Context Navigation

source: vendor/3.6.23/source3/smbd/reply.c

Visit:

Last change on this file was 860, checked in by Silvan Scherrer, 11 years ago
Samba 3.6: updated vendor to latest version
File size: 201.6 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	Main SMB reply routines
4	Copyright (C) Andrew Tridgell 1992-1998
5	Copyright (C) Andrew Bartlett 2001
6	Copyright (C) Jeremy Allison 1992-2007.
7	Copyright (C) Volker Lendecke 2007
8
9	This program is free software; you can redistribute it and/or modify
10	it under the terms of the GNU General Public License as published by
11	the Free Software Foundation; either version 3 of the License, or
12	(at your option) any later version.
13
14	This program is distributed in the hope that it will be useful,
15	but WITHOUT ANY WARRANTY; without even the implied warranty of
16	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	GNU General Public License for more details.
18
19	You should have received a copy of the GNU General Public License
20	along with this program. If not, see <http://www.gnu.org/licenses/>.
21	*/
22	/*
23	This file handles most of the reply_ calls that the server
24	makes to handle specific protocols
25	*/
26
27	#include "includes.h"
28	#include "system/filesys.h"
29	#include "printing.h"
30	#include "smbd/smbd.h"
31	#include "smbd/globals.h"
32	#include "fake_file.h"
33	#include "rpc_client/rpc_client.h"
34	#include "../librpc/gen_ndr/ndr_spoolss_c.h"
35	#include "rpc_client/cli_spoolss.h"
36	#include "rpc_client/init_spoolss.h"
37	#include "rpc_server/rpc_ncacn_np.h"
38	#include "libcli/security/security.h"
39	#include "libsmb/nmblib.h"
40	#include "auth.h"
41	#include "smbprofile.h"
42
43	/****************************************************************************
44	Ensure we check the path in exactly the same way as W2K for a findfirst/findnext
45	path or anything including wildcards.
46	We're assuming here that '/' is not the second byte in any multibyte char
47	set (a safe assumption). '\\' may be the second byte in a multibyte char
48	set.
49	****************************************************************************/
50
51	/* Custom version for processing POSIX paths. */
52	#define IS_PATH_SEP(c,posix_only) ((c) == '/' \|\| (!(posix_only) && (c) == '\\'))
53
54	static NTSTATUS check_path_syntax_internal(char *path,
55	bool posix_path,
56	bool *p_last_component_contains_wcard)
57	{
58	char *d = path;
59	const char *s = path;
60	NTSTATUS ret = NT_STATUS_OK;
61	bool start_of_name_component = True;
62	bool stream_started = false;
63
64	*p_last_component_contains_wcard = False;
65
66	while (*s) {
67	if (stream_started) {
68	switch (*s) {
69	case '/':
70	case '\\':
71	return NT_STATUS_OBJECT_NAME_INVALID;
72	case ':':
73	if (s[1] == '\0') {
74	return NT_STATUS_OBJECT_NAME_INVALID;
75	}
76	if (strchr_m(&s[1], ':')) {
77	return NT_STATUS_OBJECT_NAME_INVALID;
78	}
79	break;
80	}
81	}
82
83	if ((*s == ':') && !posix_path && !stream_started) {
84	if (*p_last_component_contains_wcard) {
85	return NT_STATUS_OBJECT_NAME_INVALID;
86	}
87	/* Stream names allow more characters than file names.
88	We're overloading posix_path here to allow a wider
89	range of characters. If stream_started is true this
90	is still a Windows path even if posix_path is true.
91	JRA.
92	*/
93	stream_started = true;
94	start_of_name_component = false;
95	posix_path = true;
96
97	if (s[1] == '\0') {
98	return NT_STATUS_OBJECT_NAME_INVALID;
99	}
100	}
101
102	if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
103	/*
104	* Safe to assume is not the second part of a mb char
105	* as this is handled below.
106	*/
107	/* Eat multiple '/' or '\\' */
108	while (IS_PATH_SEP(*s,posix_path)) {
109	s++;
110	}
111	if ((d != path) && (*s != '\0')) {
112	/* We only care about non-leading or trailing '/' or '\\' */
113	*d++ = '/';
114	}
115
116	start_of_name_component = True;
117	/* New component. */
118	*p_last_component_contains_wcard = False;
119	continue;
120	}
121
122	if (start_of_name_component) {
123	if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) \|\| s[2] == '\0')) {
124	/* Uh oh - "/../" or "\\..\\" or "/..\0" or "\\..\0" ! */
125
126	/*
127	* No mb char starts with '.' so we're safe checking the directory separator here.
128	*/
129
130	/* If we just added a '/' - delete it */
131	if ((d > path) && (*(d-1) == '/')) {
132	*(d-1) = '\0';
133	d--;
134	}
135
136	/* Are we at the start ? Can't go back further if so. */
137	if (d <= path) {
138	ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
139	break;
140	}
141	/* Go back one level... */
142	/* We know this is safe as '/' cannot be part of a mb sequence. */
143	/* NOTE - if this assumption is invalid we are not in good shape... */
144	/* Decrement d first as d points to the next char to write into. */
145	for (d--; d > path; d--) {
146	if (*d == '/')
147	break;
148	}
149	s += 2; /* Else go past the .. */
150	/* We're still at the start of a name component, just the previous one. */
151	continue;
152
153	} else if ((s[0] == '.') && ((s[1] == '\0') \|\| IS_PATH_SEP(s[1],posix_path))) {
154	if (posix_path) {
155	/* Eat the '.' */
156	s++;
157	continue;
158	}
159	}
160
161	}
162
163	if (!(*s & 0x80)) {
164	if (!posix_path) {
165	if (s <= 0x1f \|\| s == '\|') {
166	return NT_STATUS_OBJECT_NAME_INVALID;
167	}
168	switch (*s) {
169	case '*':
170	case '?':
171	case '<':
172	case '>':
173	case '"':
174	*p_last_component_contains_wcard = True;
175	break;
176	default:
177	break;
178	}
179	}
180	d++ = s++;
181	} else {
182	size_t siz;
183	/* Get the size of the next MB character. */
184	next_codepoint(s,&siz);
185	switch(siz) {
186	case 5:
187	d++ = s++;
188	/fall through/
189	case 4:
190	d++ = s++;
191	/fall through/
192	case 3:
193	d++ = s++;
194	/fall through/
195	case 2:
196	d++ = s++;
197	/fall through/
198	case 1:
199	d++ = s++;
200	break;
201	default:
202	DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
203	*d = '\0';
204	return NT_STATUS_INVALID_PARAMETER;
205	}
206	}
207	start_of_name_component = False;
208	}
209
210	*d = '\0';
211
212	return ret;
213	}
214
215	/****************************************************************************
216	Ensure we check the path in exactly the same way as W2K for regular pathnames.
217	No wildcards allowed.
218	****************************************************************************/
219
220	NTSTATUS check_path_syntax(char *path)
221	{
222	bool ignore;
223	return check_path_syntax_internal(path, False, &ignore);
224	}
225
226	/****************************************************************************
227	Ensure we check the path in exactly the same way as W2K for regular pathnames.
228	Wildcards allowed - p_contains_wcard returns true if the last component contained
229	a wildcard.
230	****************************************************************************/
231
232	NTSTATUS check_path_syntax_wcard(char path, bool p_contains_wcard)
233	{
234	return check_path_syntax_internal(path, False, p_contains_wcard);
235	}
236
237	/****************************************************************************
238	Check the path for a POSIX client.
239	We're assuming here that '/' is not the second byte in any multibyte char
240	set (a safe assumption).
241	****************************************************************************/
242
243	NTSTATUS check_path_syntax_posix(char *path)
244	{
245	bool ignore;
246	return check_path_syntax_internal(path, True, &ignore);
247	}
248
249	/****************************************************************************
250	Pull a string and check the path allowing a wilcard - provide for error return.
251	****************************************************************************/
252
253	size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
254	const char *base_ptr,
255	uint16 smb_flags2,
256	char **pp_dest,
257	const char *src,
258	size_t src_len,
259	int flags,
260	NTSTATUS *err,
261	bool *contains_wcard)
262	{
263	size_t ret;
264
265	*pp_dest = NULL;
266
267	ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
268	src_len, flags);
269
270	if (!*pp_dest) {
271	*err = NT_STATUS_INVALID_PARAMETER;
272	return ret;
273	}
274
275	*contains_wcard = False;
276
277	if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
278	/*
279	* For a DFS path the function parse_dfs_path()
280	* will do the path processing, just make a copy.
281	*/
282	*err = NT_STATUS_OK;
283	return ret;
284	}
285
286	if (lp_posix_pathnames()) {
287	err = check_path_syntax_posix(pp_dest);
288	} else {
289	err = check_path_syntax_wcard(pp_dest, contains_wcard);
290	}
291
292	return ret;
293	}
294
295	/****************************************************************************
296	Pull a string and check the path - provide for error return.
297	****************************************************************************/
298
299	size_t srvstr_get_path(TALLOC_CTX *ctx,
300	const char *base_ptr,
301	uint16 smb_flags2,
302	char **pp_dest,
303	const char *src,
304	size_t src_len,
305	int flags,
306	NTSTATUS *err)
307	{
308	bool ignore;
309	return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
310	src_len, flags, err, &ignore);
311	}
312
313	size_t srvstr_get_path_req_wcard(TALLOC_CTX mem_ctx, struct smb_request req,
314	char *pp_dest, const char src, int flags,
315	NTSTATUS err, bool contains_wcard)
316	{
317	return srvstr_get_path_wcard(mem_ctx, (char *)req->inbuf, req->flags2,
318	pp_dest, src, smbreq_bufrem(req, src),
319	flags, err, contains_wcard);
320	}
321
322	size_t srvstr_get_path_req(TALLOC_CTX mem_ctx, struct smb_request req,
323	char *pp_dest, const char src, int flags,
324	NTSTATUS *err)
325	{
326	bool ignore;
327	return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
328	flags, err, &ignore);
329	}
330
331	/****************************************************************************
332	Check if we have a correct fsp pointing to a file. Basic check for open fsp.
333	****************************************************************************/
334
335	bool check_fsp_open(connection_struct conn, struct smb_request req,
336	files_struct *fsp)
337	{
338	if ((fsp == NULL) \|\| (conn == NULL)) {
339	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
340	return False;
341	}
342	if ((conn != fsp->conn) \|\| (req->vuid != fsp->vuid)) {
343	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
344	return False;
345	}
346	return True;
347	}
348
349	/****************************************************************************
350	Check if we have a correct fsp pointing to a file.
351	****************************************************************************/
352
353	bool check_fsp(connection_struct conn, struct smb_request req,
354	files_struct *fsp)
355	{
356	if (!check_fsp_open(conn, req, fsp)) {
357	return False;
358	}
359	if (fsp->is_directory) {
360	reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
361	return False;
362	}
363	if (fsp->fh->fd == -1) {
364	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
365	return False;
366	}
367	fsp->num_smb_operations++;
368	return True;
369	}
370
371	/****************************************************************************
372	Check if we have a correct fsp pointing to a quota fake file. Replacement for
373	the CHECK_NTQUOTA_HANDLE_OK macro.
374	****************************************************************************/
375
376	bool check_fsp_ntquota_handle(connection_struct conn, struct smb_request req,
377	files_struct *fsp)
378	{
379	if (!check_fsp_open(conn, req, fsp)) {
380	return false;
381	}
382
383	if (fsp->is_directory) {
384	return false;
385	}
386
387	if (fsp->fake_file_handle == NULL) {
388	return false;
389	}
390
391	if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
392	return false;
393	}
394
395	if (fsp->fake_file_handle->private_data == NULL) {
396	return false;
397	}
398
399	return true;
400	}
401
402	static bool netbios_session_retarget(struct smbd_server_connection *sconn,
403	const char *name, int name_type)
404	{
405	char *trim_name;
406	char *trim_name_type;
407	const char *retarget_parm;
408	char *retarget;
409	char *p;
410	int retarget_type = 0x20;
411	int retarget_port = 139;
412	struct sockaddr_storage retarget_addr;
413	struct sockaddr_in *in_addr;
414	bool ret = false;
415	uint8_t outbuf[10];
416
417	if (get_socket_port(sconn->sock) != 139) {
418	return false;
419	}
420
421	trim_name = talloc_strdup(talloc_tos(), name);
422	if (trim_name == NULL) {
423	goto fail;
424	}
425	trim_char(trim_name, ' ', ' ');
426
427	trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
428	name_type);
429	if (trim_name_type == NULL) {
430	goto fail;
431	}
432
433	retarget_parm = lp_parm_const_string(-1, "netbios retarget",
434	trim_name_type, NULL);
435	if (retarget_parm == NULL) {
436	retarget_parm = lp_parm_const_string(-1, "netbios retarget",
437	trim_name, NULL);
438	}
439	if (retarget_parm == NULL) {
440	goto fail;
441	}
442
443	retarget = talloc_strdup(trim_name, retarget_parm);
444	if (retarget == NULL) {
445	goto fail;
446	}
447
448	DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
449
450	p = strchr(retarget, ':');
451	if (p != NULL) {
452	*p++ = '\0';
453	retarget_port = atoi(p);
454	}
455
456	p = strchr_m(retarget, '#');
457	if (p != NULL) {
458	*p++ = '\0';
459	if (sscanf(p, "%x", &retarget_type) != 1) {
460	goto fail;
461	}
462	}
463
464	ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
465	if (!ret) {
466	DEBUG(10, ("could not resolve %s\n", retarget));
467	goto fail;
468	}
469
470	if (retarget_addr.ss_family != AF_INET) {
471	DEBUG(10, ("Retarget target not an IPv4 addr\n"));
472	goto fail;
473	}
474
475	in_addr = (struct sockaddr_in )(void )&retarget_addr;
476
477	_smb_setlen(outbuf, 6);
478	SCVAL(outbuf, 0, 0x84);
479	(uint32_t )(outbuf+4) = in_addr->sin_addr.s_addr;
480	(uint16_t )(outbuf+8) = htons(retarget_port);
481
482	if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
483	NULL)) {
484	exit_server_cleanly("netbios_session_regarget: srv_send_smb "
485	"failed.");
486	}
487
488	ret = true;
489	fail:
490	TALLOC_FREE(trim_name);
491	return ret;
492	}
493
494	/****************************************************************************
495	Reply to a (netbios-level) special message.
496	****************************************************************************/
497
498	void reply_special(struct smbd_server_connection sconn, char inbuf, size_t inbuf_size)
499	{
500	int msg_type = CVAL(inbuf,0);
501	int msg_flags = CVAL(inbuf,1);
502	/*
503	* We only really use 4 bytes of the outbuf, but for the smb_setlen
504	* calculation & friends (srv_send_smb uses that) we need the full smb
505	* header.
506	*/
507	char outbuf[smb_size];
508
509	memset(outbuf, '\0', sizeof(outbuf));
510
511	smb_setlen(outbuf,0);
512
513	switch (msg_type) {
514	case 0x81: /* session request */
515	{
516	/* inbuf_size is guarenteed to be at least 4. */
517	fstring name1,name2;
518	int name_type1, name_type2;
519	int name_len1, name_len2;
520
521	name1 = name2 = 0;
522
523	if (sconn->nbt.got_session) {
524	exit_server_cleanly("multiple session request not permitted");
525	}
526
527	SCVAL(outbuf,0,0x82);
528	SCVAL(outbuf,3,0);
529
530	/* inbuf_size is guaranteed to be at least 4. */
531	name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
532	if (name_len1 <= 0 \|\| name_len1 > inbuf_size - 4) {
533	DEBUG(0,("Invalid name length in session request\n"));
534	break;
535	}
536	name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
537	if (name_len2 <= 0 \|\| name_len2 > inbuf_size - 4 - name_len1) {
538	DEBUG(0,("Invalid name length in session request\n"));
539	break;
540	}
541
542	name_type1 = name_extract((unsigned char *)inbuf,
543	inbuf_size,(unsigned int)4,name1);
544	name_type2 = name_extract((unsigned char *)inbuf,
545	inbuf_size,(unsigned int)(4 + name_len1),name2);
546
547	if (name_type1 == -1 \|\| name_type2 == -1) {
548	DEBUG(0,("Invalid name type in session request\n"));
549	break;
550	}
551
552	DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
553	name1, name_type1, name2, name_type2));
554
555	if (netbios_session_retarget(sconn, name1, name_type1)) {
556	exit_server_cleanly("retargeted client");
557	}
558
559	/*
560	* Windows NT/2k uses "*SMBSERVER" and XP uses
561	* "*SMBSERV" arrggg!!!
562	*/
563	if (strequal(name1, "*SMBSERVER ")
564	\|\| strequal(name1, "*SMBSERV ")) {
565	fstrcpy(name1, sconn->client_id.addr);
566	}
567
568	set_local_machine_name(name1, True);
569	set_remote_machine_name(name2, True);
570
571	DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
572	get_local_machine_name(), get_remote_machine_name(),
573	name_type2));
574
575	if (name_type2 == 'R') {
576	/* We are being asked for a pathworks session ---
577	no thanks! */
578	SCVAL(outbuf, 0,0x83);
579	break;
580	}
581
582	/* only add the client's machine name to the list
583	of possibly valid usernames if we are operating
584	in share mode security */
585	if (lp_security() == SEC_SHARE) {
586	add_session_user(sconn, get_remote_machine_name());
587	}
588
589	reload_services(sconn->msg_ctx, sconn->sock, True);
590	reopen_logs();
591
592	sconn->nbt.got_session = true;
593	break;
594	}
595
596	case 0x89: /* session keepalive request
597	(some old clients produce this?) */
598	SCVAL(outbuf,0,SMBkeepalive);
599	SCVAL(outbuf,3,0);
600	break;
601
602	case 0x82: /* positive session response */
603	case 0x83: /* negative session response */
604	case 0x84: /* retarget session response */
605	DEBUG(0,("Unexpected session response\n"));
606	break;
607
608	case SMBkeepalive: /* session keepalive */
609	default:
610	return;
611	}
612
613	DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
614	msg_type, msg_flags));
615
616	srv_send_smb(sconn, outbuf, false, 0, false, NULL);
617	return;
618	}
619
620	/****************************************************************************
621	Reply to a tcon.
622	conn POINTER CAN BE NULL HERE !
623	****************************************************************************/
624
625	void reply_tcon(struct smb_request *req)
626	{
627	connection_struct *conn = req->conn;
628	const char *service;
629	char *service_buf = NULL;
630	char *password = NULL;
631	char *dev = NULL;
632	int pwlen=0;
633	NTSTATUS nt_status;
634	const char *p;
635	DATA_BLOB password_blob;
636	TALLOC_CTX *ctx = talloc_tos();
637	struct smbd_server_connection *sconn = req->sconn;
638
639	START_PROFILE(SMBtcon);
640
641	if (req->buflen < 4) {
642	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
643	END_PROFILE(SMBtcon);
644	return;
645	}
646
647	p = (const char *)req->buf + 1;
648	p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
649	p += 1;
650	pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
651	p += pwlen+1;
652	p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
653	p += 1;
654
655	if (service_buf == NULL \|\| password == NULL \|\| dev == NULL) {
656	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
657	END_PROFILE(SMBtcon);
658	return;
659	}
660	p = strrchr_m(service_buf,'\\');
661	if (p) {
662	service = p+1;
663	} else {
664	service = service_buf;
665	}
666
667	password_blob = data_blob(password, pwlen+1);
668
669	conn = make_connection(sconn,service,password_blob,dev,
670	req->vuid,&nt_status);
671	req->conn = conn;
672
673	data_blob_clear_free(&password_blob);
674
675	if (!conn) {
676	reply_nterror(req, nt_status);
677	END_PROFILE(SMBtcon);
678	return;
679	}
680
681	reply_outbuf(req, 2, 0);
682	SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
683	SSVAL(req->outbuf,smb_vwv1,conn->cnum);
684	SSVAL(req->outbuf,smb_tid,conn->cnum);
685
686	DEBUG(3,("tcon service=%s cnum=%d\n",
687	service, conn->cnum));
688
689	END_PROFILE(SMBtcon);
690	return;
691	}
692
693	/****************************************************************************
694	Reply to a tcon and X.
695	conn POINTER CAN BE NULL HERE !
696	****************************************************************************/
697
698	void reply_tcon_and_X(struct smb_request *req)
699	{
700	connection_struct *conn = req->conn;
701	const char *service = NULL;
702	DATA_BLOB password;
703	TALLOC_CTX *ctx = talloc_tos();
704	/* what the cleint thinks the device is */
705	char *client_devicetype = NULL;
706	/* what the server tells the client the share represents */
707	const char *server_devicetype;
708	NTSTATUS nt_status;
709	int passlen;
710	char *path = NULL;
711	const char p, q;
712	uint16 tcon_flags;
713	struct smbd_server_connection *sconn = req->sconn;
714
715	START_PROFILE(SMBtconX);
716
717	if (req->wct < 4) {
718	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
719	END_PROFILE(SMBtconX);
720	return;
721	}
722
723	passlen = SVAL(req->vwv+3, 0);
724	tcon_flags = SVAL(req->vwv+2, 0);
725
726	/* we might have to close an old one */
727	if ((tcon_flags & 0x1) && conn) {
728	close_cnum(conn,req->vuid);
729	req->conn = NULL;
730	conn = NULL;
731	}
732
733	if ((passlen > MAX_PASS_LEN) \|\| (passlen >= req->buflen)) {
734	reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
735	END_PROFILE(SMBtconX);
736	return;
737	}
738
739	if (sconn->smb1.negprot.encrypted_passwords) {
740	password = data_blob_talloc(talloc_tos(), req->buf, passlen);
741	if (lp_security() == SEC_SHARE) {
742	/*
743	* Security = share always has a pad byte
744	* after the password.
745	*/
746	p = (const char *)req->buf + passlen + 1;
747	} else {
748	p = (const char *)req->buf + passlen;
749	}
750	} else {
751	password = data_blob_talloc(talloc_tos(), req->buf, passlen+1);
752	/* Ensure correct termination */
753	password.data[passlen]=0;
754	p = (const char *)req->buf + passlen + 1;
755	}
756
757	p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
758
759	if (path == NULL) {
760	data_blob_clear_free(&password);
761	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
762	END_PROFILE(SMBtconX);
763	return;
764	}
765
766	/*
767	* the service name can be either: \\server\share
768	* or share directly like on the DELL PowerVault 705
769	*/
770	if (*path=='\\') {
771	q = strchr_m(path+2,'\\');
772	if (!q) {
773	data_blob_clear_free(&password);
774	reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
775	END_PROFILE(SMBtconX);
776	return;
777	}
778	service = q+1;
779	} else {
780	service = path;
781	}
782
783	p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
784	&client_devicetype, p,
785	MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
786
787	if (client_devicetype == NULL) {
788	data_blob_clear_free(&password);
789	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
790	END_PROFILE(SMBtconX);
791	return;
792	}
793
794	DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
795
796	conn = make_connection(sconn, service, password, client_devicetype,
797	req->vuid, &nt_status);
798	req->conn =conn;
799
800	data_blob_clear_free(&password);
801
802	if (!conn) {
803	reply_nterror(req, nt_status);
804	END_PROFILE(SMBtconX);
805	return;
806	}
807
808	if ( IS_IPC(conn) )
809	server_devicetype = "IPC";
810	else if ( IS_PRINT(conn) )
811	server_devicetype = "LPT1:";
812	else
813	server_devicetype = "A:";
814
815	if (get_Protocol() < PROTOCOL_NT1) {
816	reply_outbuf(req, 2, 0);
817	if (message_push_string(&req->outbuf, server_devicetype,
818	STR_TERMINATE\|STR_ASCII) == -1) {
819	reply_nterror(req, NT_STATUS_NO_MEMORY);
820	END_PROFILE(SMBtconX);
821	return;
822	}
823	} else {
824	/* NT sets the fstype of IPC$ to the null string */
825	const char *fstype = IS_IPC(conn) ? "" : lp_fstype(SNUM(conn));
826
827	if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
828	/* Return permissions. */
829	uint32 perm1 = 0;
830	uint32 perm2 = 0;
831
832	reply_outbuf(req, 7, 0);
833
834	if (IS_IPC(conn)) {
835	perm1 = FILE_ALL_ACCESS;
836	perm2 = FILE_ALL_ACCESS;
837	} else {
838	perm1 = conn->share_access;
839	}
840
841	SIVAL(req->outbuf, smb_vwv3, perm1);
842	SIVAL(req->outbuf, smb_vwv5, perm2);
843	} else {
844	reply_outbuf(req, 3, 0);
845	}
846
847	if ((message_push_string(&req->outbuf, server_devicetype,
848	STR_TERMINATE\|STR_ASCII) == -1)
849	\|\| (message_push_string(&req->outbuf, fstype,
850	STR_TERMINATE) == -1)) {
851	reply_nterror(req, NT_STATUS_NO_MEMORY);
852	END_PROFILE(SMBtconX);
853	return;
854	}
855
856	/* what does setting this bit do? It is set by NT4 and
857	may affect the ability to autorun mounted cdroms */
858	SSVAL(req->outbuf, smb_vwv2, SMB_SUPPORT_SEARCH_BITS\|
859	(lp_csc_policy(SNUM(conn)) << 2));
860
861	if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
862	DEBUG(2,("Serving %s as a Dfs root\n",
863	lp_servicename(SNUM(conn)) ));
864	SSVAL(req->outbuf, smb_vwv2,
865	SMB_SHARE_IN_DFS \| SVAL(req->outbuf, smb_vwv2));
866	}
867	}
868
869
870	DEBUG(3,("tconX service=%s \n",
871	service));
872
873	/* set the incoming and outgoing tid to the just created one */
874	SSVAL(req->inbuf,smb_tid,conn->cnum);
875	SSVAL(req->outbuf,smb_tid,conn->cnum);
876
877	END_PROFILE(SMBtconX);
878
879	req->tid = conn->cnum;
880	chain_reply(req);
881	return;
882	}
883
884	/****************************************************************************
885	Reply to an unknown type.
886	****************************************************************************/
887
888	void reply_unknown_new(struct smb_request *req, uint8 type)
889	{
890	DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
891	smb_fn_name(type), type, type));
892	reply_force_doserror(req, ERRSRV, ERRunknownsmb);
893	return;
894	}
895
896	/****************************************************************************
897	Reply to an ioctl.
898	conn POINTER CAN BE NULL HERE !
899	****************************************************************************/
900
901	void reply_ioctl(struct smb_request *req)
902	{
903	connection_struct *conn = req->conn;
904	uint16 device;
905	uint16 function;
906	uint32 ioctl_code;
907	int replysize;
908	char *p;
909
910	START_PROFILE(SMBioctl);
911
912	if (req->wct < 3) {
913	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
914	END_PROFILE(SMBioctl);
915	return;
916	}
917
918	device = SVAL(req->vwv+1, 0);
919	function = SVAL(req->vwv+2, 0);
920	ioctl_code = (device << 16) + function;
921
922	DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
923
924	switch (ioctl_code) {
925	case IOCTL_QUERY_JOB_INFO:
926	replysize = 32;
927	break;
928	default:
929	reply_force_doserror(req, ERRSRV, ERRnosupport);
930	END_PROFILE(SMBioctl);
931	return;
932	}
933
934	reply_outbuf(req, 8, replysize+1);
935	SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
936	SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
937	SSVAL(req->outbuf,smb_vwv6,52); /* Offset to data */
938	p = smb_buf(req->outbuf);
939	memset(p, '\0', replysize+1); /* valgrind-safe. */
940	p += 1; /* Allow for alignment */
941
942	switch (ioctl_code) {
943	case IOCTL_QUERY_JOB_INFO:
944	{
945	files_struct *fsp = file_fsp(
946	req, SVAL(req->vwv+0, 0));
947	if (!fsp) {
948	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
949	END_PROFILE(SMBioctl);
950	return;
951	}
952	/* Job number */
953	if (fsp->print_file) {
954	SSVAL(p, 0, fsp->print_file->rap_jobid);
955	} else {
956	SSVAL(p, 0, 0);
957	}
958	srvstr_push((char *)req->outbuf, req->flags2, p+2,
959	global_myname(), 15,
960	STR_TERMINATE\|STR_ASCII);
961	if (conn) {
962	srvstr_push((char *)req->outbuf, req->flags2,
963	p+18, lp_servicename(SNUM(conn)),
964	13, STR_TERMINATE\|STR_ASCII);
965	} else {
966	memset(p+18, 0, 13);
967	}
968	break;
969	}
970	}
971
972	END_PROFILE(SMBioctl);
973	return;
974	}
975
976	/****************************************************************************
977	Strange checkpath NTSTATUS mapping.
978	****************************************************************************/
979
980	static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
981	{
982	/* Strange DOS error code semantics only for checkpath... */
983	if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
984	if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
985	/* We need to map to ERRbadpath */
986	return NT_STATUS_OBJECT_PATH_NOT_FOUND;
987	}
988	}
989	return status;
990	}
991
992	/****************************************************************************
993	Reply to a checkpath.
994	****************************************************************************/
995
996	void reply_checkpath(struct smb_request *req)
997	{
998	connection_struct *conn = req->conn;
999	struct smb_filename *smb_fname = NULL;
1000	char *name = NULL;
1001	NTSTATUS status;
1002	TALLOC_CTX *ctx = talloc_tos();
1003
1004	START_PROFILE(SMBcheckpath);
1005
1006	srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1007	STR_TERMINATE, &status);
1008
1009	if (!NT_STATUS_IS_OK(status)) {
1010	status = map_checkpath_error(req->flags2, status);
1011	reply_nterror(req, status);
1012	END_PROFILE(SMBcheckpath);
1013	return;
1014	}
1015
1016	DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1017
1018	status = filename_convert(ctx,
1019	conn,
1020	req->flags2 & FLAGS2_DFS_PATHNAMES,
1021	name,
1022	0,
1023	NULL,
1024	&smb_fname);
1025
1026	if (!NT_STATUS_IS_OK(status)) {
1027	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1028	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1029	ERRSRV, ERRbadpath);
1030	END_PROFILE(SMBcheckpath);
1031	return;
1032	}
1033	goto path_err;
1034	}
1035
1036	if (!VALID_STAT(smb_fname->st) &&
1037	(SMB_VFS_STAT(conn, smb_fname) != 0)) {
1038	DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1039	smb_fname_str_dbg(smb_fname), strerror(errno)));
1040	status = map_nt_error_from_unix(errno);
1041	goto path_err;
1042	}
1043
1044	if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1045	reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1046	ERRDOS, ERRbadpath);
1047	goto out;
1048	}
1049
1050	reply_outbuf(req, 0, 0);
1051
1052	path_err:
1053	/* We special case this - as when a Windows machine
1054	is parsing a path is steps through the components
1055	one at a time - if a component fails it expects
1056	ERRbadpath, not ERRbadfile.
1057	*/
1058	status = map_checkpath_error(req->flags2, status);
1059	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1060	/*
1061	* Windows returns different error codes if
1062	* the parent directory is valid but not the
1063	* last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1064	* for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1065	* if the path is invalid.
1066	*/
1067	reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1068	ERRDOS, ERRbadpath);
1069	goto out;
1070	}
1071
1072	reply_nterror(req, status);
1073
1074	out:
1075	TALLOC_FREE(smb_fname);
1076	END_PROFILE(SMBcheckpath);
1077	return;
1078	}
1079
1080	/****************************************************************************
1081	Reply to a getatr.
1082	****************************************************************************/
1083
1084	void reply_getatr(struct smb_request *req)
1085	{
1086	connection_struct *conn = req->conn;
1087	struct smb_filename *smb_fname = NULL;
1088	char *fname = NULL;
1089	int mode=0;
1090	SMB_OFF_T size=0;
1091	time_t mtime=0;
1092	const char *p;
1093	NTSTATUS status;
1094	TALLOC_CTX *ctx = talloc_tos();
1095	bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1096
1097	START_PROFILE(SMBgetatr);
1098
1099	p = (const char *)req->buf + 1;
1100	p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1101	if (!NT_STATUS_IS_OK(status)) {
1102	reply_nterror(req, status);
1103	goto out;
1104	}
1105
1106	/* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1107	under WfWg - weird! */
1108	if (*fname == '\0') {
1109	mode = FILE_ATTRIBUTE_HIDDEN \| FILE_ATTRIBUTE_DIRECTORY;
1110	if (!CAN_WRITE(conn)) {
1111	mode \|= FILE_ATTRIBUTE_READONLY;
1112	}
1113	size = 0;
1114	mtime = 0;
1115	} else {
1116	status = filename_convert(ctx,
1117	conn,
1118	req->flags2 & FLAGS2_DFS_PATHNAMES,
1119	fname,
1120	0,
1121	NULL,
1122	&smb_fname);
1123	if (!NT_STATUS_IS_OK(status)) {
1124	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1125	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1126	ERRSRV, ERRbadpath);
1127	goto out;
1128	}
1129	reply_nterror(req, status);
1130	goto out;
1131	}
1132	if (!VALID_STAT(smb_fname->st) &&
1133	(SMB_VFS_STAT(conn, smb_fname) != 0)) {
1134	DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1135	smb_fname_str_dbg(smb_fname),
1136	strerror(errno)));
1137	reply_nterror(req, map_nt_error_from_unix(errno));
1138	goto out;
1139	}
1140
1141	mode = dos_mode(conn, smb_fname);
1142	size = smb_fname->st.st_ex_size;
1143
1144	if (ask_sharemode) {
1145	struct timespec write_time_ts;
1146	struct file_id fileid;
1147
1148	ZERO_STRUCT(write_time_ts);
1149	fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1150	get_file_infos(fileid, 0, NULL, &write_time_ts);
1151	if (!null_timespec(write_time_ts)) {
1152	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1153	}
1154	}
1155
1156	mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1157	if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1158	size = 0;
1159	}
1160	}
1161
1162	reply_outbuf(req, 10, 0);
1163
1164	SSVAL(req->outbuf,smb_vwv0,mode);
1165	if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1166	srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1167	} else {
1168	srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1169	}
1170	SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1171
1172	if (get_Protocol() >= PROTOCOL_NT1) {
1173	SSVAL(req->outbuf, smb_flg2,
1174	SVAL(req->outbuf, smb_flg2) \| FLAGS2_IS_LONG_NAME);
1175	}
1176
1177	DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1178	smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1179
1180	out:
1181	TALLOC_FREE(smb_fname);
1182	TALLOC_FREE(fname);
1183	END_PROFILE(SMBgetatr);
1184	return;
1185	}
1186
1187	/****************************************************************************
1188	Reply to a setatr.
1189	****************************************************************************/
1190
1191	void reply_setatr(struct smb_request *req)
1192	{
1193	struct smb_file_time ft;
1194	connection_struct *conn = req->conn;
1195	struct smb_filename *smb_fname = NULL;
1196	char *fname = NULL;
1197	int mode;
1198	time_t mtime;
1199	const char *p;
1200	NTSTATUS status;
1201	TALLOC_CTX *ctx = talloc_tos();
1202
1203	START_PROFILE(SMBsetatr);
1204
1205	ZERO_STRUCT(ft);
1206
1207	if (req->wct < 2) {
1208	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1209	goto out;
1210	}
1211
1212	p = (const char *)req->buf + 1;
1213	p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1214	if (!NT_STATUS_IS_OK(status)) {
1215	reply_nterror(req, status);
1216	goto out;
1217	}
1218
1219	status = filename_convert(ctx,
1220	conn,
1221	req->flags2 & FLAGS2_DFS_PATHNAMES,
1222	fname,
1223	0,
1224	NULL,
1225	&smb_fname);
1226	if (!NT_STATUS_IS_OK(status)) {
1227	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1228	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1229	ERRSRV, ERRbadpath);
1230	goto out;
1231	}
1232	reply_nterror(req, status);
1233	goto out;
1234	}
1235
1236	if (smb_fname->base_name[0] == '.' &&
1237	smb_fname->base_name[1] == '\0') {
1238	/*
1239	* Not sure here is the right place to catch this
1240	* condition. Might be moved to somewhere else later -- vl
1241	*/
1242	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1243	goto out;
1244	}
1245
1246	mode = SVAL(req->vwv+0, 0);
1247	mtime = srv_make_unix_date3(req->vwv+1);
1248
1249	ft.mtime = convert_time_t_to_timespec(mtime);
1250	status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1251	if (!NT_STATUS_IS_OK(status)) {
1252	reply_nterror(req, status);
1253	goto out;
1254	}
1255
1256	if (mode != FILE_ATTRIBUTE_NORMAL) {
1257	if (VALID_STAT_OF_DIR(smb_fname->st))
1258	mode \|= FILE_ATTRIBUTE_DIRECTORY;
1259	else
1260	mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1261
1262	if (file_set_dosmode(conn, smb_fname, mode, NULL,
1263	false) != 0) {
1264	reply_nterror(req, map_nt_error_from_unix(errno));
1265	goto out;
1266	}
1267	}
1268
1269	reply_outbuf(req, 0, 0);
1270
1271	DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1272	mode));
1273	out:
1274	TALLOC_FREE(smb_fname);
1275	END_PROFILE(SMBsetatr);
1276	return;
1277	}
1278
1279	/****************************************************************************
1280	Reply to a dskattr.
1281	****************************************************************************/
1282
1283	void reply_dskattr(struct smb_request *req)
1284	{
1285	connection_struct *conn = req->conn;
1286	uint64_t dfree,dsize,bsize;
1287	START_PROFILE(SMBdskattr);
1288
1289	if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1290	reply_nterror(req, map_nt_error_from_unix(errno));
1291	END_PROFILE(SMBdskattr);
1292	return;
1293	}
1294
1295	reply_outbuf(req, 5, 0);
1296
1297	if (get_Protocol() <= PROTOCOL_LANMAN2) {
1298	double total_space, free_space;
1299	/* we need to scale this to a number that DOS6 can handle. We
1300	use floating point so we can handle large drives on systems
1301	that don't have 64 bit integers
1302
1303	we end up displaying a maximum of 2G to DOS systems
1304	*/
1305	total_space = dsize * (double)bsize;
1306	free_space = dfree * (double)bsize;
1307
1308	dsize = (uint64_t)((total_space+63512) / (64512));
1309	dfree = (uint64_t)((free_space+63512) / (64512));
1310
1311	if (dsize > 0xFFFF) dsize = 0xFFFF;
1312	if (dfree > 0xFFFF) dfree = 0xFFFF;
1313
1314	SSVAL(req->outbuf,smb_vwv0,dsize);
1315	SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1316	SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1317	SSVAL(req->outbuf,smb_vwv3,dfree);
1318	} else {
1319	SSVAL(req->outbuf,smb_vwv0,dsize);
1320	SSVAL(req->outbuf,smb_vwv1,bsize/512);
1321	SSVAL(req->outbuf,smb_vwv2,512);
1322	SSVAL(req->outbuf,smb_vwv3,dfree);
1323	}
1324
1325	DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1326
1327	END_PROFILE(SMBdskattr);
1328	return;
1329	}
1330
1331	/*
1332	* Utility function to split the filename from the directory.
1333	*/
1334	static NTSTATUS split_fname_dir_mask(TALLOC_CTX ctx, const char fname_in,
1335	char **fname_dir_out,
1336	char **fname_mask_out)
1337	{
1338	const char *p = NULL;
1339	char *fname_dir = NULL;
1340	char *fname_mask = NULL;
1341
1342	p = strrchr_m(fname_in, '/');
1343	if (!p) {
1344	fname_dir = talloc_strdup(ctx, ".");
1345	fname_mask = talloc_strdup(ctx, fname_in);
1346	} else {
1347	fname_dir = talloc_strndup(ctx, fname_in,
1348	PTR_DIFF(p, fname_in));
1349	fname_mask = talloc_strdup(ctx, p+1);
1350	}
1351
1352	if (!fname_dir \|\| !fname_mask) {
1353	TALLOC_FREE(fname_dir);
1354	TALLOC_FREE(fname_mask);
1355	return NT_STATUS_NO_MEMORY;
1356	}
1357
1358	*fname_dir_out = fname_dir;
1359	*fname_mask_out = fname_mask;
1360	return NT_STATUS_OK;
1361	}
1362
1363	/****************************************************************************
1364	Reply to a search.
1365	Can be called from SMBsearch, SMBffirst or SMBfunique.
1366	****************************************************************************/
1367
1368	void reply_search(struct smb_request *req)
1369	{
1370	connection_struct *conn = req->conn;
1371	char *path = NULL;
1372	const char *mask = NULL;
1373	char *directory = NULL;
1374	struct smb_filename *smb_fname = NULL;
1375	char *fname = NULL;
1376	SMB_OFF_T size;
1377	uint32 mode;
1378	struct timespec date;
1379	uint32 dirtype;
1380	unsigned int numentries = 0;
1381	unsigned int maxentries = 0;
1382	bool finished = False;
1383	const char *p;
1384	int status_len;
1385	char status[21];
1386	int dptr_num= -1;
1387	bool check_descend = False;
1388	bool expect_close = False;
1389	NTSTATUS nt_status;
1390	bool mask_contains_wcard = False;
1391	bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1392	TALLOC_CTX *ctx = talloc_tos();
1393	bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1394	struct dptr_struct *dirptr = NULL;
1395	struct smbd_server_connection *sconn = req->sconn;
1396
1397	START_PROFILE(SMBsearch);
1398
1399	if (req->wct < 2) {
1400	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1401	goto out;
1402	}
1403
1404	if (lp_posix_pathnames()) {
1405	reply_unknown_new(req, req->cmd);
1406	goto out;
1407	}
1408
1409	/* If we were called as SMBffirst then we must expect close. */
1410	if(req->cmd == SMBffirst) {
1411	expect_close = True;
1412	}
1413
1414	reply_outbuf(req, 1, 3);
1415	maxentries = SVAL(req->vwv+0, 0);
1416	dirtype = SVAL(req->vwv+1, 0);
1417	p = (const char *)req->buf + 1;
1418	p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1419	&nt_status, &mask_contains_wcard);
1420	if (!NT_STATUS_IS_OK(nt_status)) {
1421	reply_nterror(req, nt_status);
1422	goto out;
1423	}
1424
1425	p++;
1426	status_len = SVAL(p, 0);
1427	p += 2;
1428
1429	/* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1430
1431	if (status_len == 0) {
1432	nt_status = filename_convert(ctx, conn,
1433	req->flags2 & FLAGS2_DFS_PATHNAMES,
1434	path,
1435	UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1436	&mask_contains_wcard,
1437	&smb_fname);
1438	if (!NT_STATUS_IS_OK(nt_status)) {
1439	if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1440	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1441	ERRSRV, ERRbadpath);
1442	goto out;
1443	}
1444	reply_nterror(req, nt_status);
1445	goto out;
1446	}
1447
1448	directory = smb_fname->base_name;
1449
1450	p = strrchr_m(directory,'/');
1451	if ((p != NULL) && (*directory != '/')) {
1452	mask = p + 1;
1453	directory = talloc_strndup(ctx, directory,
1454	PTR_DIFF(p, directory));
1455	} else {
1456	mask = directory;
1457	directory = talloc_strdup(ctx,".");
1458	}
1459
1460	if (!directory) {
1461	reply_nterror(req, NT_STATUS_NO_MEMORY);
1462	goto out;
1463	}
1464
1465	memset((char *)status,'\0',21);
1466	SCVAL(status,0,(dirtype & 0x1F));
1467
1468	nt_status = dptr_create(conn,
1469	NULL, /* fsp */
1470	directory,
1471	True,
1472	expect_close,
1473	req->smbpid,
1474	mask,
1475	mask_contains_wcard,
1476	dirtype,
1477	&dirptr);
1478	if (!NT_STATUS_IS_OK(nt_status)) {
1479	reply_nterror(req, nt_status);
1480	goto out;
1481	}
1482	dptr_num = dptr_dnum(dirptr);
1483	} else {
1484	int status_dirtype;
1485	const char *dirpath;
1486
1487	memcpy(status,p,21);
1488	status_dirtype = CVAL(status,0) & 0x1F;
1489	if (status_dirtype != (dirtype & 0x1F)) {
1490	dirtype = status_dirtype;
1491	}
1492
1493	dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1494	if (!dirptr) {
1495	goto SearchEmpty;
1496	}
1497	dirpath = dptr_path(sconn, dptr_num);
1498	directory = talloc_strdup(ctx, dirpath);
1499	if (!directory) {
1500	reply_nterror(req, NT_STATUS_NO_MEMORY);
1501	goto out;
1502	}
1503
1504	mask = dptr_wcard(sconn, dptr_num);
1505	if (!mask) {
1506	goto SearchEmpty;
1507	}
1508	/*
1509	* For a 'continue' search we have no string. So
1510	* check from the initial saved string.
1511	*/
1512	mask_contains_wcard = ms_has_wild(mask);
1513	dirtype = dptr_attr(sconn, dptr_num);
1514	}
1515
1516	DEBUG(4,("dptr_num is %d\n",dptr_num));
1517
1518	/* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1519	dptr_init_search_op(dirptr);
1520
1521	if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1522	char buf[DIR_STRUCT_SIZE];
1523	memcpy(buf,status,21);
1524	if (!make_dir_struct(ctx,buf,"???????????",volume_label(SNUM(conn)),
1525	0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1526	reply_nterror(req, NT_STATUS_NO_MEMORY);
1527	goto out;
1528	}
1529	dptr_fill(sconn, buf+12,dptr_num);
1530	if (dptr_zero(buf+12) && (status_len==0)) {
1531	numentries = 1;
1532	} else {
1533	numentries = 0;
1534	}
1535	if (message_push_blob(&req->outbuf,
1536	data_blob_const(buf, sizeof(buf)))
1537	== -1) {
1538	reply_nterror(req, NT_STATUS_NO_MEMORY);
1539	goto out;
1540	}
1541	} else {
1542	unsigned int i;
1543	maxentries = MIN(
1544	maxentries,
1545	((BUFFER_SIZE -
1546	((uint8 *)smb_buf(req->outbuf) + 3 - req->outbuf))
1547	/DIR_STRUCT_SIZE));
1548
1549	DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1550	directory,lp_dontdescend(SNUM(conn))));
1551	if (in_list(directory, lp_dontdescend(SNUM(conn)),True)) {
1552	check_descend = True;
1553	}
1554
1555	for (i=numentries;(i<maxentries) && !finished;i++) {
1556	finished = !get_dir_entry(ctx,
1557	dirptr,
1558	mask,
1559	dirtype,
1560	&fname,
1561	&size,
1562	&mode,
1563	&date,
1564	check_descend,
1565	ask_sharemode);
1566	if (!finished) {
1567	char buf[DIR_STRUCT_SIZE];
1568	memcpy(buf,status,21);
1569	if (!make_dir_struct(ctx,
1570	buf,
1571	mask,
1572	fname,
1573	size,
1574	mode,
1575	convert_timespec_to_time_t(date),
1576	!allow_long_path_components)) {
1577	reply_nterror(req, NT_STATUS_NO_MEMORY);
1578	goto out;
1579	}
1580	if (!dptr_fill(sconn, buf+12,dptr_num)) {
1581	break;
1582	}
1583	if (message_push_blob(&req->outbuf,
1584	data_blob_const(buf, sizeof(buf)))
1585	== -1) {
1586	reply_nterror(req, NT_STATUS_NO_MEMORY);
1587	goto out;
1588	}
1589	numentries++;
1590	}
1591	}
1592	}
1593
1594	SearchEmpty:
1595
1596	/* If we were called as SMBffirst with smb_search_id == NULL
1597	and no entries were found then return error and close dirptr
1598	(X/Open spec) */
1599
1600	if (numentries == 0) {
1601	dptr_close(sconn, &dptr_num);
1602	} else if(expect_close && status_len == 0) {
1603	/* Close the dptr - we know it's gone */
1604	dptr_close(sconn, &dptr_num);
1605	}
1606
1607	/* If we were called as SMBfunique, then we can close the dirptr now ! */
1608	if(dptr_num >= 0 && req->cmd == SMBfunique) {
1609	dptr_close(sconn, &dptr_num);
1610	}
1611
1612	if ((numentries == 0) && !mask_contains_wcard) {
1613	reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1614	goto out;
1615	}
1616
1617	SSVAL(req->outbuf,smb_vwv0,numentries);
1618	SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1619	SCVAL(smb_buf(req->outbuf),0,5);
1620	SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1621
1622	/* The replies here are never long name. */
1623	SSVAL(req->outbuf, smb_flg2,
1624	SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1625	if (!allow_long_path_components) {
1626	SSVAL(req->outbuf, smb_flg2,
1627	SVAL(req->outbuf, smb_flg2)
1628	& (~FLAGS2_LONG_PATH_COMPONENTS));
1629	}
1630
1631	/* This SMB always returns ASCII names. Remove the unicode bit in flags2. */
1632	SSVAL(req->outbuf, smb_flg2,
1633	(SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1634
1635	DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1636	smb_fn_name(req->cmd),
1637	mask,
1638	directory,
1639	dirtype,
1640	numentries,
1641	maxentries ));
1642	out:
1643	TALLOC_FREE(directory);
1644	TALLOC_FREE(smb_fname);
1645	END_PROFILE(SMBsearch);
1646	return;
1647	}
1648
1649	/****************************************************************************
1650	Reply to a fclose (stop directory search).
1651	****************************************************************************/
1652
1653	void reply_fclose(struct smb_request *req)
1654	{
1655	int status_len;
1656	char status[21];
1657	int dptr_num= -2;
1658	const char *p;
1659	char *path = NULL;
1660	NTSTATUS err;
1661	bool path_contains_wcard = False;
1662	TALLOC_CTX *ctx = talloc_tos();
1663	struct smbd_server_connection *sconn = req->sconn;
1664
1665	START_PROFILE(SMBfclose);
1666
1667	if (lp_posix_pathnames()) {
1668	reply_unknown_new(req, req->cmd);
1669	END_PROFILE(SMBfclose);
1670	return;
1671	}
1672
1673	p = (const char *)req->buf + 1;
1674	p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1675	&err, &path_contains_wcard);
1676	if (!NT_STATUS_IS_OK(err)) {
1677	reply_nterror(req, err);
1678	END_PROFILE(SMBfclose);
1679	return;
1680	}
1681	p++;
1682	status_len = SVAL(p,0);
1683	p += 2;
1684
1685	if (status_len == 0) {
1686	reply_force_doserror(req, ERRSRV, ERRsrverror);
1687	END_PROFILE(SMBfclose);
1688	return;
1689	}
1690
1691	memcpy(status,p,21);
1692
1693	if(dptr_fetch(sconn, status+12,&dptr_num)) {
1694	/* Close the dptr - we know it's gone */
1695	dptr_close(sconn, &dptr_num);
1696	}
1697
1698	reply_outbuf(req, 1, 0);
1699	SSVAL(req->outbuf,smb_vwv0,0);
1700
1701	DEBUG(3,("search close\n"));
1702
1703	END_PROFILE(SMBfclose);
1704	return;
1705	}
1706
1707	/****************************************************************************
1708	Reply to an open.
1709	****************************************************************************/
1710
1711	void reply_open(struct smb_request *req)
1712	{
1713	connection_struct *conn = req->conn;
1714	struct smb_filename *smb_fname = NULL;
1715	char *fname = NULL;
1716	uint32 fattr=0;
1717	SMB_OFF_T size = 0;
1718	time_t mtime=0;
1719	int info;
1720	files_struct *fsp;
1721	int oplock_request;
1722	int deny_mode;
1723	uint32 dos_attr;
1724	uint32 access_mask;
1725	uint32 share_mode;
1726	uint32 create_disposition;
1727	uint32 create_options = 0;
1728	uint32_t private_flags = 0;
1729	NTSTATUS status;
1730	bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1731	TALLOC_CTX *ctx = talloc_tos();
1732
1733	START_PROFILE(SMBopen);
1734
1735	if (req->wct < 2) {
1736	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1737	goto out;
1738	}
1739
1740	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1741	deny_mode = SVAL(req->vwv+0, 0);
1742	dos_attr = SVAL(req->vwv+1, 0);
1743
1744	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1745	STR_TERMINATE, &status);
1746	if (!NT_STATUS_IS_OK(status)) {
1747	reply_nterror(req, status);
1748	goto out;
1749	}
1750
1751	if (!map_open_params_to_ntcreate(fname, deny_mode,
1752	OPENX_FILE_EXISTS_OPEN, &access_mask,
1753	&share_mode, &create_disposition,
1754	&create_options, &private_flags)) {
1755	reply_force_doserror(req, ERRDOS, ERRbadaccess);
1756	goto out;
1757	}
1758
1759	status = filename_convert(ctx,
1760	conn,
1761	req->flags2 & FLAGS2_DFS_PATHNAMES,
1762	fname,
1763	(create_disposition == FILE_CREATE)
1764	? UCF_CREATING_FILE : 0,
1765	NULL,
1766	&smb_fname);
1767	if (!NT_STATUS_IS_OK(status)) {
1768	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1769	reply_botherror(req,
1770	NT_STATUS_PATH_NOT_COVERED,
1771	ERRSRV, ERRbadpath);
1772	goto out;
1773	}
1774	reply_nterror(req, status);
1775	goto out;
1776	}
1777
1778	status = SMB_VFS_CREATE_FILE(
1779	conn, /* conn */
1780	req, /* req */
1781	0, /* root_dir_fid */
1782	smb_fname, /* fname */
1783	access_mask, /* access_mask */
1784	share_mode, /* share_access */
1785	create_disposition, /* create_disposition*/
1786	create_options, /* create_options */
1787	dos_attr, /* file_attributes */
1788	oplock_request, /* oplock_request */
1789	0, /* allocation_size */
1790	private_flags,
1791	NULL, /* sd */
1792	NULL, /* ea_list */
1793	&fsp, /* result */
1794	&info); /* pinfo */
1795
1796	if (!NT_STATUS_IS_OK(status)) {
1797	if (open_was_deferred(req->mid)) {
1798	/* We have re-scheduled this call. */
1799	goto out;
1800	}
1801	reply_openerror(req, status);
1802	goto out;
1803	}
1804
1805	size = smb_fname->st.st_ex_size;
1806	fattr = dos_mode(conn, smb_fname);
1807
1808	/* Deal with other possible opens having a modified
1809	write time. JRA. */
1810	if (ask_sharemode) {
1811	struct timespec write_time_ts;
1812
1813	ZERO_STRUCT(write_time_ts);
1814	get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1815	if (!null_timespec(write_time_ts)) {
1816	update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1817	}
1818	}
1819
1820	mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1821
1822	if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1823	DEBUG(3,("attempt to open a directory %s\n",
1824	fsp_str_dbg(fsp)));
1825	close_file(req, fsp, ERROR_CLOSE);
1826	reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1827	ERRDOS, ERRnoaccess);
1828	goto out;
1829	}
1830
1831	reply_outbuf(req, 7, 0);
1832	SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1833	SSVAL(req->outbuf,smb_vwv1,fattr);
1834	if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1835	srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1836	} else {
1837	srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1838	}
1839	SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1840	SSVAL(req->outbuf,smb_vwv6,deny_mode);
1841
1842	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1843	SCVAL(req->outbuf,smb_flg,
1844	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
1845	}
1846
1847	if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
1848	SCVAL(req->outbuf,smb_flg,
1849	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
1850	}
1851	out:
1852	TALLOC_FREE(smb_fname);
1853	END_PROFILE(SMBopen);
1854	return;
1855	}
1856
1857	/****************************************************************************
1858	Reply to an open and X.
1859	****************************************************************************/
1860
1861	void reply_open_and_X(struct smb_request *req)
1862	{
1863	connection_struct *conn = req->conn;
1864	struct smb_filename *smb_fname = NULL;
1865	char *fname = NULL;
1866	uint16 open_flags;
1867	int deny_mode;
1868	uint32 smb_attr;
1869	/* Breakout the oplock request bits so we can set the
1870	reply bits separately. */
1871	int ex_oplock_request;
1872	int core_oplock_request;
1873	int oplock_request;
1874	#if 0
1875	int smb_sattr = SVAL(req->vwv+4, 0);
1876	uint32 smb_time = make_unix_date3(req->vwv+6);
1877	#endif
1878	int smb_ofun;
1879	uint32 fattr=0;
1880	int mtime=0;
1881	int smb_action = 0;
1882	files_struct *fsp;
1883	NTSTATUS status;
1884	uint64_t allocation_size;
1885	ssize_t retval = -1;
1886	uint32 access_mask;
1887	uint32 share_mode;
1888	uint32 create_disposition;
1889	uint32 create_options = 0;
1890	uint32_t private_flags = 0;
1891	TALLOC_CTX *ctx = talloc_tos();
1892
1893	START_PROFILE(SMBopenX);
1894
1895	if (req->wct < 15) {
1896	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1897	goto out;
1898	}
1899
1900	open_flags = SVAL(req->vwv+2, 0);
1901	deny_mode = SVAL(req->vwv+3, 0);
1902	smb_attr = SVAL(req->vwv+5, 0);
1903	ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
1904	core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1905	oplock_request = ex_oplock_request \| core_oplock_request;
1906	smb_ofun = SVAL(req->vwv+8, 0);
1907	allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
1908
1909	/* If it's an IPC, pass off the pipe handler. */
1910	if (IS_IPC(conn)) {
1911	if (lp_nt_pipe_support()) {
1912	reply_open_pipe_and_X(conn, req);
1913	} else {
1914	reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
1915	}
1916	goto out;
1917	}
1918
1919	/* XXXX we need to handle passed times, sattr and flags */
1920	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
1921	STR_TERMINATE, &status);
1922	if (!NT_STATUS_IS_OK(status)) {
1923	reply_nterror(req, status);
1924	goto out;
1925	}
1926
1927	if (!map_open_params_to_ntcreate(fname, deny_mode,
1928	smb_ofun,
1929	&access_mask, &share_mode,
1930	&create_disposition,
1931	&create_options,
1932	&private_flags)) {
1933	reply_force_doserror(req, ERRDOS, ERRbadaccess);
1934	goto out;
1935	}
1936
1937	status = filename_convert(ctx,
1938	conn,
1939	req->flags2 & FLAGS2_DFS_PATHNAMES,
1940	fname,
1941	(create_disposition == FILE_CREATE)
1942	? UCF_CREATING_FILE : 0,
1943	NULL,
1944	&smb_fname);
1945	if (!NT_STATUS_IS_OK(status)) {
1946	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1947	reply_botherror(req,
1948	NT_STATUS_PATH_NOT_COVERED,
1949	ERRSRV, ERRbadpath);
1950	goto out;
1951	}
1952	reply_nterror(req, status);
1953	goto out;
1954	}
1955
1956	status = SMB_VFS_CREATE_FILE(
1957	conn, /* conn */
1958	req, /* req */
1959	0, /* root_dir_fid */
1960	smb_fname, /* fname */
1961	access_mask, /* access_mask */
1962	share_mode, /* share_access */
1963	create_disposition, /* create_disposition*/
1964	create_options, /* create_options */
1965	smb_attr, /* file_attributes */
1966	oplock_request, /* oplock_request */
1967	0, /* allocation_size */
1968	private_flags,
1969	NULL, /* sd */
1970	NULL, /* ea_list */
1971	&fsp, /* result */
1972	&smb_action); /* pinfo */
1973
1974	if (!NT_STATUS_IS_OK(status)) {
1975	if (open_was_deferred(req->mid)) {
1976	/* We have re-scheduled this call. */
1977	goto out;
1978	}
1979	reply_openerror(req, status);
1980	goto out;
1981	}
1982
1983	/* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
1984	if the file is truncated or created. */
1985	if (((smb_action == FILE_WAS_CREATED) \|\| (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
1986	fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
1987	if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
1988	close_file(req, fsp, ERROR_CLOSE);
1989	reply_nterror(req, NT_STATUS_DISK_FULL);
1990	goto out;
1991	}
1992	retval = vfs_set_filelen(fsp, (SMB_OFF_T)allocation_size);
1993	if (retval < 0) {
1994	close_file(req, fsp, ERROR_CLOSE);
1995	reply_nterror(req, NT_STATUS_DISK_FULL);
1996	goto out;
1997	}
1998	status = vfs_stat_fsp(fsp);
1999	if (!NT_STATUS_IS_OK(status)) {
2000	close_file(req, fsp, ERROR_CLOSE);
2001	reply_nterror(req, status);
2002	goto out;
2003	}
2004	}
2005
2006	fattr = dos_mode(conn, fsp->fsp_name);
2007	mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2008	if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2009	close_file(req, fsp, ERROR_CLOSE);
2010	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2011	goto out;
2012	}
2013
2014	/* If the caller set the extended oplock request bit
2015	and we granted one (by whatever means) - set the
2016	correct bit for extended oplock reply.
2017	*/
2018
2019	if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2020	smb_action \|= EXTENDED_OPLOCK_GRANTED;
2021	}
2022
2023	if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2024	smb_action \|= EXTENDED_OPLOCK_GRANTED;
2025	}
2026
2027	/* If the caller set the core oplock request bit
2028	and we granted one (by whatever means) - set the
2029	correct bit for core oplock reply.
2030	*/
2031
2032	if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2033	reply_outbuf(req, 19, 0);
2034	} else {
2035	reply_outbuf(req, 15, 0);
2036	}
2037
2038	if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2039	SCVAL(req->outbuf, smb_flg,
2040	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2041	}
2042
2043	if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2044	SCVAL(req->outbuf, smb_flg,
2045	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2046	}
2047
2048	SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2049	SSVAL(req->outbuf,smb_vwv3,fattr);
2050	if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2051	srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2052	} else {
2053	srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2054	}
2055	SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2056	SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2057	SSVAL(req->outbuf,smb_vwv11,smb_action);
2058
2059	if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2060	SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2061	}
2062
2063	chain_reply(req);
2064	out:
2065	TALLOC_FREE(smb_fname);
2066	END_PROFILE(SMBopenX);
2067	return;
2068	}
2069
2070	/****************************************************************************
2071	Reply to a SMBulogoffX.
2072	****************************************************************************/
2073
2074	void reply_ulogoffX(struct smb_request *req)
2075	{
2076	struct smbd_server_connection *sconn = req->sconn;
2077	user_struct *vuser;
2078
2079	START_PROFILE(SMBulogoffX);
2080
2081	vuser = get_valid_user_struct(sconn, req->vuid);
2082
2083	if(vuser == NULL) {
2084	DEBUG(3,("ulogoff, vuser id %d does not map to user.\n",
2085	req->vuid));
2086	}
2087
2088	/* in user level security we are supposed to close any files
2089	open by this user */
2090	if ((vuser != NULL) && (lp_security() != SEC_SHARE)) {
2091	file_close_user(sconn, req->vuid);
2092	}
2093
2094	invalidate_vuid(sconn, req->vuid);
2095
2096	reply_outbuf(req, 2, 0);
2097
2098	DEBUG( 3, ( "ulogoffX vuid=%d\n", req->vuid ) );
2099
2100	END_PROFILE(SMBulogoffX);
2101	req->vuid = UID_FIELD_INVALID;
2102	chain_reply(req);
2103	}
2104
2105	/****************************************************************************
2106	Reply to a mknew or a create.
2107	****************************************************************************/
2108
2109	void reply_mknew(struct smb_request *req)
2110	{
2111	connection_struct *conn = req->conn;
2112	struct smb_filename *smb_fname = NULL;
2113	char *fname = NULL;
2114	uint32 fattr = 0;
2115	struct smb_file_time ft;
2116	files_struct *fsp;
2117	int oplock_request = 0;
2118	NTSTATUS status;
2119	uint32 access_mask = FILE_GENERIC_READ \| FILE_GENERIC_WRITE;
2120	uint32 share_mode = FILE_SHARE_READ\|FILE_SHARE_WRITE;
2121	uint32 create_disposition;
2122	uint32 create_options = 0;
2123	TALLOC_CTX *ctx = talloc_tos();
2124
2125	START_PROFILE(SMBcreate);
2126	ZERO_STRUCT(ft);
2127
2128	if (req->wct < 3) {
2129	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2130	goto out;
2131	}
2132
2133	fattr = SVAL(req->vwv+0, 0);
2134	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2135
2136	/* mtime. */
2137	ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2138
2139	srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2140	STR_TERMINATE, &status);
2141	if (!NT_STATUS_IS_OK(status)) {
2142	reply_nterror(req, status);
2143	goto out;
2144	}
2145
2146	status = filename_convert(ctx,
2147	conn,
2148	req->flags2 & FLAGS2_DFS_PATHNAMES,
2149	fname,
2150	UCF_CREATING_FILE,
2151	NULL,
2152	&smb_fname);
2153	if (!NT_STATUS_IS_OK(status)) {
2154	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2155	reply_botherror(req,
2156	NT_STATUS_PATH_NOT_COVERED,
2157	ERRSRV, ERRbadpath);
2158	goto out;
2159	}
2160	reply_nterror(req, status);
2161	goto out;
2162	}
2163
2164	if (fattr & FILE_ATTRIBUTE_VOLUME) {
2165	DEBUG(0,("Attempt to create file (%s) with volid set - "
2166	"please report this\n",
2167	smb_fname_str_dbg(smb_fname)));
2168	}
2169
2170	if(req->cmd == SMBmknew) {
2171	/* We should fail if file exists. */
2172	create_disposition = FILE_CREATE;
2173	} else {
2174	/* Create if file doesn't exist, truncate if it does. */
2175	create_disposition = FILE_OVERWRITE_IF;
2176	}
2177
2178	status = SMB_VFS_CREATE_FILE(
2179	conn, /* conn */
2180	req, /* req */
2181	0, /* root_dir_fid */
2182	smb_fname, /* fname */
2183	access_mask, /* access_mask */
2184	share_mode, /* share_access */
2185	create_disposition, /* create_disposition*/
2186	create_options, /* create_options */
2187	fattr, /* file_attributes */
2188	oplock_request, /* oplock_request */
2189	0, /* allocation_size */
2190	0, /* private_flags */
2191	NULL, /* sd */
2192	NULL, /* ea_list */
2193	&fsp, /* result */
2194	NULL); /* pinfo */
2195
2196	if (!NT_STATUS_IS_OK(status)) {
2197	if (open_was_deferred(req->mid)) {
2198	/* We have re-scheduled this call. */
2199	goto out;
2200	}
2201	reply_openerror(req, status);
2202	goto out;
2203	}
2204
2205	ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2206	status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2207	if (!NT_STATUS_IS_OK(status)) {
2208	END_PROFILE(SMBcreate);
2209	goto out;
2210	}
2211
2212	reply_outbuf(req, 1, 0);
2213	SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2214
2215	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2216	SCVAL(req->outbuf,smb_flg,
2217	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2218	}
2219
2220	if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2221	SCVAL(req->outbuf,smb_flg,
2222	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2223	}
2224
2225	DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2226	DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2227	smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2228	(unsigned int)fattr));
2229
2230	out:
2231	TALLOC_FREE(smb_fname);
2232	END_PROFILE(SMBcreate);
2233	return;
2234	}
2235
2236	/****************************************************************************
2237	Reply to a create temporary file.
2238	****************************************************************************/
2239
2240	void reply_ctemp(struct smb_request *req)
2241	{
2242	connection_struct *conn = req->conn;
2243	struct smb_filename *smb_fname = NULL;
2244	char *wire_name = NULL;
2245	char *fname = NULL;
2246	uint32 fattr;
2247	files_struct *fsp;
2248	int oplock_request;
2249	char *s;
2250	NTSTATUS status;
2251	int i;
2252	TALLOC_CTX *ctx = talloc_tos();
2253
2254	START_PROFILE(SMBctemp);
2255
2256	if (req->wct < 3) {
2257	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2258	goto out;
2259	}
2260
2261	fattr = SVAL(req->vwv+0, 0);
2262	oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2263
2264	srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2265	STR_TERMINATE, &status);
2266	if (!NT_STATUS_IS_OK(status)) {
2267	reply_nterror(req, status);
2268	goto out;
2269	}
2270
2271	for (i = 0; i < 10; i++) {
2272	if (*wire_name) {
2273	fname = talloc_asprintf(ctx,
2274	"%s/TMP%s",
2275	wire_name,
2276	generate_random_str_list(ctx, 5, "0123456789"));
2277	} else {
2278	fname = talloc_asprintf(ctx,
2279	"TMP%s",
2280	generate_random_str_list(ctx, 5, "0123456789"));
2281	}
2282
2283	if (!fname) {
2284	reply_nterror(req, NT_STATUS_NO_MEMORY);
2285	goto out;
2286	}
2287
2288	status = filename_convert(ctx, conn,
2289	req->flags2 & FLAGS2_DFS_PATHNAMES,
2290	fname,
2291	UCF_CREATING_FILE,
2292	NULL,
2293	&smb_fname);
2294	if (!NT_STATUS_IS_OK(status)) {
2295	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2296	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2297	ERRSRV, ERRbadpath);
2298	goto out;
2299	}
2300	reply_nterror(req, status);
2301	goto out;
2302	}
2303
2304	/* Create the file. */
2305	status = SMB_VFS_CREATE_FILE(
2306	conn, /* conn */
2307	req, /* req */
2308	0, /* root_dir_fid */
2309	smb_fname, /* fname */
2310	FILE_GENERIC_READ \| FILE_GENERIC_WRITE, /* access_mask */
2311	FILE_SHARE_READ \| FILE_SHARE_WRITE, /* share_access */
2312	FILE_CREATE, /* create_disposition*/
2313	0, /* create_options */
2314	fattr, /* file_attributes */
2315	oplock_request, /* oplock_request */
2316	0, /* allocation_size */
2317	0, /* private_flags */
2318	NULL, /* sd */
2319	NULL, /* ea_list */
2320	&fsp, /* result */
2321	NULL); /* pinfo */
2322
2323	if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2324	TALLOC_FREE(fname);
2325	TALLOC_FREE(smb_fname);
2326	continue;
2327	}
2328
2329	if (!NT_STATUS_IS_OK(status)) {
2330	if (open_was_deferred(req->mid)) {
2331	/* We have re-scheduled this call. */
2332	goto out;
2333	}
2334	reply_openerror(req, status);
2335	goto out;
2336	}
2337
2338	break;
2339	}
2340
2341	if (i == 10) {
2342	/* Collision after 10 times... */
2343	reply_nterror(req, status);
2344	goto out;
2345	}
2346
2347	reply_outbuf(req, 1, 0);
2348	SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2349
2350	/* the returned filename is relative to the directory */
2351	s = strrchr_m(fsp->fsp_name->base_name, '/');
2352	if (!s) {
2353	s = fsp->fsp_name->base_name;
2354	} else {
2355	s++;
2356	}
2357
2358	#if 0
2359	/* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2360	thing in the byte section. JRA */
2361	SSVALS(p, 0, -1); /* what is this? not in spec */
2362	#endif
2363	if (message_push_string(&req->outbuf, s, STR_ASCII\|STR_TERMINATE)
2364	== -1) {
2365	reply_nterror(req, NT_STATUS_NO_MEMORY);
2366	goto out;
2367	}
2368
2369	if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2370	SCVAL(req->outbuf, smb_flg,
2371	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2372	}
2373
2374	if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2375	SCVAL(req->outbuf, smb_flg,
2376	CVAL(req->outbuf,smb_flg)\|CORE_OPLOCK_GRANTED);
2377	}
2378
2379	DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2380	DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2381	fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2382	out:
2383	TALLOC_FREE(smb_fname);
2384	TALLOC_FREE(fname);
2385	TALLOC_FREE(wire_name);
2386	END_PROFILE(SMBctemp);
2387	return;
2388	}
2389
2390	/*******************************************************************
2391	Check if a user is allowed to rename a file.
2392	********************************************************************/
2393
2394	static NTSTATUS can_rename(connection_struct conn, files_struct fsp,
2395	uint16 dirtype)
2396	{
2397	if (!CAN_WRITE(conn)) {
2398	return NT_STATUS_MEDIA_WRITE_PROTECTED;
2399	}
2400
2401	if ((dirtype & (FILE_ATTRIBUTE_HIDDEN \| FILE_ATTRIBUTE_SYSTEM)) !=
2402	(FILE_ATTRIBUTE_HIDDEN \| FILE_ATTRIBUTE_SYSTEM)) {
2403	/* Only bother to read the DOS attribute if we might deny the
2404	rename on the grounds of attribute missmatch. */
2405	uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2406	if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN \| FILE_ATTRIBUTE_SYSTEM)) {
2407	return NT_STATUS_NO_SUCH_FILE;
2408	}
2409	}
2410
2411	if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2412	if (fsp->posix_open) {
2413	return NT_STATUS_OK;
2414	}
2415
2416	/* If no pathnames are open below this
2417	directory, allow the rename. */
2418
2419	if (file_find_subpath(fsp)) {
2420	return NT_STATUS_ACCESS_DENIED;
2421	}
2422	return NT_STATUS_OK;
2423	}
2424
2425	if (fsp->access_mask & (DELETE_ACCESS\|FILE_WRITE_ATTRIBUTES)) {
2426	return NT_STATUS_OK;
2427	}
2428
2429	return NT_STATUS_ACCESS_DENIED;
2430	}
2431
2432	/*******************************************************************
2433	* unlink a file with all relevant access checks
2434	*******************************************************************/
2435
2436	static NTSTATUS do_unlink(connection_struct *conn,
2437	struct smb_request *req,
2438	struct smb_filename *smb_fname,
2439	uint32 dirtype)
2440	{
2441	uint32 fattr;
2442	files_struct *fsp;
2443	uint32 dirtype_orig = dirtype;
2444	NTSTATUS status;
2445	int ret;
2446	bool posix_paths = lp_posix_pathnames();
2447
2448	DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2449	smb_fname_str_dbg(smb_fname),
2450	dirtype));
2451
2452	if (!CAN_WRITE(conn)) {
2453	return NT_STATUS_MEDIA_WRITE_PROTECTED;
2454	}
2455
2456	if (posix_paths) {
2457	ret = SMB_VFS_LSTAT(conn, smb_fname);
2458	} else {
2459	ret = SMB_VFS_STAT(conn, smb_fname);
2460	}
2461	if (ret != 0) {
2462	return map_nt_error_from_unix(errno);
2463	}
2464
2465	fattr = dos_mode(conn, smb_fname);
2466
2467	if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2468	dirtype = FILE_ATTRIBUTE_DIRECTORY\|FILE_ATTRIBUTE_ARCHIVE\|FILE_ATTRIBUTE_READONLY;
2469	}
2470
2471	dirtype &= (FILE_ATTRIBUTE_DIRECTORY\|FILE_ATTRIBUTE_ARCHIVE\|FILE_ATTRIBUTE_READONLY\|FILE_ATTRIBUTE_HIDDEN\|FILE_ATTRIBUTE_SYSTEM);
2472	if (!dirtype) {
2473	return NT_STATUS_NO_SUCH_FILE;
2474	}
2475
2476	if (!dir_check_ftype(conn, fattr, dirtype)) {
2477	if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2478	return NT_STATUS_FILE_IS_A_DIRECTORY;
2479	}
2480	return NT_STATUS_NO_SUCH_FILE;
2481	}
2482
2483	if (dirtype_orig & 0x8000) {
2484	/* These will never be set for POSIX. */
2485	return NT_STATUS_NO_SUCH_FILE;
2486	}
2487
2488	#if 0
2489	if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2490	return NT_STATUS_FILE_IS_A_DIRECTORY;
2491	}
2492
2493	if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN\|FILE_ATTRIBUTE_SYSTEM)) {
2494	return NT_STATUS_NO_SUCH_FILE;
2495	}
2496
2497	if (dirtype & 0xFF00) {
2498	/* These will never be set for POSIX. */
2499	return NT_STATUS_NO_SUCH_FILE;
2500	}
2501
2502	dirtype &= 0xFF;
2503	if (!dirtype) {
2504	return NT_STATUS_NO_SUCH_FILE;
2505	}
2506
2507	/* Can't delete a directory. */
2508	if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2509	return NT_STATUS_FILE_IS_A_DIRECTORY;
2510	}
2511	#endif
2512
2513	#if 0 /* JRATEST */
2514	else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2515	return NT_STATUS_OBJECT_NAME_INVALID;
2516	#endif /* JRATEST */
2517
2518	/* On open checks the open itself will check the share mode, so
2519	don't do it here as we'll get it wrong. */
2520
2521	status = SMB_VFS_CREATE_FILE
2522	(conn, /* conn */
2523	req, /* req */
2524	0, /* root_dir_fid */
2525	smb_fname, /* fname */
2526	DELETE_ACCESS, /* access_mask */
2527	FILE_SHARE_NONE, /* share_access */
2528	FILE_OPEN, /* create_disposition*/
2529	FILE_NON_DIRECTORY_FILE, /* create_options */
2530	/* file_attributes */
2531	posix_paths ? FILE_FLAG_POSIX_SEMANTICS\|0777 :
2532	FILE_ATTRIBUTE_NORMAL,
2533	0, /* oplock_request */
2534	0, /* allocation_size */
2535	0, /* private_flags */
2536	NULL, /* sd */
2537	NULL, /* ea_list */
2538	&fsp, /* result */
2539	NULL); /* pinfo */
2540
2541	if (!NT_STATUS_IS_OK(status)) {
2542	DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2543	nt_errstr(status)));
2544	return status;
2545	}
2546
2547	status = can_set_delete_on_close(fsp, fattr);
2548	if (!NT_STATUS_IS_OK(status)) {
2549	DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2550	"(%s)\n",
2551	smb_fname_str_dbg(smb_fname),
2552	nt_errstr(status)));
2553	close_file(req, fsp, NORMAL_CLOSE);
2554	return status;
2555	}
2556
2557	/* The set is across all open files on this dev/inode pair. */
2558	if (!set_delete_on_close(fsp, true,
2559	conn->session_info->security_token,
2560	&conn->session_info->utok)) {
2561	close_file(req, fsp, NORMAL_CLOSE);
2562	return NT_STATUS_ACCESS_DENIED;
2563	}
2564
2565	return close_file(req, fsp, NORMAL_CLOSE);
2566	}
2567
2568	/****************************************************************************
2569	The guts of the unlink command, split out so it may be called by the NT SMB
2570	code.
2571	****************************************************************************/
2572
2573	NTSTATUS unlink_internals(connection_struct conn, struct smb_request req,
2574	uint32 dirtype, struct smb_filename *smb_fname,
2575	bool has_wild)
2576	{
2577	char *fname_dir = NULL;
2578	char *fname_mask = NULL;
2579	int count=0;
2580	NTSTATUS status = NT_STATUS_OK;
2581	TALLOC_CTX *ctx = talloc_tos();
2582
2583	/* Split up the directory from the filename/mask. */
2584	status = split_fname_dir_mask(ctx, smb_fname->base_name,
2585	&fname_dir, &fname_mask);
2586	if (!NT_STATUS_IS_OK(status)) {
2587	goto out;
2588	}
2589
2590	/*
2591	* We should only check the mangled cache
2592	* here if unix_convert failed. This means
2593	* that the path in 'mask' doesn't exist
2594	* on the file system and so we need to look
2595	* for a possible mangle. This patch from
2596	* Tine Smukavec <valentin.smukavec@hermes.si>.
2597	*/
2598
2599	if (!VALID_STAT(smb_fname->st) &&
2600	mangle_is_mangled(fname_mask, conn->params)) {
2601	char *new_mask = NULL;
2602	mangle_lookup_name_from_8_3(ctx, fname_mask,
2603	&new_mask, conn->params);
2604	if (new_mask) {
2605	TALLOC_FREE(fname_mask);
2606	fname_mask = new_mask;
2607	}
2608	}
2609
2610	if (!has_wild) {
2611
2612	/*
2613	* Only one file needs to be unlinked. Append the mask back
2614	* onto the directory.
2615	*/
2616	TALLOC_FREE(smb_fname->base_name);
2617	if (ISDOT(fname_dir)) {
2618	/* Ensure we use canonical names on open. */
2619	smb_fname->base_name = talloc_asprintf(smb_fname,
2620	"%s",
2621	fname_mask);
2622	} else {
2623	smb_fname->base_name = talloc_asprintf(smb_fname,
2624	"%s/%s",
2625	fname_dir,
2626	fname_mask);
2627	}
2628	if (!smb_fname->base_name) {
2629	status = NT_STATUS_NO_MEMORY;
2630	goto out;
2631	}
2632	if (dirtype == 0) {
2633	dirtype = FILE_ATTRIBUTE_NORMAL;
2634	}
2635
2636	status = check_name(conn, smb_fname->base_name);
2637	if (!NT_STATUS_IS_OK(status)) {
2638	goto out;
2639	}
2640
2641	status = do_unlink(conn, req, smb_fname, dirtype);
2642	if (!NT_STATUS_IS_OK(status)) {
2643	goto out;
2644	}
2645
2646	count++;
2647	} else {
2648	struct smb_Dir *dir_hnd = NULL;
2649	long offset = 0;
2650	const char *dname = NULL;
2651	char *talloced = NULL;
2652
2653	if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2654	status = NT_STATUS_OBJECT_NAME_INVALID;
2655	goto out;
2656	}
2657
2658	if (strequal(fname_mask,"????????.???")) {
2659	TALLOC_FREE(fname_mask);
2660	fname_mask = talloc_strdup(ctx, "*");
2661	if (!fname_mask) {
2662	status = NT_STATUS_NO_MEMORY;
2663	goto out;
2664	}
2665	}
2666
2667	status = check_name(conn, fname_dir);
2668	if (!NT_STATUS_IS_OK(status)) {
2669	goto out;
2670	}
2671
2672	dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2673	dirtype);
2674	if (dir_hnd == NULL) {
2675	status = map_nt_error_from_unix(errno);
2676	goto out;
2677	}
2678
2679	/* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2680	the pattern matches against the long name, otherwise the short name
2681	We don't implement this yet XXXX
2682	*/
2683
2684	status = NT_STATUS_NO_SUCH_FILE;
2685
2686	while ((dname = ReadDirName(dir_hnd, &offset,
2687	&smb_fname->st, &talloced))) {
2688	TALLOC_CTX *frame = talloc_stackframe();
2689
2690	if (!is_visible_file(conn, fname_dir, dname,
2691	&smb_fname->st, true)) {
2692	TALLOC_FREE(frame);
2693	TALLOC_FREE(talloced);
2694	continue;
2695	}
2696
2697	/* Quick check for "." and ".." */
2698	if (ISDOT(dname) \|\| ISDOTDOT(dname)) {
2699	TALLOC_FREE(frame);
2700	TALLOC_FREE(talloced);
2701	continue;
2702	}
2703
2704	if(!mask_match(dname, fname_mask,
2705	conn->case_sensitive)) {
2706	TALLOC_FREE(frame);
2707	TALLOC_FREE(talloced);
2708	continue;
2709	}
2710
2711	TALLOC_FREE(smb_fname->base_name);
2712	if (ISDOT(fname_dir)) {
2713	/* Ensure we use canonical names on open. */
2714	smb_fname->base_name =
2715	talloc_asprintf(smb_fname, "%s",
2716	dname);
2717	} else {
2718	smb_fname->base_name =
2719	talloc_asprintf(smb_fname, "%s/%s",
2720	fname_dir, dname);
2721	}
2722
2723	if (!smb_fname->base_name) {
2724	TALLOC_FREE(dir_hnd);
2725	status = NT_STATUS_NO_MEMORY;
2726	TALLOC_FREE(frame);
2727	TALLOC_FREE(talloced);
2728	goto out;
2729	}
2730
2731	status = check_name(conn, smb_fname->base_name);
2732	if (!NT_STATUS_IS_OK(status)) {
2733	TALLOC_FREE(dir_hnd);
2734	TALLOC_FREE(frame);
2735	TALLOC_FREE(talloced);
2736	goto out;
2737	}
2738
2739	status = do_unlink(conn, req, smb_fname, dirtype);
2740	if (!NT_STATUS_IS_OK(status)) {
2741	TALLOC_FREE(frame);
2742	TALLOC_FREE(talloced);
2743	continue;
2744	}
2745
2746	count++;
2747	DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2748	smb_fname->base_name));
2749
2750	TALLOC_FREE(frame);
2751	TALLOC_FREE(talloced);
2752	}
2753	TALLOC_FREE(dir_hnd);
2754	}
2755
2756	if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2757	status = map_nt_error_from_unix(errno);
2758	}
2759
2760	out:
2761	TALLOC_FREE(fname_dir);
2762	TALLOC_FREE(fname_mask);
2763	return status;
2764	}
2765
2766	/****************************************************************************
2767	Reply to a unlink
2768	****************************************************************************/
2769
2770	void reply_unlink(struct smb_request *req)
2771	{
2772	connection_struct *conn = req->conn;
2773	char *name = NULL;
2774	struct smb_filename *smb_fname = NULL;
2775	uint32 dirtype;
2776	NTSTATUS status;
2777	bool path_contains_wcard = False;
2778	TALLOC_CTX *ctx = talloc_tos();
2779
2780	START_PROFILE(SMBunlink);
2781
2782	if (req->wct < 1) {
2783	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2784	goto out;
2785	}
2786
2787	dirtype = SVAL(req->vwv+0, 0);
2788
2789	srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2790	STR_TERMINATE, &status,
2791	&path_contains_wcard);
2792	if (!NT_STATUS_IS_OK(status)) {
2793	reply_nterror(req, status);
2794	goto out;
2795	}
2796
2797	status = filename_convert(ctx, conn,
2798	req->flags2 & FLAGS2_DFS_PATHNAMES,
2799	name,
2800	UCF_COND_ALLOW_WCARD_LCOMP,
2801	&path_contains_wcard,
2802	&smb_fname);
2803	if (!NT_STATUS_IS_OK(status)) {
2804	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2805	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2806	ERRSRV, ERRbadpath);
2807	goto out;
2808	}
2809	reply_nterror(req, status);
2810	goto out;
2811	}
2812
2813	DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2814
2815	status = unlink_internals(conn, req, dirtype, smb_fname,
2816	path_contains_wcard);
2817	if (!NT_STATUS_IS_OK(status)) {
2818	if (open_was_deferred(req->mid)) {
2819	/* We have re-scheduled this call. */
2820	goto out;
2821	}
2822	reply_nterror(req, status);
2823	goto out;
2824	}
2825
2826	reply_outbuf(req, 0, 0);
2827	out:
2828	TALLOC_FREE(smb_fname);
2829	END_PROFILE(SMBunlink);
2830	return;
2831	}
2832
2833	/****************************************************************************
2834	Fail for readbraw.
2835	****************************************************************************/
2836
2837	static void fail_readraw(void)
2838	{
2839	const char *errstr = talloc_asprintf(talloc_tos(),
2840	"FAIL ! reply_readbraw: socket write fail (%s)",
2841	strerror(errno));
2842	if (!errstr) {
2843	errstr = "";
2844	}
2845	exit_server_cleanly(errstr);
2846	}
2847
2848	/****************************************************************************
2849	Fake (read/write) sendfile. Returns -1 on read or write fail.
2850	****************************************************************************/
2851
2852	ssize_t fake_sendfile(files_struct *fsp, SMB_OFF_T startpos, size_t nread)
2853	{
2854	size_t bufsize;
2855	size_t tosend = nread;
2856	char *buf;
2857
2858	if (nread == 0) {
2859	return 0;
2860	}
2861
2862	bufsize = MIN(nread, 65536);
2863
2864	if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
2865	return -1;
2866	}
2867
2868	while (tosend > 0) {
2869	ssize_t ret;
2870	size_t cur_read;
2871
2872	if (tosend > bufsize) {
2873	cur_read = bufsize;
2874	} else {
2875	cur_read = tosend;
2876	}
2877	ret = read_file(fsp,buf,startpos,cur_read);
2878	if (ret == -1) {
2879	SAFE_FREE(buf);
2880	return -1;
2881	}
2882
2883	/* If we had a short read, fill with zeros. */
2884	if (ret < cur_read) {
2885	memset(buf + ret, '\0', cur_read - ret);
2886	}
2887
2888	if (write_data(fsp->conn->sconn->sock, buf, cur_read)
2889	!= cur_read) {
2890	char addr[INET6_ADDRSTRLEN];
2891	/*
2892	* Try and give an error message saying what
2893	* client failed.
2894	*/
2895	DEBUG(0, ("write_data failed for client %s. "
2896	"Error %s\n",
2897	get_peer_addr(fsp->conn->sconn->sock, addr,
2898	sizeof(addr)),
2899	strerror(errno)));
2900	SAFE_FREE(buf);
2901	return -1;
2902	}
2903	tosend -= cur_read;
2904	startpos += cur_read;
2905	}
2906
2907	SAFE_FREE(buf);
2908	return (ssize_t)nread;
2909	}
2910
2911	/****************************************************************************
2912	Deal with the case of sendfile reading less bytes from the file than
2913	requested. Fill with zeros (all we can do).
2914	****************************************************************************/
2915
2916	void sendfile_short_send(files_struct *fsp,
2917	ssize_t nread,
2918	size_t headersize,
2919	size_t smb_maxcnt)
2920	{
2921	#define SHORT_SEND_BUFSIZE 1024
2922	if (nread < headersize) {
2923	DEBUG(0,("sendfile_short_send: sendfile failed to send "
2924	"header for file %s (%s). Terminating\n",
2925	fsp_str_dbg(fsp), strerror(errno)));
2926	exit_server_cleanly("sendfile_short_send failed");
2927	}
2928
2929	nread -= headersize;
2930
2931	if (nread < smb_maxcnt) {
2932	char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
2933	if (!buf) {
2934	exit_server_cleanly("sendfile_short_send: "
2935	"malloc failed");
2936	}
2937
2938	DEBUG(0,("sendfile_short_send: filling truncated file %s "
2939	"with zeros !\n", fsp_str_dbg(fsp)));
2940
2941	while (nread < smb_maxcnt) {
2942	/*
2943	* We asked for the real file size and told sendfile
2944	* to not go beyond the end of the file. But it can
2945	* happen that in between our fstat call and the
2946	* sendfile call the file was truncated. This is very
2947	* bad because we have already announced the larger
2948	* number of bytes to the client.
2949	*
2950	* The best we can do now is to send 0-bytes, just as
2951	* a read from a hole in a sparse file would do.
2952	*
2953	* This should happen rarely enough that I don't care
2954	* about efficiency here :-)
2955	*/
2956	size_t to_write;
2957
2958	to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
2959	if (write_data(fsp->conn->sconn->sock, buf, to_write)
2960	!= to_write) {
2961	char addr[INET6_ADDRSTRLEN];
2962	/*
2963	* Try and give an error message saying what
2964	* client failed.
2965	*/
2966	DEBUG(0, ("write_data failed for client %s. "
2967	"Error %s\n",
2968	get_peer_addr(
2969	fsp->conn->sconn->sock, addr,
2970	sizeof(addr)),
2971	strerror(errno)));
2972	exit_server_cleanly("sendfile_short_send: "
2973	"write_data failed");
2974	}
2975	nread += to_write;
2976	}
2977	SAFE_FREE(buf);
2978	}
2979	}
2980
2981	/****************************************************************************
2982	Return a readbraw error (4 bytes of zero).
2983	****************************************************************************/
2984
2985	static void reply_readbraw_error(struct smbd_server_connection *sconn)
2986	{
2987	char header[4];
2988
2989	SIVAL(header,0,0);
2990
2991	smbd_lock_socket(sconn);
2992	if (write_data(sconn->sock,header,4) != 4) {
2993	char addr[INET6_ADDRSTRLEN];
2994	/*
2995	* Try and give an error message saying what
2996	* client failed.
2997	*/
2998	DEBUG(0, ("write_data failed for client %s. "
2999	"Error %s\n",
3000	get_peer_addr(sconn->sock, addr, sizeof(addr)),
3001	strerror(errno)));
3002
3003	fail_readraw();
3004	}
3005	smbd_unlock_socket(sconn);
3006	}
3007
3008	/****************************************************************************
3009	Use sendfile in readbraw.
3010	****************************************************************************/
3011
3012	static void send_file_readbraw(connection_struct *conn,
3013	struct smb_request *req,
3014	files_struct *fsp,
3015	SMB_OFF_T startpos,
3016	size_t nread,
3017	ssize_t mincount)
3018	{
3019	struct smbd_server_connection *sconn = req->sconn;
3020	char *outbuf = NULL;
3021	ssize_t ret=0;
3022
3023	/*
3024	* We can only use sendfile on a non-chained packet
3025	* but we can use on a non-oplocked file. tridge proved this
3026	* on a train in Germany :-). JRA.
3027	* reply_readbraw has already checked the length.
3028	*/
3029
3030	if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3031	(fsp->wcp == NULL) &&
3032	lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3033	ssize_t sendfile_read = -1;
3034	char header[4];
3035	DATA_BLOB header_blob;
3036
3037	_smb_setlen(header,nread);
3038	header_blob = data_blob_const(header, 4);
3039
3040	sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3041	&header_blob, startpos,
3042	nread);
3043	if (sendfile_read == -1) {
3044	/* Returning ENOSYS means no data at all was sent.
3045	* Do this as a normal read. */
3046	if (errno == ENOSYS) {
3047	goto normal_readbraw;
3048	}
3049
3050	/*
3051	* Special hack for broken Linux with no working sendfile. If we
3052	* return EINTR we sent the header but not the rest of the data.
3053	* Fake this up by doing read/write calls.
3054	*/
3055	if (errno == EINTR) {
3056	/* Ensure we don't do this again. */
3057	set_use_sendfile(SNUM(conn), False);
3058	DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3059
3060	if (fake_sendfile(fsp, startpos, nread) == -1) {
3061	DEBUG(0,("send_file_readbraw: "
3062	"fake_sendfile failed for "
3063	"file %s (%s).\n",
3064	fsp_str_dbg(fsp),
3065	strerror(errno)));
3066	exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3067	}
3068	return;
3069	}
3070
3071	DEBUG(0,("send_file_readbraw: sendfile failed for "
3072	"file %s (%s). Terminating\n",
3073	fsp_str_dbg(fsp), strerror(errno)));
3074	exit_server_cleanly("send_file_readbraw sendfile failed");
3075	} else if (sendfile_read == 0) {
3076	/*
3077	* Some sendfile implementations return 0 to indicate
3078	* that there was a short read, but nothing was
3079	* actually written to the socket. In this case,
3080	* fallback to the normal read path so the header gets
3081	* the correct byte count.
3082	*/
3083	DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3084	"bytes falling back to the normal read: "
3085	"%s\n", fsp_str_dbg(fsp)));
3086	goto normal_readbraw;
3087	}
3088
3089	/* Deal with possible short send. */
3090	if (sendfile_read != 4+nread) {
3091	sendfile_short_send(fsp, sendfile_read, 4, nread);
3092	}
3093	return;
3094	}
3095
3096	normal_readbraw:
3097
3098	outbuf = TALLOC_ARRAY(NULL, char, nread+4);
3099	if (!outbuf) {
3100	DEBUG(0,("send_file_readbraw: TALLOC_ARRAY failed for size %u.\n",
3101	(unsigned)(nread+4)));
3102	reply_readbraw_error(sconn);
3103	return;
3104	}
3105
3106	if (nread > 0) {
3107	ret = read_file(fsp,outbuf+4,startpos,nread);
3108	#if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3109	if (ret < mincount)
3110	ret = 0;
3111	#else
3112	if (ret < nread)
3113	ret = 0;
3114	#endif
3115	}
3116
3117	_smb_setlen(outbuf,ret);
3118	if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3119	char addr[INET6_ADDRSTRLEN];
3120	/*
3121	* Try and give an error message saying what
3122	* client failed.
3123	*/
3124	DEBUG(0, ("write_data failed for client %s. "
3125	"Error %s\n",
3126	get_peer_addr(fsp->conn->sconn->sock, addr,
3127	sizeof(addr)),
3128	strerror(errno)));
3129
3130	fail_readraw();
3131	}
3132
3133	TALLOC_FREE(outbuf);
3134	}
3135
3136	/****************************************************************************
3137	Reply to a readbraw (core+ protocol).
3138	****************************************************************************/
3139
3140	void reply_readbraw(struct smb_request *req)
3141	{
3142	connection_struct *conn = req->conn;
3143	struct smbd_server_connection *sconn = req->sconn;
3144	ssize_t maxcount,mincount;
3145	size_t nread = 0;
3146	SMB_OFF_T startpos;
3147	files_struct *fsp;
3148	struct lock_struct lock;
3149	SMB_OFF_T size = 0;
3150
3151	START_PROFILE(SMBreadbraw);
3152
3153	if (srv_is_signing_active(sconn) \|\| req->encrypted) {
3154	exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3155	"raw reads/writes are disallowed.");
3156	}
3157
3158	if (req->wct < 8) {
3159	reply_readbraw_error(sconn);
3160	END_PROFILE(SMBreadbraw);
3161	return;
3162	}
3163
3164	if (sconn->smb1.echo_handler.trusted_fde) {
3165	DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3166	"'async smb echo handler = yes'\n"));
3167	reply_readbraw_error(sconn);
3168	END_PROFILE(SMBreadbraw);
3169	return;
3170	}
3171
3172	/*
3173	* Special check if an oplock break has been issued
3174	* and the readraw request croses on the wire, we must
3175	* return a zero length response here.
3176	*/
3177
3178	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3179
3180	/*
3181	* We have to do a check_fsp by hand here, as
3182	* we must always return 4 zero bytes on error,
3183	* not a NTSTATUS.
3184	*/
3185
3186	if (!fsp \|\| !conn \|\| conn != fsp->conn \|\|
3187	req->vuid != fsp->vuid \|\|
3188	fsp->is_directory \|\| fsp->fh->fd == -1) {
3189	/*
3190	* fsp could be NULL here so use the value from the packet. JRA.
3191	*/
3192	DEBUG(3,("reply_readbraw: fnum %d not valid "
3193	"- cache prime?\n",
3194	(int)SVAL(req->vwv+0, 0)));
3195	reply_readbraw_error(sconn);
3196	END_PROFILE(SMBreadbraw);
3197	return;
3198	}
3199
3200	/* Do a "by hand" version of CHECK_READ. */
3201	if (!(fsp->can_read \|\|
3202	((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3203	(fsp->access_mask & FILE_EXECUTE)))) {
3204	DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3205	(int)SVAL(req->vwv+0, 0)));
3206	reply_readbraw_error(sconn);
3207	END_PROFILE(SMBreadbraw);
3208	return;
3209	}
3210
3211	flush_write_cache(fsp, READRAW_FLUSH);
3212
3213	startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3214	if(req->wct == 10) {
3215	/*
3216	* This is a large offset (64 bit) read.
3217	*/
3218	#ifdef LARGE_SMB_OFF_T
3219
3220	startpos \|= (((SMB_OFF_T)IVAL(req->vwv+8, 0)) << 32);
3221
3222	#else /* !LARGE_SMB_OFF_T */
3223
3224	/*
3225	* Ensure we haven't been sent a >32 bit offset.
3226	*/
3227
3228	if(IVAL(req->vwv+8, 0) != 0) {
3229	DEBUG(0,("reply_readbraw: large offset "
3230	"(%x << 32) used and we don't support "
3231	"64 bit offsets.\n",
3232	(unsigned int)IVAL(req->vwv+8, 0) ));
3233	reply_readbraw_error(sconn);
3234	END_PROFILE(SMBreadbraw);
3235	return;
3236	}
3237
3238	#endif /* LARGE_SMB_OFF_T */
3239
3240	if(startpos < 0) {
3241	DEBUG(0,("reply_readbraw: negative 64 bit "
3242	"readraw offset (%.0f) !\n",
3243	(double)startpos ));
3244	reply_readbraw_error(sconn);
3245	END_PROFILE(SMBreadbraw);
3246	return;
3247	}
3248	}
3249
3250	maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3251	mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3252
3253	/* ensure we don't overrun the packet size */
3254	maxcount = MIN(65535,maxcount);
3255
3256	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3257	(uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3258	&lock);
3259
3260	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3261	reply_readbraw_error(sconn);
3262	END_PROFILE(SMBreadbraw);
3263	return;
3264	}
3265
3266	if (fsp_stat(fsp) == 0) {
3267	size = fsp->fsp_name->st.st_ex_size;
3268	}
3269
3270	if (startpos >= size) {
3271	nread = 0;
3272	} else {
3273	nread = MIN(maxcount,(size - startpos));
3274	}
3275
3276	#if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3277	if (nread < mincount)
3278	nread = 0;
3279	#endif
3280
3281	DEBUG( 3, ( "reply_readbraw: fnum=%d start=%.0f max=%lu "
3282	"min=%lu nread=%lu\n",
3283	fsp->fnum, (double)startpos,
3284	(unsigned long)maxcount,
3285	(unsigned long)mincount,
3286	(unsigned long)nread ) );
3287
3288	send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3289
3290	DEBUG(5,("reply_readbraw finished\n"));
3291
3292	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3293
3294	END_PROFILE(SMBreadbraw);
3295	return;
3296	}
3297
3298	#undef DBGC_CLASS
3299	#define DBGC_CLASS DBGC_LOCKING
3300
3301	/****************************************************************************
3302	Reply to a lockread (core+ protocol).
3303	****************************************************************************/
3304
3305	void reply_lockread(struct smb_request *req)
3306	{
3307	connection_struct *conn = req->conn;
3308	ssize_t nread = -1;
3309	char *data;
3310	SMB_OFF_T startpos;
3311	size_t numtoread;
3312	NTSTATUS status;
3313	files_struct *fsp;
3314	struct byte_range_lock *br_lck = NULL;
3315	char *p = NULL;
3316	struct smbd_server_connection *sconn = req->sconn;
3317
3318	START_PROFILE(SMBlockread);
3319
3320	if (req->wct < 5) {
3321	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3322	END_PROFILE(SMBlockread);
3323	return;
3324	}
3325
3326	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3327
3328	if (!check_fsp(conn, req, fsp)) {
3329	END_PROFILE(SMBlockread);
3330	return;
3331	}
3332
3333	if (!CHECK_READ(fsp,req)) {
3334	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3335	END_PROFILE(SMBlockread);
3336	return;
3337	}
3338
3339	numtoread = SVAL(req->vwv+1, 0);
3340	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3341
3342	numtoread = MIN(BUFFER_SIZE - (smb_size + 3*2 + 3), numtoread);
3343
3344	reply_outbuf(req, 5, numtoread + 3);
3345
3346	data = smb_buf(req->outbuf) + 3;
3347
3348	/*
3349	* NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3350	* protocol request that predates the read/write lock concept.
3351	* Thus instead of asking for a read lock here we need to ask
3352	* for a write lock. JRA.
3353	* Note that the requested lock size is unaffected by max_recv.
3354	*/
3355
3356	br_lck = do_lock(req->sconn->msg_ctx,
3357	fsp,
3358	(uint64_t)req->smbpid,
3359	(uint64_t)numtoread,
3360	(uint64_t)startpos,
3361	WRITE_LOCK,
3362	WINDOWS_LOCK,
3363	False, /* Non-blocking lock. */
3364	&status,
3365	NULL,
3366	NULL);
3367	TALLOC_FREE(br_lck);
3368
3369	if (NT_STATUS_V(status)) {
3370	reply_nterror(req, status);
3371	END_PROFILE(SMBlockread);
3372	return;
3373	}
3374
3375	/*
3376	* However the requested READ size IS affected by max_recv. Insanity.... JRA.
3377	*/
3378
3379	if (numtoread > sconn->smb1.negprot.max_recv) {
3380	DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u). \
3381	Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3382	(unsigned int)numtoread,
3383	(unsigned int)sconn->smb1.negprot.max_recv));
3384	numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3385	}
3386	nread = read_file(fsp,data,startpos,numtoread);
3387
3388	if (nread < 0) {
3389	reply_nterror(req, map_nt_error_from_unix(errno));
3390	END_PROFILE(SMBlockread);
3391	return;
3392	}
3393
3394	srv_set_message((char *)req->outbuf, 5, nread+3, False);
3395
3396	SSVAL(req->outbuf,smb_vwv0,nread);
3397	SSVAL(req->outbuf,smb_vwv5,nread+3);
3398	p = smb_buf(req->outbuf);
3399	SCVAL(p,0,0); /* pad byte. */
3400	SSVAL(p,1,nread);
3401
3402	DEBUG(3,("lockread fnum=%d num=%d nread=%d\n",
3403	fsp->fnum, (int)numtoread, (int)nread));
3404
3405	END_PROFILE(SMBlockread);
3406	return;
3407	}
3408
3409	#undef DBGC_CLASS
3410	#define DBGC_CLASS DBGC_ALL
3411
3412	/****************************************************************************
3413	Reply to a read.
3414	****************************************************************************/
3415
3416	void reply_read(struct smb_request *req)
3417	{
3418	connection_struct *conn = req->conn;
3419	size_t numtoread;
3420	ssize_t nread = 0;
3421	char *data;
3422	SMB_OFF_T startpos;
3423	int outsize = 0;
3424	files_struct *fsp;
3425	struct lock_struct lock;
3426	struct smbd_server_connection *sconn = req->sconn;
3427
3428	START_PROFILE(SMBread);
3429
3430	if (req->wct < 3) {
3431	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3432	END_PROFILE(SMBread);
3433	return;
3434	}
3435
3436	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3437
3438	if (!check_fsp(conn, req, fsp)) {
3439	END_PROFILE(SMBread);
3440	return;
3441	}
3442
3443	if (!CHECK_READ(fsp,req)) {
3444	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3445	END_PROFILE(SMBread);
3446	return;
3447	}
3448
3449	numtoread = SVAL(req->vwv+1, 0);
3450	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3451
3452	numtoread = MIN(BUFFER_SIZE-outsize,numtoread);
3453
3454	/*
3455	* The requested read size cannot be greater than max_recv. JRA.
3456	*/
3457	if (numtoread > sconn->smb1.negprot.max_recv) {
3458	DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u). \
3459	Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3460	(unsigned int)numtoread,
3461	(unsigned int)sconn->smb1.negprot.max_recv));
3462	numtoread = MIN(numtoread, sconn->smb1.negprot.max_recv);
3463	}
3464
3465	reply_outbuf(req, 5, numtoread+3);
3466
3467	data = smb_buf(req->outbuf) + 3;
3468
3469	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3470	(uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3471	&lock);
3472
3473	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3474	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3475	END_PROFILE(SMBread);
3476	return;
3477	}
3478
3479	if (numtoread > 0)
3480	nread = read_file(fsp,data,startpos,numtoread);
3481
3482	if (nread < 0) {
3483	reply_nterror(req, map_nt_error_from_unix(errno));
3484	goto strict_unlock;
3485	}
3486
3487	srv_set_message((char *)req->outbuf, 5, nread+3, False);
3488
3489	SSVAL(req->outbuf,smb_vwv0,nread);
3490	SSVAL(req->outbuf,smb_vwv5,nread+3);
3491	SCVAL(smb_buf(req->outbuf),0,1);
3492	SSVAL(smb_buf(req->outbuf),1,nread);
3493
3494	DEBUG( 3, ( "read fnum=%d num=%d nread=%d\n",
3495	fsp->fnum, (int)numtoread, (int)nread ) );
3496
3497	strict_unlock:
3498	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3499
3500	END_PROFILE(SMBread);
3501	return;
3502	}
3503
3504	/****************************************************************************
3505	Setup readX header.
3506	****************************************************************************/
3507
3508	static int setup_readX_header(struct smb_request req, char outbuf,
3509	size_t smb_maxcnt)
3510	{
3511	int outsize;
3512	char *data;
3513
3514	outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3515	data = smb_buf(outbuf);
3516
3517	memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3518
3519	SCVAL(outbuf,smb_vwv0,0xFF);
3520	SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3521	SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3522	SSVAL(outbuf,smb_vwv6,
3523	req_wct_ofs(req)
3524	+ 1 /* the wct field */
3525	+ 12 * sizeof(uint16_t) /* vwv */
3526	+ 2); /* the buflen field */
3527	SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3528	SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3529	/* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3530	_smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3531	return outsize;
3532	}
3533
3534	/****************************************************************************
3535	Reply to a read and X - possibly using sendfile.
3536	****************************************************************************/
3537
3538	static void send_file_readX(connection_struct conn, struct smb_request req,
3539	files_struct *fsp, SMB_OFF_T startpos,
3540	size_t smb_maxcnt)
3541	{
3542	ssize_t nread = -1;
3543	struct lock_struct lock;
3544	int saved_errno = 0;
3545
3546	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3547	(uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3548	&lock);
3549
3550	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3551	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3552	return;
3553	}
3554
3555	/*
3556	* We can only use sendfile on a non-chained packet
3557	* but we can use on a non-oplocked file. tridge proved this
3558	* on a train in Germany :-). JRA.
3559	*/
3560
3561	if (!req_is_in_chain(req) &&
3562	!req->encrypted && (fsp->base_fsp == NULL) &&
3563	(fsp->wcp == NULL) &&
3564	lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3565	uint8 headerbuf[smb_size + 12 * 2];
3566	DATA_BLOB header;
3567
3568	if(fsp_stat(fsp) == -1) {
3569	reply_nterror(req, map_nt_error_from_unix(errno));
3570	goto strict_unlock;
3571	}
3572
3573	if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) \|\|
3574	(startpos > fsp->fsp_name->st.st_ex_size) \|\|
3575	(smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3576	/*
3577	* We already know that we would do a short read, so don't
3578	* try the sendfile() path.
3579	*/
3580	goto nosendfile_read;
3581	}
3582
3583	/*
3584	* Set up the packet header before send. We
3585	* assume here the sendfile will work (get the
3586	* correct amount of data).
3587	*/
3588
3589	header = data_blob_const(headerbuf, sizeof(headerbuf));
3590
3591	construct_reply_common_req(req, (char *)headerbuf);
3592	setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3593
3594	nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3595	startpos, smb_maxcnt);
3596	if (nread == -1) {
3597	/* Returning ENOSYS means no data at all was sent.
3598	Do this as a normal read. */
3599	if (errno == ENOSYS) {
3600	goto normal_read;
3601	}
3602
3603	/*
3604	* Special hack for broken Linux with no working sendfile. If we
3605	* return EINTR we sent the header but not the rest of the data.
3606	* Fake this up by doing read/write calls.
3607	*/
3608
3609	if (errno == EINTR) {
3610	/* Ensure we don't do this again. */
3611	set_use_sendfile(SNUM(conn), False);
3612	DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3613	nread = fake_sendfile(fsp, startpos,
3614	smb_maxcnt);
3615	if (nread == -1) {
3616	DEBUG(0,("send_file_readX: "
3617	"fake_sendfile failed for "
3618	"file %s (%s).\n",
3619	fsp_str_dbg(fsp),
3620	strerror(errno)));
3621	exit_server_cleanly("send_file_readX: fake_sendfile failed");
3622	}
3623	DEBUG( 3, ( "send_file_readX: fake_sendfile fnum=%d max=%d nread=%d\n",
3624	fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3625	/* No outbuf here means successful sendfile. */
3626	goto strict_unlock;
3627	}
3628
3629	DEBUG(0,("send_file_readX: sendfile failed for file "
3630	"%s (%s). Terminating\n", fsp_str_dbg(fsp),
3631	strerror(errno)));
3632	exit_server_cleanly("send_file_readX sendfile failed");
3633	} else if (nread == 0) {
3634	/*
3635	* Some sendfile implementations return 0 to indicate
3636	* that there was a short read, but nothing was
3637	* actually written to the socket. In this case,
3638	* fallback to the normal read path so the header gets
3639	* the correct byte count.
3640	*/
3641	DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3642	"falling back to the normal read: %s\n",
3643	fsp_str_dbg(fsp)));
3644	goto normal_read;
3645	}
3646
3647	DEBUG( 3, ( "send_file_readX: sendfile fnum=%d max=%d nread=%d\n",
3648	fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3649
3650	/* Deal with possible short send. */
3651	if (nread != smb_maxcnt + sizeof(headerbuf)) {
3652	sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3653	}
3654	/* No outbuf here means successful sendfile. */
3655	SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3656	SMB_PERFCOUNT_END(&req->pcd);
3657	goto strict_unlock;
3658	}
3659
3660	normal_read:
3661
3662	if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3663	uint8 headerbuf[smb_size + 2*12];
3664
3665	construct_reply_common_req(req, (char *)headerbuf);
3666	setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3667
3668	/* Send out the header. */
3669	if (write_data(req->sconn->sock, (char *)headerbuf,
3670	sizeof(headerbuf)) != sizeof(headerbuf)) {
3671
3672	char addr[INET6_ADDRSTRLEN];
3673	/*
3674	* Try and give an error message saying what
3675	* client failed.
3676	*/
3677	DEBUG(0, ("write_data failed for client %s. "
3678	"Error %s\n",
3679	get_peer_addr(req->sconn->sock, addr,
3680	sizeof(addr)),
3681	strerror(errno)));
3682
3683	DEBUG(0,("send_file_readX: write_data failed for file "
3684	"%s (%s). Terminating\n", fsp_str_dbg(fsp),
3685	strerror(errno)));
3686	exit_server_cleanly("send_file_readX sendfile failed");
3687	}
3688	nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3689	if (nread == -1) {
3690	DEBUG(0,("send_file_readX: fake_sendfile failed for "
3691	"file %s (%s).\n", fsp_str_dbg(fsp),
3692	strerror(errno)));
3693	exit_server_cleanly("send_file_readX: fake_sendfile failed");
3694	}
3695	goto strict_unlock;
3696	}
3697
3698	nosendfile_read:
3699
3700	reply_outbuf(req, 12, smb_maxcnt);
3701
3702	nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3703	saved_errno = errno;
3704
3705	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3706
3707	if (nread < 0) {
3708	reply_nterror(req, map_nt_error_from_unix(saved_errno));
3709	return;
3710	}
3711
3712	setup_readX_header(req, (char *)req->outbuf, nread);
3713
3714	DEBUG( 3, ( "send_file_readX fnum=%d max=%d nread=%d\n",
3715	fsp->fnum, (int)smb_maxcnt, (int)nread ) );
3716
3717	chain_reply(req);
3718	return;
3719
3720	strict_unlock:
3721	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3722	TALLOC_FREE(req->outbuf);
3723	return;
3724	}
3725
3726	/****************************************************************************
3727	Reply to a read and X.
3728	****************************************************************************/
3729
3730	void reply_read_and_X(struct smb_request *req)
3731	{
3732	connection_struct *conn = req->conn;
3733	files_struct *fsp;
3734	SMB_OFF_T startpos;
3735	size_t smb_maxcnt;
3736	bool big_readX = False;
3737	#if 0
3738	size_t smb_mincnt = SVAL(req->vwv+6, 0);
3739	#endif
3740
3741	START_PROFILE(SMBreadX);
3742
3743	if ((req->wct != 10) && (req->wct != 12)) {
3744	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3745	return;
3746	}
3747
3748	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3749	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3750	smb_maxcnt = SVAL(req->vwv+5, 0);
3751
3752	/* If it's an IPC, pass off the pipe handler. */
3753	if (IS_IPC(conn)) {
3754	reply_pipe_read_and_X(req);
3755	END_PROFILE(SMBreadX);
3756	return;
3757	}
3758
3759	if (!check_fsp(conn, req, fsp)) {
3760	END_PROFILE(SMBreadX);
3761	return;
3762	}
3763
3764	if (!CHECK_READ(fsp,req)) {
3765	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3766	END_PROFILE(SMBreadX);
3767	return;
3768	}
3769
3770	if (global_client_caps & CAP_LARGE_READX) {
3771	size_t upper_size = SVAL(req->vwv+7, 0);
3772	smb_maxcnt \|= (upper_size<<16);
3773	if (upper_size > 1) {
3774	/* Can't do this on a chained packet. */
3775	if ((CVAL(req->vwv+0, 0) != 0xFF)) {
3776	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3777	END_PROFILE(SMBreadX);
3778	return;
3779	}
3780	/* We currently don't do this on signed or sealed data. */
3781	if (srv_is_signing_active(req->sconn) \|\| req->encrypted) {
3782	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3783	END_PROFILE(SMBreadX);
3784	return;
3785	}
3786	/* Is there room in the reply for this data ? */
3787	if (smb_maxcnt > (0xFFFFFF - (smb_size -4 + 12*2))) {
3788	reply_nterror(req,
3789	NT_STATUS_INVALID_PARAMETER);
3790	END_PROFILE(SMBreadX);
3791	return;
3792	}
3793	big_readX = True;
3794	}
3795	}
3796
3797	if (req->wct == 12) {
3798	#ifdef LARGE_SMB_OFF_T
3799	/*
3800	* This is a large offset (64 bit) read.
3801	*/
3802	startpos \|= (((SMB_OFF_T)IVAL(req->vwv+10, 0)) << 32);
3803
3804	#else /* !LARGE_SMB_OFF_T */
3805
3806	/*
3807	* Ensure we haven't been sent a >32 bit offset.
3808	*/
3809
3810	if(IVAL(req->vwv+10, 0) != 0) {
3811	DEBUG(0,("reply_read_and_X - large offset (%x << 32) "
3812	"used and we don't support 64 bit offsets.\n",
3813	(unsigned int)IVAL(req->vwv+10, 0) ));
3814	END_PROFILE(SMBreadX);
3815	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3816	return;
3817	}
3818
3819	#endif /* LARGE_SMB_OFF_T */
3820
3821	}
3822
3823	if (!big_readX) {
3824	NTSTATUS status = schedule_aio_read_and_X(conn,
3825	req,
3826	fsp,
3827	startpos,
3828	smb_maxcnt);
3829	if (NT_STATUS_IS_OK(status)) {
3830	/* Read scheduled - we're done. */
3831	goto out;
3832	}
3833	if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
3834	/* Real error - report to client. */
3835	END_PROFILE(SMBreadX);
3836	reply_nterror(req, status);
3837	return;
3838	}
3839	/* NT_STATUS_RETRY - fall back to sync read. */
3840	}
3841
3842	smbd_lock_socket(req->sconn);
3843	send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
3844	smbd_unlock_socket(req->sconn);
3845
3846	out:
3847	END_PROFILE(SMBreadX);
3848	return;
3849	}
3850
3851	/****************************************************************************
3852	Error replies to writebraw must have smb_wct == 1. Fix this up.
3853	****************************************************************************/
3854
3855	void error_to_writebrawerr(struct smb_request *req)
3856	{
3857	uint8 *old_outbuf = req->outbuf;
3858
3859	reply_outbuf(req, 1, 0);
3860
3861	memcpy(req->outbuf, old_outbuf, smb_size);
3862	TALLOC_FREE(old_outbuf);
3863	}
3864
3865	/****************************************************************************
3866	Read 4 bytes of a smb packet and return the smb length of the packet.
3867	Store the result in the buffer. This version of the function will
3868	never return a session keepalive (length of zero).
3869	Timeout is in milliseconds.
3870	****************************************************************************/
3871
3872	static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
3873	size_t *len)
3874	{
3875	uint8_t msgtype = SMBkeepalive;
3876
3877	while (msgtype == SMBkeepalive) {
3878	NTSTATUS status;
3879
3880	status = read_smb_length_return_keepalive(fd, inbuf, timeout,
3881	len);
3882	if (!NT_STATUS_IS_OK(status)) {
3883	char addr[INET6_ADDRSTRLEN];
3884	/* Try and give an error message
3885	* saying what client failed. */
3886	DEBUG(0, ("read_fd_with_timeout failed for "
3887	"client %s read error = %s.\n",
3888	get_peer_addr(fd,addr,sizeof(addr)),
3889	nt_errstr(status)));
3890	return status;
3891	}
3892
3893	msgtype = CVAL(inbuf, 0);
3894	}
3895
3896	DEBUG(10,("read_smb_length: got smb length of %lu\n",
3897	(unsigned long)len));
3898
3899	return NT_STATUS_OK;
3900	}
3901
3902	/****************************************************************************
3903	Reply to a writebraw (core+ or LANMAN1.0 protocol).
3904	****************************************************************************/
3905
3906	void reply_writebraw(struct smb_request *req)
3907	{
3908	connection_struct *conn = req->conn;
3909	char *buf = NULL;
3910	ssize_t nwritten=0;
3911	ssize_t total_written=0;
3912	size_t numtowrite=0;
3913	size_t tcount;
3914	SMB_OFF_T startpos;
3915	char *data=NULL;
3916	bool write_through;
3917	files_struct *fsp;
3918	struct lock_struct lock;
3919	NTSTATUS status;
3920
3921	START_PROFILE(SMBwritebraw);
3922
3923	/*
3924	* If we ever reply with an error, it must have the SMB command
3925	* type of SMBwritec, not SMBwriteBraw, as this tells the client
3926	* we're finished.
3927	*/
3928	SCVAL(req->inbuf,smb_com,SMBwritec);
3929
3930	if (srv_is_signing_active(req->sconn)) {
3931	END_PROFILE(SMBwritebraw);
3932	exit_server_cleanly("reply_writebraw: SMB signing is active - "
3933	"raw reads/writes are disallowed.");
3934	}
3935
3936	if (req->wct < 12) {
3937	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3938	error_to_writebrawerr(req);
3939	END_PROFILE(SMBwritebraw);
3940	return;
3941	}
3942
3943	if (req->sconn->smb1.echo_handler.trusted_fde) {
3944	DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
3945	"'async smb echo handler = yes'\n"));
3946	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
3947	error_to_writebrawerr(req);
3948	END_PROFILE(SMBwritebraw);
3949	return;
3950	}
3951
3952	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3953	if (!check_fsp(conn, req, fsp)) {
3954	error_to_writebrawerr(req);
3955	END_PROFILE(SMBwritebraw);
3956	return;
3957	}
3958
3959	if (!CHECK_WRITE(fsp)) {
3960	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3961	error_to_writebrawerr(req);
3962	END_PROFILE(SMBwritebraw);
3963	return;
3964	}
3965
3966	tcount = IVAL(req->vwv+1, 0);
3967	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3968	write_through = BITSETW(req->vwv+7,0);
3969
3970	/* We have to deal with slightly different formats depending
3971	on whether we are using the core+ or lanman1.0 protocol */
3972
3973	if(get_Protocol() <= PROTOCOL_COREPLUS) {
3974	numtowrite = SVAL(smb_buf(req->inbuf),-2);
3975	data = smb_buf(req->inbuf);
3976	} else {
3977	numtowrite = SVAL(req->vwv+10, 0);
3978	data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
3979	}
3980
3981	/* Ensure we don't write bytes past the end of this packet. */
3982	if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
3983	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3984	error_to_writebrawerr(req);
3985	END_PROFILE(SMBwritebraw);
3986	return;
3987	}
3988
3989	if (!fsp->print_file) {
3990	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3991	(uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
3992	&lock);
3993
3994	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3995	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3996	error_to_writebrawerr(req);
3997	END_PROFILE(SMBwritebraw);
3998	return;
3999	}
4000	}
4001
4002	if (numtowrite>0) {
4003	nwritten = write_file(req,fsp,data,startpos,numtowrite);
4004	}
4005
4006	DEBUG(3,("reply_writebraw: initial write fnum=%d start=%.0f num=%d "
4007	"wrote=%d sync=%d\n",
4008	fsp->fnum, (double)startpos, (int)numtowrite,
4009	(int)nwritten, (int)write_through));
4010
4011	if (nwritten < (ssize_t)numtowrite) {
4012	reply_nterror(req, NT_STATUS_DISK_FULL);
4013	error_to_writebrawerr(req);
4014	goto strict_unlock;
4015	}
4016
4017	total_written = nwritten;
4018
4019	/* Allocate a buffer of 64k + length. */
4020	buf = TALLOC_ARRAY(NULL, char, 65540);
4021	if (!buf) {
4022	reply_nterror(req, NT_STATUS_NO_MEMORY);
4023	error_to_writebrawerr(req);
4024	goto strict_unlock;
4025	}
4026
4027	/* Return a SMBwritebraw message to the redirector to tell
4028	* it to send more bytes */
4029
4030	memcpy(buf, req->inbuf, smb_size);
4031	srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4032	SCVAL(buf,smb_com,SMBwritebraw);
4033	SSVALS(buf,smb_vwv0,0xFFFF);
4034	show_msg(buf);
4035	if (!srv_send_smb(req->sconn,
4036	buf,
4037	false, 0, /* no signing */
4038	IS_CONN_ENCRYPTED(conn),
4039	&req->pcd)) {
4040	exit_server_cleanly("reply_writebraw: srv_send_smb "
4041	"failed.");
4042	}
4043
4044	/* Now read the raw data into the buffer and write it */
4045	status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4046	&numtowrite);
4047	if (!NT_STATUS_IS_OK(status)) {
4048	exit_server_cleanly("secondary writebraw failed");
4049	}
4050
4051	/* Set up outbuf to return the correct size */
4052	reply_outbuf(req, 1, 0);
4053
4054	if (numtowrite != 0) {
4055
4056	if (numtowrite > 0xFFFF) {
4057	DEBUG(0,("reply_writebraw: Oversize secondary write "
4058	"raw requested (%u). Terminating\n",
4059	(unsigned int)numtowrite ));
4060	exit_server_cleanly("secondary writebraw failed");
4061	}
4062
4063	if (tcount > nwritten+numtowrite) {
4064	DEBUG(3,("reply_writebraw: Client overestimated the "
4065	"write %d %d %d\n",
4066	(int)tcount,(int)nwritten,(int)numtowrite));
4067	}
4068
4069	status = read_data(req->sconn->sock, buf+4, numtowrite);
4070
4071	if (!NT_STATUS_IS_OK(status)) {
4072	char addr[INET6_ADDRSTRLEN];
4073	/* Try and give an error message
4074	* saying what client failed. */
4075	DEBUG(0, ("reply_writebraw: Oversize secondary write "
4076	"raw read failed (%s) for client %s. "
4077	"Terminating\n", nt_errstr(status),
4078	get_peer_addr(req->sconn->sock, addr,
4079	sizeof(addr))));
4080	exit_server_cleanly("secondary writebraw failed");
4081	}
4082
4083	nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4084	if (nwritten == -1) {
4085	TALLOC_FREE(buf);
4086	reply_nterror(req, map_nt_error_from_unix(errno));
4087	error_to_writebrawerr(req);
4088	goto strict_unlock;
4089	}
4090
4091	if (nwritten < (ssize_t)numtowrite) {
4092	SCVAL(req->outbuf,smb_rcls,ERRHRD);
4093	SSVAL(req->outbuf,smb_err,ERRdiskfull);
4094	}
4095
4096	if (nwritten > 0) {
4097	total_written += nwritten;
4098	}
4099	}
4100
4101	TALLOC_FREE(buf);
4102	SSVAL(req->outbuf,smb_vwv0,total_written);
4103
4104	status = sync_file(conn, fsp, write_through);
4105	if (!NT_STATUS_IS_OK(status)) {
4106	DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4107	fsp_str_dbg(fsp), nt_errstr(status)));
4108	reply_nterror(req, status);
4109	error_to_writebrawerr(req);
4110	goto strict_unlock;
4111	}
4112
4113	DEBUG(3,("reply_writebraw: secondart write fnum=%d start=%.0f num=%d "
4114	"wrote=%d\n",
4115	fsp->fnum, (double)startpos, (int)numtowrite,
4116	(int)total_written));
4117
4118	if (!fsp->print_file) {
4119	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4120	}
4121
4122	/* We won't return a status if write through is not selected - this
4123	* follows what WfWg does */
4124	END_PROFILE(SMBwritebraw);
4125
4126	if (!write_through && total_written==tcount) {
4127
4128	#if RABBIT_PELLET_FIX
4129	/*
4130	* Fix for "rabbit pellet" mode, trigger an early TCP ack by
4131	* sending a SMBkeepalive. Thanks to DaveCB at Sun for this.
4132	* JRA.
4133	*/
4134	if (!send_keepalive(req->sconn->sock)) {
4135	exit_server_cleanly("reply_writebraw: send of "
4136	"keepalive failed");
4137	}
4138	#endif
4139	TALLOC_FREE(req->outbuf);
4140	}
4141	return;
4142
4143	strict_unlock:
4144	if (!fsp->print_file) {
4145	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4146	}
4147
4148	END_PROFILE(SMBwritebraw);
4149	return;
4150	}
4151
4152	#undef DBGC_CLASS
4153	#define DBGC_CLASS DBGC_LOCKING
4154
4155	/****************************************************************************
4156	Reply to a writeunlock (core+).
4157	****************************************************************************/
4158
4159	void reply_writeunlock(struct smb_request *req)
4160	{
4161	connection_struct *conn = req->conn;
4162	ssize_t nwritten = -1;
4163	size_t numtowrite;
4164	SMB_OFF_T startpos;
4165	const char *data;
4166	NTSTATUS status = NT_STATUS_OK;
4167	files_struct *fsp;
4168	struct lock_struct lock;
4169	int saved_errno = 0;
4170
4171	START_PROFILE(SMBwriteunlock);
4172
4173	if (req->wct < 5) {
4174	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4175	END_PROFILE(SMBwriteunlock);
4176	return;
4177	}
4178
4179	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4180
4181	if (!check_fsp(conn, req, fsp)) {
4182	END_PROFILE(SMBwriteunlock);
4183	return;
4184	}
4185
4186	if (!CHECK_WRITE(fsp)) {
4187	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4188	END_PROFILE(SMBwriteunlock);
4189	return;
4190	}
4191
4192	numtowrite = SVAL(req->vwv+1, 0);
4193	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4194	data = (const char *)req->buf + 3;
4195
4196	if (!fsp->print_file && numtowrite > 0) {
4197	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4198	(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4199	&lock);
4200
4201	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4202	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4203	END_PROFILE(SMBwriteunlock);
4204	return;
4205	}
4206	}
4207
4208	/* The special X/Open SMB protocol handling of
4209	zero length writes is NOT done for
4210	this call */
4211	if(numtowrite == 0) {
4212	nwritten = 0;
4213	} else {
4214	nwritten = write_file(req,fsp,data,startpos,numtowrite);
4215	saved_errno = errno;
4216	}
4217
4218	status = sync_file(conn, fsp, False /* write through */);
4219	if (!NT_STATUS_IS_OK(status)) {
4220	DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4221	fsp_str_dbg(fsp), nt_errstr(status)));
4222	reply_nterror(req, status);
4223	goto strict_unlock;
4224	}
4225
4226	if(nwritten < 0) {
4227	reply_nterror(req, map_nt_error_from_unix(saved_errno));
4228	goto strict_unlock;
4229	}
4230
4231	if((nwritten < numtowrite) && (numtowrite != 0)) {
4232	reply_nterror(req, NT_STATUS_DISK_FULL);
4233	goto strict_unlock;
4234	}
4235
4236	if (numtowrite && !fsp->print_file) {
4237	status = do_unlock(req->sconn->msg_ctx,
4238	fsp,
4239	(uint64_t)req->smbpid,
4240	(uint64_t)numtowrite,
4241	(uint64_t)startpos,
4242	WINDOWS_LOCK);
4243
4244	if (NT_STATUS_V(status)) {
4245	reply_nterror(req, status);
4246	goto strict_unlock;
4247	}
4248	}
4249
4250	reply_outbuf(req, 1, 0);
4251
4252	SSVAL(req->outbuf,smb_vwv0,nwritten);
4253
4254	DEBUG(3,("writeunlock fnum=%d num=%d wrote=%d\n",
4255	fsp->fnum, (int)numtowrite, (int)nwritten));
4256
4257	strict_unlock:
4258	if (numtowrite && !fsp->print_file) {
4259	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4260	}
4261
4262	END_PROFILE(SMBwriteunlock);
4263	return;
4264	}
4265
4266	#undef DBGC_CLASS
4267	#define DBGC_CLASS DBGC_ALL
4268
4269	/****************************************************************************
4270	Reply to a write.
4271	****************************************************************************/
4272
4273	void reply_write(struct smb_request *req)
4274	{
4275	connection_struct *conn = req->conn;
4276	size_t numtowrite;
4277	ssize_t nwritten = -1;
4278	SMB_OFF_T startpos;
4279	const char *data;
4280	files_struct *fsp;
4281	struct lock_struct lock;
4282	NTSTATUS status;
4283	int saved_errno = 0;
4284
4285	START_PROFILE(SMBwrite);
4286
4287	if (req->wct < 5) {
4288	END_PROFILE(SMBwrite);
4289	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4290	return;
4291	}
4292
4293	/* If it's an IPC, pass off the pipe handler. */
4294	if (IS_IPC(conn)) {
4295	reply_pipe_write(req);
4296	END_PROFILE(SMBwrite);
4297	return;
4298	}
4299
4300	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4301
4302	if (!check_fsp(conn, req, fsp)) {
4303	END_PROFILE(SMBwrite);
4304	return;
4305	}
4306
4307	if (!CHECK_WRITE(fsp)) {
4308	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4309	END_PROFILE(SMBwrite);
4310	return;
4311	}
4312
4313	numtowrite = SVAL(req->vwv+1, 0);
4314	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4315	data = (const char *)req->buf + 3;
4316
4317	if (!fsp->print_file) {
4318	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4319	(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4320	&lock);
4321
4322	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4323	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4324	END_PROFILE(SMBwrite);
4325	return;
4326	}
4327	}
4328
4329	/*
4330	* X/Open SMB protocol says that if smb_vwv1 is
4331	* zero then the file size should be extended or
4332	* truncated to the size given in smb_vwv[2-3].
4333	*/
4334
4335	if(numtowrite == 0) {
4336	/*
4337	* This is actually an allocate call, and set EOF. JRA.
4338	*/
4339	nwritten = vfs_allocate_file_space(fsp, (SMB_OFF_T)startpos);
4340	if (nwritten < 0) {
4341	reply_nterror(req, NT_STATUS_DISK_FULL);
4342	goto strict_unlock;
4343	}
4344	nwritten = vfs_set_filelen(fsp, (SMB_OFF_T)startpos);
4345	if (nwritten < 0) {
4346	reply_nterror(req, NT_STATUS_DISK_FULL);
4347	goto strict_unlock;
4348	}
4349	trigger_write_time_update_immediate(fsp);
4350	} else {
4351	nwritten = write_file(req,fsp,data,startpos,numtowrite);
4352	}
4353
4354	status = sync_file(conn, fsp, False);
4355	if (!NT_STATUS_IS_OK(status)) {
4356	DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4357	fsp_str_dbg(fsp), nt_errstr(status)));
4358	reply_nterror(req, status);
4359	goto strict_unlock;
4360	}
4361
4362	if(nwritten < 0) {
4363	reply_nterror(req, map_nt_error_from_unix(saved_errno));
4364	goto strict_unlock;
4365	}
4366
4367	if((nwritten == 0) && (numtowrite != 0)) {
4368	reply_nterror(req, NT_STATUS_DISK_FULL);
4369	goto strict_unlock;
4370	}
4371
4372	reply_outbuf(req, 1, 0);
4373
4374	SSVAL(req->outbuf,smb_vwv0,nwritten);
4375
4376	if (nwritten < (ssize_t)numtowrite) {
4377	SCVAL(req->outbuf,smb_rcls,ERRHRD);
4378	SSVAL(req->outbuf,smb_err,ERRdiskfull);
4379	}
4380
4381	DEBUG(3,("write fnum=%d num=%d wrote=%d\n", fsp->fnum, (int)numtowrite, (int)nwritten));
4382
4383	strict_unlock:
4384	if (!fsp->print_file) {
4385	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4386	}
4387
4388	END_PROFILE(SMBwrite);
4389	return;
4390	}
4391
4392	/****************************************************************************
4393	Ensure a buffer is a valid writeX for recvfile purposes.
4394	****************************************************************************/
4395
4396	#define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4397	(214) + / word count (including bcc) */ \
4398	1 /* pad byte */)
4399
4400	bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4401	const uint8_t *inbuf)
4402	{
4403	size_t numtowrite;
4404	connection_struct *conn = NULL;
4405	unsigned int doff = 0;
4406	size_t len = smb_len_large(inbuf);
4407
4408	if (is_encrypted_packet(inbuf)) {
4409	/* Can't do this on encrypted
4410	* connections. */
4411	return false;
4412	}
4413
4414	if (CVAL(inbuf,smb_com) != SMBwriteX) {
4415	return false;
4416	}
4417
4418	if (CVAL(inbuf,smb_vwv0) != 0xFF \|\|
4419	CVAL(inbuf,smb_wct) != 14) {
4420	DEBUG(10,("is_valid_writeX_buffer: chained or "
4421	"invalid word length.\n"));
4422	return false;
4423	}
4424
4425	conn = conn_find(sconn, SVAL(inbuf, smb_tid));
4426	if (conn == NULL) {
4427	DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4428	return false;
4429	}
4430	if (IS_IPC(conn)) {
4431	DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4432	return false;
4433	}
4434	if (IS_PRINT(conn)) {
4435	DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4436	return false;
4437	}
4438	doff = SVAL(inbuf,smb_vwv11);
4439
4440	numtowrite = SVAL(inbuf,smb_vwv10);
4441
4442	if (len > doff && len - doff > 0xFFFF) {
4443	numtowrite \|= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4444	}
4445
4446	if (numtowrite == 0) {
4447	DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4448	return false;
4449	}
4450
4451	/* Ensure the sizes match up. */
4452	if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4453	/* no pad byte...old smbclient :-( */
4454	DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4455	(unsigned int)doff,
4456	(unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4457	return false;
4458	}
4459
4460	if (len - doff != numtowrite) {
4461	DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4462	"len = %u, doff = %u, numtowrite = %u\n",
4463	(unsigned int)len,
4464	(unsigned int)doff,
4465	(unsigned int)numtowrite ));
4466	return false;
4467	}
4468
4469	DEBUG(10,("is_valid_writeX_buffer: true "
4470	"len = %u, doff = %u, numtowrite = %u\n",
4471	(unsigned int)len,
4472	(unsigned int)doff,
4473	(unsigned int)numtowrite ));
4474
4475	return true;
4476	}
4477
4478	/****************************************************************************
4479	Reply to a write and X.
4480	****************************************************************************/
4481
4482	void reply_write_and_X(struct smb_request *req)
4483	{
4484	connection_struct *conn = req->conn;
4485	files_struct *fsp;
4486	struct lock_struct lock;
4487	SMB_OFF_T startpos;
4488	size_t numtowrite;
4489	bool write_through;
4490	ssize_t nwritten;
4491	unsigned int smb_doff;
4492	unsigned int smblen;
4493	char *data;
4494	NTSTATUS status;
4495	int saved_errno = 0;
4496
4497	START_PROFILE(SMBwriteX);
4498
4499	if ((req->wct != 12) && (req->wct != 14)) {
4500	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4501	END_PROFILE(SMBwriteX);
4502	return;
4503	}
4504
4505	numtowrite = SVAL(req->vwv+10, 0);
4506	smb_doff = SVAL(req->vwv+11, 0);
4507	smblen = smb_len(req->inbuf);
4508
4509	if (req->unread_bytes > 0xFFFF \|\|
4510	(smblen > smb_doff &&
4511	smblen - smb_doff > 0xFFFF)) {
4512	numtowrite \|= (((size_t)SVAL(req->vwv+9, 0))<<16);
4513	}
4514
4515	if (req->unread_bytes) {
4516	/* Can't do a recvfile write on IPC$ */
4517	if (IS_IPC(conn)) {
4518	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4519	END_PROFILE(SMBwriteX);
4520	return;
4521	}
4522	if (numtowrite != req->unread_bytes) {
4523	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4524	END_PROFILE(SMBwriteX);
4525	return;
4526	}
4527	} else {
4528	if (smb_doff > smblen \|\| smb_doff + numtowrite < numtowrite \|\|
4529	smb_doff + numtowrite > smblen) {
4530	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4531	END_PROFILE(SMBwriteX);
4532	return;
4533	}
4534	}
4535
4536	/* If it's an IPC, pass off the pipe handler. */
4537	if (IS_IPC(conn)) {
4538	if (req->unread_bytes) {
4539	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4540	END_PROFILE(SMBwriteX);
4541	return;
4542	}
4543	reply_pipe_write_and_X(req);
4544	END_PROFILE(SMBwriteX);
4545	return;
4546	}
4547
4548	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4549	startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4550	write_through = BITSETW(req->vwv+7,0);
4551
4552	if (!check_fsp(conn, req, fsp)) {
4553	END_PROFILE(SMBwriteX);
4554	return;
4555	}
4556
4557	if (!CHECK_WRITE(fsp)) {
4558	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4559	END_PROFILE(SMBwriteX);
4560	return;
4561	}
4562
4563	data = smb_base(req->inbuf) + smb_doff;
4564
4565	if(req->wct == 14) {
4566	#ifdef LARGE_SMB_OFF_T
4567	/*
4568	* This is a large offset (64 bit) write.
4569	*/
4570	startpos \|= (((SMB_OFF_T)IVAL(req->vwv+12, 0)) << 32);
4571
4572	#else /* !LARGE_SMB_OFF_T */
4573
4574	/*
4575	* Ensure we haven't been sent a >32 bit offset.
4576	*/
4577
4578	if(IVAL(req->vwv+12, 0) != 0) {
4579	DEBUG(0,("reply_write_and_X - large offset (%x << 32) "
4580	"used and we don't support 64 bit offsets.\n",
4581	(unsigned int)IVAL(req->vwv+12, 0) ));
4582	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4583	END_PROFILE(SMBwriteX);
4584	return;
4585	}
4586
4587	#endif /* LARGE_SMB_OFF_T */
4588	}
4589
4590	/* X/Open SMB protocol says that, unlike SMBwrite
4591	if the length is zero then NO truncation is
4592	done, just a write of zero. To truncate a file,
4593	use SMBwrite. */
4594
4595	if(numtowrite == 0) {
4596	nwritten = 0;
4597	} else {
4598	if (req->unread_bytes == 0) {
4599	status = schedule_aio_write_and_X(conn,
4600	req,
4601	fsp,
4602	data,
4603	startpos,
4604	numtowrite);
4605
4606	if (NT_STATUS_IS_OK(status)) {
4607	/* write scheduled - we're done. */
4608	goto out;
4609	}
4610	if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4611	/* Real error - report to client. */
4612	reply_nterror(req, status);
4613	goto out;
4614	}
4615	/* NT_STATUS_RETRY - fall through to sync write. */
4616	}
4617
4618	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4619	(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4620	&lock);
4621
4622	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4623	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4624	goto out;
4625	}
4626
4627	nwritten = write_file(req,fsp,data,startpos,numtowrite);
4628	saved_errno = errno;
4629
4630	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4631	}
4632
4633	if(nwritten < 0) {
4634	reply_nterror(req, map_nt_error_from_unix(saved_errno));
4635	goto out;
4636	}
4637
4638	if((nwritten == 0) && (numtowrite != 0)) {
4639	reply_nterror(req, NT_STATUS_DISK_FULL);
4640	goto out;
4641	}
4642
4643	reply_outbuf(req, 6, 0);
4644	SSVAL(req->outbuf,smb_vwv2,nwritten);
4645	SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4646
4647	DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
4648	fsp->fnum, (int)numtowrite, (int)nwritten));
4649
4650	status = sync_file(conn, fsp, write_through);
4651	if (!NT_STATUS_IS_OK(status)) {
4652	DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4653	fsp_str_dbg(fsp), nt_errstr(status)));
4654	reply_nterror(req, status);
4655	goto out;
4656	}
4657
4658	END_PROFILE(SMBwriteX);
4659	chain_reply(req);
4660	return;
4661
4662	out:
4663	END_PROFILE(SMBwriteX);
4664	return;
4665	}
4666
4667	/****************************************************************************
4668	Reply to a lseek.
4669	****************************************************************************/
4670
4671	void reply_lseek(struct smb_request *req)
4672	{
4673	connection_struct *conn = req->conn;
4674	SMB_OFF_T startpos;
4675	SMB_OFF_T res= -1;
4676	int mode,umode;
4677	files_struct *fsp;
4678
4679	START_PROFILE(SMBlseek);
4680
4681	if (req->wct < 4) {
4682	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4683	END_PROFILE(SMBlseek);
4684	return;
4685	}
4686
4687	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4688
4689	if (!check_fsp(conn, req, fsp)) {
4690	return;
4691	}
4692
4693	flush_write_cache(fsp, SEEK_FLUSH);
4694
4695	mode = SVAL(req->vwv+1, 0) & 3;
4696	/* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4697	startpos = (SMB_OFF_T)IVALS(req->vwv+2, 0);
4698
4699	switch (mode) {
4700	case 0:
4701	umode = SEEK_SET;
4702	res = startpos;
4703	break;
4704	case 1:
4705	umode = SEEK_CUR;
4706	res = fsp->fh->pos + startpos;
4707	break;
4708	case 2:
4709	umode = SEEK_END;
4710	break;
4711	default:
4712	umode = SEEK_SET;
4713	res = startpos;
4714	break;
4715	}
4716
4717	if (umode == SEEK_END) {
4718	if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4719	if(errno == EINVAL) {
4720	SMB_OFF_T current_pos = startpos;
4721
4722	if(fsp_stat(fsp) == -1) {
4723	reply_nterror(req,
4724	map_nt_error_from_unix(errno));
4725	END_PROFILE(SMBlseek);
4726	return;
4727	}
4728
4729	current_pos += fsp->fsp_name->st.st_ex_size;
4730	if(current_pos < 0)
4731	res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4732	}
4733	}
4734
4735	if(res == -1) {
4736	reply_nterror(req, map_nt_error_from_unix(errno));
4737	END_PROFILE(SMBlseek);
4738	return;
4739	}
4740	}
4741
4742	fsp->fh->pos = res;
4743
4744	reply_outbuf(req, 2, 0);
4745	SIVAL(req->outbuf,smb_vwv0,res);
4746
4747	DEBUG(3,("lseek fnum=%d ofs=%.0f newpos = %.0f mode=%d\n",
4748	fsp->fnum, (double)startpos, (double)res, mode));
4749
4750	END_PROFILE(SMBlseek);
4751	return;
4752	}
4753
4754	/****************************************************************************
4755	Reply to a flush.
4756	****************************************************************************/
4757
4758	void reply_flush(struct smb_request *req)
4759	{
4760	connection_struct *conn = req->conn;
4761	uint16 fnum;
4762	files_struct *fsp;
4763
4764	START_PROFILE(SMBflush);
4765
4766	if (req->wct < 1) {
4767	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4768	return;
4769	}
4770
4771	fnum = SVAL(req->vwv+0, 0);
4772	fsp = file_fsp(req, fnum);
4773
4774	if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4775	return;
4776	}
4777
4778	if (!fsp) {
4779	file_sync_all(conn);
4780	} else {
4781	NTSTATUS status = sync_file(conn, fsp, True);
4782	if (!NT_STATUS_IS_OK(status)) {
4783	DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4784	fsp_str_dbg(fsp), nt_errstr(status)));
4785	reply_nterror(req, status);
4786	END_PROFILE(SMBflush);
4787	return;
4788	}
4789	}
4790
4791	reply_outbuf(req, 0, 0);
4792
4793	DEBUG(3,("flush\n"));
4794	END_PROFILE(SMBflush);
4795	return;
4796	}
4797
4798	/****************************************************************************
4799	Reply to a exit.
4800	conn POINTER CAN BE NULL HERE !
4801	****************************************************************************/
4802
4803	void reply_exit(struct smb_request *req)
4804	{
4805	START_PROFILE(SMBexit);
4806
4807	file_close_pid(req->sconn, req->smbpid, req->vuid);
4808
4809	reply_outbuf(req, 0, 0);
4810
4811	DEBUG(3,("exit\n"));
4812
4813	END_PROFILE(SMBexit);
4814	return;
4815	}
4816
4817	/****************************************************************************
4818	Reply to a close - has to deal with closing a directory opened by NT SMB's.
4819	****************************************************************************/
4820
4821	void reply_close(struct smb_request *req)
4822	{
4823	connection_struct *conn = req->conn;
4824	NTSTATUS status = NT_STATUS_OK;
4825	files_struct *fsp = NULL;
4826	START_PROFILE(SMBclose);
4827
4828	if (req->wct < 3) {
4829	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4830	END_PROFILE(SMBclose);
4831	return;
4832	}
4833
4834	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4835
4836	/*
4837	* We can only use check_fsp if we know it's not a directory.
4838	*/
4839
4840	if (!check_fsp_open(conn, req, fsp)) {
4841	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
4842	END_PROFILE(SMBclose);
4843	return;
4844	}
4845
4846	if(fsp->is_directory) {
4847	/*
4848	* Special case - close NT SMB directory handle.
4849	*/
4850	DEBUG(3,("close directory fnum=%d\n", fsp->fnum));
4851	status = close_file(req, fsp, NORMAL_CLOSE);
4852	} else {
4853	time_t t;
4854	/*
4855	* Close ordinary file.
4856	*/
4857
4858	DEBUG(3,("close fd=%d fnum=%d (numopen=%d)\n",
4859	fsp->fh->fd, fsp->fnum,
4860	conn->num_files_open));
4861
4862	/*
4863	* Take care of any time sent in the close.
4864	*/
4865
4866	t = srv_make_unix_date3(req->vwv+1);
4867	set_close_write_time(fsp, convert_time_t_to_timespec(t));
4868
4869	/*
4870	* close_file() returns the unix errno if an error
4871	* was detected on close - normally this is due to
4872	* a disk full error. If not then it was probably an I/O error.
4873	*/
4874
4875	status = close_file(req, fsp, NORMAL_CLOSE);
4876	}
4877
4878	if (!NT_STATUS_IS_OK(status)) {
4879	reply_nterror(req, status);
4880	END_PROFILE(SMBclose);
4881	return;
4882	}
4883
4884	reply_outbuf(req, 0, 0);
4885	END_PROFILE(SMBclose);
4886	return;
4887	}
4888
4889	/****************************************************************************
4890	Reply to a writeclose (Core+ protocol).
4891	****************************************************************************/
4892
4893	void reply_writeclose(struct smb_request *req)
4894	{
4895	connection_struct *conn = req->conn;
4896	size_t numtowrite;
4897	ssize_t nwritten = -1;
4898	NTSTATUS close_status = NT_STATUS_OK;
4899	SMB_OFF_T startpos;
4900	const char *data;
4901	struct timespec mtime;
4902	files_struct *fsp;
4903	struct lock_struct lock;
4904
4905	START_PROFILE(SMBwriteclose);
4906
4907	if (req->wct < 6) {
4908	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4909	END_PROFILE(SMBwriteclose);
4910	return;
4911	}
4912
4913	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4914
4915	if (!check_fsp(conn, req, fsp)) {
4916	END_PROFILE(SMBwriteclose);
4917	return;
4918	}
4919	if (!CHECK_WRITE(fsp)) {
4920	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4921	END_PROFILE(SMBwriteclose);
4922	return;
4923	}
4924
4925	numtowrite = SVAL(req->vwv+1, 0);
4926	startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4927	mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
4928	data = (const char *)req->buf + 1;
4929
4930	if (!fsp->print_file) {
4931	init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4932	(uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4933	&lock);
4934
4935	if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4936	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4937	END_PROFILE(SMBwriteclose);
4938	return;
4939	}
4940	}
4941
4942	nwritten = write_file(req,fsp,data,startpos,numtowrite);
4943
4944	set_close_write_time(fsp, mtime);
4945
4946	/*
4947	* More insanity. W2K only closes the file if writelen > 0.
4948	* JRA.
4949	*/
4950
4951	if (numtowrite) {
4952	DEBUG(3,("reply_writeclose: zero length write doesn't close "
4953	"file %s\n", fsp_str_dbg(fsp)));
4954	close_status = close_file(req, fsp, NORMAL_CLOSE);
4955	}
4956
4957	DEBUG(3,("writeclose fnum=%d num=%d wrote=%d (numopen=%d)\n",
4958	fsp->fnum, (int)numtowrite, (int)nwritten,
4959	conn->num_files_open));
4960
4961	if(((nwritten == 0) && (numtowrite != 0))\|\|(nwritten < 0)) {
4962	reply_nterror(req, NT_STATUS_DISK_FULL);
4963	goto strict_unlock;
4964	}
4965
4966	if(!NT_STATUS_IS_OK(close_status)) {
4967	reply_nterror(req, close_status);
4968	goto strict_unlock;
4969	}
4970
4971	reply_outbuf(req, 1, 0);
4972
4973	SSVAL(req->outbuf,smb_vwv0,nwritten);
4974
4975	strict_unlock:
4976	if (numtowrite && !fsp->print_file) {
4977	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4978	}
4979
4980	END_PROFILE(SMBwriteclose);
4981	return;
4982	}
4983
4984	#undef DBGC_CLASS
4985	#define DBGC_CLASS DBGC_LOCKING
4986
4987	/****************************************************************************
4988	Reply to a lock.
4989	****************************************************************************/
4990
4991	void reply_lock(struct smb_request *req)
4992	{
4993	connection_struct *conn = req->conn;
4994	uint64_t count,offset;
4995	NTSTATUS status;
4996	files_struct *fsp;
4997	struct byte_range_lock *br_lck = NULL;
4998
4999	START_PROFILE(SMBlock);
5000
5001	if (req->wct < 5) {
5002	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5003	END_PROFILE(SMBlock);
5004	return;
5005	}
5006
5007	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5008
5009	if (!check_fsp(conn, req, fsp)) {
5010	END_PROFILE(SMBlock);
5011	return;
5012	}
5013
5014	count = (uint64_t)IVAL(req->vwv+1, 0);
5015	offset = (uint64_t)IVAL(req->vwv+3, 0);
5016
5017	DEBUG(3,("lock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5018	fsp->fh->fd, fsp->fnum, (double)offset, (double)count));
5019
5020	br_lck = do_lock(req->sconn->msg_ctx,
5021	fsp,
5022	(uint64_t)req->smbpid,
5023	count,
5024	offset,
5025	WRITE_LOCK,
5026	WINDOWS_LOCK,
5027	False, /* Non-blocking lock. */
5028	&status,
5029	NULL,
5030	NULL);
5031
5032	TALLOC_FREE(br_lck);
5033
5034	if (NT_STATUS_V(status)) {
5035	reply_nterror(req, status);
5036	END_PROFILE(SMBlock);
5037	return;
5038	}
5039
5040	reply_outbuf(req, 0, 0);
5041
5042	END_PROFILE(SMBlock);
5043	return;
5044	}
5045
5046	/****************************************************************************
5047	Reply to a unlock.
5048	****************************************************************************/
5049
5050	void reply_unlock(struct smb_request *req)
5051	{
5052	connection_struct *conn = req->conn;
5053	uint64_t count,offset;
5054	NTSTATUS status;
5055	files_struct *fsp;
5056
5057	START_PROFILE(SMBunlock);
5058
5059	if (req->wct < 5) {
5060	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5061	END_PROFILE(SMBunlock);
5062	return;
5063	}
5064
5065	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5066
5067	if (!check_fsp(conn, req, fsp)) {
5068	END_PROFILE(SMBunlock);
5069	return;
5070	}
5071
5072	count = (uint64_t)IVAL(req->vwv+1, 0);
5073	offset = (uint64_t)IVAL(req->vwv+3, 0);
5074
5075	status = do_unlock(req->sconn->msg_ctx,
5076	fsp,
5077	(uint64_t)req->smbpid,
5078	count,
5079	offset,
5080	WINDOWS_LOCK);
5081
5082	if (NT_STATUS_V(status)) {
5083	reply_nterror(req, status);
5084	END_PROFILE(SMBunlock);
5085	return;
5086	}
5087
5088	DEBUG( 3, ( "unlock fd=%d fnum=%d offset=%.0f count=%.0f\n",
5089	fsp->fh->fd, fsp->fnum, (double)offset, (double)count ) );
5090
5091	reply_outbuf(req, 0, 0);
5092
5093	END_PROFILE(SMBunlock);
5094	return;
5095	}
5096
5097	#undef DBGC_CLASS
5098	#define DBGC_CLASS DBGC_ALL
5099
5100	/****************************************************************************
5101	Reply to a tdis.
5102	conn POINTER CAN BE NULL HERE !
5103	****************************************************************************/
5104
5105	void reply_tdis(struct smb_request *req)
5106	{
5107	connection_struct *conn = req->conn;
5108	START_PROFILE(SMBtdis);
5109
5110	if (!conn) {
5111	DEBUG(4,("Invalid connection in tdis\n"));
5112	reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
5113	END_PROFILE(SMBtdis);
5114	return;
5115	}
5116
5117	conn->used = False;
5118
5119	close_cnum(conn,req->vuid);
5120	req->conn = NULL;
5121
5122	reply_outbuf(req, 0, 0);
5123	END_PROFILE(SMBtdis);
5124	return;
5125	}
5126
5127	/****************************************************************************
5128	Reply to a echo.
5129	conn POINTER CAN BE NULL HERE !
5130	****************************************************************************/
5131
5132	void reply_echo(struct smb_request *req)
5133	{
5134	connection_struct *conn = req->conn;
5135	struct smb_perfcount_data local_pcd;
5136	struct smb_perfcount_data *cur_pcd;
5137	int smb_reverb;
5138	int seq_num;
5139
5140	START_PROFILE(SMBecho);
5141
5142	smb_init_perfcount_data(&local_pcd);
5143
5144	if (req->wct < 1) {
5145	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5146	END_PROFILE(SMBecho);
5147	return;
5148	}
5149
5150	smb_reverb = SVAL(req->vwv+0, 0);
5151
5152	reply_outbuf(req, 1, req->buflen);
5153
5154	/* copy any incoming data back out */
5155	if (req->buflen > 0) {
5156	memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5157	}
5158
5159	if (smb_reverb > 100) {
5160	DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5161	smb_reverb = 100;
5162	}
5163
5164	for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5165
5166	/* this makes sure we catch the request pcd */
5167	if (seq_num == smb_reverb) {
5168	cur_pcd = &req->pcd;
5169	} else {
5170	SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5171	cur_pcd = &local_pcd;
5172	}
5173
5174	SSVAL(req->outbuf,smb_vwv0,seq_num);
5175
5176	show_msg((char *)req->outbuf);
5177	if (!srv_send_smb(req->sconn,
5178	(char *)req->outbuf,
5179	true, req->seqnum+1,
5180	IS_CONN_ENCRYPTED(conn)\|\|req->encrypted,
5181	cur_pcd))
5182	exit_server_cleanly("reply_echo: srv_send_smb failed.");
5183	}
5184
5185	DEBUG(3,("echo %d times\n", smb_reverb));
5186
5187	TALLOC_FREE(req->outbuf);
5188
5189	END_PROFILE(SMBecho);
5190	return;
5191	}
5192
5193	/****************************************************************************
5194	Reply to a printopen.
5195	****************************************************************************/
5196
5197	void reply_printopen(struct smb_request *req)
5198	{
5199	connection_struct *conn = req->conn;
5200	files_struct *fsp;
5201	NTSTATUS status;
5202
5203	START_PROFILE(SMBsplopen);
5204
5205	if (req->wct < 2) {
5206	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5207	END_PROFILE(SMBsplopen);
5208	return;
5209	}
5210
5211	if (!CAN_PRINT(conn)) {
5212	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5213	END_PROFILE(SMBsplopen);
5214	return;
5215	}
5216
5217	status = file_new(req, conn, &fsp);
5218	if(!NT_STATUS_IS_OK(status)) {
5219	reply_nterror(req, status);
5220	END_PROFILE(SMBsplopen);
5221	return;
5222	}
5223
5224	/* Open for exclusive use, write only. */
5225	status = print_spool_open(fsp, NULL, req->vuid);
5226
5227	if (!NT_STATUS_IS_OK(status)) {
5228	file_free(req, fsp);
5229	reply_nterror(req, status);
5230	END_PROFILE(SMBsplopen);
5231	return;
5232	}
5233
5234	reply_outbuf(req, 1, 0);
5235	SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5236
5237	DEBUG(3,("openprint fd=%d fnum=%d\n",
5238	fsp->fh->fd, fsp->fnum));
5239
5240	END_PROFILE(SMBsplopen);
5241	return;
5242	}
5243
5244	/****************************************************************************
5245	Reply to a printclose.
5246	****************************************************************************/
5247
5248	void reply_printclose(struct smb_request *req)
5249	{
5250	connection_struct *conn = req->conn;
5251	files_struct *fsp;
5252	NTSTATUS status;
5253
5254	START_PROFILE(SMBsplclose);
5255
5256	if (req->wct < 1) {
5257	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5258	END_PROFILE(SMBsplclose);
5259	return;
5260	}
5261
5262	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5263
5264	if (!check_fsp(conn, req, fsp)) {
5265	END_PROFILE(SMBsplclose);
5266	return;
5267	}
5268
5269	if (!CAN_PRINT(conn)) {
5270	reply_force_doserror(req, ERRSRV, ERRerror);
5271	END_PROFILE(SMBsplclose);
5272	return;
5273	}
5274
5275	DEBUG(3,("printclose fd=%d fnum=%d\n",
5276	fsp->fh->fd,fsp->fnum));
5277
5278	status = close_file(req, fsp, NORMAL_CLOSE);
5279
5280	if(!NT_STATUS_IS_OK(status)) {
5281	reply_nterror(req, status);
5282	END_PROFILE(SMBsplclose);
5283	return;
5284	}
5285
5286	reply_outbuf(req, 0, 0);
5287
5288	END_PROFILE(SMBsplclose);
5289	return;
5290	}
5291
5292	/****************************************************************************
5293	Reply to a printqueue.
5294	****************************************************************************/
5295
5296	void reply_printqueue(struct smb_request *req)
5297	{
5298	connection_struct *conn = req->conn;
5299	int max_count;
5300	int start_index;
5301
5302	START_PROFILE(SMBsplretq);
5303
5304	if (req->wct < 2) {
5305	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5306	END_PROFILE(SMBsplretq);
5307	return;
5308	}
5309
5310	max_count = SVAL(req->vwv+0, 0);
5311	start_index = SVAL(req->vwv+1, 0);
5312
5313	/* we used to allow the client to get the cnum wrong, but that
5314	is really quite gross and only worked when there was only
5315	one printer - I think we should now only accept it if they
5316	get it right (tridge) */
5317	if (!CAN_PRINT(conn)) {
5318	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5319	END_PROFILE(SMBsplretq);
5320	return;
5321	}
5322
5323	reply_outbuf(req, 2, 3);
5324	SSVAL(req->outbuf,smb_vwv0,0);
5325	SSVAL(req->outbuf,smb_vwv1,0);
5326	SCVAL(smb_buf(req->outbuf),0,1);
5327	SSVAL(smb_buf(req->outbuf),1,0);
5328
5329	DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5330	start_index, max_count));
5331
5332	{
5333	TALLOC_CTX *mem_ctx = talloc_tos();
5334	NTSTATUS status;
5335	WERROR werr;
5336	const char *sharename = lp_servicename(SNUM(conn));
5337	struct rpc_pipe_client *cli = NULL;
5338	struct dcerpc_binding_handle *b = NULL;
5339	struct policy_handle handle;
5340	struct spoolss_DevmodeContainer devmode_ctr;
5341	union spoolss_JobInfo *info;
5342	uint32_t count;
5343	uint32_t num_to_get;
5344	uint32_t first;
5345	uint32_t i;
5346
5347	ZERO_STRUCT(handle);
5348
5349	status = rpc_pipe_open_interface(conn,
5350	&ndr_table_spoolss.syntax_id,
5351	conn->session_info,
5352	&conn->sconn->client_id,
5353	conn->sconn->msg_ctx,
5354	&cli);
5355	if (!NT_STATUS_IS_OK(status)) {
5356	DEBUG(0, ("reply_printqueue: "
5357	"could not connect to spoolss: %s\n",
5358	nt_errstr(status)));
5359	reply_nterror(req, status);
5360	goto out;
5361	}
5362	b = cli->binding_handle;
5363
5364	ZERO_STRUCT(devmode_ctr);
5365
5366	status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5367	sharename,
5368	NULL, devmode_ctr,
5369	SEC_FLAG_MAXIMUM_ALLOWED,
5370	&handle,
5371	&werr);
5372	if (!NT_STATUS_IS_OK(status)) {
5373	reply_nterror(req, status);
5374	goto out;
5375	}
5376	if (!W_ERROR_IS_OK(werr)) {
5377	reply_nterror(req, werror_to_ntstatus(werr));
5378	goto out;
5379	}
5380
5381	werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5382	&handle,
5383	0, /* firstjob */
5384	0xff, /* numjobs */
5385	2, /* level */
5386	0, /* offered */
5387	&count,
5388	&info);
5389	if (!W_ERROR_IS_OK(werr)) {
5390	reply_nterror(req, werror_to_ntstatus(werr));
5391	goto out;
5392	}
5393
5394	if (max_count > 0) {
5395	first = start_index;
5396	} else {
5397	first = start_index + max_count + 1;
5398	}
5399
5400	if (first >= count) {
5401	num_to_get = first;
5402	} else {
5403	num_to_get = first + MIN(ABS(max_count), count - first);
5404	}
5405
5406	for (i = first; i < num_to_get; i++) {
5407	char blob[28];
5408	char *p = blob;
5409	time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5410	int qstatus;
5411	uint16_t qrapjobid = pjobid_to_rap(sharename,
5412	info[i].info2.job_id);
5413
5414	if (info[i].info2.status == JOB_STATUS_PRINTING) {
5415	qstatus = 2;
5416	} else {
5417	qstatus = 3;
5418	}
5419
5420	srv_put_dos_date2(p, 0, qtime);
5421	SCVAL(p, 4, qstatus);
5422	SSVAL(p, 5, qrapjobid);
5423	SIVAL(p, 7, info[i].info2.size);
5424	SCVAL(p, 11, 0);
5425	srvstr_push(blob, req->flags2, p+12,
5426	info[i].info2.notify_name, 16, STR_ASCII);
5427
5428	if (message_push_blob(
5429	&req->outbuf,
5430	data_blob_const(
5431	blob, sizeof(blob))) == -1) {
5432	reply_nterror(req, NT_STATUS_NO_MEMORY);
5433	goto out;
5434	}
5435	}
5436
5437	if (count > 0) {
5438	SSVAL(req->outbuf,smb_vwv0,count);
5439	SSVAL(req->outbuf,smb_vwv1,
5440	(max_count>0?first+count:first-1));
5441	SCVAL(smb_buf(req->outbuf),0,1);
5442	SSVAL(smb_buf(req->outbuf),1,28*count);
5443	}
5444
5445
5446	DEBUG(3, ("%u entries returned in queue\n",
5447	(unsigned)count));
5448
5449	out:
5450	if (b && is_valid_policy_hnd(&handle)) {
5451	dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5452	}
5453
5454	}
5455
5456	END_PROFILE(SMBsplretq);
5457	return;
5458	}
5459
5460	/****************************************************************************
5461	Reply to a printwrite.
5462	****************************************************************************/
5463
5464	void reply_printwrite(struct smb_request *req)
5465	{
5466	connection_struct *conn = req->conn;
5467	int numtowrite;
5468	const char *data;
5469	files_struct *fsp;
5470
5471	START_PROFILE(SMBsplwr);
5472
5473	if (req->wct < 1) {
5474	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5475	END_PROFILE(SMBsplwr);
5476	return;
5477	}
5478
5479	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5480
5481	if (!check_fsp(conn, req, fsp)) {
5482	END_PROFILE(SMBsplwr);
5483	return;
5484	}
5485
5486	if (!fsp->print_file) {
5487	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5488	END_PROFILE(SMBsplwr);
5489	return;
5490	}
5491
5492	if (!CHECK_WRITE(fsp)) {
5493	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5494	END_PROFILE(SMBsplwr);
5495	return;
5496	}
5497
5498	numtowrite = SVAL(req->buf, 1);
5499
5500	if (req->buflen < numtowrite + 3) {
5501	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5502	END_PROFILE(SMBsplwr);
5503	return;
5504	}
5505
5506	data = (const char *)req->buf + 3;
5507
5508	if (write_file(req,fsp,data,(SMB_OFF_T)-1,numtowrite) != numtowrite) {
5509	reply_nterror(req, map_nt_error_from_unix(errno));
5510	END_PROFILE(SMBsplwr);
5511	return;
5512	}
5513
5514	DEBUG( 3, ( "printwrite fnum=%d num=%d\n", fsp->fnum, numtowrite ) );
5515
5516	END_PROFILE(SMBsplwr);
5517	return;
5518	}
5519
5520	/****************************************************************************
5521	Reply to a mkdir.
5522	****************************************************************************/
5523
5524	void reply_mkdir(struct smb_request *req)
5525	{
5526	connection_struct *conn = req->conn;
5527	struct smb_filename *smb_dname = NULL;
5528	char *directory = NULL;
5529	NTSTATUS status;
5530	TALLOC_CTX *ctx = talloc_tos();
5531
5532	START_PROFILE(SMBmkdir);
5533
5534	srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5535	STR_TERMINATE, &status);
5536	if (!NT_STATUS_IS_OK(status)) {
5537	reply_nterror(req, status);
5538	goto out;
5539	}
5540
5541	status = filename_convert(ctx, conn,
5542	req->flags2 & FLAGS2_DFS_PATHNAMES,
5543	directory,
5544	UCF_CREATING_FILE,
5545	NULL,
5546	&smb_dname);
5547	if (!NT_STATUS_IS_OK(status)) {
5548	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5549	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5550	ERRSRV, ERRbadpath);
5551	goto out;
5552	}
5553	reply_nterror(req, status);
5554	goto out;
5555	}
5556
5557	status = create_directory(conn, req, smb_dname);
5558
5559	DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5560
5561	if (!NT_STATUS_IS_OK(status)) {
5562
5563	if (!use_nt_status()
5564	&& NT_STATUS_EQUAL(status,
5565	NT_STATUS_OBJECT_NAME_COLLISION)) {
5566	/*
5567	* Yes, in the DOS error code case we get a
5568	* ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5569	* samba4 torture test.
5570	*/
5571	status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5572	}
5573
5574	reply_nterror(req, status);
5575	goto out;
5576	}
5577
5578	reply_outbuf(req, 0, 0);
5579
5580	DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5581	out:
5582	TALLOC_FREE(smb_dname);
5583	END_PROFILE(SMBmkdir);
5584	return;
5585	}
5586
5587	/****************************************************************************
5588	Reply to a rmdir.
5589	****************************************************************************/
5590
5591	void reply_rmdir(struct smb_request *req)
5592	{
5593	connection_struct *conn = req->conn;
5594	struct smb_filename *smb_dname = NULL;
5595	char *directory = NULL;
5596	NTSTATUS status;
5597	TALLOC_CTX *ctx = talloc_tos();
5598	files_struct *fsp = NULL;
5599	int info = 0;
5600	struct smbd_server_connection *sconn = req->sconn;
5601
5602	START_PROFILE(SMBrmdir);
5603
5604	srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5605	STR_TERMINATE, &status);
5606	if (!NT_STATUS_IS_OK(status)) {
5607	reply_nterror(req, status);
5608	goto out;
5609	}
5610
5611	status = filename_convert(ctx, conn,
5612	req->flags2 & FLAGS2_DFS_PATHNAMES,
5613	directory,
5614	0,
5615	NULL,
5616	&smb_dname);
5617	if (!NT_STATUS_IS_OK(status)) {
5618	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5619	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5620	ERRSRV, ERRbadpath);
5621	goto out;
5622	}
5623	reply_nterror(req, status);
5624	goto out;
5625	}
5626
5627	if (is_ntfs_stream_smb_fname(smb_dname)) {
5628	reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5629	goto out;
5630	}
5631
5632	status = SMB_VFS_CREATE_FILE(
5633	conn, /* conn */
5634	req, /* req */
5635	0, /* root_dir_fid */
5636	smb_dname, /* fname */
5637	DELETE_ACCESS, /* access_mask */
5638	(FILE_SHARE_READ \| FILE_SHARE_WRITE \| /* share_access */
5639	FILE_SHARE_DELETE),
5640	FILE_OPEN, /* create_disposition*/
5641	FILE_DIRECTORY_FILE, /* create_options */
5642	FILE_ATTRIBUTE_DIRECTORY, /* file_attributes */
5643	0, /* oplock_request */
5644	0, /* allocation_size */
5645	0, /* private_flags */
5646	NULL, /* sd */
5647	NULL, /* ea_list */
5648	&fsp, /* result */
5649	&info); /* pinfo */
5650
5651	if (!NT_STATUS_IS_OK(status)) {
5652	if (open_was_deferred(req->mid)) {
5653	/* We have re-scheduled this call. */
5654	goto out;
5655	}
5656	reply_nterror(req, status);
5657	goto out;
5658	}
5659
5660	status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5661	if (!NT_STATUS_IS_OK(status)) {
5662	close_file(req, fsp, ERROR_CLOSE);
5663	reply_nterror(req, status);
5664	goto out;
5665	}
5666
5667	if (!set_delete_on_close(fsp, true,
5668	conn->session_info->security_token,
5669	&conn->session_info->utok)) {
5670	close_file(req, fsp, ERROR_CLOSE);
5671	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5672	goto out;
5673	}
5674
5675	status = close_file(req, fsp, NORMAL_CLOSE);
5676	if (!NT_STATUS_IS_OK(status)) {
5677	reply_nterror(req, status);
5678	} else {
5679	reply_outbuf(req, 0, 0);
5680	}
5681
5682	dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5683
5684	DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5685	out:
5686	TALLOC_FREE(smb_dname);
5687	END_PROFILE(SMBrmdir);
5688	return;
5689	}
5690
5691	/*******************************************************************
5692	Resolve wildcards in a filename rename.
5693	********************************************************************/
5694
5695	static bool resolve_wildcards(TALLOC_CTX *ctx,
5696	const char *name1,
5697	const char *name2,
5698	char **pp_newname)
5699	{
5700	char *name2_copy = NULL;
5701	char *root1 = NULL;
5702	char *root2 = NULL;
5703	char *ext1 = NULL;
5704	char *ext2 = NULL;
5705	char p,p2, pname1, pname2;
5706
5707	name2_copy = talloc_strdup(ctx, name2);
5708	if (!name2_copy) {
5709	return False;
5710	}
5711
5712	pname1 = strrchr_m(name1,'/');
5713	pname2 = strrchr_m(name2_copy,'/');
5714
5715	if (!pname1 \|\| !pname2) {
5716	return False;
5717	}
5718
5719	/* Truncate the copy of name2 at the last '/' */
5720	*pname2 = '\0';
5721
5722	/* Now go past the '/' */
5723	pname1++;
5724	pname2++;
5725
5726	root1 = talloc_strdup(ctx, pname1);
5727	root2 = talloc_strdup(ctx, pname2);
5728
5729	if (!root1 \|\| !root2) {
5730	return False;
5731	}
5732
5733	p = strrchr_m(root1,'.');
5734	if (p) {
5735	*p = 0;
5736	ext1 = talloc_strdup(ctx, p+1);
5737	} else {
5738	ext1 = talloc_strdup(ctx, "");
5739	}
5740	p = strrchr_m(root2,'.');
5741	if (p) {
5742	*p = 0;
5743	ext2 = talloc_strdup(ctx, p+1);
5744	} else {
5745	ext2 = talloc_strdup(ctx, "");
5746	}
5747
5748	if (!ext1 \|\| !ext2) {
5749	return False;
5750	}
5751
5752	p = root1;
5753	p2 = root2;
5754	while (*p2) {
5755	if (*p2 == '?') {
5756	/* Hmmm. Should this be mb-aware ? */
5757	p2 = p;
5758	p2++;
5759	} else if (p2 == '') {
5760	*p2 = '\0';
5761	root2 = talloc_asprintf(ctx, "%s%s",
5762	root2,
5763	p);
5764	if (!root2) {
5765	return False;
5766	}
5767	break;
5768	} else {
5769	p2++;
5770	}
5771	if (*p) {
5772	p++;
5773	}
5774	}
5775
5776	p = ext1;
5777	p2 = ext2;
5778	while (*p2) {
5779	if (*p2 == '?') {
5780	/* Hmmm. Should this be mb-aware ? */
5781	p2 = p;
5782	p2++;
5783	} else if (p2 == '') {
5784	*p2 = '\0';
5785	ext2 = talloc_asprintf(ctx, "%s%s",
5786	ext2,
5787	p);
5788	if (!ext2) {
5789	return False;
5790	}
5791	break;
5792	} else {
5793	p2++;
5794	}
5795	if (*p) {
5796	p++;
5797	}
5798	}
5799
5800	if (*ext2) {
5801	*pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
5802	name2_copy,
5803	root2,
5804	ext2);
5805	} else {
5806	*pp_newname = talloc_asprintf(ctx, "%s/%s",
5807	name2_copy,
5808	root2);
5809	}
5810
5811	if (!*pp_newname) {
5812	return False;
5813	}
5814
5815	return True;
5816	}
5817
5818	/****************************************************************************
5819	Ensure open files have their names updated. Updated to notify other smbd's
5820	asynchronously.
5821	****************************************************************************/
5822
5823	static void rename_open_files(connection_struct *conn,
5824	struct share_mode_lock *lck,
5825	uint32_t orig_name_hash,
5826	const struct smb_filename *smb_fname_dst)
5827	{
5828	files_struct *fsp;
5829	bool did_rename = False;
5830	NTSTATUS status;
5831	uint32_t new_name_hash;
5832
5833	for(fsp = file_find_di_first(conn->sconn, lck->id); fsp;
5834	fsp = file_find_di_next(fsp)) {
5835	/* fsp_name is a relative path under the fsp. To change this for other
5836	sharepaths we need to manipulate relative paths. */
5837	/* TODO - create the absolute path and manipulate the newname
5838	relative to the sharepath. */
5839	if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
5840	continue;
5841	}
5842	if (fsp->name_hash != orig_name_hash) {
5843	continue;
5844	}
5845	DEBUG(10, ("rename_open_files: renaming file fnum %d "
5846	"(file_id %s) from %s -> %s\n", fsp->fnum,
5847	file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
5848	smb_fname_str_dbg(smb_fname_dst)));
5849
5850	status = fsp_set_smb_fname(fsp, smb_fname_dst);
5851	if (NT_STATUS_IS_OK(status)) {
5852	did_rename = True;
5853	new_name_hash = fsp->name_hash;
5854	}
5855	}
5856
5857	if (!did_rename) {
5858	DEBUG(10, ("rename_open_files: no open files on file_id %s "
5859	"for %s\n", file_id_string_tos(&lck->id),
5860	smb_fname_str_dbg(smb_fname_dst)));
5861	}
5862
5863	/* Send messages to all smbd's (not ourself) that the name has changed. */
5864	rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
5865	orig_name_hash, new_name_hash,
5866	smb_fname_dst);
5867
5868	}
5869
5870	/****************************************************************************
5871	We need to check if the source path is a parent directory of the destination
5872	(ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
5873	refuse the rename with a sharing violation. Under UNIX the above call can
5874	succeed if /foo/bar/baz is a symlink to another area in the share. We
5875	probably need to check that the client is a Windows one before disallowing
5876	this as a UNIX client (one with UNIX extensions) can know the source is a
5877	symlink and make this decision intelligently. Found by an excellent bug
5878	report from <AndyLiebman@aol.com>.
5879	****************************************************************************/
5880
5881	static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
5882	const struct smb_filename *smb_fname_dst)
5883	{
5884	const char *psrc = smb_fname_src->base_name;
5885	const char *pdst = smb_fname_dst->base_name;
5886	size_t slen;
5887
5888	if (psrc[0] == '.' && psrc[1] == '/') {
5889	psrc += 2;
5890	}
5891	if (pdst[0] == '.' && pdst[1] == '/') {
5892	pdst += 2;
5893	}
5894	if ((slen = strlen(psrc)) > strlen(pdst)) {
5895	return False;
5896	}
5897	return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
5898	}
5899
5900	/*
5901	* Do the notify calls from a rename
5902	*/
5903
5904	static void notify_rename(connection_struct *conn, bool is_dir,
5905	const struct smb_filename *smb_fname_src,
5906	const struct smb_filename *smb_fname_dst)
5907	{
5908	char *parent_dir_src = NULL;
5909	char *parent_dir_dst = NULL;
5910	uint32 mask;
5911
5912	mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
5913	: FILE_NOTIFY_CHANGE_FILE_NAME;
5914
5915	if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
5916	&parent_dir_src, NULL) \|\|
5917	!parent_dirname(talloc_tos(), smb_fname_dst->base_name,
5918	&parent_dir_dst, NULL)) {
5919	goto out;
5920	}
5921
5922	if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
5923	notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
5924	smb_fname_src->base_name);
5925	notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
5926	smb_fname_dst->base_name);
5927	}
5928	else {
5929	notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
5930	smb_fname_src->base_name);
5931	notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
5932	smb_fname_dst->base_name);
5933	}
5934
5935	/* this is a strange one. w2k3 gives an additional event for
5936	CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
5937	files, but not directories */
5938	if (!is_dir) {
5939	notify_fname(conn, NOTIFY_ACTION_MODIFIED,
5940	FILE_NOTIFY_CHANGE_ATTRIBUTES
5941	\|FILE_NOTIFY_CHANGE_CREATION,
5942	smb_fname_dst->base_name);
5943	}
5944	out:
5945	TALLOC_FREE(parent_dir_src);
5946	TALLOC_FREE(parent_dir_dst);
5947	}
5948
5949	/****************************************************************************
5950	Returns an error if the parent directory for a filename is open in an
5951	incompatible way.
5952	****************************************************************************/
5953
5954	static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
5955	const struct smb_filename *smb_fname_dst_in)
5956	{
5957	char *parent_dir = NULL;
5958	struct smb_filename smb_fname_parent;
5959	struct file_id id;
5960	files_struct *fsp = NULL;
5961	int ret;
5962
5963	if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
5964	&parent_dir, NULL)) {
5965	return NT_STATUS_NO_MEMORY;
5966	}
5967	ZERO_STRUCT(smb_fname_parent);
5968	smb_fname_parent.base_name = parent_dir;
5969
5970	ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
5971	if (ret == -1) {
5972	return map_nt_error_from_unix(errno);
5973	}
5974
5975	/*
5976	* We're only checking on this smbd here, mostly good
5977	* enough.. and will pass tests.
5978	*/
5979
5980	id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
5981	for (fsp = file_find_di_first(conn->sconn, id); fsp;
5982	fsp = file_find_di_next(fsp)) {
5983	if (fsp->access_mask & DELETE_ACCESS) {
5984	return NT_STATUS_SHARING_VIOLATION;
5985	}
5986	}
5987	return NT_STATUS_OK;
5988	}
5989
5990	/****************************************************************************
5991	Rename an open file - given an fsp.
5992	****************************************************************************/
5993
5994	NTSTATUS rename_internals_fsp(connection_struct *conn,
5995	files_struct *fsp,
5996	const struct smb_filename *smb_fname_dst_in,
5997	uint32 attrs,
5998	bool replace_if_exists)
5999	{
6000	TALLOC_CTX *ctx = talloc_tos();
6001	struct smb_filename *smb_fname_dst = NULL;
6002	NTSTATUS status = NT_STATUS_OK;
6003	struct share_mode_lock *lck = NULL;
6004	bool dst_exists, old_is_stream, new_is_stream;
6005
6006	status = check_name(conn, smb_fname_dst_in->base_name);
6007	if (!NT_STATUS_IS_OK(status)) {
6008	return status;
6009	}
6010
6011	status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6012	if (!NT_STATUS_IS_OK(status)) {
6013	return status;
6014	}
6015
6016	/* Make a copy of the dst smb_fname structs */
6017
6018	status = copy_smb_filename(ctx, smb_fname_dst_in, &smb_fname_dst);
6019	if (!NT_STATUS_IS_OK(status)) {
6020	goto out;
6021	}
6022
6023	/*
6024	* Check for special case with case preserving and not
6025	* case sensitive. If the old last component differs from the original
6026	* last component only by case, then we should allow
6027	* the rename (user is trying to change the case of the
6028	* filename).
6029	*/
6030	if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6031	strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6032	strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6033	char *last_slash;
6034	char *fname_dst_lcomp_base_mod = NULL;
6035	struct smb_filename *smb_fname_orig_lcomp = NULL;
6036
6037	/*
6038	* Get the last component of the destination name.
6039	*/
6040	last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6041	if (last_slash) {
6042	fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6043	} else {
6044	fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6045	}
6046	if (!fname_dst_lcomp_base_mod) {
6047	status = NT_STATUS_NO_MEMORY;
6048	goto out;
6049	}
6050
6051	/*
6052	* Create an smb_filename struct using the original last
6053	* component of the destination.
6054	*/
6055	status = create_synthetic_smb_fname_split(ctx,
6056	smb_fname_dst->original_lcomp, NULL,
6057	&smb_fname_orig_lcomp);
6058	if (!NT_STATUS_IS_OK(status)) {
6059	TALLOC_FREE(fname_dst_lcomp_base_mod);
6060	goto out;
6061	}
6062
6063	/* If the base names only differ by case, use original. */
6064	if(!strcsequal(fname_dst_lcomp_base_mod,
6065	smb_fname_orig_lcomp->base_name)) {
6066	char *tmp;
6067	/*
6068	* Replace the modified last component with the
6069	* original.
6070	*/
6071	if (last_slash) {
6072	last_slash = '\0'; / Truncate at the '/' */
6073	tmp = talloc_asprintf(smb_fname_dst,
6074	"%s/%s",
6075	smb_fname_dst->base_name,
6076	smb_fname_orig_lcomp->base_name);
6077	} else {
6078	tmp = talloc_asprintf(smb_fname_dst,
6079	"%s",
6080	smb_fname_orig_lcomp->base_name);
6081	}
6082	if (tmp == NULL) {
6083	status = NT_STATUS_NO_MEMORY;
6084	TALLOC_FREE(fname_dst_lcomp_base_mod);
6085	TALLOC_FREE(smb_fname_orig_lcomp);
6086	goto out;
6087	}
6088	TALLOC_FREE(smb_fname_dst->base_name);
6089	smb_fname_dst->base_name = tmp;
6090	}
6091
6092	/* If the stream_names only differ by case, use original. */
6093	if(!strcsequal(smb_fname_dst->stream_name,
6094	smb_fname_orig_lcomp->stream_name)) {
6095	char *tmp = NULL;
6096	/* Use the original stream. */
6097	tmp = talloc_strdup(smb_fname_dst,
6098	smb_fname_orig_lcomp->stream_name);
6099	if (tmp == NULL) {
6100	status = NT_STATUS_NO_MEMORY;
6101	TALLOC_FREE(fname_dst_lcomp_base_mod);
6102	TALLOC_FREE(smb_fname_orig_lcomp);
6103	goto out;
6104	}
6105	TALLOC_FREE(smb_fname_dst->stream_name);
6106	smb_fname_dst->stream_name = tmp;
6107	}
6108	TALLOC_FREE(fname_dst_lcomp_base_mod);
6109	TALLOC_FREE(smb_fname_orig_lcomp);
6110	}
6111
6112	/*
6113	* If the src and dest names are identical - including case,
6114	* don't do the rename, just return success.
6115	*/
6116
6117	if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6118	strcsequal(fsp->fsp_name->stream_name,
6119	smb_fname_dst->stream_name)) {
6120	DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6121	"- returning success\n",
6122	smb_fname_str_dbg(smb_fname_dst)));
6123	status = NT_STATUS_OK;
6124	goto out;
6125	}
6126
6127	old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6128	new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6129
6130	/* Return the correct error code if both names aren't streams. */
6131	if (!old_is_stream && new_is_stream) {
6132	status = NT_STATUS_OBJECT_NAME_INVALID;
6133	goto out;
6134	}
6135
6136	if (old_is_stream && !new_is_stream) {
6137	status = NT_STATUS_INVALID_PARAMETER;
6138	goto out;
6139	}
6140
6141	dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6142
6143	if(!replace_if_exists && dst_exists) {
6144	DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6145	"%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6146	smb_fname_str_dbg(smb_fname_dst)));
6147	status = NT_STATUS_OBJECT_NAME_COLLISION;
6148	goto out;
6149	}
6150
6151	if (dst_exists) {
6152	struct file_id fileid = vfs_file_id_from_sbuf(conn,
6153	&smb_fname_dst->st);
6154	files_struct *dst_fsp = file_find_di_first(conn->sconn,
6155	fileid);
6156	/* The file can be open when renaming a stream */
6157	if (dst_fsp && !new_is_stream) {
6158	DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6159	status = NT_STATUS_ACCESS_DENIED;
6160	goto out;
6161	}
6162	}
6163
6164	/* Ensure we have a valid stat struct for the source. */
6165	status = vfs_stat_fsp(fsp);
6166	if (!NT_STATUS_IS_OK(status)) {
6167	goto out;
6168	}
6169
6170	status = can_rename(conn, fsp, attrs);
6171
6172	if (!NT_STATUS_IS_OK(status)) {
6173	DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6174	nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6175	smb_fname_str_dbg(smb_fname_dst)));
6176	if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6177	status = NT_STATUS_ACCESS_DENIED;
6178	goto out;
6179	}
6180
6181	if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6182	status = NT_STATUS_ACCESS_DENIED;
6183	}
6184
6185	lck = get_share_mode_lock(talloc_tos(), fsp->file_id, NULL, NULL,
6186	NULL);
6187
6188	/*
6189	* We have the file open ourselves, so not being able to get the
6190	* corresponding share mode lock is a fatal error.
6191	*/
6192
6193	SMB_ASSERT(lck != NULL);
6194
6195	if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6196	uint32 create_options = fsp->fh->private_options;
6197
6198	DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6199	"%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6200	smb_fname_str_dbg(smb_fname_dst)));
6201
6202	if (!fsp->is_directory &&
6203	!lp_posix_pathnames() &&
6204	(lp_map_archive(SNUM(conn)) \|\|
6205	lp_store_dos_attributes(SNUM(conn)))) {
6206	/* We must set the archive bit on the newly
6207	renamed file. */
6208	if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6209	uint32_t old_dosmode = dos_mode(conn,
6210	smb_fname_dst);
6211	file_set_dosmode(conn,
6212	smb_fname_dst,
6213	old_dosmode \| FILE_ATTRIBUTE_ARCHIVE,
6214	NULL,
6215	true);
6216	}
6217	}
6218
6219	notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6220	smb_fname_dst);
6221
6222	rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6223
6224	/*
6225	* A rename acts as a new file create w.r.t. allowing an initial delete
6226	* on close, probably because in Windows there is a new handle to the
6227	* new file. If initial delete on close was requested but not
6228	* originally set, we need to set it here. This is probably not 100% correct,
6229	* but will work for the CIFSFS client which in non-posix mode
6230	* depends on these semantics. JRA.
6231	*/
6232
6233	if (create_options & FILE_DELETE_ON_CLOSE) {
6234	status = can_set_delete_on_close(fsp, 0);
6235
6236	if (NT_STATUS_IS_OK(status)) {
6237	/* Note that here we set the inital delete on close flag,
6238	* not the regular one. The magic gets handled in close. */
6239	fsp->initial_delete_on_close = True;
6240	}
6241	}
6242	TALLOC_FREE(lck);
6243	status = NT_STATUS_OK;
6244	goto out;
6245	}
6246
6247	TALLOC_FREE(lck);
6248
6249	if (errno == ENOTDIR \|\| errno == EISDIR) {
6250	status = NT_STATUS_OBJECT_NAME_COLLISION;
6251	} else {
6252	status = map_nt_error_from_unix(errno);
6253	}
6254
6255	DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6256	nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6257	smb_fname_str_dbg(smb_fname_dst)));
6258
6259	out:
6260	TALLOC_FREE(smb_fname_dst);
6261
6262	return status;
6263	}
6264
6265	/****************************************************************************
6266	The guts of the rename command, split out so it may be called by the NT SMB
6267	code.
6268	****************************************************************************/
6269
6270	NTSTATUS rename_internals(TALLOC_CTX *ctx,
6271	connection_struct *conn,
6272	struct smb_request *req,
6273	struct smb_filename *smb_fname_src,
6274	struct smb_filename *smb_fname_dst,
6275	uint32 attrs,
6276	bool replace_if_exists,
6277	bool src_has_wild,
6278	bool dest_has_wild,
6279	uint32_t access_mask)
6280	{
6281	char *fname_src_dir = NULL;
6282	char *fname_src_mask = NULL;
6283	int count=0;
6284	NTSTATUS status = NT_STATUS_OK;
6285	struct smb_Dir *dir_hnd = NULL;
6286	const char *dname = NULL;
6287	char *talloced = NULL;
6288	long offset = 0;
6289	int create_options = 0;
6290	bool posix_pathnames = lp_posix_pathnames();
6291
6292	/*
6293	* Split the old name into directory and last component
6294	* strings. Note that unix_convert may have stripped off a
6295	* leading ./ from both name and newname if the rename is
6296	* at the root of the share. We need to make sure either both
6297	* name and newname contain a / character or neither of them do
6298	* as this is checked in resolve_wildcards().
6299	*/
6300
6301	/* Split up the directory from the filename/mask. */
6302	status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6303	&fname_src_dir, &fname_src_mask);
6304	if (!NT_STATUS_IS_OK(status)) {
6305	status = NT_STATUS_NO_MEMORY;
6306	goto out;
6307	}
6308
6309	/*
6310	* We should only check the mangled cache
6311	* here if unix_convert failed. This means
6312	* that the path in 'mask' doesn't exist
6313	* on the file system and so we need to look
6314	* for a possible mangle. This patch from
6315	* Tine Smukavec <valentin.smukavec@hermes.si>.
6316	*/
6317
6318	if (!VALID_STAT(smb_fname_src->st) &&
6319	mangle_is_mangled(fname_src_mask, conn->params)) {
6320	char *new_mask = NULL;
6321	mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6322	conn->params);
6323	if (new_mask) {
6324	TALLOC_FREE(fname_src_mask);
6325	fname_src_mask = new_mask;
6326	}
6327	}
6328
6329	if (!src_has_wild) {
6330	files_struct *fsp;
6331
6332	/*
6333	* Only one file needs to be renamed. Append the mask back
6334	* onto the directory.
6335	*/
6336	TALLOC_FREE(smb_fname_src->base_name);
6337	if (ISDOT(fname_src_dir)) {
6338	/* Ensure we use canonical names on open. */
6339	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6340	"%s",
6341	fname_src_mask);
6342	} else {
6343	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6344	"%s/%s",
6345	fname_src_dir,
6346	fname_src_mask);
6347	}
6348	if (!smb_fname_src->base_name) {
6349	status = NT_STATUS_NO_MEMORY;
6350	goto out;
6351	}
6352
6353	DEBUG(3, ("rename_internals: case_sensitive = %d, "
6354	"case_preserve = %d, short case preserve = %d, "
6355	"directory = %s, newname = %s, "
6356	"last_component_dest = %s\n",
6357	conn->case_sensitive, conn->case_preserve,
6358	conn->short_case_preserve,
6359	smb_fname_str_dbg(smb_fname_src),
6360	smb_fname_str_dbg(smb_fname_dst),
6361	smb_fname_dst->original_lcomp));
6362
6363	/* The dest name still may have wildcards. */
6364	if (dest_has_wild) {
6365	char *fname_dst_mod = NULL;
6366	if (!resolve_wildcards(smb_fname_dst,
6367	smb_fname_src->base_name,
6368	smb_fname_dst->base_name,
6369	&fname_dst_mod)) {
6370	DEBUG(6, ("rename_internals: resolve_wildcards "
6371	"%s %s failed\n",
6372	smb_fname_src->base_name,
6373	smb_fname_dst->base_name));
6374	status = NT_STATUS_NO_MEMORY;
6375	goto out;
6376	}
6377	TALLOC_FREE(smb_fname_dst->base_name);
6378	smb_fname_dst->base_name = fname_dst_mod;
6379	}
6380
6381	ZERO_STRUCT(smb_fname_src->st);
6382	if (posix_pathnames) {
6383	SMB_VFS_LSTAT(conn, smb_fname_src);
6384	} else {
6385	SMB_VFS_STAT(conn, smb_fname_src);
6386	}
6387
6388	if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6389	create_options \|= FILE_DIRECTORY_FILE;
6390	}
6391
6392	status = SMB_VFS_CREATE_FILE(
6393	conn, /* conn */
6394	req, /* req */
6395	0, /* root_dir_fid */
6396	smb_fname_src, /* fname */
6397	access_mask, /* access_mask */
6398	(FILE_SHARE_READ \| /* share_access */
6399	FILE_SHARE_WRITE),
6400	FILE_OPEN, /* create_disposition*/
6401	create_options, /* create_options */
6402	posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS\|0777 : 0, /* file_attributes */
6403	0, /* oplock_request */
6404	0, /* allocation_size */
6405	0, /* private_flags */
6406	NULL, /* sd */
6407	NULL, /* ea_list */
6408	&fsp, /* result */
6409	NULL); /* pinfo */
6410
6411	if (!NT_STATUS_IS_OK(status)) {
6412	DEBUG(3, ("Could not open rename source %s: %s\n",
6413	smb_fname_str_dbg(smb_fname_src),
6414	nt_errstr(status)));
6415	goto out;
6416	}
6417
6418	status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6419	attrs, replace_if_exists);
6420
6421	close_file(req, fsp, NORMAL_CLOSE);
6422
6423	DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6424	nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6425	smb_fname_str_dbg(smb_fname_dst)));
6426
6427	goto out;
6428	}
6429
6430	/*
6431	* Wildcards - process each file that matches.
6432	*/
6433	if (strequal(fname_src_mask, "????????.???")) {
6434	TALLOC_FREE(fname_src_mask);
6435	fname_src_mask = talloc_strdup(ctx, "*");
6436	if (!fname_src_mask) {
6437	status = NT_STATUS_NO_MEMORY;
6438	goto out;
6439	}
6440	}
6441
6442	status = check_name(conn, fname_src_dir);
6443	if (!NT_STATUS_IS_OK(status)) {
6444	goto out;
6445	}
6446
6447	dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6448	attrs);
6449	if (dir_hnd == NULL) {
6450	status = map_nt_error_from_unix(errno);
6451	goto out;
6452	}
6453
6454	status = NT_STATUS_NO_SUCH_FILE;
6455	/*
6456	* Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6457	* - gentest fix. JRA
6458	*/
6459
6460	while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6461	&talloced))) {
6462	files_struct *fsp = NULL;
6463	char *destname = NULL;
6464	bool sysdir_entry = False;
6465
6466	/* Quick check for "." and ".." */
6467	if (ISDOT(dname) \|\| ISDOTDOT(dname)) {
6468	if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6469	sysdir_entry = True;
6470	} else {
6471	TALLOC_FREE(talloced);
6472	continue;
6473	}
6474	}
6475
6476	if (!is_visible_file(conn, fname_src_dir, dname,
6477	&smb_fname_src->st, false)) {
6478	TALLOC_FREE(talloced);
6479	continue;
6480	}
6481
6482	if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6483	TALLOC_FREE(talloced);
6484	continue;
6485	}
6486
6487	if (sysdir_entry) {
6488	status = NT_STATUS_OBJECT_NAME_INVALID;
6489	break;
6490	}
6491
6492	TALLOC_FREE(smb_fname_src->base_name);
6493	if (ISDOT(fname_src_dir)) {
6494	/* Ensure we use canonical names on open. */
6495	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6496	"%s",
6497	dname);
6498	} else {
6499	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6500	"%s/%s",
6501	fname_src_dir,
6502	dname);
6503	}
6504	if (!smb_fname_src->base_name) {
6505	status = NT_STATUS_NO_MEMORY;
6506	goto out;
6507	}
6508
6509	if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6510	smb_fname_dst->base_name,
6511	&destname)) {
6512	DEBUG(6, ("resolve_wildcards %s %s failed\n",
6513	smb_fname_src->base_name, destname));
6514	TALLOC_FREE(talloced);
6515	continue;
6516	}
6517	if (!destname) {
6518	status = NT_STATUS_NO_MEMORY;
6519	goto out;
6520	}
6521
6522	TALLOC_FREE(smb_fname_dst->base_name);
6523	smb_fname_dst->base_name = destname;
6524
6525	ZERO_STRUCT(smb_fname_src->st);
6526	if (posix_pathnames) {
6527	SMB_VFS_LSTAT(conn, smb_fname_src);
6528	} else {
6529	SMB_VFS_STAT(conn, smb_fname_src);
6530	}
6531
6532	create_options = 0;
6533
6534	if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6535	create_options \|= FILE_DIRECTORY_FILE;
6536	}
6537
6538	status = SMB_VFS_CREATE_FILE(
6539	conn, /* conn */
6540	req, /* req */
6541	0, /* root_dir_fid */
6542	smb_fname_src, /* fname */
6543	access_mask, /* access_mask */
6544	(FILE_SHARE_READ \| /* share_access */
6545	FILE_SHARE_WRITE),
6546	FILE_OPEN, /* create_disposition*/
6547	create_options, /* create_options */
6548	posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS\|0777 : 0, /* file_attributes */
6549	0, /* oplock_request */
6550	0, /* allocation_size */
6551	0, /* private_flags */
6552	NULL, /* sd */
6553	NULL, /* ea_list */
6554	&fsp, /* result */
6555	NULL); /* pinfo */
6556
6557	if (!NT_STATUS_IS_OK(status)) {
6558	DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6559	"returned %s rename %s -> %s\n",
6560	nt_errstr(status),
6561	smb_fname_str_dbg(smb_fname_src),
6562	smb_fname_str_dbg(smb_fname_dst)));
6563	break;
6564	}
6565
6566	smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6567	dname);
6568	if (!smb_fname_dst->original_lcomp) {
6569	status = NT_STATUS_NO_MEMORY;
6570	goto out;
6571	}
6572
6573	status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6574	attrs, replace_if_exists);
6575
6576	close_file(req, fsp, NORMAL_CLOSE);
6577
6578	if (!NT_STATUS_IS_OK(status)) {
6579	DEBUG(3, ("rename_internals_fsp returned %s for "
6580	"rename %s -> %s\n", nt_errstr(status),
6581	smb_fname_str_dbg(smb_fname_src),
6582	smb_fname_str_dbg(smb_fname_dst)));
6583	break;
6584	}
6585
6586	count++;
6587
6588	DEBUG(3,("rename_internals: doing rename on %s -> "
6589	"%s\n", smb_fname_str_dbg(smb_fname_src),
6590	smb_fname_str_dbg(smb_fname_src)));
6591	TALLOC_FREE(talloced);
6592	}
6593	TALLOC_FREE(dir_hnd);
6594
6595	if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6596	status = map_nt_error_from_unix(errno);
6597	}
6598
6599	out:
6600	TALLOC_FREE(talloced);
6601	TALLOC_FREE(fname_src_dir);
6602	TALLOC_FREE(fname_src_mask);
6603	return status;
6604	}
6605
6606	/****************************************************************************
6607	Reply to a mv.
6608	****************************************************************************/
6609
6610	void reply_mv(struct smb_request *req)
6611	{
6612	connection_struct *conn = req->conn;
6613	char *name = NULL;
6614	char *newname = NULL;
6615	const char *p;
6616	uint32 attrs;
6617	NTSTATUS status;
6618	bool src_has_wcard = False;
6619	bool dest_has_wcard = False;
6620	TALLOC_CTX *ctx = talloc_tos();
6621	struct smb_filename *smb_fname_src = NULL;
6622	struct smb_filename *smb_fname_dst = NULL;
6623	uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6624	uint32_t dst_ucf_flags = UCF_SAVE_LCOMP \| (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6625	bool stream_rename = false;
6626
6627	START_PROFILE(SMBmv);
6628
6629	if (req->wct < 1) {
6630	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6631	goto out;
6632	}
6633
6634	attrs = SVAL(req->vwv+0, 0);
6635
6636	p = (const char *)req->buf + 1;
6637	p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6638	&status, &src_has_wcard);
6639	if (!NT_STATUS_IS_OK(status)) {
6640	reply_nterror(req, status);
6641	goto out;
6642	}
6643	p++;
6644	p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6645	&status, &dest_has_wcard);
6646	if (!NT_STATUS_IS_OK(status)) {
6647	reply_nterror(req, status);
6648	goto out;
6649	}
6650
6651	if (!lp_posix_pathnames()) {
6652	/* The newname must begin with a ':' if the
6653	name contains a ':'. */
6654	if (strchr_m(name, ':')) {
6655	if (newname[0] != ':') {
6656	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6657	goto out;
6658	}
6659	stream_rename = true;
6660	}
6661	}
6662
6663	status = filename_convert(ctx,
6664	conn,
6665	req->flags2 & FLAGS2_DFS_PATHNAMES,
6666	name,
6667	src_ucf_flags,
6668	&src_has_wcard,
6669	&smb_fname_src);
6670
6671	if (!NT_STATUS_IS_OK(status)) {
6672	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6673	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6674	ERRSRV, ERRbadpath);
6675	goto out;
6676	}
6677	reply_nterror(req, status);
6678	goto out;
6679	}
6680
6681	status = filename_convert(ctx,
6682	conn,
6683	req->flags2 & FLAGS2_DFS_PATHNAMES,
6684	newname,
6685	dst_ucf_flags,
6686	&dest_has_wcard,
6687	&smb_fname_dst);
6688
6689	if (!NT_STATUS_IS_OK(status)) {
6690	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6691	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6692	ERRSRV, ERRbadpath);
6693	goto out;
6694	}
6695	reply_nterror(req, status);
6696	goto out;
6697	}
6698
6699	if (stream_rename) {
6700	/* smb_fname_dst->base_name must be the same as
6701	smb_fname_src->base_name. */
6702	TALLOC_FREE(smb_fname_dst->base_name);
6703	smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6704	smb_fname_src->base_name);
6705	if (!smb_fname_dst->base_name) {
6706	reply_nterror(req, NT_STATUS_NO_MEMORY);
6707	goto out;
6708	}
6709	}
6710
6711	DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
6712	smb_fname_str_dbg(smb_fname_dst)));
6713
6714	status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
6715	attrs, False, src_has_wcard, dest_has_wcard,
6716	DELETE_ACCESS);
6717	if (!NT_STATUS_IS_OK(status)) {
6718	if (open_was_deferred(req->mid)) {
6719	/* We have re-scheduled this call. */
6720	goto out;
6721	}
6722	reply_nterror(req, status);
6723	goto out;
6724	}
6725
6726	reply_outbuf(req, 0, 0);
6727	out:
6728	TALLOC_FREE(smb_fname_src);
6729	TALLOC_FREE(smb_fname_dst);
6730	END_PROFILE(SMBmv);
6731	return;
6732	}
6733
6734	/*******************************************************************
6735	Copy a file as part of a reply_copy.
6736	******************************************************************/
6737
6738	/*
6739	* TODO: check error codes on all callers
6740	*/
6741
6742	NTSTATUS copy_file(TALLOC_CTX *ctx,
6743	connection_struct *conn,
6744	struct smb_filename *smb_fname_src,
6745	struct smb_filename *smb_fname_dst,
6746	int ofun,
6747	int count,
6748	bool target_is_directory)
6749	{
6750	struct smb_filename *smb_fname_dst_tmp = NULL;
6751	SMB_OFF_T ret=-1;
6752	files_struct fsp1,fsp2;
6753	uint32 dosattrs;
6754	uint32 new_create_disposition;
6755	NTSTATUS status;
6756
6757
6758	status = copy_smb_filename(ctx, smb_fname_dst, &smb_fname_dst_tmp);
6759	if (!NT_STATUS_IS_OK(status)) {
6760	return status;
6761	}
6762
6763	/*
6764	* If the target is a directory, extract the last component from the
6765	* src filename and append it to the dst filename
6766	*/
6767	if (target_is_directory) {
6768	const char *p;
6769
6770	/* dest/target can't be a stream if it's a directory. */
6771	SMB_ASSERT(smb_fname_dst->stream_name == NULL);
6772
6773	p = strrchr_m(smb_fname_src->base_name,'/');
6774	if (p) {
6775	p++;
6776	} else {
6777	p = smb_fname_src->base_name;
6778	}
6779	smb_fname_dst_tmp->base_name =
6780	talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
6781	p);
6782	if (!smb_fname_dst_tmp->base_name) {
6783	status = NT_STATUS_NO_MEMORY;
6784	goto out;
6785	}
6786	}
6787
6788	status = vfs_file_exist(conn, smb_fname_src);
6789	if (!NT_STATUS_IS_OK(status)) {
6790	goto out;
6791	}
6792
6793	if (!target_is_directory && count) {
6794	new_create_disposition = FILE_OPEN;
6795	} else {
6796	if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
6797	0, ofun,
6798	NULL, NULL,
6799	&new_create_disposition,
6800	NULL,
6801	NULL)) {
6802	status = NT_STATUS_INVALID_PARAMETER;
6803	goto out;
6804	}
6805	}
6806
6807	/* Open the src file for reading. */
6808	status = SMB_VFS_CREATE_FILE(
6809	conn, /* conn */
6810	NULL, /* req */
6811	0, /* root_dir_fid */
6812	smb_fname_src, /* fname */
6813	FILE_GENERIC_READ, /* access_mask */
6814	FILE_SHARE_READ \| FILE_SHARE_WRITE, /* share_access */
6815	FILE_OPEN, /* create_disposition*/
6816	0, /* create_options */
6817	FILE_ATTRIBUTE_NORMAL, /* file_attributes */
6818	INTERNAL_OPEN_ONLY, /* oplock_request */
6819	0, /* allocation_size */
6820	0, /* private_flags */
6821	NULL, /* sd */
6822	NULL, /* ea_list */
6823	&fsp1, /* result */
6824	NULL); /* psbuf */
6825
6826	if (!NT_STATUS_IS_OK(status)) {
6827	goto out;
6828	}
6829
6830	dosattrs = dos_mode(conn, smb_fname_src);
6831
6832	if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
6833	ZERO_STRUCTP(&smb_fname_dst_tmp->st);
6834	}
6835
6836	/* Open the dst file for writing. */
6837	status = SMB_VFS_CREATE_FILE(
6838	conn, /* conn */
6839	NULL, /* req */
6840	0, /* root_dir_fid */
6841	smb_fname_dst, /* fname */
6842	FILE_GENERIC_WRITE, /* access_mask */
6843	FILE_SHARE_READ \| FILE_SHARE_WRITE, /* share_access */
6844	new_create_disposition, /* create_disposition*/
6845	0, /* create_options */
6846	dosattrs, /* file_attributes */
6847	INTERNAL_OPEN_ONLY, /* oplock_request */
6848	0, /* allocation_size */
6849	0, /* private_flags */
6850	NULL, /* sd */
6851	NULL, /* ea_list */
6852	&fsp2, /* result */
6853	NULL); /* psbuf */
6854
6855	if (!NT_STATUS_IS_OK(status)) {
6856	close_file(NULL, fsp1, ERROR_CLOSE);
6857	goto out;
6858	}
6859
6860	if (ofun & OPENX_FILE_EXISTS_OPEN) {
6861	ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
6862	if (ret == -1) {
6863	DEBUG(0, ("error - vfs lseek returned error %s\n",
6864	strerror(errno)));
6865	status = map_nt_error_from_unix(errno);
6866	close_file(NULL, fsp1, ERROR_CLOSE);
6867	close_file(NULL, fsp2, ERROR_CLOSE);
6868	goto out;
6869	}
6870	}
6871
6872	/* Do the actual copy. */
6873	if (smb_fname_src->st.st_ex_size) {
6874	ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
6875	} else {
6876	ret = 0;
6877	}
6878
6879	close_file(NULL, fsp1, NORMAL_CLOSE);
6880
6881	/* Ensure the modtime is set correctly on the destination file. */
6882	set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
6883
6884	/*
6885	* As we are opening fsp1 read-only we only expect
6886	* an error on close on fsp2 if we are out of space.
6887	* Thus we don't look at the error return from the
6888	* close of fsp1.
6889	*/
6890	status = close_file(NULL, fsp2, NORMAL_CLOSE);
6891
6892	if (!NT_STATUS_IS_OK(status)) {
6893	goto out;
6894	}
6895
6896	if (ret != (SMB_OFF_T)smb_fname_src->st.st_ex_size) {
6897	status = NT_STATUS_DISK_FULL;
6898	goto out;
6899	}
6900
6901	status = NT_STATUS_OK;
6902
6903	out:
6904	TALLOC_FREE(smb_fname_dst_tmp);
6905	return status;
6906	}
6907
6908	/****************************************************************************
6909	Reply to a file copy.
6910	****************************************************************************/
6911
6912	void reply_copy(struct smb_request *req)
6913	{
6914	connection_struct *conn = req->conn;
6915	struct smb_filename *smb_fname_src = NULL;
6916	struct smb_filename *smb_fname_dst = NULL;
6917	char *fname_src = NULL;
6918	char *fname_dst = NULL;
6919	char *fname_src_mask = NULL;
6920	char *fname_src_dir = NULL;
6921	const char *p;
6922	int count=0;
6923	int error = ERRnoaccess;
6924	int tid2;
6925	int ofun;
6926	int flags;
6927	bool target_is_directory=False;
6928	bool source_has_wild = False;
6929	bool dest_has_wild = False;
6930	NTSTATUS status;
6931	TALLOC_CTX *ctx = talloc_tos();
6932
6933	START_PROFILE(SMBcopy);
6934
6935	if (req->wct < 3) {
6936	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6937	goto out;
6938	}
6939
6940	tid2 = SVAL(req->vwv+0, 0);
6941	ofun = SVAL(req->vwv+1, 0);
6942	flags = SVAL(req->vwv+2, 0);
6943
6944	p = (const char *)req->buf;
6945	p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
6946	&status, &source_has_wild);
6947	if (!NT_STATUS_IS_OK(status)) {
6948	reply_nterror(req, status);
6949	goto out;
6950	}
6951	p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
6952	&status, &dest_has_wild);
6953	if (!NT_STATUS_IS_OK(status)) {
6954	reply_nterror(req, status);
6955	goto out;
6956	}
6957
6958	DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
6959
6960	if (tid2 != conn->cnum) {
6961	/* can't currently handle inter share copies XXXX */
6962	DEBUG(3,("Rejecting inter-share copy\n"));
6963	reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
6964	goto out;
6965	}
6966
6967	status = filename_convert(ctx, conn,
6968	req->flags2 & FLAGS2_DFS_PATHNAMES,
6969	fname_src,
6970	UCF_COND_ALLOW_WCARD_LCOMP,
6971	&source_has_wild,
6972	&smb_fname_src);
6973	if (!NT_STATUS_IS_OK(status)) {
6974	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6975	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6976	ERRSRV, ERRbadpath);
6977	goto out;
6978	}
6979	reply_nterror(req, status);
6980	goto out;
6981	}
6982
6983	status = filename_convert(ctx, conn,
6984	req->flags2 & FLAGS2_DFS_PATHNAMES,
6985	fname_dst,
6986	UCF_COND_ALLOW_WCARD_LCOMP,
6987	&dest_has_wild,
6988	&smb_fname_dst);
6989	if (!NT_STATUS_IS_OK(status)) {
6990	if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6991	reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6992	ERRSRV, ERRbadpath);
6993	goto out;
6994	}
6995	reply_nterror(req, status);
6996	goto out;
6997	}
6998
6999	target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7000
7001	if ((flags&1) && target_is_directory) {
7002	reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7003	goto out;
7004	}
7005
7006	if ((flags&2) && !target_is_directory) {
7007	reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7008	goto out;
7009	}
7010
7011	if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7012	/* wants a tree copy! XXXX */
7013	DEBUG(3,("Rejecting tree copy\n"));
7014	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7015	goto out;
7016	}
7017
7018	/* Split up the directory from the filename/mask. */
7019	status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7020	&fname_src_dir, &fname_src_mask);
7021	if (!NT_STATUS_IS_OK(status)) {
7022	reply_nterror(req, NT_STATUS_NO_MEMORY);
7023	goto out;
7024	}
7025
7026	/*
7027	* We should only check the mangled cache
7028	* here if unix_convert failed. This means
7029	* that the path in 'mask' doesn't exist
7030	* on the file system and so we need to look
7031	* for a possible mangle. This patch from
7032	* Tine Smukavec <valentin.smukavec@hermes.si>.
7033	*/
7034	if (!VALID_STAT(smb_fname_src->st) &&
7035	mangle_is_mangled(fname_src_mask, conn->params)) {
7036	char *new_mask = NULL;
7037	mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7038	&new_mask, conn->params);
7039
7040	/* Use demangled name if one was successfully found. */
7041	if (new_mask) {
7042	TALLOC_FREE(fname_src_mask);
7043	fname_src_mask = new_mask;
7044	}
7045	}
7046
7047	if (!source_has_wild) {
7048
7049	/*
7050	* Only one file needs to be copied. Append the mask back onto
7051	* the directory.
7052	*/
7053	TALLOC_FREE(smb_fname_src->base_name);
7054	if (ISDOT(fname_src_dir)) {
7055	/* Ensure we use canonical names on open. */
7056	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7057	"%s",
7058	fname_src_mask);
7059	} else {
7060	smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7061	"%s/%s",
7062	fname_src_dir,
7063	fname_src_mask);
7064	}
7065	if (!smb_fname_src->base_name) {
7066	reply_nterror(req, NT_STATUS_NO_MEMORY);
7067	goto out;
7068	}
7069
7070	if (dest_has_wild) {
7071	char *fname_dst_mod = NULL;
7072	if (!resolve_wildcards(smb_fname_dst,
7073	smb_fname_src->base_name,
7074	smb_fname_dst->base_name,
7075	&fname_dst_mod)) {
7076	reply_nterror(req, NT_STATUS_NO_MEMORY);
7077	goto out;
7078	}
7079	TALLOC_FREE(smb_fname_dst->base_name);
7080	smb_fname_dst->base_name = fname_dst_mod;
7081	}
7082
7083	status = check_name(conn, smb_fname_src->base_name);
7084	if (!NT_STATUS_IS_OK(status)) {
7085	reply_nterror(req, status);
7086	goto out;
7087	}
7088
7089	status = check_name(conn, smb_fname_dst->base_name);
7090	if (!NT_STATUS_IS_OK(status)) {
7091	reply_nterror(req, status);
7092	goto out;
7093	}
7094
7095	status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7096	ofun, count, target_is_directory);
7097
7098	if(!NT_STATUS_IS_OK(status)) {
7099	reply_nterror(req, status);
7100	goto out;
7101	} else {
7102	count++;
7103	}
7104	} else {
7105	struct smb_Dir *dir_hnd = NULL;
7106	const char *dname = NULL;
7107	char *talloced = NULL;
7108	long offset = 0;
7109
7110	/*
7111	* There is a wildcard that requires us to actually read the
7112	* src dir and copy each file matching the mask to the dst.
7113	* Right now streams won't be copied, but this could
7114	* presumably be added with a nested loop for reach dir entry.
7115	*/
7116	SMB_ASSERT(!smb_fname_src->stream_name);
7117	SMB_ASSERT(!smb_fname_dst->stream_name);
7118
7119	smb_fname_src->stream_name = NULL;
7120	smb_fname_dst->stream_name = NULL;
7121
7122	if (strequal(fname_src_mask,"????????.???")) {
7123	TALLOC_FREE(fname_src_mask);
7124	fname_src_mask = talloc_strdup(ctx, "*");
7125	if (!fname_src_mask) {
7126	reply_nterror(req, NT_STATUS_NO_MEMORY);
7127	goto out;
7128	}
7129	}
7130
7131	status = check_name(conn, fname_src_dir);
7132	if (!NT_STATUS_IS_OK(status)) {
7133	reply_nterror(req, status);
7134	goto out;
7135	}
7136
7137	dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7138	if (dir_hnd == NULL) {
7139	status = map_nt_error_from_unix(errno);
7140	reply_nterror(req, status);
7141	goto out;
7142	}
7143
7144	error = ERRbadfile;
7145
7146	/* Iterate over the src dir copying each entry to the dst. */
7147	while ((dname = ReadDirName(dir_hnd, &offset,
7148	&smb_fname_src->st, &talloced))) {
7149	char *destname = NULL;
7150
7151	if (ISDOT(dname) \|\| ISDOTDOT(dname)) {
7152	TALLOC_FREE(talloced);
7153	continue;
7154	}
7155
7156	if (!is_visible_file(conn, fname_src_dir, dname,
7157	&smb_fname_src->st, false)) {
7158	TALLOC_FREE(talloced);
7159	continue;
7160	}
7161
7162	if(!mask_match(dname, fname_src_mask,
7163	conn->case_sensitive)) {
7164	TALLOC_FREE(talloced);
7165	continue;
7166	}
7167
7168	error = ERRnoaccess;
7169
7170	/* Get the src smb_fname struct setup. */
7171	TALLOC_FREE(smb_fname_src->base_name);
7172	if (ISDOT(fname_src_dir)) {
7173	/* Ensure we use canonical names on open. */
7174	smb_fname_src->base_name =
7175	talloc_asprintf(smb_fname_src, "%s",
7176	dname);
7177	} else {
7178	smb_fname_src->base_name =
7179	talloc_asprintf(smb_fname_src, "%s/%s",
7180	fname_src_dir, dname);
7181	}
7182
7183	if (!smb_fname_src->base_name) {
7184	TALLOC_FREE(dir_hnd);
7185	TALLOC_FREE(talloced);
7186	reply_nterror(req, NT_STATUS_NO_MEMORY);
7187	goto out;
7188	}
7189
7190	if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7191	smb_fname_dst->base_name,
7192	&destname)) {
7193	TALLOC_FREE(talloced);
7194	continue;
7195	}
7196	if (!destname) {
7197	TALLOC_FREE(dir_hnd);
7198	TALLOC_FREE(talloced);
7199	reply_nterror(req, NT_STATUS_NO_MEMORY);
7200	goto out;
7201	}
7202
7203	TALLOC_FREE(smb_fname_dst->base_name);
7204	smb_fname_dst->base_name = destname;
7205
7206	status = check_name(conn, smb_fname_src->base_name);
7207	if (!NT_STATUS_IS_OK(status)) {
7208	TALLOC_FREE(dir_hnd);
7209	TALLOC_FREE(talloced);
7210	reply_nterror(req, status);
7211	goto out;
7212	}
7213
7214	status = check_name(conn, smb_fname_dst->base_name);
7215	if (!NT_STATUS_IS_OK(status)) {
7216	TALLOC_FREE(dir_hnd);
7217	TALLOC_FREE(talloced);
7218	reply_nterror(req, status);
7219	goto out;
7220	}
7221
7222	DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7223	smb_fname_src->base_name,
7224	smb_fname_dst->base_name));
7225
7226	status = copy_file(ctx, conn, smb_fname_src,
7227	smb_fname_dst, ofun, count,
7228	target_is_directory);
7229	if (NT_STATUS_IS_OK(status)) {
7230	count++;
7231	}
7232
7233	TALLOC_FREE(talloced);
7234	}
7235	TALLOC_FREE(dir_hnd);
7236	}
7237
7238	if (count == 0) {
7239	reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7240	goto out;
7241	}
7242
7243	reply_outbuf(req, 1, 0);
7244	SSVAL(req->outbuf,smb_vwv0,count);
7245	out:
7246	TALLOC_FREE(smb_fname_src);
7247	TALLOC_FREE(smb_fname_dst);
7248	TALLOC_FREE(fname_src);
7249	TALLOC_FREE(fname_dst);
7250	TALLOC_FREE(fname_src_mask);
7251	TALLOC_FREE(fname_src_dir);
7252
7253	END_PROFILE(SMBcopy);
7254	return;
7255	}
7256
7257	#undef DBGC_CLASS
7258	#define DBGC_CLASS DBGC_LOCKING
7259
7260	/****************************************************************************
7261	Get a lock pid, dealing with large count requests.
7262	****************************************************************************/
7263
7264	uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7265	bool large_file_format)
7266	{
7267	if(!large_file_format)
7268	return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7269	else
7270	return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7271	}
7272
7273	/****************************************************************************
7274	Get a lock count, dealing with large count requests.
7275	****************************************************************************/
7276
7277	uint64_t get_lock_count(const uint8_t *data, int data_offset,
7278	bool large_file_format)
7279	{
7280	uint64_t count = 0;
7281
7282	if(!large_file_format) {
7283	count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7284	} else {
7285
7286	#if defined(HAVE_LONGLONG)
7287	count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) \|
7288	((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7289	#else /* HAVE_LONGLONG */
7290
7291	/*
7292	* NT4.x seems to be broken in that it sends large file (64 bit)
7293	* lockingX calls even if the CAP_LARGE_FILES was not
7294	* negotiated. For boxes without large unsigned ints truncate the
7295	* lock count by dropping the top 32 bits.
7296	*/
7297
7298	if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7299	DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7300	(unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7301	(unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7302	SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7303	}
7304
7305	count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7306	#endif /* HAVE_LONGLONG */
7307	}
7308
7309	return count;
7310	}
7311
7312	#if !defined(HAVE_LONGLONG)
7313	/****************************************************************************
7314	Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7315	****************************************************************************/
7316
7317	static uint32 map_lock_offset(uint32 high, uint32 low)
7318	{
7319	unsigned int i;
7320	uint32 mask = 0;
7321	uint32 highcopy = high;
7322
7323	/*
7324	* Try and find out how many significant bits there are in high.
7325	*/
7326
7327	for(i = 0; highcopy; i++)
7328	highcopy >>= 1;
7329
7330	/*
7331	* We use 31 bits not 32 here as POSIX
7332	* lock offsets may not be negative.
7333	*/
7334
7335	mask = (~0) << (31 - i);
7336
7337	if(low & mask)
7338	return 0; /* Fail. */
7339
7340	high <<= (31 - i);
7341
7342	return (high\|low);
7343	}
7344	#endif /* !defined(HAVE_LONGLONG) */
7345
7346	/****************************************************************************
7347	Get a lock offset, dealing with large offset requests.
7348	****************************************************************************/
7349
7350	uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7351	bool large_file_format, bool *err)
7352	{
7353	uint64_t offset = 0;
7354
7355	*err = False;
7356
7357	if(!large_file_format) {
7358	offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7359	} else {
7360
7361	#if defined(HAVE_LONGLONG)
7362	offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) \|
7363	((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7364	#else /* HAVE_LONGLONG */
7365
7366	/*
7367	* NT4.x seems to be broken in that it sends large file (64 bit)
7368	* lockingX calls even if the CAP_LARGE_FILES was not
7369	* negotiated. For boxes without large unsigned ints mangle the
7370	* lock offset by mapping the top 32 bits onto the lower 32.
7371	*/
7372
7373	if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7374	uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7375	uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7376	uint32 new_low = 0;
7377
7378	if((new_low = map_lock_offset(high, low)) == 0) {
7379	*err = True;
7380	return (uint64_t)-1;
7381	}
7382
7383	DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7384	(unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7385	SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7386	SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7387	}
7388
7389	offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7390	#endif /* HAVE_LONGLONG */
7391	}
7392
7393	return offset;
7394	}
7395
7396	NTSTATUS smbd_do_locking(struct smb_request *req,
7397	files_struct *fsp,
7398	uint8_t type,
7399	int32_t timeout,
7400	uint16_t num_ulocks,
7401	struct smbd_lock_element *ulocks,
7402	uint16_t num_locks,
7403	struct smbd_lock_element *locks,
7404	bool *async)
7405	{
7406	connection_struct *conn = req->conn;
7407	int i;
7408	NTSTATUS status = NT_STATUS_OK;
7409
7410	*async = false;
7411
7412	/* Data now points at the beginning of the list
7413	of smb_unlkrng structs */
7414	for(i = 0; i < (int)num_ulocks; i++) {
7415	struct smbd_lock_element *e = &ulocks[i];
7416
7417	DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7418	"pid %u, file %s\n",
7419	(double)e->offset,
7420	(double)e->count,
7421	(unsigned int)e->smblctx,
7422	fsp_str_dbg(fsp)));
7423
7424	if (e->brltype != UNLOCK_LOCK) {
7425	/* this can only happen with SMB2 */
7426	return NT_STATUS_INVALID_PARAMETER;
7427	}
7428
7429	status = do_unlock(req->sconn->msg_ctx,
7430	fsp,
7431	e->smblctx,
7432	e->count,
7433	e->offset,
7434	WINDOWS_LOCK);
7435
7436	DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7437	nt_errstr(status)));
7438
7439	if (!NT_STATUS_IS_OK(status)) {
7440	return status;
7441	}
7442	}
7443
7444	/* Setup the timeout in seconds. */
7445
7446	if (!lp_blocking_locks(SNUM(conn))) {
7447	timeout = 0;
7448	}
7449
7450	/* Data now points at the beginning of the list
7451	of smb_lkrng structs */
7452
7453	for(i = 0; i < (int)num_locks; i++) {
7454	struct smbd_lock_element *e = &locks[i];
7455
7456	DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7457	"%llu, file %s timeout = %d\n",
7458	(double)e->offset,
7459	(double)e->count,
7460	(unsigned long long)e->smblctx,
7461	fsp_str_dbg(fsp),
7462	(int)timeout));
7463
7464	if (type & LOCKING_ANDX_CANCEL_LOCK) {
7465	struct blocking_lock_record *blr = NULL;
7466
7467	if (num_locks > 1) {
7468	/*
7469	* MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7470	* if the lock vector contains one entry. When given mutliple cancel
7471	* requests in a single PDU we expect the server to return an
7472	* error. Windows servers seem to accept the request but only
7473	* cancel the first lock.
7474	* JRA - Do what Windows does (tm) :-).
7475	*/
7476
7477	#if 0
7478	/* MS-CIFS (2.2.4.32.1) behavior. */
7479	return NT_STATUS_DOS(ERRDOS,
7480	ERRcancelviolation);
7481	#else
7482	/* Windows behavior. */
7483	if (i != 0) {
7484	DEBUG(10,("smbd_do_locking: ignoring subsequent "
7485	"cancel request\n"));
7486	continue;
7487	}
7488	#endif
7489	}
7490
7491	if (lp_blocking_locks(SNUM(conn))) {
7492
7493	/* Schedule a message to ourselves to
7494	remove the blocking lock record and
7495	return the right error. */
7496
7497	blr = blocking_lock_cancel_smb1(fsp,
7498	e->smblctx,
7499	e->offset,
7500	e->count,
7501	WINDOWS_LOCK,
7502	type,
7503	NT_STATUS_FILE_LOCK_CONFLICT);
7504	if (blr == NULL) {
7505	return NT_STATUS_DOS(
7506	ERRDOS,
7507	ERRcancelviolation);
7508	}
7509	}
7510	/* Remove a matching pending lock. */
7511	status = do_lock_cancel(fsp,
7512	e->smblctx,
7513	e->count,
7514	e->offset,
7515	WINDOWS_LOCK,
7516	blr);
7517	} else {
7518	bool blocking_lock = timeout ? true : false;
7519	bool defer_lock = false;
7520	struct byte_range_lock *br_lck;
7521	uint64_t block_smblctx;
7522
7523	br_lck = do_lock(req->sconn->msg_ctx,
7524	fsp,
7525	e->smblctx,
7526	e->count,
7527	e->offset,
7528	e->brltype,
7529	WINDOWS_LOCK,
7530	blocking_lock,
7531	&status,
7532	&block_smblctx,
7533	NULL);
7534
7535	if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7536	/* Windows internal resolution for blocking locks seems
7537	to be about 200ms... Don't wait for less than that. JRA. */
7538	if (timeout != -1 && timeout < lp_lock_spin_time()) {
7539	timeout = lp_lock_spin_time();
7540	}
7541	defer_lock = true;
7542	}
7543
7544	/* If a lock sent with timeout of zero would fail, and
7545	* this lock has been requested multiple times,
7546	* according to brl_lock_failed() we convert this
7547	* request to a blocking lock with a timeout of between
7548	* 150 - 300 milliseconds.
7549	*
7550	* If lp_lock_spin_time() has been set to 0, we skip
7551	* this blocking retry and fail immediately.
7552	*
7553	* Replacement for do_lock_spin(). JRA. */
7554
7555	if (!req->sconn->using_smb2 &&
7556	br_lck && lp_blocking_locks(SNUM(conn)) &&
7557	lp_lock_spin_time() && !blocking_lock &&
7558	NT_STATUS_EQUAL((status),
7559	NT_STATUS_FILE_LOCK_CONFLICT))
7560	{
7561	defer_lock = true;
7562	timeout = lp_lock_spin_time();
7563	}
7564
7565	if (br_lck && defer_lock) {
7566	/*
7567	* A blocking lock was requested. Package up
7568	* this smb into a queued request and push it
7569	* onto the blocking lock queue.
7570	*/
7571	if(push_blocking_lock_request(br_lck,
7572	req,
7573	fsp,
7574	timeout,
7575	i,
7576	e->smblctx,
7577	e->brltype,
7578	WINDOWS_LOCK,
7579	e->offset,
7580	e->count,
7581	block_smblctx)) {
7582	TALLOC_FREE(br_lck);
7583	*async = true;
7584	return NT_STATUS_OK;
7585	}
7586	}
7587
7588	TALLOC_FREE(br_lck);
7589	}
7590
7591	if (!NT_STATUS_IS_OK(status)) {
7592	break;
7593	}
7594	}
7595
7596	/* If any of the above locks failed, then we must unlock
7597	all of the previous locks (X/Open spec). */
7598
7599	if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7600
7601	if (type & LOCKING_ANDX_CANCEL_LOCK) {
7602	i = -1; /* we want to skip the for loop */
7603	}
7604
7605	/*
7606	* Ensure we don't do a remove on the lock that just failed,
7607	* as under POSIX rules, if we have a lock already there, we
7608	* will delete it (and we shouldn't) .....
7609	*/
7610	for(i--; i >= 0; i--) {
7611	struct smbd_lock_element *e = &locks[i];
7612
7613	do_unlock(req->sconn->msg_ctx,
7614	fsp,
7615	e->smblctx,
7616	e->count,
7617	e->offset,
7618	WINDOWS_LOCK);
7619	}
7620	return status;
7621	}
7622
7623	DEBUG(3, ("smbd_do_locking: fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7624	fsp->fnum, (unsigned int)type, num_locks, num_ulocks));
7625
7626	return NT_STATUS_OK;
7627	}
7628
7629	/****************************************************************************
7630	Reply to a lockingX request.
7631	****************************************************************************/
7632
7633	void reply_lockingX(struct smb_request *req)
7634	{
7635	connection_struct *conn = req->conn;
7636	files_struct *fsp;
7637	unsigned char locktype;
7638	unsigned char oplocklevel;
7639	uint16 num_ulocks;
7640	uint16 num_locks;
7641	int32 lock_timeout;
7642	int i;
7643	const uint8_t *data;
7644	bool large_file_format;
7645	bool err;
7646	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7647	struct smbd_lock_element *ulocks;
7648	struct smbd_lock_element *locks;
7649	bool async = false;
7650
7651	START_PROFILE(SMBlockingX);
7652
7653	if (req->wct < 8) {
7654	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7655	END_PROFILE(SMBlockingX);
7656	return;
7657	}
7658
7659	fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7660	locktype = CVAL(req->vwv+3, 0);
7661	oplocklevel = CVAL(req->vwv+3, 1);
7662	num_ulocks = SVAL(req->vwv+6, 0);
7663	num_locks = SVAL(req->vwv+7, 0);
7664	lock_timeout = IVAL(req->vwv+4, 0);
7665	large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7666
7667	if (!check_fsp(conn, req, fsp)) {
7668	END_PROFILE(SMBlockingX);
7669	return;
7670	}
7671
7672	data = req->buf;
7673
7674	if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7675	/* we don't support these - and CANCEL_LOCK makes w2k
7676	and XP reboot so I don't really want to be
7677	compatible! (tridge) */
7678	reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7679	END_PROFILE(SMBlockingX);
7680	return;
7681	}
7682
7683	/* Check if this is an oplock break on a file
7684	we have granted an oplock on.
7685	*/
7686	if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7687	/* Client can insist on breaking to none. */
7688	bool break_to_none = (oplocklevel == 0);
7689	bool result;
7690
7691	DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7692	"for fnum = %d\n", (unsigned int)oplocklevel,
7693	fsp->fnum ));
7694
7695	/*
7696	* Make sure we have granted an exclusive or batch oplock on
7697	* this file.
7698	*/
7699
7700	if (fsp->oplock_type == 0) {
7701
7702	/* The Samba4 nbench simulator doesn't understand
7703	the difference between break to level2 and break
7704	to none from level2 - it sends oplock break
7705	replies in both cases. Don't keep logging an error
7706	message here - just ignore it. JRA. */
7707
7708	DEBUG(5,("reply_lockingX: Error : oplock break from "
7709	"client for fnum = %d (oplock=%d) and no "
7710	"oplock granted on this file (%s).\n",
7711	fsp->fnum, fsp->oplock_type,
7712	fsp_str_dbg(fsp)));
7713
7714	/* if this is a pure oplock break request then don't
7715	* send a reply */
7716	if (num_locks == 0 && num_ulocks == 0) {
7717	END_PROFILE(SMBlockingX);
7718	return;
7719	} else {
7720	END_PROFILE(SMBlockingX);
7721	reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
7722	return;
7723	}
7724	}
7725
7726	if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) \|\|
7727	(break_to_none)) {
7728	result = remove_oplock(fsp);
7729	} else {
7730	result = downgrade_oplock(fsp);
7731	}
7732
7733	if (!result) {
7734	DEBUG(0, ("reply_lockingX: error in removing "
7735	"oplock on file %s\n", fsp_str_dbg(fsp)));
7736	/* Hmmm. Is this panic justified? */
7737	smb_panic("internal tdb error");
7738	}
7739
7740	reply_to_oplock_break_requests(fsp);
7741
7742	/* if this is a pure oplock break request then don't send a
7743	* reply */
7744	if (num_locks == 0 && num_ulocks == 0) {
7745	/* Sanity check - ensure a pure oplock break is not a
7746	chained request. */
7747	if(CVAL(req->vwv+0, 0) != 0xff)
7748	DEBUG(0,("reply_lockingX: Error : pure oplock "
7749	"break is a chained %d request !\n",
7750	(unsigned int)CVAL(req->vwv+0, 0)));
7751	END_PROFILE(SMBlockingX);
7752	return;
7753	}
7754	}
7755
7756	if (req->buflen <
7757	(num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
7758	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7759	END_PROFILE(SMBlockingX);
7760	return;
7761	}
7762
7763	ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
7764	if (ulocks == NULL) {
7765	reply_nterror(req, NT_STATUS_NO_MEMORY);
7766	END_PROFILE(SMBlockingX);
7767	return;
7768	}
7769
7770	locks = talloc_array(req, struct smbd_lock_element, num_locks);
7771	if (locks == NULL) {
7772	reply_nterror(req, NT_STATUS_NO_MEMORY);
7773	END_PROFILE(SMBlockingX);
7774	return;
7775	}
7776
7777	/* Data now points at the beginning of the list
7778	of smb_unlkrng structs */
7779	for(i = 0; i < (int)num_ulocks; i++) {
7780	ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
7781	ulocks[i].count = get_lock_count(data, i, large_file_format);
7782	ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7783	ulocks[i].brltype = UNLOCK_LOCK;
7784
7785	/*
7786	* There is no error code marked "stupid client bug".... :-).
7787	*/
7788	if(err) {
7789	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7790	END_PROFILE(SMBlockingX);
7791	return;
7792	}
7793	}
7794
7795	/* Now do any requested locks */
7796	data += ((large_file_format ? 20 : 10)*num_ulocks);
7797
7798	/* Data now points at the beginning of the list
7799	of smb_lkrng structs */
7800
7801	for(i = 0; i < (int)num_locks; i++) {
7802	locks[i].smblctx = get_lock_pid(data, i, large_file_format);
7803	locks[i].count = get_lock_count(data, i, large_file_format);
7804	locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
7805
7806	if (locktype & LOCKING_ANDX_SHARED_LOCK) {
7807	if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7808	locks[i].brltype = PENDING_READ_LOCK;
7809	} else {
7810	locks[i].brltype = READ_LOCK;
7811	}
7812	} else {
7813	if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
7814	locks[i].brltype = PENDING_WRITE_LOCK;
7815	} else {
7816	locks[i].brltype = WRITE_LOCK;
7817	}
7818	}
7819
7820	/*
7821	* There is no error code marked "stupid client bug".... :-).
7822	*/
7823	if(err) {
7824	reply_nterror(req, NT_STATUS_ACCESS_DENIED);
7825	END_PROFILE(SMBlockingX);
7826	return;
7827	}
7828	}
7829
7830	status = smbd_do_locking(req, fsp,
7831	locktype, lock_timeout,
7832	num_ulocks, ulocks,
7833	num_locks, locks,
7834	&async);
7835	if (!NT_STATUS_IS_OK(status)) {
7836	END_PROFILE(SMBlockingX);
7837	reply_nterror(req, status);
7838	return;
7839	}
7840	if (async) {
7841	END_PROFILE(SMBlockingX);
7842	return;
7843	}
7844
7845	reply_outbuf(req, 2, 0);
7846
7847	DEBUG(3, ("lockingX fnum=%d type=%d num_locks=%d num_ulocks=%d\n",
7848	fsp->fnum, (unsigned int)locktype, num_locks, num_ulocks));
7849
7850	END_PROFILE(SMBlockingX);
7851	chain_reply(req);
7852	}
7853
7854	#undef DBGC_CLASS
7855	#define DBGC_CLASS DBGC_ALL
7856
7857	/****************************************************************************
7858	Reply to a SMBreadbmpx (read block multiplex) request.
7859	Always reply with an error, if someone has a platform really needs this,
7860	please contact vl@samba.org
7861	****************************************************************************/
7862
7863	void reply_readbmpx(struct smb_request *req)
7864	{
7865	START_PROFILE(SMBreadBmpx);
7866	reply_force_doserror(req, ERRSRV, ERRuseSTD);
7867	END_PROFILE(SMBreadBmpx);
7868	return;
7869	}
7870
7871	/****************************************************************************
7872	Reply to a SMBreadbs (read block multiplex secondary) request.
7873	Always reply with an error, if someone has a platform really needs this,
7874	please contact vl@samba.org
7875	****************************************************************************/
7876
7877	void reply_readbs(struct smb_request *req)
7878	{
7879	START_PROFILE(SMBreadBs);
7880	reply_force_doserror(req, ERRSRV, ERRuseSTD);
7881	END_PROFILE(SMBreadBs);
7882	return;
7883	}
7884
7885	/****************************************************************************
7886	Reply to a SMBsetattrE.
7887	****************************************************************************/
7888
7889	void reply_setattrE(struct smb_request *req)
7890	{
7891	connection_struct *conn = req->conn;
7892	struct smb_file_time ft;
7893	files_struct *fsp;
7894	NTSTATUS status;
7895
7896	START_PROFILE(SMBsetattrE);
7897	ZERO_STRUCT(ft);
7898
7899	if (req->wct < 7) {
7900	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7901	goto out;
7902	}
7903
7904	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
7905
7906	if(!fsp \|\| (fsp->conn != conn)) {
7907	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
7908	goto out;
7909	}
7910
7911	/*
7912	* Convert the DOS times into unix times.
7913	*/
7914
7915	ft.atime = convert_time_t_to_timespec(
7916	srv_make_unix_date2(req->vwv+3));
7917	ft.mtime = convert_time_t_to_timespec(
7918	srv_make_unix_date2(req->vwv+5));
7919	ft.create_time = convert_time_t_to_timespec(
7920	srv_make_unix_date2(req->vwv+1));
7921
7922	reply_outbuf(req, 0, 0);
7923
7924	/*
7925	* Patch from Ray Frush <frush@engr.colostate.edu>
7926	* Sometimes times are sent as zero - ignore them.
7927	*/
7928
7929	/* Ensure we have a valid stat struct for the source. */
7930	status = vfs_stat_fsp(fsp);
7931	if (!NT_STATUS_IS_OK(status)) {
7932	reply_nterror(req, status);
7933	goto out;
7934	}
7935
7936	status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
7937	if (!NT_STATUS_IS_OK(status)) {
7938	reply_nterror(req, status);
7939	goto out;
7940	}
7941
7942	DEBUG( 3, ( "reply_setattrE fnum=%d actime=%u modtime=%u "
7943	" createtime=%u\n",
7944	fsp->fnum,
7945	(unsigned int)ft.atime.tv_sec,
7946	(unsigned int)ft.mtime.tv_sec,
7947	(unsigned int)ft.create_time.tv_sec
7948	));
7949	out:
7950	END_PROFILE(SMBsetattrE);
7951	return;
7952	}
7953
7954
7955	/* Back from the dead for OS/2..... JRA. */
7956
7957	/****************************************************************************
7958	Reply to a SMBwritebmpx (write block multiplex primary) request.
7959	Always reply with an error, if someone has a platform really needs this,
7960	please contact vl@samba.org
7961	****************************************************************************/
7962
7963	void reply_writebmpx(struct smb_request *req)
7964	{
7965	START_PROFILE(SMBwriteBmpx);
7966	reply_force_doserror(req, ERRSRV, ERRuseSTD);
7967	END_PROFILE(SMBwriteBmpx);
7968	return;
7969	}
7970
7971	/****************************************************************************
7972	Reply to a SMBwritebs (write block multiplex secondary) request.
7973	Always reply with an error, if someone has a platform really needs this,
7974	please contact vl@samba.org
7975	****************************************************************************/
7976
7977	void reply_writebs(struct smb_request *req)
7978	{
7979	START_PROFILE(SMBwriteBs);
7980	reply_force_doserror(req, ERRSRV, ERRuseSTD);
7981	END_PROFILE(SMBwriteBs);
7982	return;
7983	}
7984
7985	/****************************************************************************
7986	Reply to a SMBgetattrE.
7987	****************************************************************************/
7988
7989	void reply_getattrE(struct smb_request *req)
7990	{
7991	connection_struct *conn = req->conn;
7992	int mode;
7993	files_struct *fsp;
7994	struct timespec create_ts;
7995
7996	START_PROFILE(SMBgetattrE);
7997
7998	if (req->wct < 1) {
7999	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8000	END_PROFILE(SMBgetattrE);
8001	return;
8002	}
8003
8004	fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8005
8006	if(!fsp \|\| (fsp->conn != conn)) {
8007	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8008	END_PROFILE(SMBgetattrE);
8009	return;
8010	}
8011
8012	/* Do an fstat on this file */
8013	if(fsp_stat(fsp)) {
8014	reply_nterror(req, map_nt_error_from_unix(errno));
8015	END_PROFILE(SMBgetattrE);
8016	return;
8017	}
8018
8019	mode = dos_mode(conn, fsp->fsp_name);
8020
8021	/*
8022	* Convert the times into dos times. Set create
8023	* date to be last modify date as UNIX doesn't save
8024	* this.
8025	*/
8026
8027	reply_outbuf(req, 11, 0);
8028
8029	create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8030	srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8031	srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8032	convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8033	/* Should we check pending modtime here ? JRA */
8034	srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8035	convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8036
8037	if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8038	SIVAL(req->outbuf, smb_vwv6, 0);
8039	SIVAL(req->outbuf, smb_vwv8, 0);
8040	} else {
8041	uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8042	SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8043	SIVAL(req->outbuf, smb_vwv8, allocation_size);
8044	}
8045	SSVAL(req->outbuf,smb_vwv10, mode);
8046
8047	DEBUG( 3, ( "reply_getattrE fnum=%d\n", fsp->fnum));
8048
8049	END_PROFILE(SMBgetattrE);
8050	return;
8051	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: