       const uint8_t *p = dh2q->data.data;
+                       uint32_t durable_v2_timeout = 0;
+                       DATA_BLOB create_guid_blob;
+
+                       if (dh2q->data.length != 32) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
                        }
-                       /* we don't support durable handles yet */
-                       tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
-                       return tevent_req_post(req, ev);
-               }
 
-               if (alsi) {
-                       if (dhnc) {
+                       if (dhnq) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
                        }
 
+                       durable_v2_timeout = IVAL(p, 0);
+                       create_guid_blob = data_blob_const(p + 16, 16);
+
+                       status = GUID_from_ndr_blob(&create_guid_blob,
+                                                   &create_guid);
+                       if (tevent_req_nterror(req, status)) {
+                               return tevent_req_post(req, ev);
+                       }
+                       /*
+                        * we need to store the create_guid later
+                        */
+                       update_open = true;
+
+                       /*
+                        * durable handle v2 request processed below
+                        */
+                       durable_requested = true;
+                       durable_timeout_msec = durable_v2_timeout;
+                       if (durable_timeout_msec == 0) {
+                               /*
+                                * Set the timeout to 1 min as default.
+                                *
+                                * This matches Windows 2012.
+                                */
+                               durable_timeout_msec = (60*1000);
+                       }
+               }
+
+               if (dhnc) {
+                       persistent_id = BVAL(dhnc->data.data, 0);
+
+                       do_durable_reconnect = true;
+               }
+
+               if (dh2c) {
+                       const uint8_t *p = dh2c->data.data;
+                       DATA_BLOB create_guid_blob;
+
+                       persistent_id = BVAL(p, 0);
+                       create_guid_blob = data_blob_const(p + 16, 16);
+
+                       status = GUID_from_ndr_blob(&create_guid_blob,
+                                                   &create_guid);
+                       if (tevent_req_nterror(req, status)) {
+                               return tevent_req_post(req, ev);
+                       }
+
+                       do_durable_reconnect = true;
+               }
+
+               if (alsi) {
                        if (alsi->data.length != 8) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
@@ -633,11 +718,6 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        time_t t;
                        struct tm *tm;
 
-                       if (dhnc) {
-                               tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                               return tevent_req_post(req, ev);
-                       }
-
                        if (twrp->data.length != 8) {
                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                                return tevent_req_post(req, ev);
@@ -673,58 +753,134 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                in_create_options &= ~(0x10);/* NTCREATEX_OPTIONS_SYNC_ALERT */
                in_create_options &= ~(0x20);/* NTCREATEX_OPTIONS_ASYNC_ALERT */
 
-                /*
-                * For a DFS path the function parse_dfs_path()
-                * will do the path processing.
-                */
+               in_file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
+
+               DEBUG(10, ("smbd_smb2_create_send: open execution phase\n"));
 
-               if (!smb1req->flags2 & FLAGS2_DFS_PATHNAMES) {
-                       /* convert '\\' into '/' */
-                       status = check_path_syntax(fname);
+               /*
+                * For the backend file open procedure, there are
+                * two possible modes: durable_reconnect or not.
+                */
+               if (do_durable_reconnect) {
+                       DATA_BLOB new_cookie = data_blob_null;
+                       NTTIME now = timeval_to_nttime(&smb2req->request_time);
+
+                       status = smb2srv_open_recreate(smb2req->sconn->conn,
+                                               smb1req->conn->session_info,
+                                               persistent_id, create_guid,
+                                               now, &op);
                        if (!NT_STATUS_IS_OK(status)) {
+                               DEBUG(3, ("smbd_smb2_create_send: "
+                                         "smb2srv_open_recreate failed: %s\n",
+                                         nt_errstr(status)));
                                tevent_req_nterror(req, status);
                                return tevent_req_post(req, ev);
                        }
-               }
 
-               status = filename_convert(req,
-                                         smb1req->conn,
-                                         smb1req->flags2 & FLAGS2_DFS_PATHNAMES,
-                                         fname,
-                                         0,
-                                         NULL,
-                                         &smb_fname);
-               if (!NT_STATUS_IS_OK(status)) {
-                       tevent_req_nterror(req, status);
-                       return tevent_req_post(req, ev);
-               }
+                       DEBUG(10, ("smb2_create_send: %s to recreate the "
+                                  "smb2srv_open struct for a durable handle.\n",
+                                  op->global->durable ? "succeded" : "failed"));
 
-               in_file_attributes &= ~FILE_FLAG_POSIX_SEMANTICS;
+                       if (!op->global->durable) {
+                               talloc_free(op);
+                               tevent_req_nterror(req,
+                                       NT_STATUS_OBJECT_NAME_NOT_FOUND);
+                               return tevent_req_post(req, ev);
+                       }
 
-               status = SMB_VFS_CREATE_FILE(smb1req->conn,
-                                            smb1req,
-                                            0, /* root_dir_fid */
-                                            smb_fname,
-                                            in_desired_access,
-                                            in_share_access,
-                                            in_create_disposition,
-                                            in_create_options,
-                                            in_file_attributes,
-                                            map_smb2_oplock_levels_to_samba(requested_oplock_level),
-                                            allocation_size,
-                                            0, /* private_flags */
-                                            sec_desc,
-                                            ea_list,
-                                            &result,
-                                            &info);
-               if (!NT_STATUS_IS_OK(status)) {
-                       if (open_was_deferred(smb1req->mid)) {
-                               return req;
+                       status = SMB_VFS_DURABLE_RECONNECT(smb1req->conn,
+                                               smb1req,
+                                               op,
+                                               op->global->backend_cookie,
+                                               op, &result, &new_cookie);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               NTSTATUS return_status;
+
+                               return_status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
+
+                               DEBUG(3, ("smbd_smb2_create_send: "
+                                         "durable_reconnect failed: %s => %s\n",
+                                         nt_errstr(status),
+                                         nt_errstr(return_status)));
+
+                               tevent_req_nterror(req, return_status);
+                               return tevent_req_post(req, ev);
                        }
-                       tevent_req_nterror(req, status);
-                       return tevent_req_post(req, ev);
+
+                       data_blob_free(&op->global->backend_cookie);
+                       op->global->backend_cookie = new_cookie;
+
+                       op->status = NT_STATUS_OK;
+                       op->global->disconnect_time = 0;
+
+                       /* save the timout for later update */
+                       durable_timeout_msec = op->global->durable_timeout_msec;
+
+                       update_open = true;
+
+                       info = FILE_WAS_OPENED;
+               } else {
+                       struct smb_filename *smb_fname = NULL;
+
+                       /*
+                        * For a DFS path the function parse_dfs_path()
+                        * will do the path processing.
+                        */
+
+                       if (!(smb1req->flags2 & FLAGS2_DFS_PATHNAMES)) {
+                               /* convert '\\' into '/' */
+                               status = check_path_syntax(fname);
+                               if (!NT_STATUS_IS_OK(status)) {
+                                       tevent_req_nterror(req, status);
+                                       return tevent_req_post(req, ev);
+                               }
+                       }
+
+                       status = filename_convert(req,
+                                                 smb1req->conn,
+                                                 smb1req->flags2 & FLAGS2_DFS_PATHNAMES,
+                                                 fname,
+                                                 0,    /* unix_convert flags */
+                                                 NULL, /* ppath_contains_wcards */
+                                                 &smb_fname);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
+
+                       status = SMB_VFS_CREATE_FILE(smb1req->conn,
+                                                    smb1req,
+                                                    0, /* root_dir_fid */
+                                                    smb_fname,
+                                                    in_desired_access,
+                                                    in_share_access,
+                                                    in_create_disposition,
+                                                    in_create_options,
+                                                    in_file_attributes,
+                                                    map_smb2_oplock_levels_to_samba(requested_oplock_level),
+                                                    allocation_size,
+                                                    0, /* private_flags */
+                                                    sec_desc,
+                                                    ea_list,
+                                                    &result,
+                                                    &info);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               if (open_was_deferred(smb1req->sconn, smb1req->mid)) {
+                                       return req;
+                               }
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
+                       op = result->op;
                }
 
+               /*
+                * here we have op == result->op
+                */
+
+               DEBUG(10, ("smbd_smb2_create_send: "
+                          "response construction phase\n"));
+
                if (mxac) {
                        NTTIME last_write_time;
 
@@ -735,8 +891,9 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                                uint32_t max_access_granted;
                                DATA_BLOB blob = data_blob_const(p, sizeof(p));
 
-                               status = smbd_check_open_rights(smb1req->conn,
+                               status = smbd_calculate_access_mask(smb1req->conn,
                                                        result->fsp_name,
+                                                       false,
                                                        SEC_FLAG_MAXIMUM_ALLOWED,
                                                        &max_access_granted);
 
@@ -754,6 +911,67 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        }
                }
 
+               if (durable_requested &&
+                   BATCH_OPLOCK_TYPE(result->oplock_type))
+               {
+                       status = SMB_VFS_DURABLE_COOKIE(result,
+                                               op,
+                                               &op->global->backend_cookie);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               op->global->backend_cookie = data_blob_null;
+                       }
+               }
+               if (op->global->backend_cookie.length > 0) {
+                       update_open = true;
+
+                       op->global->durable = true;
+                       op->global->durable_timeout_msec = durable_timeout_msec;
+               }
+
+               if (update_open) {
+                       op->global->create_guid = create_guid;
+
+                       status = smbXsrv_open_update(op);
+                       DEBUG(10, ("smb2_create_send: smbXsrv_open_update "
+                                  "returned %s\n",
+                                  nt_errstr(status)));
+                       if (!NT_STATUS_IS_OK(status)) {
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
+               }
+
+               if (dhnq && op->global->durable) {
+                       uint8_t p[8] = { 0, };
+                       DATA_BLOB blob = data_blob_const(p, sizeof(p));
+
+                       status = smb2_create_blob_add(state,
+                                                     &out_context_blobs,
+                                                     SMB2_CREATE_TAG_DHNQ,
+                                                     blob);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
+               }
+
+               if (dh2q && op->global->durable) {
+                       uint8_t p[8] = { 0, };
+                       DATA_BLOB blob = data_blob_const(p, sizeof(p));
+                       uint32_t durable_v2_response_flags = 0;
+
+                       SIVAL(p, 0, op->global->durable_timeout_msec);
+                       SIVAL(p, 4, durable_v2_response_flags);
+
+                       status = smb2_create_blob_add(state, &out_context_blobs,
+                                                     SMB2_CREATE_TAG_DH2Q,
+                                                     blob);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               tevent_req_nterror(req, status);
+                               return tevent_req_post(req, ev);
+                       }
+               }
+
                if (qfid) {
                        uint8_t p[32];
                        uint64_t file_index = get_FileIndex(result->conn,
@@ -781,7 +999,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
 
        smb2req->compat_chain_fsp = smb1req->chain_fsp;
 
-       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat_conn))) {
+       if(lp_fake_oplocks(SNUM(smb2req->tcon->compat))) {
                state->out_oplock_level = in_oplock_level;
        } else {
                state->out_oplock_level = map_samba_oplock_levels_to_smb2(result->oplock_type);
@@ -798,7 +1016,7 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
        /* Deal with other possible opens having a modified
           write time. JRA. */
        ZERO_STRUCT(write_time_ts);
-       get_file_infos(result->file_id, NULL, &write_time_ts);
+       get_file_infos(result->file_id, 0, NULL, &write_time_ts);
        if (!null_timespec(write_time_ts)) {
                update_stat_ex_mtime(&result->fsp_name->st, write_time_ts);
        }
@@ -814,16 +1032,19 @@ static struct tevent_req *smbd_smb2_create_send(TALLOC_CTX *mem_ctx,
                        get_change_timespec(smb1req->conn, result,
                                        result->fsp_name));
        state->out_allocation_size =
-                       result->fsp_name->st.st_ex_blksize *
-                       result->fsp_name->st.st_ex_blocks;
+                       SMB_VFS_GET_ALLOC_SIZE(smb1req->conn, result,
+                                              &(result->fsp_name->st));
        state->out_end_of_file = result->fsp_name->st.st_ex_size;
        if (state->out_file_attributes == 0) {
                state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
        }
-       state->out_file_id_persistent = result->fnum;
-       state->out_file_id_volatile = result->fnum;
+       state->out_file_id_persistent = result->op->global->open_persistent_id;
+       state->out_file_id_volatile = result->op->global->open_volatile_id;
        state->out_context_blobs = out_context_blobs;
 
+       DEBUG(10,("smbd_smb2_create_send: %s - %s\n",
+                 fsp_str_dbg(result), fsp_fnum_dbg(result)));
+
        tevent_req_done(req);
        return tevent_req_post(req, ev);
 }
@@ -885,9 +1106,6 @@ bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
        if (!smb2req) {
                return false;
        }
-       if (!smb2req->async) {
-               return false;
-       }
        req = smb2req->subreq;
        if (!req) {
                return false;
@@ -896,6 +1114,9 @@ bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
        if (!state) {
                return false;
        }
+       if (!state->open_was_deferred) {
+               return false;
+       }
        if (p_request_time) {
                *p_request_time = state->request_time;
        }
@@ -910,9 +1131,9 @@ bool get_deferred_open_message_state_smb2(struct smbd_smb2_request *smb2req,
  close.
 *********************************************************/
 
-static struct smbd_smb2_request *find_open_smb2req(uint64_t mid)
+static struct smbd_smb2_request *find_open_smb2req(
+       struct smbd_server_connection *sconn, uint64_t mid)
 {
-       struct smbd_server_connection *sconn = smbd_server_conn;
        struct smbd_smb2_request *smb2req;
 
        for (smb2req = sconn->smb2.requests; smb2req; smb2req = smb2req->next) {
@@ -933,10 +1154,12 @@ static struct smbd_smb2_request *find_open_smb2req(uint64_t mid)
        return NULL;
 }
 
-bool open_was_deferred_smb2(uint64_t mid)
+bool open_was_deferred_smb2(struct smbd_server_connection *sconn, uint64_t mid)
 {
        struct smbd_smb2_create_state *state = NULL;
-       struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
 
        if (!smb2req) {
                DEBUG(10,("open_was_deferred_smb2: mid %llu smb2req == NULL\n",
@@ -955,7 +1178,7 @@ bool open_was_deferred_smb2(uint64_t mid)
                return false;
        }
        /* It's not in progress if there's no timeout event. */
-       if (!state->te) {
+       if (!state->open_was_deferred) {
                return false;
        }
 
@@ -986,15 +1209,19 @@ static void remove_deferred_open_message_smb2_internal(struct smbd_smb2_request
                "mid %llu\n",
                (unsigned long long)mid ));
 
+       state->open_was_deferred = false;
        /* Ensure we don't have any outstanding timer event. */
        TALLOC_FREE(state->te);
        /* Ensure we don't have any outstanding immediate event. */
        TALLOC_FREE(state->im);
 }
 
-void remove_deferred_open_message_smb2(uint64_t mid)
+void remove_deferred_open_message_smb2(
+       struct smbd_server_connection *sconn, uint64_t mid)
 {
-       struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
 
        if (!smb2req) {
                DEBUG(10,("remove_deferred_open_message_smb2: "
@@ -1026,27 +1253,30 @@ static void smbd_smb2_create_request_dispatch_immediate(struct tevent_context *c
        }
 }
 
-void schedule_deferred_open_message_smb2(uint64_t mid)
+bool schedule_deferred_open_message_smb2(
+       struct smbd_server_connection *sconn, uint64_t mid)
 {
        struct smbd_smb2_create_state *state = NULL;
-       struct smbd_smb2_request *smb2req = find_open_smb2req(mid);
+       struct smbd_smb2_request *smb2req;
+
+       smb2req = find_open_smb2req(sconn, mid);
 
        if (!smb2req) {
                DEBUG(10,("schedule_deferred_open_message_smb2: "
                        "can't find mid %llu\n",
                        (unsigned long long)mid ));
-               return;
+               return false;
        }
        if (!smb2req->subreq) {
-               return;
+               return false;
        }
        if (!tevent_req_is_in_progress(smb2req->subreq)) {
-               return;
+               return false;
        }
        state = tevent_req_data(smb2req->subreq,
                        struct smbd_smb2_create_state);
        if (!state) {
-               return;
+               return false;
        }
 
        /* Ensure we don't have any outstanding timer event. */
@@ -1056,7 +1286,7 @@ void schedule_deferred_open_message_smb2(uint64_t mid)
 
        /*
         * This is subtle. We must null out the callback
-        * before resheduling, else the first call to
+        * before rescheduling, else the first call to
         * tevent_req_nterror() causes the _receive()
         * function to be called, this causing tevent_req_post()
         * to crash.
@@ -1067,6 +1297,7 @@ void schedule_deferred_open_message_smb2(uint64_t mid)
        if (!state->im) {
                smbd_server_connection_terminate(smb2req->sconn,
                        nt_errstr(NT_STATUS_NO_MEMORY));
+               return false;
        }
 
        DEBUG(10,("schedule_deferred_open_message_smb2: "
@@ -1074,58 +1305,11 @@ void schedule_deferred_open_message_smb2(uint64_t mid)
                (unsigned long long)mid ));
 
        tevent_schedule_immediate(state->im,
-                       smb2req->sconn->smb2.event_ctx,
+                       smb2req->sconn->ev_ctx,
                        smbd_smb2_create_request_dispatch_immediate,
                        smb2req);
-}
-
-/*********************************************************
- Re-process this call.
-*********************************************************/
-
-static void smb2_deferred_open_timer(struct event_context *ev,
-                                       struct timed_event *te,
-                                       struct timeval _tval,
-                                       void *private_data)
-{
-       NTSTATUS status;
-       struct smbd_smb2_create_state *state = NULL;
-       struct smbd_smb2_request *smb2req = talloc_get_type(private_data,
-                                               struct smbd_smb2_request);
-
-       DEBUG(10,("smb2_deferred_open_timer: [idx=%d], %s\n",
-               smb2req->current_idx,
-               tevent_req_default_print(smb2req->subreq, talloc_tos()) ));
-
-       state = tevent_req_data(smb2req->subreq,
-                       struct smbd_smb2_create_state);
-       if (!state) {
-               return;
-       }
-       /*
-        * Null this out, don't talloc_free. It will
-        * be talloc_free'd by the tevent library when
-        * this returns.
-        */
-       state->te = NULL;
-       /* Ensure we don't have any outstanding immediate event. */
-       TALLOC_FREE(state->im);
-
-       /*
-        * This is subtle. We must null out the callback
-        * before resheduling, else the first call to
-        * tevent_req_nterror() causes the _receive()
-        * function to be called, this causing tevent_req_post()
-        * to crash.
-        */
-       tevent_req_set_callback(smb2req->subreq, NULL, NULL);
 
-       status = smbd_smb2_request_dispatch(smb2req);
-
-       if (!NT_STATUS_IS_OK(status)) {
-               smbd_server_connection_terminate(smb2req->sconn,
-                               nt_errstr(status));
-       }
+       return true;
 }
 
 static bool smbd_smb2_create_cancel(struct tevent_req *req)
@@ -1146,11 +1330,15 @@ static bool smbd_smb2_create_cancel(struct tevent_req *req)
        smb2req = state->smb2req;
        mid = get_mid_from_smb2req(smb2req);
 
-       remove_deferred_open_entry(state->id, mid);
+       if (is_deferred_open_async(state->private_data.data)) {
+               /* Can't cancel an async create. */
+               return false;
+       }
+
        remove_deferred_open_message_smb2_internal(smb2req, mid);
-       smb2req->cancelled = true;
 
-       tevent_req_done(req);
+       tevent_req_defer_callback(req, smb2req->sconn->ev_ctx);
+       tevent_req_nterror(req, NT_STATUS_CANCELLED);
        return true;
 }
 
@@ -1184,35 +1372,6 @@ bool push_deferred_open_message_smb2(struct smbd_smb2_request *smb2req,
                return false;
        }
 
-#if 1
-       /* Boo - turns out this isn't what W2K8R2
-          does. It actually sends the STATUS_PENDING
-          message followed by the STATUS_SHARING_VIOLATION
-          message. Surely this means that all open
-          calls (even on directories) will potentially
-          fail in a chain.... ? And I've seen directory
-          opens as the start of a chain. JRA.
-
-          Update: 19th May 2010. Talking with Microsoft
-          engineers at the plugfest this is a bug in
-          Windows. Re-enable this code.
-       */
-       /*
-        * More subtlety. To match W2K8R2 don't
-        * send a "gone async" message if it's simply
-        * a STATUS_SHARING_VIOLATION (short) wait, not
-        * an oplock break wait. We do this by prematurely
-        * setting smb2req->async flag.
-        */
-       if (timeout.tv_sec < 2) {
-               DEBUG(10,("push_deferred_open_message_smb2: "
-                       "short timer wait (usec = %u). "
-                       "Don't send async message.\n",
-                       (unsigned int)timeout.tv_usec ));
-               smb2req->async = true;
-       }
-#endif
-
        /* Re-schedule us to retry on timer expiry. */
        end_time = timeval_sum(&request_time, &timeout);
 
@@ -1222,14 +1381,7 @@ bool push_deferred_open_message_smb2(struct smbd_smb2_request *smb2req,
                                &end_time,
                                true) ));
 
-       state->te = event_add_timed(smb2req->sconn->smb2.event_ctx,
-                               state,
-                               end_time,
-                               smb2_deferred_open_timer,
-                               smb2req);
-        if (!state->te) {
-               return false;
-       }
+       state->open_was_deferred = true;
 
        /* allow this request to be canceled */
        tevent_req_set_cancel_fn(req, smbd_smb2_create_cancel);