Changeset 746 for vendor/current/source3/smbd

Timestamp:

Nov 27, 2012, 4:56:06 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated vendor to 3.6.9

Location:

vendor/current/source3/smbd

Files:

• aio.c (modified) (2 diffs)
• blocking.c (modified) (3 diffs)
• close.c (modified) (12 diffs)
• conn.c (modified) (1 diff)
• dir.c (modified) (9 diffs)
• file_access.c (modified) (4 diffs)
• filename.c (modified) (6 diffs)
• files.c (modified) (3 diffs)
• globals.h (modified) (4 diffs)
• lanman.c (modified) (3 diffs)
• msdfs.c (modified) (2 diffs)
• negprot.c (modified) (1 diff)
• notify.c (modified) (1 diff)
• nttrans.c (modified) (24 diffs)
• open.c (modified) (17 diffs)
• oplock_linux.c (modified) (1 diff)
• password.c (modified) (1 diff)
• posix_acls.c (modified) (22 diffs)
• process.c (modified) (6 diffs)
• proto.h (modified) (11 diffs)
• quotas.c (modified) (1 diff)
• reply.c (modified) (11 diffs)
• sec_ctx.c (modified) (1 diff)
• server.c (modified) (16 diffs)
• server_exit.c (modified) (4 diffs)
• server_reload.c (modified) (5 diffs)
• service.c (modified) (11 diffs)
• sesssetup.c (modified) (1 diff)
• smb2_break.c (modified) (7 diffs)
• smb2_close.c (modified) (5 diffs)
• smb2_create.c (modified) (15 diffs)
• smb2_find.c (modified) (11 diffs)
• smb2_flush.c (modified) (7 diffs)
• smb2_getinfo.c (modified) (11 diffs)
• smb2_ioctl.c (modified) (11 diffs)
• smb2_keepalive.c (modified) (1 diff)
• smb2_lock.c (modified) (11 diffs)
• smb2_negprot.c (modified) (6 diffs)
• smb2_notify.c (modified) (8 diffs)
• smb2_read.c (modified) (13 diffs)
• smb2_server.c (modified) (34 diffs)
• smb2_sesssetup.c (modified) (13 diffs)
• smb2_setinfo.c (modified) (10 diffs)
• smb2_tcon.c (modified) (8 diffs)
• smb2_write.c (modified) (11 diffs)
• statcache.c (modified) (4 diffs)
• trans2.c (modified) (14 diffs)
• vfs.c (modified) (4 diffs)

vendor/current/source3/smbd/aio.c

@@ -67 +67 @@
 
         smbd_aio_complete_aio_ex(aio_ex);
+        TALLOC_FREE(aio_ex);
 }
 
@@ -895 +896 @@
                 return;
         }
-
-        TALLOC_FREE(aio_ex);
 }
 

vendor/current/source3/smbd/blocking.c

@@ -327 +327 @@
 *****************************************************************************/
 
-static void reply_lockingX_error(struct blocking_lock_record *blr, NTSTATUS status)
+static void undo_locks_obtained(struct blocking_lock_record *blr)
 {
         files_struct *fsp = blr->fsp;
@@ -371 +371 @@
                         WINDOWS_LOCK);
         }
-
-        generic_blocking_lock_error(blr, status);
 }
 
@@ -385 +383 @@
         switch(blr->req->cmd) {
         case SMBlockingX:
-                reply_lockingX_error(blr, status);
-                break;
+                /*
+                 * This code can be called during the rundown of a
+                 * file after it was already closed. In that case,
+                 * blr->fsp==NULL and we do not need to undo any
+                 * locks, they are already gone.
+                 */
+                if (blr->fsp != NULL) {
+                        undo_locks_obtained(blr);
+                }
+                generic_blocking_lock_error(blr, status);
+                break;
         case SMBtrans2:
         case SMBtranss2:

vendor/current/source3/smbd/close.c

@@ -202 +202 @@
 NTSTATUS delete_all_streams(connection_struct *conn, const char *fname)
 {
-        struct stream_struct *stream_info;
+        struct stream_struct *stream_info = NULL;
         int i;
-        unsigned int num_streams;
+        unsigned int num_streams = 0;
         TALLOC_CTX *frame = talloc_stackframe();
         NTSTATUS status;
 
-        status = SMB_VFS_STREAMINFO(conn, NULL, fname, talloc_tos(),
-                                    &num_streams, &stream_info);
+        status = vfs_streaminfo(conn, NULL, fname, talloc_tos(),
+                                &num_streams, &stream_info);
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
@@ -218 +218 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(10, ("SMB_VFS_STREAMINFO failed: %s\n",
+                DEBUG(10, ("vfs_streaminfo failed: %s\n",
                            nt_errstr(status)));
                 goto fail;
@@ -281 +281 @@
         struct file_id id;
         const struct security_unix_token *del_token = NULL;
+        const struct security_token *del_nt_token = NULL;
+        bool got_tokens = false;
 
         /* Ensure any pending write time updates are done. */
@@ -346 +348 @@
                 }
                 fsp->delete_on_close = true;
-                set_delete_on_close_lck(fsp, lck, True, get_current_utok(conn));
+                set_delete_on_close_lck(fsp, lck, True,
+                                get_current_nttok(conn),
+                                get_current_utok(conn));
                 if (became_user) {
                         unbecome_user();
@@ -399 +403 @@
         fsp->update_write_time_on_close = false;
 
-        del_token = get_delete_on_close_token(lck, fsp->name_hash);
-        SMB_ASSERT(del_token != NULL);
+        got_tokens = get_delete_on_close_token(lck, fsp->name_hash,
+                                        &del_nt_token, &del_token);
+        SMB_ASSERT(got_tokens);
 
         if (!unix_token_equal(del_token, get_current_utok(conn))) {
@@ -419 +424 @@
                             del_token->ngroups,
                             del_token->groups,
-                            NULL);
+                            del_nt_token);
 
                 changed_user = true;
@@ -492 +497 @@
 
         fsp->delete_on_close = false;
-        set_delete_on_close_lck(fsp, lck, false, NULL);
+        set_delete_on_close_lck(fsp, lck, false, NULL, NULL);
 
  done:
@@ -818 +823 @@
         }
 
-        if(((errno == ENOTEMPTY)||(errno == EEXIST)) && lp_veto_files(SNUM(conn))) {
+        if(((errno == ENOTEMPTY)||(errno == EEXIST)) && *lp_veto_files(SNUM(conn))) {
                 /*
                  * Check to see if the only thing in this directory are
@@ -963 +968 @@
         NTSTATUS status = NT_STATUS_OK;
         NTSTATUS status1 = NT_STATUS_OK;
+        const struct security_token *del_nt_token = NULL;
         const struct security_unix_token *del_token = NULL;
 
@@ -999 +1005 @@
                                                fsp->fsp_name->base_name);
                 set_delete_on_close_lck(fsp, lck, true,
+                                get_current_nttok(fsp->conn),
                                 get_current_utok(fsp->conn));
                 fsp->delete_on_close = true;
@@ -1006 +1013 @@
         }
 
-        del_token = get_delete_on_close_token(lck, fsp->name_hash);
-        delete_dir = (del_token != NULL);
+        delete_dir = get_delete_on_close_token(lck, fsp->name_hash,
+                                        &del_nt_token, &del_token);
 
         if (delete_dir) {
@@ -1039 +1046 @@
                                 del_token->ngroups,
                                 del_token->groups,
-                                NULL);
+                                del_nt_token);
 
                 TALLOC_FREE(lck);
+
+                if ((fsp->conn->fs_capabilities & FILE_NAMED_STREAMS)
+                    && !is_ntfs_stream_smb_fname(fsp->fsp_name)) {
+
+                        status = delete_all_streams(fsp->conn, fsp->fsp_name->base_name);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                DEBUG(5, ("delete_all_streams failed: %s\n",
+                                          nt_errstr(status)));
+                                goto out;
+                        }
+                }
 
                 status = rmdir_internals(talloc_tos(), fsp);

vendor/current/source3/smbd/conn.c

@@ -68 +68 @@
                                 if (ptcon->compat_conn &&
                                                 ptcon->compat_conn->params &&
-                                                (ptcon->compat_conn->params->service = snum)) {
+                                                (ptcon->compat_conn->params->service == snum)) {
                                         return true;
                                 }

vendor/current/source3/smbd/dir.c

@@ -261 +261 @@
         }
 
+        if (sconn->using_smb2) {
+                goto done;
+        }
+
         DLIST_REMOVE(sconn->searches.dirptrs, dptr);
 
@@ -280 +284 @@
         /* Lanman 2 specific code */
         SAFE_FREE(dptr->wcard);
-        string_set(&dptr->path,"");
+        SAFE_FREE(dptr->path);
         SAFE_FREE(dptr);
 }
@@ -471 +475 @@
         ZERO_STRUCTP(dptr);
 
+        dptr->path = SMB_STRDUP(path);
+        if (!dptr->path) {
+                SAFE_FREE(dptr);
+                TALLOC_FREE(dir_hnd);
+                return NT_STATUS_NO_MEMORY;
+        }
+        dptr->conn = conn;
+        dptr->dir_hnd = dir_hnd;
+        dptr->spid = spid;
+        dptr->expect_close = expect_close;
+        dptr->wcard = SMB_STRDUP(wcard);
+        if (!dptr->wcard) {
+                SAFE_FREE(dptr->path);
+                SAFE_FREE(dptr);
+                TALLOC_FREE(dir_hnd);
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (lp_posix_pathnames() || (wcard[0] == '.' && wcard[1] == 0)) {
+                dptr->has_wild = True;
+        } else {
+                dptr->has_wild = wcard_has_wild;
+        }
+
+        dptr->attr = attr;
+
+        if (sconn->using_smb2) {
+                goto done;
+        }
+
         if(old_handle) {
 
@@ -494 +527 @@
                         if(dptr->dnum == -1 || dptr->dnum > 254) {
                                 DEBUG(0,("dptr_create: returned %d: Error - all old dirptrs in use ?\n", dptr->dnum));
+                                SAFE_FREE(dptr->path);
+                                SAFE_FREE(dptr->wcard);
                                 SAFE_FREE(dptr);
                                 TALLOC_FREE(dir_hnd);
@@ -524 +559 @@
                         if(dptr->dnum == -1 || dptr->dnum < 255) {
                                 DEBUG(0,("dptr_create: returned %d: Error - all new dirptrs in use ?\n", dptr->dnum));
+                                SAFE_FREE(dptr->path);
+                                SAFE_FREE(dptr->wcard);
                                 SAFE_FREE(dptr);
                                 TALLOC_FREE(dir_hnd);
@@ -535 +572 @@
         dptr->dnum += 1; /* Always bias the dnum by one - no zero dnums allowed. */
 
-        string_set(&dptr->path,path);
-        dptr->conn = conn;
-        dptr->dir_hnd = dir_hnd;
-        dptr->spid = spid;
-        dptr->expect_close = expect_close;
-        dptr->wcard = SMB_STRDUP(wcard);
-        if (!dptr->wcard) {
-                bitmap_clear(sconn->searches.dptr_bmap, dptr->dnum - 1);
-                SAFE_FREE(dptr);
-                TALLOC_FREE(dir_hnd);
-                return NT_STATUS_NO_MEMORY;
-        }
-        if (lp_posix_pathnames() || (wcard[0] == '.' && wcard[1] == 0)) {
-                dptr->has_wild = True;
-        } else {
-                dptr->has_wild = wcard_has_wild;
-        }
-
-        dptr->attr = attr;
-
         DLIST_ADD(sconn->searches.dirptrs, dptr);
 
+done:
         DEBUG(3,("creating new dirptr %d for path %s, expect_close = %d\n",
                 dptr->dnum,path,expect_close));  
@@ -1328 +1346 @@
                 SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir);
         }
-        if (dirp->conn->sconn) {
+        if (dirp->conn->sconn && !dirp->conn->sconn->using_smb2) {
                 dirp->conn->sconn->searches.dirhandles_open--;
         }
@@ -1359 +1377 @@
         }
 
-        if (sconn) {
+        if (sconn && !sconn->using_smb2) {
                 sconn->searches.dirhandles_open++;
         }
@@ -1403 +1421 @@
         }
 
-        if (sconn) {
+        if (sconn && !sconn->using_smb2) {
                 sconn->searches.dirhandles_open++;
         }

vendor/current/source3/smbd/file_access.c

@@ -42 +42 @@
         if (get_current_uid(conn) == (uid_t)0) {
                 /* I'm sorry sir, I didn't know you were root... */
+                return true;
+        }
+
+        if (access_mask == DELETE_ACCESS &&
+                        VALID_STAT(smb_fname->st) &&
+                        S_ISLNK(smb_fname->st.st_ex_mode)) {
+                /* We can always delete a symlink. */
                 return true;
         }
@@ -81 +88 @@
 
 bool can_delete_file_in_directory(connection_struct *conn,
-                                  struct smb_filename *smb_fname)
+                                  const struct smb_filename *smb_fname)
 {
         TALLOC_CTX *ctx = talloc_tos();
@@ -131 +138 @@
          * by owner of directory. */
         if (smb_fname_parent->st.st_ex_mode & S_ISVTX) {
-                if(SMB_VFS_STAT(conn, smb_fname) != 0) {
-                        if (errno == ENOENT) {
-                                /* If the file doesn't already exist then
-                                 * yes we'll be able to delete it. */
-                                ret = true;
-                                goto out;
-                        }
-                        DEBUG(10,("can_delete_file_in_directory: can't "
-                                  "stat file %s (%s)",
-                                  smb_fname_str_dbg(smb_fname),
-                                  strerror(errno) ));
-                        ret = false;
+                if (!VALID_STAT(smb_fname->st)) {
+                        /* If the file doesn't already exist then
+                         * yes we'll be able to delete it. */
+                        ret = true;
                         goto out;
                 }
@@ -263 +262 @@
                                 SECINFO_DACL, &secdesc);
 
-        if (!NT_STATUS_IS_OK(status) || secdesc == NULL) {
+        if (!NT_STATUS_IS_OK(status) ||
+                        secdesc == NULL ||
+                        secdesc->dacl == NULL) {
+                TALLOC_FREE(secdesc);
                 return false;
         }

vendor/current/source3/smbd/filename.c

@@ -384 +384 @@
         if((!conn->case_sensitive || !(conn->fs_capabilities &
                                        FILE_CASE_SENSITIVE_SEARCH)) &&
-            stat_cache_lookup(conn, &smb_fname->base_name, &dirpath, &start,
+            stat_cache_lookup(conn, posix_pathnames, &smb_fname->base_name, &dirpath, &start,
                               &smb_fname->st)) {
                 goto done;
@@ -978 +978 @@
 
 /****************************************************************************
+ Ensure a path is not vetod.
+****************************************************************************/
+
+NTSTATUS check_veto_path(connection_struct *conn, const char *name)
+{
+        if (IS_VETO_PATH(conn, name))  {
+                /* Is it not dot or dot dot. */
+                if (!(ISDOT(name) || ISDOTDOT(name))) {
+                        DEBUG(5,("check_veto_path: file path name %s vetoed\n",
+                                                name));
+                        return map_nt_error_from_unix(ENOENT);
+                }
+        }
+        return NT_STATUS_OK;
+}
+
+/****************************************************************************
  Check a filename - possibly calling check_reduced_name.
  This is called by every routine before it allows an operation on a filename.
@@ -986 +1003 @@
 NTSTATUS check_name(connection_struct *conn, const char *name)
 {
-        if (IS_VETO_PATH(conn, name))  {
-                /* Is it not dot or dot dot. */
-                if (!((name[0] == '.') && (!name[1] ||
-                                        (name[1] == '.' && !name[2])))) {
-                        DEBUG(5,("check_name: file path name %s vetoed\n",
-                                                name));
-                        return map_nt_error_from_unix(ENOENT);
-                }
+        NTSTATUS status = check_veto_path(conn, name);
+
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
         }
 
         if (!lp_widelinks(SNUM(conn)) || !lp_symlinks(SNUM(conn))) {
-                NTSTATUS status = check_reduced_name(conn,name);
+                status = check_reduced_name(conn,name);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(5,("check_name: name %s failed with %s\n",name,
@@ -1171 +1184 @@
 {
         NTSTATUS status;
-        unsigned int i, num_streams;
+        unsigned int i, num_streams = 0;
         struct stream_struct *streams = NULL;
 
@@ -1186 +1199 @@
 
         /* Fall back to a case-insensitive scan of all streams on the file. */
-        status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, mem_ctx,
-                                    &num_streams, &streams);
+        status = vfs_streaminfo(conn, NULL, smb_fname->base_name, mem_ctx,
+                                &num_streams, &streams);
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
@@ -1315 +1328 @@
         }
 
+        if ((ucf_flags & UCF_UNIX_NAME_LOOKUP) &&
+                        VALID_STAT((*pp_smb_fname)->st) &&
+                        S_ISLNK((*pp_smb_fname)->st.st_ex_mode)) {
+                return check_veto_path(conn, (*pp_smb_fname)->base_name);
+        }
+
         status = check_name(conn, (*pp_smb_fname)->base_name);
         if (!NT_STATUS_IS_OK(status)) {

vendor/current/source3/smbd/files.c

@@ -29 +29 @@
 
 /****************************************************************************
- Return a unique number identifying this fsp over the life of this pid.
+ Return a unique number identifying this fsp over the life of this pid,
+ and try to make it as globally unique as possible.
+ See bug #8995 for the details.
 ****************************************************************************/
 
 static unsigned long get_gen_count(struct smbd_server_connection *sconn)
 {
+        /*
+         * While fsp->fh->gen_id is 'unsigned long' currently
+         * (which might by 8 bytes),
+         * there's some oplock code which truncates it to
+         * uint32_t(using IVAL()).
+         */
+        if (sconn->file_gen_counter == 0) {
+                sconn->file_gen_counter = generate_random();
+        }
         sconn->file_gen_counter += 1;
+        if (sconn->file_gen_counter >= UINT32_MAX) {
+                sconn->file_gen_counter = 0;
+        }
         if (sconn->file_gen_counter == 0) {
                 sconn->file_gen_counter += 1;
@@ -284 +298 @@
         int count=0;
         files_struct *fsp;
+
+        if (gen_id == 0) {
+                return NULL;
+        }
 
         for (fsp=sconn->files; fsp; fsp=fsp->next,count++) {
@@ -549 +567 @@
 }
 
+uint64_t fsp_persistent_id(const struct files_struct *fsp)
+{
+        uint64_t persistent_id;
+
+        /*
+         * This calculates a number that is most likely
+         * globally unique. In future we will have a database
+         * to make it completely unique.
+         *
+         * 32-bit random gen_id
+         * 16-bit truncated open_time
+         * 16-bit fnum (valatile_id)
+         */
+        persistent_id = fsp->fh->gen_id & UINT32_MAX;
+        persistent_id <<= 16;
+        persistent_id &= 0x0000FFFFFFFF0000LLU;
+        persistent_id |= fsp->open_time.tv_usec & UINT16_MAX;
+        persistent_id <<= 16;
+        persistent_id &= 0xFFFFFFFFFFFF0000LLU;
+        persistent_id |= fsp->fnum & UINT16_MAX;
+
+        return persistent_id;
+}
+
+struct files_struct *file_fsp_smb2(struct smbd_smb2_request *smb2req,
+                                   uint64_t persistent_id,
+                                   uint64_t volatile_id)
+{
+        struct files_struct *fsp;
+        uint64_t fsp_persistent;
+
+        if (smb2req->compat_chain_fsp != NULL) {
+                return smb2req->compat_chain_fsp;
+        }
+
+        if (volatile_id > UINT16_MAX) {
+                return NULL;
+        }
+
+        fsp = file_fnum(smb2req->sconn, (uint16_t)volatile_id);
+        if (fsp == NULL) {
+                return NULL;
+        }
+        fsp_persistent = fsp_persistent_id(fsp);
+
+        if (persistent_id != fsp_persistent) {
+                return NULL;
+        }
+
+        if (smb2req->tcon == NULL) {
+                return NULL;
+        }
+
+        if (smb2req->tcon->compat_conn != fsp->conn) {
+                return NULL;
+        }
+
+        if (smb2req->session == NULL) {
+                return NULL;
+        }
+
+        if (smb2req->session->vuid != fsp->vuid) {
+                return NULL;
+        }
+
+        smb2req->compat_chain_fsp = fsp;
+        return fsp;
+}
+
 /****************************************************************************
  Duplicate the file handle part for a DOS or FCB open.

vendor/current/source3/smbd/globals.h

@@ -278 +278 @@
 struct smb_request *smbd_smb2_fake_smb_request(struct smbd_smb2_request *req);
 void remove_smb2_chained_fsp(files_struct *fsp);
+
+NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
+                                        size_t expected_body_size);
 
 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req);
@@ -351 +354 @@
         /* the session the request operates on, maybe NULL */
         struct smbd_smb2_session *session;
+        uint64_t last_session_id;
 
         /* the tcon the request operates on, maybe NULL */
         struct smbd_smb2_tcon *tcon;
+        uint32_t last_tid;
 
         int current_idx;
@@ -359 +364 @@
         bool async;
         bool cancelled;
+        bool compound_related;
 
         /* fake smb1 request. */
         struct smb_request *smb1req;
         struct files_struct *compat_chain_fsp;
-
-        NTSTATUS next_status;
 
         /*
@@ -598 +602 @@
                 } locks;
                 struct smbd_smb2_request *requests;
+                /*
+                 * seqnum_low is the lowest sequence number
+                 * we will accept.
+                 */
                 uint64_t seqnum_low;
-                uint32_t credits_granted;
-                uint32_t max_credits;
+                /*
+                 * seqnum_range is the range of credits we have
+                 * granted from the sequence windows starting
+                 * at seqnum_low.
+                 *
+                 * This gets incremented when new credits are
+                 * granted and gets decremented when the
+                 * lowest sequence number is consumed
+                 * (when seqnum_low gets incremented).
+                 */
+                uint16_t seqnum_range;
+                /*
+                 * credits_grantedThe number of credits we have currently granted
+                 * to the client.
+                 *
+                 * This gets incremented when new credits are
+                 * granted and gets decremented when any credit
+                 * is comsumed.
+                 *
+                 * Note: the decrementing is different compared
+                 *       to seqnum_range.
+                 */
+                uint16_t credits_granted;
+                /*
+                 * The maximum number of credits we will ever
+                 * grant to the client.
+                 *
+                 * Typically we will only grant 1/16th of
+                 * max_credits.
+                 *
+                 * This is the "server max credits" parameter.
+                 */
+                uint16_t max_credits;
+                /*
+                 * a bitmap of size max_credits
+                 */
                 struct bitmap *credits_bitmap;
+                uint32_t max_trans;
+                uint32_t max_read;
+                uint32_t max_write;
+                bool compound_related_in_progress;
         } smb2;
 };

vendor/current/source3/smbd/lanman.c

@@ -3525 +3525 @@
                                             NULL,
                                             devmode_ctr,
-                                            SEC_FLAG_MAXIMUM_ALLOWED,
+                                            PRINTER_ACCESS_ADMINISTER,
                                             &handle,
                                             &werr);
@@ -4982 +4982 @@
                                             NULL,
                                             devmode_ctr,
-                                            SEC_FLAG_MAXIMUM_ALLOWED,
+                                            PRINTER_ACCESS_USE,
                                             &handle,
                                             &werr);
@@ -5182 +5182 @@
                                             NULL,
                                             devmode_ctr,
-                                            SEC_FLAG_MAXIMUM_ALLOWED,
+                                            PRINTER_ACCESS_USE,
                                             &handle,
                                             &werr);

vendor/current/source3/smbd/msdfs.c

@@ -576 +576 @@
 
         /*
-         * Note the unix path conversion here we're doing we can
+         * Note the unix path conversion here we're doing we
          * throw away. We're looking for a symlink for a dfs
          * resolution, if we don't find it we'll do another
          * unix_convert later in the codepath.
-         * If we needed to remember what we'd resolved in
-         * dp->reqpath (as the original code did) we'd
-         * copy (localhost, dp->reqpath) on any code
-         * path below that returns True - but I don't
-         * think this is needed. JRA.
          */
 
@@ -595 +590 @@
                         return status;
                 }
-
-                /* Create an smb_fname to use below. */
-                status = create_synthetic_smb_fname(ctx, pdp->reqpath, NULL,
-                                                    NULL, &smb_fname);
-                if (!NT_STATUS_IS_OK(status)) {
+                if (smb_fname == NULL || smb_fname->base_name == NULL) {
                         return status;
                 }

vendor/current/source3/smbd/negprot.c

@@ -717 +717 @@
 
         TALLOC_FREE(cliprotos);
+
+        if (lp_async_smb_echo_handler() && (get_Protocol() < PROTOCOL_SMB2) &&
+            !fork_echo_handler(sconn)) {
+                exit_server("Failed to fork echo handler");
+        }
+
         END_PROFILE(SMBnegprot);
         return;

vendor/current/source3/smbd/notify.c

@@ -346 +346 @@
 }
 
+static void notify_parent_dir(connection_struct *conn,
+                              uint32 action, uint32 filter,
+                              const char *path)
+{
+        struct smb_filename smb_fname_parent;
+        char *parent;
+        const char *name;
+        char *oldwd;
+
+        if (!parent_dirname(talloc_tos(), path, &parent, &name)) {
+                return;
+        }
+
+        ZERO_STRUCT(smb_fname_parent);
+        smb_fname_parent.base_name = parent;
+
+        oldwd = vfs_GetWd(parent, conn);
+        if (oldwd == NULL) {
+                goto done;
+        }
+        if (vfs_ChDir(conn, conn->connectpath) == -1) {
+                goto done;
+        }
+
+        if (SMB_VFS_STAT(conn, &smb_fname_parent) == -1) {
+                goto chdir_done;
+        }
+
+        notify_onelevel(conn->notify_ctx, action, filter,
+                        SMB_VFS_FILE_ID_CREATE(conn, &smb_fname_parent.st),
+                        name);
+chdir_done:
+        vfs_ChDir(conn, oldwd);
+done:
+        TALLOC_FREE(parent);
+}
+
 void notify_fname(connection_struct *conn, uint32 action, uint32 filter,
                   const char *path)
 {
         char *fullpath;
-        char *parent;
-        const char *name;
 
         if (path[0] == '.' && path[1] == '/') {
                 path += 2;
         }
-        if (parent_dirname(talloc_tos(), path, &parent, &name)) {
-                struct smb_filename smb_fname_parent;
-
-                ZERO_STRUCT(smb_fname_parent);
-                smb_fname_parent.base_name = parent;
-
-                if (SMB_VFS_STAT(conn, &smb_fname_parent) != -1) {
-                        notify_onelevel(conn->notify_ctx, action, filter,
-                            SMB_VFS_FILE_ID_CREATE(conn, &smb_fname_parent.st),
-                            name);
-                }
-        }
+        notify_parent_dir(conn, action, filter, path);
 
         fullpath = talloc_asprintf(talloc_tos(), "%s/%s", conn->connectpath,

vendor/current/source3/smbd/nttrans.c

@@ -143 +143 @@
                              total_sent_thistime + alignment_offset
                              + data_alignment_offset);
-
-                /*
-                 * We might have had SMBnttranss in req->inbuf, fix that.
-                 */
-                SCVAL(req->outbuf, smb_com, SMBnttrans);
 
                 /*
@@ -694 +689 @@
                 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
                 size_t num_names = 0;
-                unsigned int num_streams;
+                unsigned int num_streams = 0;
                 struct stream_struct *streams = NULL;
 
@@ -703 +698 @@
                         file_status &= ~NO_EAS;
                 }
-                status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
+                status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
                         &num_streams, &streams);
                 /* There is always one stream, ::$DATA. */
@@ -832 +827 @@
 }
 
+/*********************************************************************
+ Windows seems to do canonicalization of inheritance bits. Do the
+ same.
+*********************************************************************/
+
+static void canonicalize_inheritance_bits(struct security_descriptor *psd)
+{
+        bool set_auto_inherited = false;
+
+        /*
+         * We need to filter out the
+         * SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ
+         * bits. If both are set we store SEC_DESC_DACL_AUTO_INHERITED
+         * as this alters whether SEC_ACE_FLAG_INHERITED_ACE is set
+         * when an ACE is inherited. Otherwise we zero these bits out.
+         * See:
+         *
+         * http://social.msdn.microsoft.com/Forums/eu/os_fileservices/thread/11f77b68-731e-407d-b1b3-064750716531
+         *
+         * for details.
+         */
+
+        if ((psd->type & (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ))
+                        == (SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ)) {
+                set_auto_inherited = true;
+        }
+
+        psd->type &= ~(SEC_DESC_DACL_AUTO_INHERITED|SEC_DESC_DACL_AUTO_INHERIT_REQ);
+        if (set_auto_inherited) {
+                psd->type |= SEC_DESC_DACL_AUTO_INHERITED;
+        }
+}
+
 /****************************************************************************
  Internal fn to set security descriptors.
 ****************************************************************************/
 
-NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
+NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
+                       uint32_t security_info_sent)
+{
+        NTSTATUS status;
+
+        if (!CAN_WRITE(fsp->conn)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
+        if (!lp_nt_acl_support(SNUM(fsp->conn))) {
+                return NT_STATUS_OK;
+        }
+
+        if (psd->owner_sid == NULL) {
+                security_info_sent &= ~SECINFO_OWNER;
+        }
+        if (psd->group_sid == NULL) {
+                security_info_sent &= ~SECINFO_GROUP;
+        }
+
+        /* Ensure we have at least one thing set. */
+        if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
+                if (security_info_sent & SECINFO_LABEL) {
+                        /* Only consider SECINFO_LABEL if no other
+                           bits are set. Just like W2K3 we don't
+                           store this. */
+                        return NT_STATUS_OK;
+                }
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        /* Ensure we have the rights to do this. */
+        if (security_info_sent & SECINFO_OWNER) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+
+        if (security_info_sent & SECINFO_GROUP) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+
+        if (security_info_sent & SECINFO_DACL) {
+                if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                /* Convert all the generic bits. */
+                if (psd->dacl) {
+                        security_acl_map_generic(psd->dacl, &file_generic_mapping);
+                }
+        }
+
+        if (security_info_sent & SECINFO_SACL) {
+                if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                /* Convert all the generic bits. */
+                if (psd->sacl) {
+                        security_acl_map_generic(psd->sacl, &file_generic_mapping);
+                }
+        }
+
+        canonicalize_inheritance_bits(psd);
+
+        if (DEBUGLEVEL >= 10) {
+                DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
+                NDR_PRINT_DEBUG(security_descriptor, psd);
+        }
+
+        status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
+
+        TALLOC_FREE(psd);
+
+        return status;
+}
+
+/****************************************************************************
+ Internal fn to set security descriptors from a data blob.
+****************************************************************************/
+
+NTSTATUS set_sd_blob(files_struct *fsp, uint8_t *data, uint32_t sd_len,
                        uint32_t security_info_sent)
 {
@@ -846 +956 @@
         }
 
-        if (!CAN_WRITE(fsp->conn)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-
-        if (!lp_nt_acl_support(SNUM(fsp->conn))) {
-                return NT_STATUS_OK;
-        }
-
         status = unmarshall_sec_desc(talloc_tos(), data, sd_len, &psd);
 
@@ -860 +962 @@
         }
 
-        if (psd->owner_sid == NULL) {
-                security_info_sent &= ~SECINFO_OWNER;
-        }
-        if (psd->group_sid == NULL) {
-                security_info_sent &= ~SECINFO_GROUP;
-        }
-
-        /* Ensure we have at least one thing set. */
-        if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
-                return NT_STATUS_INVALID_PARAMETER;
-        }
-
-        /* Ensure we have the rights to do this. */
-        if (security_info_sent & SECINFO_OWNER) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        if (security_info_sent & SECINFO_GROUP) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_OWNER)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-        }
-
-        if (security_info_sent & SECINFO_DACL) {
-                if (!(fsp->access_mask & SEC_STD_WRITE_DAC)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                /* Convert all the generic bits. */
-                if (psd->dacl) {
-                        security_acl_map_generic(psd->dacl, &file_generic_mapping);
-                }
-        }
-
-        if (security_info_sent & SECINFO_SACL) {
-                if (!(fsp->access_mask & SEC_FLAG_SYSTEM_SECURITY)) {
-                        return NT_STATUS_ACCESS_DENIED;
-                }
-                /* Convert all the generic bits. */
-                if (psd->sacl) {
-                        security_acl_map_generic(psd->sacl, &file_generic_mapping);
-                }
-        }
-
-        if (DEBUGLEVEL >= 10) {
-                DEBUG(10,("set_sd for file %s\n", fsp_str_dbg(fsp)));
-                NDR_PRINT_DEBUG(security_descriptor, psd);
-        }
-
-        status = SMB_VFS_FSET_NT_ACL(fsp, security_info_sent, psd);
-
-        TALLOC_FREE(psd);
-
-        return status;
+        return set_sd(fsp, psd, security_info_sent);
 }
 
@@ -1269 +1317 @@
                 uint16_t file_status = (NO_EAS|NO_SUBSTREAMS|NO_REPARSETAG);
                 size_t num_names = 0;
-                unsigned int num_streams;
+                unsigned int num_streams = 0;
                 struct stream_struct *streams = NULL;
 
@@ -1278 +1326 @@
                         file_status &= ~NO_EAS;
                 }
-                status = SMB_VFS_STREAMINFO(conn, NULL, smb_fname->base_name, ctx,
+                status = vfs_streaminfo(conn, NULL, smb_fname->base_name, ctx,
                         &num_streams, &streams);
                 /* There is always one stream, ::$DATA. */
@@ -1869 +1917 @@
         }
 
+        if (security_info_wanted & (SECINFO_DACL|SECINFO_OWNER|
+                        SECINFO_GROUP|SECINFO_SACL)) {
+                /* Don't return SECINFO_LABEL if anything else was
+                   requested. See bug #8458. */
+                security_info_wanted &= ~SECINFO_LABEL;
+        }
+
         if (!lp_nt_acl_support(SNUM(conn))) {
+                status = get_null_nt_acl(mem_ctx, &psd);
+        } else if (security_info_wanted & SECINFO_LABEL) {
+                /* Like W2K3 return a null object. */
                 status = get_null_nt_acl(mem_ctx, &psd);
         } else {
@@ -1886 +1944 @@
         }
         if (!(security_info_wanted & SECINFO_DACL)) {
+                psd->type &= ~SEC_DESC_DACL_PRESENT;
                 psd->dacl = NULL;
         }
         if (!(security_info_wanted & SECINFO_SACL)) {
+                psd->type &= ~SEC_DESC_SACL_PRESENT;
                 psd->sacl = NULL;
         }
@@ -1900 +1960 @@
             security_info_wanted & SECINFO_DACL)
                 psd->type |= SEC_DESC_DACL_PRESENT;
+
+        if (security_info_wanted & SECINFO_LABEL) {
+                /* Like W2K3 return a null object. */
+                psd->owner_sid = NULL;
+                psd->group_sid = NULL;
+                psd->dacl = NULL;
+                psd->sacl = NULL;
+                psd->type &= ~(SEC_DESC_DACL_PRESENT|SEC_DESC_SACL_PRESENT);
+        }
 
         *psd_size = ndr_size_security_descriptor(psd, 0);
@@ -2074 +2143 @@
         }
 
-        status = set_sd(fsp, (uint8 *)data, data_count, security_info_sent);
+        status = set_sd_blob(fsp, (uint8 *)data, data_count, security_info_sent);
 
         if (!NT_STATUS_IS_OK(status)) {
@@ -2086 +2155 @@
 }
 
-/****************************************************************************
- Reply to NT IOCTL
-****************************************************************************/
-
-static void call_nt_transact_ioctl(connection_struct *conn,
-                                   struct smb_request *req,
-                                   uint16 **ppsetup, uint32 setup_count,
-                                   char **ppparams, uint32 parameter_count,
-                                   char **ppdata, uint32 data_count,
-                                   uint32 max_data_count)
+/*
+ * Implement the default fsctl operation.
+ */
+
+static bool vfswrap_logged_ioctl_message = false;
+
+/*
+ * In 3.6 we do not have a SMB_VFS_FSCTL() function
+ * it's just faked to make it more look like
+ * master (4.0)
+ */
+NTSTATUS smb_fsctl(struct files_struct *fsp,
+                       TALLOC_CTX *ctx,
+                       uint32_t function,
+                       uint16_t req_flags,  /* Needed for UNICODE ... */
+                       const uint8_t *_in_data,
+                       uint32_t in_len,
+                       uint8_t **_out_data,
+                       uint32_t max_out_len,
+                       uint32_t *out_len)
 {
-        uint32 function;
-        uint16 fidnum;
-        files_struct *fsp;
-        uint8 isFSctl;
-        uint8 compfilter;
-        char *pdata = *ppdata;
-
-        if (setup_count != 8) {
-                DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
-                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                return;
-        }
-
-        function = IVAL(*ppsetup, 0);
-        fidnum = SVAL(*ppsetup, 4);
-        isFSctl = CVAL(*ppsetup, 6);
-        compfilter = CVAL(*ppsetup, 7);
-
-        DEBUG(10,("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n", 
-                 function, fidnum, isFSctl, compfilter));
-
-        fsp=file_fsp(req, fidnum);
-        /* this check is done in each implemented function case for now
-           because I don't want to break anything... --metze
-        FSP_BELONGS_CONN(fsp,conn);*/
-
-        SMB_PERFCOUNT_SET_IOCTL(&req->pcd, function);
+        const char *in_data = (const char *)_in_data;
+        char **out_data = (char **)_out_data;
 
         switch (function) {
@@ -2131 +2185 @@
                 NTSTATUS status;
 
-                if (data_count >= 1 && pdata[0] == 0) {
+                if (in_len >= 1 && in_data[0] == 0) {
                         set_sparse = false;
                 }
 
-                DEBUG(10,("FSCTL_SET_SPARSE: called on FID[0x%04X]set[%u]\n",
-                         fidnum, set_sparse));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                status = file_set_sparse(conn, fsp, set_sparse);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(9,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
-                                 smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
-                        reply_nterror(req, status);
-                        return;
-                }
-
-                DEBUG(10,("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
-                         smb_fname_str_dbg(fsp->fsp_name), set_sparse, nt_errstr(status)));
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
-                return;
-        }
+                status = file_set_sparse(fsp->conn, fsp, set_sparse);
+
+                DEBUG(NT_STATUS_IS_OK(status) ? 10 : 9,
+                      ("FSCTL_SET_SPARSE: fname[%s] set[%u] - %s\n",
+                       smb_fname_str_dbg(fsp->fsp_name), set_sparse,
+                       nt_errstr(status)));
+
+                return status;
+        }
+
         case FSCTL_CREATE_OR_GET_OBJECT_ID:
         {
                 unsigned char objid[16];
+                char *return_data = NULL;
 
                 /* This should return the object-id on this file.
@@ -2163 +2208 @@
                  */
 
-                DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fidnum));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                data_count = 64;
-                pdata = nttrans_realloc(ppdata, data_count);
-                if (pdata == NULL) {
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
+                DEBUG(10,("FSCTL_CREATE_OR_GET_OBJECT_ID: called on FID[0x%04X]\n",fsp->fnum));
+
+                *out_len = (max_out_len >= 64) ? 64 : max_out_len;
+                /* Hmmm, will this cause problems if less data asked for? */
+                return_data = talloc_array(ctx, char, 64);
+                if (return_data == NULL) {
+                        return NT_STATUS_NO_MEMORY;
                 }
 
                 /* For backwards compatibility only store the dev/inode. */
-                push_file_id_16(pdata, &fsp->file_id);
-                memcpy(pdata+16,create_volume_objectid(conn,objid),16);
-                push_file_id_16(pdata+32, &fsp->file_id);
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, data_count);
-                return;
+                push_file_id_16(return_data, &fsp->file_id);
+                memcpy(return_data+16,create_volume_objectid(fsp->conn,objid),16);
+                push_file_id_16(return_data+32, &fsp->file_id);
+                *out_data = return_data;
+                return NT_STATUS_OK;
         }
 
         case FSCTL_GET_REPARSE_POINT:
-                /* pretend this fail - my winXP does it like this
-                 * --metze
-                 */
-
-                DEBUG(10,("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
-                return;
+        {
+                /* Fail it with STATUS_NOT_A_REPARSE_POINT */
+                DEBUG(10, ("FSCTL_GET_REPARSE_POINT: called on FID[0x%04X] Status: NOT_IMPLEMENTED\n", fsp->fnum));
+                return NT_STATUS_NOT_A_REPARSE_POINT;
+        }
 
         case FSCTL_SET_REPARSE_POINT:
-                /* pretend this fail - I'm assuming this because of the FSCTL_GET_REPARSE_POINT case.
-                 * --metze
-                 */
-
-                DEBUG(10,("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X](but not implemented)\n",fidnum));
-                reply_nterror(req, NT_STATUS_NOT_A_REPARSE_POINT);
-                return;
-
-        case FSCTL_GET_SHADOW_COPY_DATA: /* don't know if this name is right...*/
+        {
+                /* Fail it with STATUS_NOT_A_REPARSE_POINT */
+                DEBUG(10, ("FSCTL_SET_REPARSE_POINT: called on FID[0x%04X] Status: NOT_IMPLEMENTED\n", fsp->fnum));
+                return NT_STATUS_NOT_A_REPARSE_POINT;
+        }
+
+        case FSCTL_GET_SHADOW_COPY_DATA:
         {
                 /*
@@ -2219 +2255 @@
                 uint32 labels_data_count = 0;
                 uint32 i;
-                char *cur_pdata;
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (max_data_count < 16) {
+                char *cur_pdata = NULL;
+
+                if (max_out_len < 16) {
                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) < 16 is invalid!\n",
-                                max_data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                if (max_data_count > 16) {
+                                max_out_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                if (max_out_len > 16) {
                         labels = True;
                 }
 
-                shadow_data = TALLOC_ZERO_P(talloc_tos(),
-                                            struct shadow_copy_data);
+                shadow_data = talloc_zero(ctx, struct shadow_copy_data);
                 if (shadow_data == NULL) {
                         DEBUG(0,("TALLOC_ZERO() failed!\n"));
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
+                        return NT_STATUS_NO_MEMORY;
                 }
 
@@ -2251 +2280 @@
                         if (errno == ENOSYS) {
                                 DEBUG(5,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, not supported.\n", 
-                                        conn->connectpath));
-                                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
-                                return;
+                                        fsp->conn->connectpath));
+                                return NT_STATUS_NOT_SUPPORTED;
                         } else {
                                 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: connectpath %s, failed.\n", 
-                                        conn->connectpath));
-                                reply_nterror(req, NT_STATUS_UNSUCCESSFUL);
-                                return;
+                                        fsp->conn->connectpath));
+                                return NT_STATUS_UNSUCCESSFUL;
                         }
                 }
 
-                labels_data_count = (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))+2;
+                labels_data_count = (shadow_data->num_volumes * 2 *
+                                        sizeof(SHADOW_COPY_LABEL)) + 2;
 
                 if (!labels) {
-                        data_count = 16;
+                        *out_len = 16;
                 } else {
-                        data_count = 12+labels_data_count+4;
-                }
-
-                if (max_data_count<data_count) {
+                        *out_len = 12 + labels_data_count + 4;
+                }
+
+                if (max_out_len < *out_len) {
                         DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: max_data_count(%u) too small (%u) bytes needed!\n",
-                                max_data_count,data_count));
+                                max_out_len, *out_len));
                         TALLOC_FREE(shadow_data);
-                        reply_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                        return;
-                }
-
-                pdata = nttrans_realloc(ppdata, data_count);
-                if (pdata == NULL) {
+                        return NT_STATUS_BUFFER_TOO_SMALL;
+                }
+
+                cur_pdata = talloc_array(ctx, char, *out_len);
+                if (cur_pdata == NULL) {
                         TALLOC_FREE(shadow_data);
-                        reply_nterror(req, NT_STATUS_NO_MEMORY);
-                        return;
-                }
-
-                cur_pdata = pdata;
+                        return NT_STATUS_NO_MEMORY;
+                }
+
+                *out_data = cur_pdata;
 
                 /* num_volumes 4 bytes */
-                SIVAL(pdata,0,shadow_data->num_volumes);
+                SIVAL(cur_pdata, 0, shadow_data->num_volumes);
 
                 if (labels) {
                         /* num_labels 4 bytes */
-                        SIVAL(pdata,4,shadow_data->num_volumes);
+                        SIVAL(cur_pdata, 4, shadow_data->num_volumes);
                 }
 
                 /* needed_data_count 4 bytes */
-                SIVAL(pdata, 8, labels_data_count+4);
-
-                cur_pdata+=12;
+                SIVAL(cur_pdata, 8, labels_data_count + 4);
+
+                cur_pdata += 12;
 
                 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for path[%s].\n",
                           shadow_data->num_volumes, fsp_str_dbg(fsp)));
                 if (labels && shadow_data->labels) {
-                        for (i=0;i<shadow_data->num_volumes;i++) {
-                                srvstr_push(pdata, req->flags2,
+                        for (i=0; i<shadow_data->num_volumes; i++) {
+                                srvstr_push(cur_pdata, req_flags,
                                             cur_pdata, shadow_data->labels[i],
-                                            2*sizeof(SHADOW_COPY_LABEL),
+                                            2 * sizeof(SHADOW_COPY_LABEL),
                                             STR_UNICODE|STR_TERMINATE);
-                                cur_pdata+=2*sizeof(SHADOW_COPY_LABEL);
+                                cur_pdata += 2 * sizeof(SHADOW_COPY_LABEL);
                                 DEBUGADD(10,("Label[%u]: '%s'\n",i,shadow_data->labels[i]));
                         }
@@ -2315 +2341 @@
                 TALLOC_FREE(shadow_data);
 
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, data_count);
-
-                return;
-        }
-
-        case FSCTL_FIND_FILES_BY_SID: /* I hope this name is right */
+                return NT_STATUS_OK;
+        }
+
+        case FSCTL_FIND_FILES_BY_SID:
         {
                 /* pretend this succeeded -
@@ -2333 +2356 @@
                 size_t sid_len;
 
-                DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n",fidnum));
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (data_count < 8) {
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                sid_len = MIN(data_count-4,SID_MAX_SIZE);
+                DEBUG(10,("FSCTL_FIND_FILES_BY_SID: called on FID[0x%04X]\n", fsp->fnum));
+
+                if (in_len < 8) {
+                        /* NT_STATUS_BUFFER_TOO_SMALL maybe? */
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                sid_len = MIN(in_len - 4,SID_MAX_SIZE);
 
                 /* unknown 4 bytes: this is not the length of the sid :-(  */
                 /*unknown = IVAL(pdata,0);*/
 
-                if (!sid_parse(pdata+4,sid_len,&sid)) {
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
+                if (!sid_parse(in_data + 4, sid_len, &sid)) {
+                        return NT_STATUS_INVALID_PARAMETER;
                 }
                 DEBUGADD(10, ("for SID: %s\n", sid_string_dbg(&sid)));
@@ -2373 +2391 @@
                  * (maybe we can hang the result anywhere in the fsp struct)
                  *
+                 * but I don't know how to deal with the paged results
+                 * (maybe we can hang the result anywhere in the fsp struct)
+                 *
                  * we don't send all files at once
                  * and at the next we should *not* start from the beginning,
@@ -2381 +2402 @@
 
                 /* this works for now... */
-                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
-                return;
-        }
+                return NT_STATUS_OK;
+        }
+
         case FSCTL_QUERY_ALLOCATED_RANGES:
         {
@@ -2394 +2415 @@
                 NTSTATUS status;
                 uint64_t offset, length;
-
-                if (!check_fsp_open(conn, req, fsp)) {
-                        return;
-                }
-
-                if (data_count != 16) {
+                char *out_data_tmp = NULL;
+
+                if (in_len != 16) {
                         DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: data_count(%u) != 16 is invalid!\n",
-                                data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                if (max_data_count < 16) {
-                        DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_data_count(%u) < 16 is invalid!\n",
-                                max_data_count));
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
-                offset = BVAL(pdata,0);
-                length = BVAL(pdata,8);
+                                in_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                if (max_out_len < 16) {
+                        DEBUG(0,("FSCTL_QUERY_ALLOCATED_RANGES: max_out_len (%u) < 16 is invalid!\n",
+                                max_out_len));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                offset = BVAL(in_data,0);
+                length = BVAL(in_data,8);
 
                 if (offset + length < offset) {
                         /* No 64-bit integer wrap. */
-                        reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return;
-                }
-
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+
+                /* Shouldn't this be SMB_VFS_STAT ... ? */
                 status = vfs_stat_fsp(fsp);
                 if (!NT_STATUS_IS_OK(status)) {
-                        reply_nterror(req, status);
-                        return;
+                        return status;
+                }
+
+                *out_len = 16;
+                out_data_tmp = talloc_array(ctx, char, *out_len);
+                if (out_data_tmp == NULL) {
+                        DEBUG(10, ("unable to allocate memory for response\n"));
+                        return NT_STATUS_NO_MEMORY;
                 }
 
@@ -2431 +2453 @@
                                 fsp->fsp_name->st.st_ex_size == 0 ||
                                 length == 0) {
-                        send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, NULL, 0);
+                        memset(out_data_tmp, 0, *out_len);
                 } else {
                         uint64_t end = offset + length;
                         end = MIN(end, fsp->fsp_name->st.st_ex_size);
-                        SBVAL(pdata,0,0);
-                        SBVAL(pdata,8,end);
-                        send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0,
-                                pdata, 16);
-                }
-                return;
-        }
+                        SBVAL(out_data_tmp, 0, 0);
+                        SBVAL(out_data_tmp, 8, end);
+                }
+
+                *out_data = out_data_tmp;
+
+                return NT_STATUS_OK;
+        }
+
         case FSCTL_IS_VOLUME_DIRTY:
+        {
                 DEBUG(10,("FSCTL_IS_VOLUME_DIRTY: called on FID[0x%04X] "
-                          "(but not implemented)\n", (int)fidnum));
+                          "(but not implemented)\n", fsp->fnum));
                 /*
                  * http://msdn.microsoft.com/en-us/library/cc232128%28PROT.10%29.aspx
                  * says we have to respond with NT_STATUS_INVALID_PARAMETER
                  */
-                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                return;
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
         default:
-                /* Only print this once... */
-                if (!logged_ioctl_message) {
-                        logged_ioctl_message = true;
-                        DEBUG(2,("call_nt_transact_ioctl(0x%x): "
-                                 "Currently not implemented.\n",
-                                 function));
-                }
-        }
-
-        reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                /*
+                 * Only print once ... unfortunately there could be lots of
+                 * different FSCTLs that are called.
+                 */
+                if (!vfswrap_logged_ioctl_message) {
+                        vfswrap_logged_ioctl_message = true;
+                        DEBUG(2, ("%s (0x%x): Currently not implemented.\n",
+                        __FUNCTION__, function));
+                }
+        }
+
+        return NT_STATUS_NOT_SUPPORTED;
+}
+
+/****************************************************************************
+ Reply to NT IOCTL
+****************************************************************************/
+
+static void call_nt_transact_ioctl(connection_struct *conn,
+                                   struct smb_request *req,
+                                   uint16 **ppsetup, uint32 setup_count,
+                                   char **ppparams, uint32 parameter_count,
+                                   char **ppdata, uint32 data_count,
+                                   uint32 max_data_count)
+{
+        NTSTATUS status;
+        uint32 function;
+        uint16 fidnum;
+        files_struct *fsp;
+        uint8 isFSctl;
+        uint8 compfilter;
+        char *out_data = NULL;
+        uint32 out_data_len = 0;
+        char *pdata = *ppdata;
+        TALLOC_CTX *ctx = talloc_tos();
+
+        if (setup_count != 8) {
+                DEBUG(3,("call_nt_transact_ioctl: invalid setup count %d\n", setup_count));
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
+        }
+
+        function = IVAL(*ppsetup, 0);
+        fidnum = SVAL(*ppsetup, 4);
+        isFSctl = CVAL(*ppsetup, 6);
+        compfilter = CVAL(*ppsetup, 7);
+
+        DEBUG(10, ("call_nt_transact_ioctl: function[0x%08X] FID[0x%04X] isFSctl[0x%02X] compfilter[0x%02X]\n",
+                 function, fidnum, isFSctl, compfilter));
+
+        fsp=file_fsp(req, fidnum);
+
+        /*
+         * We don't really implement IOCTLs, especially on files.
+         */
+        if (!isFSctl) {
+                DEBUG(10, ("isFSctl: 0x%02X indicates IOCTL, not FSCTL!\n",
+                        isFSctl));
+                reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+                return;
+        }
+
+        /* Has to be for an open file! */
+        if (!check_fsp_open(conn, req, fsp)) {
+                return;
+        }
+
+        /*
+         * out_data might be allocated by the VFS module, but talloc should be
+         * used, and should be cleaned up when the request ends.
+         */
+        status = smb_fsctl(fsp,
+                               ctx,
+                               function,
+                               req->flags2,
+                               (uint8_t *)pdata,
+                               data_count,
+                               (uint8_t **)&out_data,
+                               max_data_count,
+                               &out_data_len);
+        if (!NT_STATUS_IS_OK(status)) {
+                reply_nterror(req, status);
+        } else {
+                send_nt_replies(conn, req, NT_STATUS_OK, NULL, 0, out_data, out_data_len);
+        }
 }
 
@@ -3197 +3298 @@
         show_msg((char *)req->inbuf);
 
+        /* Windows clients expect all replies to
+           an NT transact secondary (SMBnttranss 0xA1)
+           to have a command code of NT transact
+           (SMBnttrans 0xA0). See bug #8989 for details. */
+        req->cmd = SMBnttrans;
+
         if (req->wct < 18) {
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);

vendor/current/source3/smbd/open.c

@@ -93 +93 @@
                         smb_fname_str_dbg(smb_fname),
                         (unsigned int)*access_granted ));
+                return NT_STATUS_OK;
+        }
+
+        if (access_mask == DELETE_ACCESS &&
+                        VALID_STAT(smb_fname->st) &&
+                        S_ISLNK(smb_fname->st.st_ex_mode)) {
+                /* We can always delete a symlink. */
+                DEBUG(10,("smbd_check_open_rights: not checking ACL "
+                        "on DELETE_ACCESS on symlink %s.\n",
+                        smb_fname_str_dbg(smb_fname) ));
                 return NT_STATUS_OK;
         }
@@ -698 +708 @@
 }
 
-/*******************************************************************
- Return True if the filename is one of the special executable types.
-********************************************************************/
-
-bool is_executable(const char *fname)
-{
-        if ((fname = strrchr_m(fname,'.'))) {
-                if (strequal(fname,".com") ||
-                    strequal(fname,".dll") ||
-                    strequal(fname,".exe") ||
-                    strequal(fname,".sym")) {
-                        return True;
-                }
-        }
-        return False;
-}
-
 /****************************************************************************
  Check if we can open a file with a share mode.
@@ -942 +935 @@
 }
 
-static bool is_delete_request(files_struct *fsp) {
-        return ((fsp->access_mask == DELETE_ACCESS) &&
-                (fsp->oplock_type == NO_OPLOCK));
-}
-
 /*
  * Send a break message to the oplock holder and delay the open for
@@ -1091 +1079 @@
 
         if (ex_entry != NULL) {
-                /* Found an exclusive or batch oplock */
-                bool delay_it = is_delete_request(fsp) ?
-                                BATCH_OPLOCK_TYPE(ex_entry->op_type) : true;
-                if (delay_it) {
-                        send_break_message(fsp, ex_entry, mid, oplock_request);
-                        return true;
-                }
+                send_break_message(fsp, ex_entry, mid, oplock_request);
+                return true;
         }
         return false;
@@ -1335 +1318 @@
 }
 
-/****************************************************************************
- Open a file with a share mode - old openX method - map into NTCreate.
-****************************************************************************/
-
-bool map_open_params_to_ntcreate(const struct smb_filename *smb_fname,
-                                 int deny_mode, int open_func,
-                                 uint32 *paccess_mask,
-                                 uint32 *pshare_mode,
-                                 uint32 *pcreate_disposition,
-                                 uint32 *pcreate_options,
-                                 uint32_t *pprivate_flags)
-{
-        uint32 access_mask;
-        uint32 share_mode;
-        uint32 create_disposition;
-        uint32 create_options = FILE_NON_DIRECTORY_FILE;
-        uint32_t private_flags = 0;
-
-        DEBUG(10,("map_open_params_to_ntcreate: fname = %s, deny_mode = 0x%x, "
-                  "open_func = 0x%x\n",
-                  smb_fname_str_dbg(smb_fname), (unsigned int)deny_mode,
-                  (unsigned int)open_func ));
-
-        /* Create the NT compatible access_mask. */
-        switch (GET_OPENX_MODE(deny_mode)) {
-                case DOS_OPEN_EXEC: /* Implies read-only - used to be FILE_READ_DATA */
-                case DOS_OPEN_RDONLY:
-                        access_mask = FILE_GENERIC_READ;
-                        break;
-                case DOS_OPEN_WRONLY:
-                        access_mask = FILE_GENERIC_WRITE;
-                        break;
-                case DOS_OPEN_RDWR:
-                case DOS_OPEN_FCB:
-                        access_mask = FILE_GENERIC_READ|FILE_GENERIC_WRITE;
-                        break;
-                default:
-                        DEBUG(10,("map_open_params_to_ntcreate: bad open mode = 0x%x\n",
-                                  (unsigned int)GET_OPENX_MODE(deny_mode)));
-                        return False;
-        }
-
-        /* Create the NT compatible create_disposition. */
-        switch (open_func) {
-                case OPENX_FILE_EXISTS_FAIL|OPENX_FILE_CREATE_IF_NOT_EXIST:
-                        create_disposition = FILE_CREATE;
-                        break;
-
-                case OPENX_FILE_EXISTS_OPEN:
-                        create_disposition = FILE_OPEN;
-                        break;
-
-                case OPENX_FILE_EXISTS_OPEN|OPENX_FILE_CREATE_IF_NOT_EXIST:
-                        create_disposition = FILE_OPEN_IF;
-                        break;
-
-                case OPENX_FILE_EXISTS_TRUNCATE:
-                        create_disposition = FILE_OVERWRITE;
-                        break;
-
-                case OPENX_FILE_EXISTS_TRUNCATE|OPENX_FILE_CREATE_IF_NOT_EXIST:
-                        create_disposition = FILE_OVERWRITE_IF;
-                        break;
-
-                default:
-                        /* From samba4 - to be confirmed. */
-                        if (GET_OPENX_MODE(deny_mode) == DOS_OPEN_EXEC) {
-                                create_disposition = FILE_CREATE;
-                                break;
-                        }
-                        DEBUG(10,("map_open_params_to_ntcreate: bad "
-                                  "open_func 0x%x\n", (unsigned int)open_func));
-                        return False;
-        }
-
-        /* Create the NT compatible share modes. */
-        switch (GET_DENY_MODE(deny_mode)) {
-                case DENY_ALL:
-                        share_mode = FILE_SHARE_NONE;
-                        break;
-
-                case DENY_WRITE:
-                        share_mode = FILE_SHARE_READ;
-                        break;
-
-                case DENY_READ:
-                        share_mode = FILE_SHARE_WRITE;
-                        break;
-
-                case DENY_NONE:
-                        share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
-                        break;
-
-                case DENY_DOS:
-                        private_flags |= NTCREATEX_OPTIONS_PRIVATE_DENY_DOS;
-                        if (is_executable(smb_fname->base_name)) {
-                                share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
-                        } else {
-                                if (GET_OPENX_MODE(deny_mode) == DOS_OPEN_RDONLY) {
-                                        share_mode = FILE_SHARE_READ;
-                                } else {
-                                        share_mode = FILE_SHARE_NONE;
-                                }
-                        }
-                        break;
-
-                case DENY_FCB:
-                        private_flags |= NTCREATEX_OPTIONS_PRIVATE_DENY_FCB;
-                        share_mode = FILE_SHARE_NONE;
-                        break;
-
-                default:
-                        DEBUG(10,("map_open_params_to_ntcreate: bad deny_mode 0x%x\n",
-                                (unsigned int)GET_DENY_MODE(deny_mode) ));
-                        return False;
-        }
-
-        DEBUG(10,("map_open_params_to_ntcreate: file %s, access_mask = 0x%x, "
-                  "share_mode = 0x%x, create_disposition = 0x%x, "
-                  "create_options = 0x%x private_flags = 0x%x\n",
-                  smb_fname_str_dbg(smb_fname),
-                  (unsigned int)access_mask,
-                  (unsigned int)share_mode,
-                  (unsigned int)create_disposition,
-                  (unsigned int)create_options,
-                  (unsigned int)private_flags));
-
-        if (paccess_mask) {
-                *paccess_mask = access_mask;
-        }
-        if (pshare_mode) {
-                *pshare_mode = share_mode;
-        }
-        if (pcreate_disposition) {
-                *pcreate_disposition = create_disposition;
-        }
-        if (pcreate_options) {
-                *pcreate_options = create_options;
-        }
-        if (pprivate_flags) {
-                *pprivate_flags = private_flags;
-        }
-
-        return True;
-
-}
-
 static void schedule_defer_open(struct share_mode_lock *lck,
                                 struct timeval request_time,
@@ -1573 +1409 @@
                                         smb_fname_str_dbg(smb_fname)));
                                 return NT_STATUS_ACCESS_DENIED;
+                        }
+
+                        if (!(access_granted & DELETE_ACCESS)) {
+                                if (can_delete_file_in_directory(conn, smb_fname)) {
+                                        access_granted |= DELETE_ACCESS;
+                                }
                         }
 
@@ -1705 +1547 @@
         ZERO_STRUCT(id);
 
-        /* Windows allows a new file to be created and
-           silently removes a FILE_ATTRIBUTE_DIRECTORY
-           sent by the client. Do the same. */
-
-        new_dos_attributes &= ~FILE_ATTRIBUTE_DIRECTORY;
-
         if (conn->printer) {
                 /*
@@ -1744 +1580 @@
                 new_dos_attributes = 0;
         } else {
+                /* Windows allows a new file to be created and
+                   silently removes a FILE_ATTRIBUTE_DIRECTORY
+                   sent by the client. Do the same. */
+
+                new_dos_attributes &= ~FILE_ATTRIBUTE_DIRECTORY;
+
                 /* We add FILE_ATTRIBUTE_ARCHIVE to this as this mode is only used if the file is
                  * created new. */
@@ -1787 +1629 @@
                         remove_deferred_open_message_smb(req->mid);
                 }
-        }
-
-        status = check_name(conn, smb_fname->base_name);
-        if (!NT_STATUS_IS_OK(status)) {
-                return status;
         }
 
@@ -2743 +2580 @@
         SMB_ASSERT(!is_ntfs_stream_smb_fname(smb_dname));
 
-        /* Ensure we have a directory attribute. */
-        file_attributes |= FILE_ATTRIBUTE_DIRECTORY;
+        if (!(file_attributes & FILE_FLAG_POSIX_SEMANTICS)) {
+                /* Ensure we have a directory attribute. */
+                file_attributes |= FILE_ATTRIBUTE_DIRECTORY;
+        }
 
         DEBUG(5,("open_directory: opening directory %s, access_mask = 0x%x, "
@@ -2900 +2739 @@
         fsp->share_access = share_access;
         fsp->fh->private_options = 0;
-        /*
-         * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
-         */
-        fsp->access_mask = access_mask | FILE_READ_ATTRIBUTES;
         fsp->print_file = NULL;
         fsp->modified = False;
@@ -2918 +2753 @@
         mtimespec = smb_dname->st.st_ex_mtime;
 
+        /* Temporary access mask used to open the directory fd. */
+        fsp->access_mask = FILE_READ_DATA | FILE_READ_ATTRIBUTES;
 #ifdef O_DIRECTORY
         status = fd_open(conn, fsp, O_RDONLY|O_DIRECTORY, 0);
@@ -2932 +2769 @@
                 return status;
         }
+
+        /*
+         * According to Samba4, SEC_FILE_READ_ATTRIBUTE is always granted,
+         * Set the real access mask for later access (possibly delete).
+         */
+        fsp->access_mask = access_mask | FILE_READ_ATTRIBUTES;
 
         status = vfs_stat_fsp(fsp);
@@ -3132 +2975 @@
                                         const char *fname)
 {
-        struct stream_struct *stream_info;
-        files_struct **streams;
+        struct stream_struct *stream_info = NULL;
+        files_struct **streams = NULL;
         int i;
-        unsigned int num_streams;
+        unsigned int num_streams = 0;
         TALLOC_CTX *frame = talloc_stackframe();
         NTSTATUS status;
 
-        status = SMB_VFS_STREAMINFO(conn, NULL, fname, talloc_tos(),
-                                    &num_streams, &stream_info);
+        status = vfs_streaminfo(conn, NULL, fname, talloc_tos(),
+                                &num_streams, &stream_info);
 
         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)
@@ -3150 +2993 @@
 
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(10, ("SMB_VFS_STREAMINFO failed: %s\n",
+                DEBUG(10, ("vfs_streaminfo failed: %s\n",
                            nt_errstr(status)));
                 goto fail;
@@ -3517 +3360 @@
                 fsp->access_mask = FILE_GENERIC_ALL;
 
-                /* Convert all the generic bits. */
-                security_acl_map_generic(sd->dacl, &file_generic_mapping);
-                security_acl_map_generic(sd->sacl, &file_generic_mapping);
-
                 if (sec_info_sent & (SECINFO_OWNER|
                                         SECINFO_GROUP|
                                         SECINFO_DACL|
                                         SECINFO_SACL)) {
-                        status = SMB_VFS_FSET_NT_ACL(fsp, sec_info_sent, sd);
+                        status = set_sd(fsp, sd, sec_info_sent);
                 }
 
@@ -3814 +3653 @@
         }
 
-        /* All file access must go through check_name() */
-
-        status = check_name(conn, smb_fname->base_name);
-        if (!NT_STATUS_IS_OK(status)) {
-                goto fail;
-        }
-
         if (stream_name && is_ntfs_default_stream_smb_fname(smb_fname)) {
                 int ret;

vendor/current/source3/smbd/oplock_linux.c

@@ -77 +77 @@
         int ret;
 
+        /* First set the signal handler. */
+        if (linux_set_lease_sighandler(fd) == -1) {
+                return -1;
+        }
         ret = fcntl(fd, F_SETLEASE, leasetype);
         if (ret == -1 && errno == EACCES) {
                 set_effective_capability(LEASE_CAPABILITY);
+                /*
+                 * Bug 8974 - work around Linux kernel bug
+                 * https://bugzilla.kernel.org/show_bug.cgi?id=43336.
+                 * "fcntl(F_SETLEASE) resets signal number when
+                 *  called multiple times"
+                 */
+                if (linux_set_lease_sighandler(fd) == -1) {
+                        return -1;
+                }
                 ret = fcntl(fd, F_SETLEASE, leasetype);
         }

vendor/current/source3/smbd/password.c

@@ -295 +295 @@
         DEBUG(3, ("register_existing_vuid: User name: %s\t"
                   "Real name: %s\n", vuser->session_info->unix_name,
-                  vuser->session_info->info3->base.full_name.string));
+                  vuser->session_info->info3->base.full_name.string ?
+                  vuser->session_info->info3->base.full_name.string : ""));
 
         if (!vuser->session_info->security_token) {

vendor/current/source3/smbd/posix_acls.c

@@ -1131 +1131 @@
 ****************************************************************************/
 
-#define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA|FILE_READ_ATTRIBUTES)
-#define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA|FILE_WRITE_ATTRIBUTES)
+#define FILE_SPECIFIC_READ_BITS (FILE_READ_DATA|FILE_READ_EA)
+#define FILE_SPECIFIC_WRITE_BITS (FILE_WRITE_DATA|FILE_APPEND_DATA|FILE_WRITE_EA)
 #define FILE_SPECIFIC_EXECUTE_BITS (FILE_EXECUTE)
 
@@ -1354 +1354 @@
 ****************************************************************************/
 
-static bool ensure_canon_entry_valid(connection_struct *conn, canon_ace **pp_ace,
-                                     const struct share_params *params,
-                                     const bool is_directory,
-                                                        const struct dom_sid *pfile_owner_sid,
-                                                        const struct dom_sid *pfile_grp_sid,
-                                                        const SMB_STRUCT_STAT *pst,
-                                                        bool setting_acl)
+static bool ensure_canon_entry_valid(connection_struct *conn,
+                                        canon_ace **pp_ace,
+                                        bool is_default_acl,
+                                        const struct share_params *params,
+                                        const bool is_directory,
+                                        const struct dom_sid *pfile_owner_sid,
+                                        const struct dom_sid *pfile_grp_sid,
+                                        const SMB_STRUCT_STAT *pst,
+                                        bool setting_acl)
 {
         canon_ace *pace;
@@ -1371 +1373 @@
                 if (pace->type == SMB_ACL_USER_OBJ) {
 
-                        if (setting_acl)
+                        if (setting_acl && !is_default_acl) {
                                 apply_default_perms(params, is_directory, pace, S_IRUSR);
+                        }
                         got_user = True;
 
@@ -1381 +1384 @@
                          */
 
-                        if (setting_acl)
+                        if (setting_acl && !is_default_acl) {
                                 apply_default_perms(params, is_directory, pace, S_IRGRP);
+                        }
                         got_grp = True;
 
@@ -1391 +1395 @@
                          */
 
-                        if (setting_acl)
+                        if (setting_acl && !is_default_acl) {
                                 apply_default_perms(params, is_directory, pace, S_IROTH);
+                        }
                         got_other = True;
                         pace_other = pace;
+
+                } else if (pace->type == SMB_ACL_USER || pace->type == SMB_ACL_GROUP) {
+
+                        /*
+                         * Ensure create mask/force create mode is respected on set.
+                         */
+
+                        if (setting_acl && !is_default_acl) {
+                                apply_default_perms(params, is_directory, pace, S_IRGRP);
+                        }
                 }
         }
@@ -1410 +1425 @@
                 pace->trustee = *pfile_owner_sid;
                 pace->attr = ALLOW_ACE;
+                /* Start with existing permissions, principle of least
+                   surprises for the user. */
+                pace->perms = pst->st_ex_mode;
 
                 if (setting_acl) {
                         /* See if the owning user is in any of the other groups in
-                           the ACE. If so, OR in the permissions from that group. */
-
-                        bool group_matched = False;
+                           the ACE, or if there's a matching user entry.
+                           If so, OR in the permissions from that entry. */
+
                         canon_ace *pace_iter;
 
                         for (pace_iter = *pp_ace; pace_iter; pace_iter = pace_iter->next) {
-                                if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
+                                if (pace_iter->type == SMB_ACL_USER &&
+                                                pace_iter->unix_ug.uid == pace->unix_ug.uid) {
+                                        pace->perms |= pace_iter->perms;
+                                } else if (pace_iter->type == SMB_ACL_GROUP_OBJ || pace_iter->type == SMB_ACL_GROUP) {
                                         if (uid_entry_in_group(conn, pace, pace_iter)) {
                                                 pace->perms |= pace_iter->perms;
-                                                group_matched = True;
                                         }
                                 }
                         }
 
-                        /* If we only got an "everyone" perm, just use that. */
-                        if (!group_matched) {
+                        if (pace->perms == 0) {
+                                /* If we only got an "everyone" perm, just use that. */
                                 if (got_other)
                                         pace->perms = pace_other->perms;
-                                else
-                                        pace->perms = 0;
-                        }
-
-                        apply_default_perms(params, is_directory, pace, S_IRUSR);
+                        }
+
+                        if (!is_default_acl) {
+                                apply_default_perms(params, is_directory, pace, S_IRUSR);
+                        }
                 } else {
                         pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);
@@ -1461 +1481 @@
                         else
                                 pace->perms = 0;
-                        apply_default_perms(params, is_directory, pace, S_IRGRP);
+                        if (!is_default_acl) {
+                                apply_default_perms(params, is_directory, pace, S_IRGRP);
+                        }
                 } else {
                         pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRGRP, S_IWGRP, S_IXGRP);
@@ -1483 +1505 @@
                 if (setting_acl) {
                         pace->perms = 0;
-                        apply_default_perms(params, is_directory, pace, S_IROTH);
+                        if (!is_default_acl) {
+                                apply_default_perms(params, is_directory, pace, S_IROTH);
+                        }
                 } else
                         pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IROTH, S_IWOTH, S_IXOTH);
@@ -1497 +1521 @@
  If it does not have them, check if there are any entries where the trustee is the
  file owner or the owning group, and map these to SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ.
+ Note we must not do this to default directory ACLs.
 ****************************************************************************/
 
@@ -1536 +1561 @@
         if (!got_group_obj)
                 DEBUG(10,("check_owning_objs: ACL is missing an owning group entry.\n"));
-}
-
-/****************************************************************************
- If an ACE entry is SMB_ACL_USER_OBJ and not CREATOR_OWNER, map to SMB_ACL_USER.
- If an ACE entry is SMB_ACL_GROUP_OBJ and not CREATOR_GROUP, map to SMB_ACL_GROUP
-****************************************************************************/
-
-static bool dup_owning_ace(canon_ace *dir_ace, canon_ace *ace)
-{
-        /* dir ace must be followings.
-           SMB_ACL_USER_OBJ : trustee(CREATOR_OWNER) -> Posix ACL d:u::perm
-           SMB_ACL_USER     : not trustee    -> Posix ACL u:user:perm
-           SMB_ACL_USER_OBJ : trustee -> convert to SMB_ACL_USER : trustee
-           Posix ACL u:trustee:perm
-
-           SMB_ACL_GROUP_OBJ: trustee(CREATOR_GROUP) -> Posix ACL d:g::perm
-           SMB_ACL_GROUP    : not trustee   -> Posix ACL g:group:perm
-           SMB_ACL_GROUP_OBJ: trustee -> convert to SMB_ACL_GROUP : trustee
-           Posix ACL g:trustee:perm
-        */
-
-        if (ace->type == SMB_ACL_USER_OBJ &&
-                        !(dom_sid_equal(&ace->trustee, &global_sid_Creator_Owner))) {
-                canon_ace *dup_ace = dup_canon_ace(ace);
-
-                if (dup_ace == NULL) {
-                        return false;
-                }
-                dup_ace->type = SMB_ACL_USER;
-                DLIST_ADD_END(dir_ace, dup_ace, canon_ace *);
-        }
-
-        if (ace->type == SMB_ACL_GROUP_OBJ &&
-                        !(dom_sid_equal(&ace->trustee, &global_sid_Creator_Group))) {
-                canon_ace *dup_ace = dup_canon_ace(ace);
-
-                if (dup_ace == NULL) {
-                        return false;
-                }
-                dup_ace->type = SMB_ACL_GROUP;
-                DLIST_ADD_END(dir_ace, dup_ace, canon_ace *);
-        }
-
-        return true;
 }
 
@@ -1805 +1786 @@
                                 (SEC_ACE_FLAG_OBJECT_INHERIT|SEC_ACE_FLAG_CONTAINER_INHERIT)) {
 
+                                canon_ace *current_dir_ace = current_ace;
                                 DLIST_ADD_END(dir_ace, current_ace, canon_ace *);
 
@@ -1830 +1812 @@
                                         dbgtext("create_canon_ace_lists: adding dir ACL:\n");
                                         print_canon_ace( current_ace, 0);
-                                }
-
-                                /*
-                                 * We have a lossy mapping: directory ACE entries
-                                 * CREATOR_OWNER ------\
-                                 *     (map to)         +---> SMB_ACL_USER_OBJ
-                                 * owning sid    ------/
-                                 *
-                                 * CREATOR_GROUP ------\
-                                 *     (map to)         +---> SMB_ACL_GROUP_OBJ
-                                 * primary group sid --/
-                                 *
-                                 * on set. And on read of a directory ACL
-                                 *
-                                 * SMB_ACL_USER_OBJ ----> CREATOR_OWNER
-                                 * SMB_ACL_GROUP_OBJ ---> CREATOR_GROUP.
-                                 *
-                                 * Deal with this on set by duplicating
-                                 * owning sid and primary group sid ACE
-                                 * entries into the directory ACL.
-                                 * Fix from Tsukasa Hamano <hamano@osstech.co.jp>.
-                                 */
-
-                                if (!dup_owning_ace(dir_ace, current_ace)) {
-                                        DEBUG(0,("create_canon_ace_lists: malloc fail !\n"));
-                                        free_canon_ace_list(file_ace);
-                                        free_canon_ace_list(dir_ace);
-                                        return false;
                                 }
 
@@ -1894 +1848 @@
                                         current_ace = NULL;
                                 }
+
+                                /*
+                                 * current_ace is now either owned by file_ace
+                                 * or is NULL. We can safely operate on current_dir_ace
+                                 * to treat mapping for default acl entries differently
+                                 * than access acl entries.
+                                 */
+
+                                if (current_dir_ace->owner_type == UID_ACE) {
+                                        /*
+                                         * We already decided above this is a uid,
+                                         * for default acls ace's only CREATOR_OWNER
+                                         * maps to ACL_USER_OBJ. All other uid
+                                         * ace's are ACL_USER.
+                                         */
+                                        if (dom_sid_equal(&current_dir_ace->trustee,
+                                                        &global_sid_Creator_Owner)) {
+                                                current_dir_ace->type = SMB_ACL_USER_OBJ;
+                                        } else {
+                                                current_dir_ace->type = SMB_ACL_USER;
+                                        }
+                                }
+
+                                if (current_dir_ace->owner_type == GID_ACE) {
+                                        /*
+                                         * We already decided above this is a gid,
+                                         * for default acls ace's only CREATOR_GROUP
+                                         * maps to ACL_GROUP_OBJ. All other uid
+                                         * ace's are ACL_GROUP.
+                                         */
+                                        if (dom_sid_equal(&current_dir_ace->trustee,
+                                                        &global_sid_Creator_Group)) {
+                                                current_dir_ace->type = SMB_ACL_GROUP_OBJ;
+                                        } else {
+                                                current_dir_ace->type = SMB_ACL_GROUP;
+                                        }
+                                }
                         }
                 }
@@ -1955 +1946 @@
         } else {
                 /*
-                 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in each
-                 * ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
-                 * entries can be converted to *_OBJ. Usually we will already have these
-                 * entries in the Default ACL, and the Access ACL will not have them.
+                 * Check if we have SMB_ACL_USER_OBJ and SMB_ACL_GROUP_OBJ entries in
+                 * the file ACL. If we don't have them, check if any SMB_ACL_USER/SMB_ACL_GROUP
+                 * entries can be converted to *_OBJ. Don't do this for the default
+                 * ACL, we will create them separately for this if needed inside
+                 * ensure_canon_entry_valid().
                  */
                 if (file_ace) {
                         check_owning_objs(file_ace, pfile_owner_sid, pfile_grp_sid);
-                }
-                if (dir_ace) {
-                        check_owning_objs(dir_ace, pfile_owner_sid, pfile_grp_sid);
                 }
         }
@@ -2287 +2276 @@
 
 /****************************************************************************
- Create a default mode that will be used if a security descriptor entry has
- no user/group/world entries.
-****************************************************************************/
-
-static mode_t create_default_mode(files_struct *fsp, bool interitable_mode)
-{
-        int snum = SNUM(fsp->conn);
-        mode_t and_bits = (mode_t)0;
-        mode_t or_bits = (mode_t)0;
-        mode_t mode;
-
-        if (interitable_mode) {
-                mode = unix_mode(fsp->conn, FILE_ATTRIBUTE_ARCHIVE,
-                                 fsp->fsp_name, NULL);
-        } else {
-                mode = S_IRUSR;
-        }
-
-        if (fsp->is_directory)
-                mode |= (S_IWUSR|S_IXUSR);
-
-        /*
-         * Now AND with the create mode/directory mode bits then OR with the
-         * force create mode/force directory mode bits.
-         */
-
-        if (fsp->is_directory) {
-                and_bits = lp_dir_security_mask(snum);
-                or_bits = lp_force_dir_security_mode(snum);
-        } else {
-                and_bits = lp_security_mask(snum);
-                or_bits = lp_force_security_mode(snum);
-        }
-
-        return ((mode & and_bits)|or_bits);
-}
-
-/****************************************************************************
  Unpack a struct security_descriptor into two canonical ace lists. We don't depend on this
  succeeding.
@@ -2338 +2289 @@
                                 const struct security_descriptor *psd)
 {
-        SMB_STRUCT_STAT st;
         canon_ace *file_ace = NULL;
         canon_ace *dir_ace = NULL;
@@ -2402 +2352 @@
         print_canon_ace_list( "file ace - before valid", file_ace);
 
-        st = *pst;
-
-        /*
-         * A default 3 element mode entry for a file should be r-- --- ---.
-         * A default 3 element mode entry for a directory should be rwx --- ---.
-         */
-
-        st.st_ex_mode = create_default_mode(fsp, False);
-
-        if (!ensure_canon_entry_valid(fsp->conn, &file_ace, fsp->conn->params,
-                        fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
+        if (!ensure_canon_entry_valid(fsp->conn, &file_ace, false, fsp->conn->params,
+                        fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
                 free_canon_ace_list(file_ace);
                 free_canon_ace_list(dir_ace);
@@ -2420 +2361 @@
         print_canon_ace_list( "dir ace - before valid", dir_ace);
 
-        /*
-         * A default inheritable 3 element mode entry for a directory should be the
-         * mode Samba will use to create a file within. Ensure user rwx bits are set if
-         * it's a directory.
-         */
-
-        st.st_ex_mode = create_default_mode(fsp, True);
-
-        if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, fsp->conn->params,
-                        fsp->is_directory, pfile_owner_sid, pfile_grp_sid, &st, True)) {
+        if (dir_ace && !ensure_canon_entry_valid(fsp->conn, &dir_ace, true, fsp->conn->params,
+                        fsp->is_directory, pfile_owner_sid, pfile_grp_sid, pst, True)) {
                 free_canon_ace_list(file_ace);
                 free_canon_ace_list(dir_ace);
@@ -2517 +2450 @@
         canon_ace *next_ace = NULL;
         int entry_id = SMB_ACL_FIRST_ENTRY;
+        bool is_default_acl = (the_acl_type == SMB_ACL_TYPE_DEFAULT);
         SMB_ACL_ENTRY_T entry;
         size_t ace_count;
@@ -2604 +2538 @@
                 ace->unix_ug = unix_ug;
                 ace->owner_type = owner_type;
-                ace->ace_flags = get_pai_flags(pal, ace, (the_acl_type == SMB_ACL_TYPE_DEFAULT));
+                ace->ace_flags = get_pai_flags(pal, ace, is_default_acl);
 
                 DLIST_ADD(l_head, ace);
@@ -2613 +2547 @@
          */
 
-        if (!ensure_canon_entry_valid(conn, &l_head, conn->params,
+        if (!ensure_canon_entry_valid(conn, &l_head, is_default_acl, conn->params,
                                       S_ISDIR(psbuf->st_ex_mode), powner, pgroup,
                                       psbuf, False))
@@ -2623 +2557 @@
          */
 
-        DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", the_acl_type == SMB_ACL_TYPE_ACCESS ? "Access" : "Default" ));
+        DEBUG(10,("canonicalise_acl: %s ace entries before arrange :\n", is_default_acl ?  "Default" : "Access"));
 
         for ( ace_count = 0, ace = l_head; ace; ace = next_ace, ace_count++) {

vendor/current/source3/smbd/process.c

@@ -452 +452 @@
                                         p_unread, &len);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(1, ("read_smb_length_return_keepalive failed for "
-                          "client %s read error = %s.\n",
-                          sconn->client_id.addr, nt_errstr(status)));
+                DEBUG(NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)?5:1,
+                      ("receive_smb_raw_talloc failed for client %s "
+                       "read error = %s.\n",
+                       sconn->client_id.addr, nt_errstr(status)));
                 return status;
         }
@@ -1442 +1443 @@
         /* Make sure this is an SMB packet. smb_size contains NetBIOS header
          * so subtract 4 from it. */
-        if (!valid_smb_header(req->inbuf)
-            || (size < (smb_size - 4))) {
+        if ((size < (smb_size - 4)) ||
+            !valid_smb_header(req->inbuf)) {
                 DEBUG(2,("Non-SMB packet of length %d. Terminating server\n",
                          smb_len(req->inbuf)));
@@ -2089 +2090 @@
 
         /*
-         * Check if the client tries to fool us. The request so far uses the
-         * space to the end of the byte buffer in the request just
-         * processed. The chain_offset can't point into that area. If that was
-         * the case, we could end up with an endless processing of the chain,
-         * we would always handle the same request.
+         * Check if the client tries to fool us. The chain offset
+         * needs to point beyond the current request in the chain, it
+         * needs to strictly grow. Otherwise we might be tricked into
+         * an endless loop always processing the same request over and
+         * over again. We used to assume that vwv and the byte buffer
+         * array in a chain are always attached, but OS/2 the
+         * Write&X/Read&X chain puts the Read&X vwv array right behind
+         * the Write&X vwv chain. The Write&X bcc array is put behind
+         * the Read&X vwv array. So now we check whether the chain
+         * offset points strictly behind the previous vwv
+         * array. req->buf points right after the vwv array of the
+         * previous request. See
+         * https://bugzilla.samba.org/show_bug.cgi?id=8360 for more
+         * information.
          */
 
-        already_used = PTR_DIFF(req->buf+req->buflen, smb_base(req->inbuf));
-        if (chain_offset < already_used) {
+        already_used = PTR_DIFF(req->buf, smb_base(req->inbuf));
+        if (chain_offset <= already_used) {
                 goto error;
         }
@@ -2798 +2808 @@
  * Handle SMBecho requests in a forked child process
  */
-static bool fork_echo_handler(struct smbd_server_connection *sconn)
+bool fork_echo_handler(struct smbd_server_connection *sconn)
 {
         int listener_pipe[2];
@@ -2912 +2922 @@
         int ret;
 
-        if (lp_maxprotocol() == PROTOCOL_SMB2 &&
-            !lp_async_smb_echo_handler()) {
+        if (lp_maxprotocol() == PROTOCOL_SMB2) {
                 /*
                  * We're not making the decision here,
@@ -3034 +3043 @@
         }
 
-        if (lp_async_smb_echo_handler() && !fork_echo_handler(sconn)) {
-                exit_server("Failed to fork echo handler");
-        }
-
         /* Setup oplocks */
         if (!init_oplocks(sconn->msg_ctx))

vendor/current/source3/smbd/proto.h

@@ -302 +302 @@
                          uint32_t access_mask);
 bool can_delete_file_in_directory(connection_struct *conn,
-                                  struct smb_filename *smb_fname);
+                                  const struct smb_filename *smb_fname);
 bool can_access_file_data(connection_struct *conn,
                           const struct smb_filename *smb_fname,
@@ -337 +337 @@
                       struct smb_filename **smb_fname,
                       uint32_t ucf_flags);
+NTSTATUS check_veto_path(connection_struct *conn, const char *name);
 NTSTATUS check_name(connection_struct *conn, const char *name);
 int get_real_filename(connection_struct *conn, const char *path,
@@ -373 +374 @@
 void file_free(struct smb_request *req, files_struct *fsp);
 files_struct *file_fsp(struct smb_request *req, uint16 fid);
+uint64_t fsp_persistent_id(const struct files_struct *fsp);
+struct files_struct *file_fsp_smb2(struct smbd_smb2_request *smb2req,
+                                   uint64_t persistent_id,
+                                   uint64_t volatile_id);
 NTSTATUS dup_file_fsp(struct smb_request *req, files_struct *from,
                       uint32 access_mask, uint32 share_access,
@@ -557 +562 @@
                      char *pdata, int datasize);
 void reply_ntcreate_and_X(struct smb_request *req);
-NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
+NTSTATUS set_sd(files_struct *fsp, struct security_descriptor *psd,
                        uint32_t security_info_sent);
+NTSTATUS set_sd_blob(files_struct *fsp, uint8_t *data, uint32_t sd_len,
+                       uint32_t security_info_sent);
+NTSTATUS smb_fsctl(struct files_struct *fsp,
+                       TALLOC_CTX *ctx,
+                       uint32_t function,
+                       uint16_t req_flags,  /* Needed for UNICODE ... */
+                       const uint8_t *_in_data,
+                       uint32_t in_len,
+                       uint8_t **_out_data,
+                       uint32_t max_out_len,
+                       uint32_t *out_len);
 struct ea_list *read_nttrans_ea_list(TALLOC_CTX *ctx, const char *pdata, size_t data_size);
 void reply_ntcancel(struct smb_request *req);
@@ -587 +603 @@
                                     const char *fname,
                                     SMB_STRUCT_STAT *psbuf);
-bool is_executable(const char *fname);
 bool is_stat_open(uint32 access_mask);
 bool request_timed_out(struct timeval request_time,
@@ -607 +622 @@
                          uint32 share_access,
                          uint32 create_options);
-bool map_open_params_to_ntcreate(const struct smb_filename *smb_fname,
-                                 int deny_mode, int open_func,
-                                 uint32 *paccess_mask,
-                                 uint32 *pshare_mode,
-                                 uint32 *pcreate_disposition,
-                                 uint32 *pcreate_options,
-                                 uint32_t *pprivate_flags);
 void remove_deferred_open_entry(struct file_id id, uint64_t mid,
                                 struct server_id pid);
@@ -802 +810 @@
 bool req_is_in_chain(struct smb_request *req);
 void smbd_process(struct smbd_server_connection *sconn);
+bool fork_echo_handler(struct smbd_server_connection *sconn);
 
 /* The following definitions come from smbd/quotas.c  */
@@ -960 +969 @@
 bool unix_token_equal(const struct security_unix_token *t1, const struct security_unix_token *t2);
 bool push_sec_ctx(void);
-void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, struct security_token *token);
+void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, const struct security_token *token);
 void set_root_sec_ctx(void);
 bool pop_sec_ctx(void);
@@ -988 +997 @@
 int add_home_service(const char *service, const char *username, const char *homedir);
 int find_service(TALLOC_CTX *ctx, const char *service, char **p_service_out);
-connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
-                                        int snum, user_struct *vuser,
+struct smbd_smb2_tcon;
+connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
+                                        struct smbd_smb2_tcon *tcon,
+                                        user_struct *vuser,
                                         DATA_BLOB password,
                                         const char *pdev,
@@ -1045 +1056 @@
                 bool case_sensitive);
 bool stat_cache_lookup(connection_struct *conn,
+                        bool posix_paths,
                         char **pp_name,
                         char **pp_dirpath,
@@ -1175 +1187 @@
 NTSTATUS vfs_stat_fsp(files_struct *fsp);
 NTSTATUS vfs_chown_fsp(files_struct *fsp, uid_t uid, gid_t gid);
+NTSTATUS vfs_streaminfo(connection_struct *conn,
+                        struct files_struct *fsp,
+                        const char *fname,
+                        TALLOC_CTX *mem_ctx,
+                        unsigned int *num_streams,
+                        struct stream_struct **streams);
 
 /* The following definitions come from smbd/avahi_register.c */

vendor/current/source3/smbd/quotas.c

@@ -746 +746 @@
         *bsize = gqr.getquota_rslt_u.gqr_rquota.rq_bsize;
         *dsize = D.dqb_bsoftlimit;
-
-        if (D.dqb_curblocks == 1)
-                *bsize = 512;
 
         if (D.dqb_curblocks > D.dqb_bsoftlimit) {

vendor/current/source3/smbd/reply.c

@@ -1767 +1767 @@
         }
 
-        if (!map_open_params_to_ntcreate(smb_fname, deny_mode,
+        if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
                                          &share_mode, &create_disposition,
@@ -1942 +1942 @@
         }
 
-        if (!map_open_params_to_ntcreate(smb_fname, deny_mode, smb_ofun,
+        if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
+                                         smb_ofun,
                                          &access_mask, &share_mode,
                                          &create_disposition,
@@ -2541 +2542 @@
 
         /* The set is across all open files on this dev/inode pair. */
-        if (!set_delete_on_close(fsp, True, &conn->session_info->utok)) {
+        if (!set_delete_on_close(fsp, true,
+                                conn->session_info->security_token,
+                                &conn->session_info->utok)) {
                 close_file(req, fsp, NORMAL_CLOSE);
                 return NT_STATUS_ACCESS_DENIED;
@@ -4630 +4633 @@
         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
 
-        if (nwritten < (ssize_t)numtowrite) {
-                SCVAL(req->outbuf,smb_rcls,ERRHRD);
-                SSVAL(req->outbuf,smb_err,ERRdiskfull);
-        }
-
         DEBUG(3,("writeX fnum=%d num=%d wrote=%d\n",
                 fsp->fnum, (int)numtowrite, (int)nwritten));
@@ -5655 +5653 @@
         }
 
-        if (!set_delete_on_close(fsp, true, &conn->session_info->utok)) {
+        if (!set_delete_on_close(fsp, true,
+                        conn->session_info->security_token,
+                        &conn->session_info->utok)) {
                 close_file(req, fsp, ERROR_CLOSE);
                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
@@ -5936 +5936 @@
 
 /****************************************************************************
+ Returns an error if the parent directory for a filename is open in an
+ incompatible way.
+****************************************************************************/
+
+static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
+                                        const struct smb_filename *smb_fname_dst_in)
+{
+        char *parent_dir = NULL;
+        struct smb_filename smb_fname_parent;
+        struct file_id id;
+        files_struct *fsp = NULL;
+        int ret;
+
+        if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
+                        &parent_dir, NULL)) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        ZERO_STRUCT(smb_fname_parent);
+        smb_fname_parent.base_name = parent_dir;
+
+        ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
+        if (ret == -1) {
+                return map_nt_error_from_unix(errno);
+        }
+
+        /*
+         * We're only checking on this smbd here, mostly good
+         * enough.. and will pass tests.
+         */
+
+        id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
+        for (fsp = file_find_di_first(conn->sconn, id); fsp;
+                        fsp = file_find_di_next(fsp)) {
+                if (fsp->access_mask & DELETE_ACCESS) {
+                        return NT_STATUS_SHARING_VIOLATION;
+                }
+        }
+        return NT_STATUS_OK;
+}
+
+/****************************************************************************
  Rename an open file - given an fsp.
 ****************************************************************************/
@@ -5952 +5993 @@
 
         status = check_name(conn, smb_fname_dst_in->base_name);
+        if (!NT_STATUS_IS_OK(status)) {
+                return status;
+        }
+
+        status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
@@ -6562 +6608 @@
         struct smb_filename *smb_fname_src = NULL;
         struct smb_filename *smb_fname_dst = NULL;
+        uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
+        uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
         bool stream_rename = false;
 
@@ -6604 +6652 @@
                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
                                   name,
-                                  UCF_COND_ALLOW_WCARD_LCOMP,
+                                  src_ucf_flags,
                                   &src_has_wcard,
                                   &smb_fname_src);
@@ -6622 +6670 @@
                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
                                   newname,
-                                  UCF_COND_ALLOW_WCARD_LCOMP | UCF_SAVE_LCOMP,
+                                  dst_ucf_flags,
                                   &dest_has_wcard,
                                   &smb_fname_dst);
@@ -6733 +6781 @@
                 new_create_disposition = FILE_OPEN;
         } else {
-                if (!map_open_params_to_ntcreate(smb_fname_dst_tmp, 0, ofun,
+                if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
+                                                 0, ofun,
                                                  NULL, NULL,
                                                  &new_create_disposition,

vendor/current/source3/smbd/sec_ctx.c

@@ -305 +305 @@
 ****************************************************************************/
 
-void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, struct security_token *token)
+void set_sec_ctx(uid_t uid, gid_t gid, int ngroups, gid_t *groups, const struct security_token *token)
 {
         struct sec_ctx *ctx_p = &sec_ctx_stack[sec_ctx_stack_ndx];

vendor/current/source3/smbd/server.c

@@ -65 +65 @@
          */
 
+        if (sconn->client_id.name != NULL &&
+            sconn->client_id.name != sconn->client_id.addr) {
+                talloc_free(discard_const_p(char, sconn->client_id.name));
+                sconn->client_id.name = NULL;
+        }
+
         client_addr(fd, sconn->client_id.addr, sizeof(sconn->client_id.addr));
 
@@ -277 +283 @@
         static struct timed_event *cleanup_te;
         struct server_id child_id;
+
+        child_id = procid_self(); /* Just initialize pid and potentially vnn */
+        child_id.pid = pid;
+
+        for (child = children; child != NULL; child = child->next) {
+                if (child->pid == pid) {
+                        struct child_pid *tmp = child;
+                        DLIST_REMOVE(children, child);
+                        SAFE_FREE(tmp);
+                        num_children -= 1;
+                        break;
+                }
+        }
+
+        if (child == NULL) {
+                /* not all forked child processes are added to the children list */
+                DEBUG(2, ("Could not find child %d -- ignoring\n", (int)pid));
+                return;
+        }
 
         if (unclean_shutdown) {
@@ -296 +321 @@
         }
 
-        child_id = procid_self(); /* Just initialize pid and potentially vnn */
-        child_id.pid = pid;
-
         if (!serverid_deregister(child_id)) {
                 DEBUG(1, ("Could not remove pid %d from serverid.tdb\n",
                           (int)pid));
         }
-
-        for (child = children; child != NULL; child = child->next) {
-                if (child->pid == pid) {
-                        struct child_pid *tmp = child;
-                        DLIST_REMOVE(children, child);
-                        SAFE_FREE(tmp);
-                        num_children -= 1;
-                        return;
-                }
-        }
-
-        /* not all forked child processes are added to the children list */
-        DEBUG(1, ("Could not find child %d -- ignoring\n", (int)pid));
 }
 
@@ -442 +451 @@
          * the global random state in the parent.
          */
-        generate_random_buffer((uint8_t *)&unique_id, sizeof(unique_id));
+        unique_id = serverid_get_random_unique_id();
 
         pid = sys_fork();
@@ -611 +620 @@
 }
 
-static bool smbd_parent_housekeeping(const struct timeval *now, void *private_data)
-{
-        time_t printcap_cache_time = (time_t)lp_printcap_cache_time();
-        time_t t = time_mono(NULL);
-
-        DEBUG(5, ("parent housekeeping\n"));
-
-        /* if periodic printcap rescan is enabled, see if it's time to reload */
-        if ((printcap_cache_time != 0)
-         && (t >= (last_printer_reload_time + printcap_cache_time))) {
-                DEBUG( 3,( "Printcap cache time expired.\n"));
-                pcap_cache_reload(server_event_context(),
-                                  smbd_messaging_context(),
-                                  &reload_pcap_change_notify);
-                last_printer_reload_time = t;
-        }
-
-        return true;
-}
-
 /****************************************************************************
  Open the socket communication.
@@ -642 +631 @@
         int i;
         char *ports;
+        char *tok;
+        const char *ptr;
         unsigned dns_port = 0;
 
@@ -663 +654 @@
         }
 
+        for (ptr = ports;
+             next_token_talloc(talloc_tos(),&ptr, &tok, " \t,");) {
+                unsigned port = atoi(tok);
+
+                if (port == 0 || port > 0xffff) {
+                        exit_server_cleanly("Invalid port in the config or on "
+                                            "the commandline specified!");
+                }
+        }
+
         if (lp_interfaces() && lp_bind_interfaces_only()) {
                 /* We have been given an interfaces line, and been
@@ -674 +675 @@
                         const struct sockaddr_storage *ifss =
                                         iface_n_sockaddr_storage(i);
-                        char *tok;
-                        const char *ptr;
 
                         if (ifss == NULL) {
@@ -687 +686 @@
                              next_token_talloc(talloc_tos(),&ptr, &tok, " \t,");) {
                                 unsigned port = atoi(tok);
-                                if (port == 0 || port > 0xffff) {
-                                        continue;
-                                }
 
                                 /* Keep the first port for mDNS service
@@ -707 +703 @@
                    from anywhere. */
 
-                char *tok;
-                const char *ptr;
                 const char *sock_addr = lp_socket_address();
                 char *sock_tok;
@@ -726 +720 @@
                         for (ptr=ports; next_token_talloc(talloc_tos(), &ptr, &tok, " \t,"); ) {
                                 struct sockaddr_storage ss;
-
                                 unsigned port = atoi(tok);
-                                if (port == 0 || port > 0xffff) {
-                                        continue;
-                                }
 
                                 /* Keep the first port for mDNS service
@@ -769 +759 @@
                 DEBUG(0, ("open_sockets_smbd: Failed to register "
                           "myself in serverid.tdb\n"));
-                return false;
-        }
-
-        if (!(event_add_idle(smbd_event_context(), NULL,
-                             timeval_set(SMBD_HOUSEKEEPING_INTERVAL, 0),
-                             "parent_housekeeping", smbd_parent_housekeeping,
-                             NULL))) {
-                DEBUG(0, ("Could not add parent_housekeeping event\n"));
                 return false;
         }
@@ -915 +897 @@
         TALLOC_CTX *frame;
         NTSTATUS status;
-        uint64_t unique_id;
 
         /*
@@ -1114 +1095 @@
         }
 
-        generate_random_buffer((uint8_t *)&unique_id, sizeof(unique_id));
-        set_my_unique_id(unique_id);
+        set_my_unique_id(serverid_get_random_unique_id());
 
 #if HAVE_SETPGID
@@ -1206 +1186 @@
                 exit(1);
 
-        if (!print_backend_init(smbd_messaging_context()))
-                exit(1);
-
         /* Open the share_info.tdb here, so we don't have to open
            after the fork on every single connection.  This is a small
@@ -1250 +1227 @@
                 exit(1);
         }
+
+        /*
+         * The print backend init also migrates the printing tdb's,
+         * this requires a winreg pipe.
+         */
+        if (!print_backend_init(smbd_messaging_context()))
+                exit(1);
 
         /* Publish nt printers, this requires a working winreg pipe */

vendor/current/source3/smbd/server_exit.c

@@ -84 +84 @@
         const char *const reason)
 {
-        bool had_open_conn = false;
         struct smbd_server_connection *sconn = smbd_server_conn;
 
@@ -102 +101 @@
                         files_forall(sconn, log_writeable_file_fn, &found);
                 }
-                had_open_conn = conn_close_all(sconn);
+                (void)conn_close_all(sconn);
                 invalidate_all_vuids(sconn);
         }
@@ -176 +175 @@
                 dump_core();
 
+                /* Notreached. */
+                exit(1);
         } else {
                 DEBUG(3,("Server exit (%s)\n",
@@ -185 +186 @@
         }
 
-        /* if we had any open SMB connections when we exited then we
-           need to tell the parent smbd so that it can trigger a retry
-           of any locks we may have been holding or open files we were
-           blocking */
-        if (had_open_conn) {
-                exit(1);
-        } else {
-                exit(0);
-        }
+        exit(0);
 }
 

vendor/current/source3/smbd/server_reload.c

@@ -39 +39 @@
         struct auth_serversupplied_info *session_info = NULL;
         struct spoolss_PrinterInfo2 *pinfo2 = NULL;
+        int n_services;
+        int pnum;
         int snum;
-        int n_services = lp_numservices();
-        int pnum = lp_servicenumber(PRINTERS_NAME);
         const char *pname;
+        const char *sname;
         NTSTATUS status;
-        bool skip = false;
 
-        SMB_ASSERT(pcap_cache_loaded());
+        load_printers(ev, msg_ctx);
+
+        n_services = lp_numservices();
+        pnum = lp_servicenumber(PRINTERS_NAME);
+
         DEBUG(10, ("reloading printer services from pcap cache\n"));
 
@@ -55 +59 @@
                 /* can't remove stale printers before we
                  * are fully initilized */
-                skip = true;
+                return;
         }
 
-        /* remove stale printers */
-        for (snum = 0; skip == false && snum < n_services; snum++) {
-                /* avoid removing PRINTERS_NAME or non-autoloaded printers */
-                if (snum == pnum || !(lp_snum_ok(snum) && lp_print_ok(snum) &&
-                                      lp_autoloaded(snum)))
+        /*
+         * Add default config for printers added to smb.conf file and remove
+         * stale printers
+         */
+        for (snum = 0; snum < n_services; snum++) {
+                /* avoid removing PRINTERS_NAME */
+                if (snum == pnum) {
                         continue;
+                }
 
+                /* skip no-printer services */
+                if (!(lp_snum_ok(snum) && lp_print_ok(snum))) {
+                        continue;
+                }
+
+                sname = lp_const_servicename(snum);
                 pname = lp_printername(snum);
-                if (!pcap_printername_ok(pname)) {
+
+                /* check printer, but avoid removing non-autoloaded printers */
+                if (lp_autoloaded(snum) && !pcap_printername_ok(pname)) {
                         DEBUG(3, ("removing stale printer %s\n", pname));
 
@@ -83 +98 @@
                                           pname);
                         lp_killservice(snum);
+                } else {
+                        DEBUG(8, ("Adding default registry entry for printer "
+                                  "[%s], if it doesn't exist.\n", sname));
+                        nt_printer_add(session_info, session_info, msg_ctx,
+                                       sname);
                 }
         }
 
+        /* Make sure deleted printers are gone */
         load_printers(ev, msg_ctx);
 
@@ -107 +128 @@
                         test = False;
                 }
+                TALLOC_FREE(fname);
         }
 
@@ -146 +168 @@
                                struct messaging_context *msg_ctx)
 {
+        /*
+         * Reload the printers first in the background process so that
+         * newly added printers get default values created in the registry.
+         *
+         * This will block the process for some time (~1 sec per printer), but
+         * it doesn't block smbd's servering clients.
+         */
+        reload_printers(ev, msg_ctx);
+
         message_send_all(msg_ctx, MSG_PRINTER_PCAP, NULL, 0, NULL);
 }

vendor/current/source3/smbd/service.c

@@ -697 +697 @@
                 }
 
+                /* We don't want to replace the original sanitized_username
+                   as it is the original user given in the connect attempt.
+                   This is used in '%U' substitutions. */
+                TALLOC_FREE(forced_serverinfo->sanitized_username);
+                forced_serverinfo->sanitized_username =
+                        talloc_move(forced_serverinfo,
+                                &conn->session_info->sanitized_username);
+
                 TALLOC_FREE(conn->session_info);
                 conn->session_info = forced_serverinfo;
@@ -733 +741 @@
 
 /****************************************************************************
+  Setup the share access mask for a connection.
+****************************************************************************/
+
+static void create_share_access_mask(connection_struct *conn, int snum)
+{
+        const struct security_token *token = conn->session_info->security_token;
+
+        share_access_check(token,
+                        lp_servicename(snum),
+                        MAXIMUM_ALLOWED_ACCESS,
+                        &conn->share_access);
+
+        if (security_token_has_privilege(token, SEC_PRIV_SECURITY)) {
+                conn->share_access |= SEC_FLAG_SYSTEM_SECURITY;
+        }
+        if (security_token_has_privilege(token, SEC_PRIV_RESTORE)) {
+                conn->share_access |= (SEC_RIGHTS_PRIV_RESTORE);
+        }
+        if (security_token_has_privilege(token, SEC_PRIV_BACKUP)) {
+                conn->share_access |= (SEC_RIGHTS_PRIV_BACKUP);
+        }
+        if (security_token_has_privilege(token, SEC_PRIV_TAKE_OWNERSHIP)) {
+                conn->share_access |= (SEC_STD_WRITE_OWNER);
+        }
+}
+
+/****************************************************************************
   Make a connection, given the snum to connect to, and the vuser of the
   connecting user if appropriate.
 ****************************************************************************/
 
-connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
+static connection_struct *make_connection_snum(struct smbd_server_connection *sconn,
+                                        connection_struct *conn,
                                         int snum, user_struct *vuser,
                                         DATA_BLOB password,
@@ -743 +779 @@
                                         NTSTATUS *pstatus)
 {
-        connection_struct *conn = NULL;
         struct smb_filename *smb_fname_cpath = NULL;
         fstring dev;
@@ -760 +795 @@
         }
 
-        conn = conn_new(sconn);
-        if (!conn) {
-                DEBUG(0,("Couldn't find free connection.\n"));
-                *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
-                goto err_root_exit;
-        }
-
         conn->params->service = snum;
 
@@ -816 +844 @@
         status = set_conn_force_user_group(conn, snum);
         if (!NT_STATUS_IS_OK(status)) {
-                conn_free(conn);
                 *pstatus = status;
                 return NULL;
@@ -854 +881 @@
          */
 
-        share_access_check(conn->session_info->security_token,
-                           lp_servicename(snum), MAXIMUM_ALLOWED_ACCESS,
-                           &conn->share_access);
+        create_share_access_mask(conn, snum);
 
         if ((conn->share_access & FILE_WRITE_DATA) == 0) {
@@ -1113 +1138 @@
                 yield_connection(conn, lp_servicename(snum));
         }
-        if (conn) {
+        return NULL;
+}
+
+/****************************************************************************
+ Make a connection to a service from SMB1. Internal interface.
+****************************************************************************/
+
+static connection_struct *make_connection_smb1(struct smbd_server_connection *sconn,
+                                        int snum, user_struct *vuser,
+                                        DATA_BLOB password,
+                                        const char *pdev,
+                                        NTSTATUS *pstatus)
+{
+        connection_struct *ret_conn = NULL;
+        connection_struct *conn = conn_new(sconn);
+        if (!conn) {
+                DEBUG(0,("make_connection_smb1: Couldn't find free connection.\n"));
+                *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+                return NULL;
+        }
+        ret_conn = make_connection_snum(sconn,
+                                        conn,
+                                        snum,
+                                        vuser,
+                                        password,
+                                        pdev,
+                                        pstatus);
+        if (ret_conn != conn) {
                 conn_free(conn);
-        }
-        return NULL;
+                return NULL;
+        }
+        return conn;
 }
 
 /****************************************************************************
- Make a connection to a service.
+ Make a connection to a service from SMB2. External SMB2 interface.
+ We must set cnum before claiming connection.
+****************************************************************************/
+
+connection_struct *make_connection_smb2(struct smbd_server_connection *sconn,
+                                        struct smbd_smb2_tcon *tcon,
+                                        user_struct *vuser,
+                                        DATA_BLOB password,
+                                        const char *pdev,
+                                        NTSTATUS *pstatus)
+{
+        connection_struct *ret_conn = NULL;
+        connection_struct *conn = conn_new(sconn);
+        if (!conn) {
+                DEBUG(0,("make_connection_smb2: Couldn't find free connection.\n"));
+                *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
+                return NULL;
+        }
+        conn->cnum = tcon->tid;
+        ret_conn = make_connection_snum(sconn,
+                                        conn,
+                                        tcon->snum,
+                                        vuser,
+                                        password,
+                                        pdev,
+                                        pstatus);
+        if (ret_conn != conn) {
+                conn_free(conn);
+                return NULL;
+        }
+        return conn;
+}
+
+/****************************************************************************
+ Make a connection to a service. External SMB1 interface.
  *
  * @param service 
@@ -1183 +1270 @@
                         DEBUG(5, ("making a connection to [homes] service "
                                   "created at session setup time\n"));
-                        return make_connection_snum(sconn,
+                        return make_connection_smb1(sconn,
                                                     vuser->homes_snum,
                                                     vuser, no_pw, 
@@ -1207 +1294 @@
                                           "service %s based on "
                                           "security=share\n", service_in));
-                                return make_connection_snum(sconn,
+                                return make_connection_smb1(sconn,
                                                             snum, NULL,
                                                             password,
@@ -1219 +1306 @@
                 DEBUG(5, ("making a connection to 'homes' service [%s] "
                           "created at session setup time\n", service_in));
-                return make_connection_snum(sconn,
+                return make_connection_smb1(sconn,
                                             vuser->homes_snum,
                                             vuser, no_pw, 
@@ -1267 +1354 @@
         DEBUG(5, ("making a connection to 'normal' service %s\n", service));
 
-        return make_connection_snum(sconn, snum, vuser,
+        return make_connection_smb1(sconn, snum, vuser,
                                     password,
                                     dev, status);

vendor/current/source3/smbd/sesssetup.c

@@ -736 +736 @@
         }
 
-        if (auth.data[0] == ASN1_APPLICATION(0)) {
+        if (auth.length > 0 && auth.data[0] == ASN1_APPLICATION(0)) {
                 /* Might be a second negTokenTarg packet */
                 char *kerb_mech = NULL;

vendor/current/source3/smbd/smb2_break.c

@@ -29 +29 @@
                                                       struct tevent_context *ev,
                                                       struct smbd_smb2_request *smb2req,
-                                                      uint8_t in_oplock_level,
-                                                      uint64_t in_file_id_volatile);
+                                                      struct files_struct *in_fsp,
+                                                      uint8_t in_oplock_level);
 static NTSTATUS smbd_smb2_oplock_break_recv(struct tevent_req *req,
                                             uint8_t *out_oplock_level);
@@ -37 +37 @@
 NTSTATUS smbd_smb2_request_process_break(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x18;
-        size_t body_size;
         uint8_t in_oplock_level;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x18);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_oplock_level         = CVAL(inbody, 0x02);
@@ -71 +64 @@
         in_file_id_volatile             = BVAL(inbody, 0x10);
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_oplock_break_send(req,
-                                             req->sconn->smb2.event_ctx,
-                                             req,
-                                             in_oplock_level,
-                                             in_file_id_volatile);
+        subreq = smbd_smb2_oplock_break_send(req, req->sconn->smb2.event_ctx,
+                                             req, in_fsp, in_oplock_level);
         if (subreq == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -157 +146 @@
                                                       struct tevent_context *ev,
                                                       struct smbd_smb2_request *smb2req,
-                                                      uint8_t in_oplock_level,
-                                                      uint64_t in_file_id_volatile)
+                                                      struct files_struct *fsp,
+                                                      uint8_t in_oplock_level)
 {
         struct tevent_req *req;
         struct smbd_smb2_oplock_break_state *state;
         struct smb_request *smbreq;
-        connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp = NULL;
         int oplocklevel = map_smb2_oplock_levels_to_samba(in_oplock_level);
         bool break_to_none = (oplocklevel == NO_OPLOCK);
@@ -177 +164 @@
         state->out_oplock_level = SMB2_OPLOCK_LEVEL_NONE;
 
-        DEBUG(10,("smbd_smb2_oplock_break_send: file_id[0x%016llX] "
-                "samba level %d\n",
-                (unsigned long long)in_file_id_volatile,
-                oplocklevel));
+        DEBUG(10,("smbd_smb2_oplock_break_send: %s - fnum[%d] "
+                  "samba level %d\n",
+                  fsp_str_dbg(fsp), fsp->fnum,
+                  oplocklevel));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
         if (tevent_req_nomem(smbreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
                 return tevent_req_post(req, ev);
         }
@@ -265 +238 @@
                                 SMB2_OPLOCK_LEVEL_NONE;
         NTSTATUS status;
+        uint64_t fsp_persistent = fsp_persistent_id(fsp);
 
         DEBUG(10,("send_break_message_smb2: sending oplock break "
@@ -273 +247 @@
 
         status = smbd_smb2_send_oplock_break(fsp->conn->sconn,
-                                        (uint64_t)fsp->fnum,
+                                        fsp_persistent,
                                         (uint64_t)fsp->fnum,
                                         smb2_oplock_level);

vendor/current/source3/smbd/smb2_close.c

@@ -25 +25 @@
 
 static NTSTATUS smbd_smb2_close(struct smbd_smb2_request *req,
+                                struct files_struct *fsp,
                                 uint16_t in_flags,
-                                uint64_t in_file_id_volatile,
                                 DATA_BLOB *outbody);
 
 NTSTATUS smbd_smb2_request_process_close(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
         const uint8_t *inbody;
         int i = req->current_idx;
         uint8_t *outhdr;
         DATA_BLOB outbody;
-        size_t expected_body_size = 0x18;
-        size_t body_size;
         uint16_t in_flags;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         NTSTATUS status;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        status = smbd_smb2_request_verify_sizes(req, 0x18);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         outbody = data_blob_talloc(req->out.vector, NULL, 0x3C);
@@ -64 +56 @@
         in_file_id_volatile     = BVAL(inbody, 0x10);
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
         status = smbd_smb2_close(req,
+                                in_fsp,
                                 in_flags,
-                                in_file_id_volatile,
                                 &outbody);
         if (!NT_STATUS_IS_OK(status)) {
@@ -83 +74 @@
 
 static NTSTATUS smbd_smb2_close(struct smbd_smb2_request *req,
+                                struct files_struct *fsp,
                                 uint16_t in_flags,
-                                uint64_t in_file_id_volatile,
                                 DATA_BLOB *outbody)
 {
@@ -90 +81 @@
         struct smb_request *smbreq;
         connection_struct *conn = req->tcon->compat_conn;
-        files_struct *fsp;
         struct smb_filename *smb_fname = NULL;
         struct timespec mdate_ts, adate_ts, cdate_ts, create_date_ts;
@@ -104 +94 @@
         ZERO_STRUCT(cdate_ts);
 
-        DEBUG(10,("smbd_smb2_close: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_close: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(req);
         if (smbreq == NULL) {
                 return NT_STATUS_NO_MEMORY;
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                return NT_STATUS_FILE_CLOSED;
-        }
-        if (conn != fsp->conn) {
-                return NT_STATUS_FILE_CLOSED;
-        }
-        if (req->session->vuid != fsp->vuid) {
-                return NT_STATUS_FILE_CLOSED;
         }
 

vendor/current/source3/smbd/smb2_create.c

@@ -101 +101 @@
         const uint8_t *inbody;
         int i = smb2req->current_idx;
-        size_t expected_body_size = 0x39;
-        size_t body_size;
         uint8_t in_oplock_level;
         uint32_t in_impersonation_level;
@@ -128 +126 @@
         struct tevent_req *tsubreq;
 
-        if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(smb2req, 0x39);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(smb2req, status);
+        }
         inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_oplock_level         = CVAL(inbody, 0x03);
@@ -159 +152 @@
          */
 
-        dyn_offset = SMB2_HDR_BODY + (body_size & 0xFFFFFFFE);
+        dyn_offset = SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len;
 
         if (in_name_offset == 0 && in_name_length == 0) {
@@ -218 +211 @@
         if (!ok) {
                 return smbd_smb2_request_error(smb2req, NT_STATUS_ILLEGAL_CHARACTER);
+        }
+
+        if (in_name_buffer.length == 0) {
+                in_name_string_size = 0;
+        }
+
+        if (strlen(in_name_string) != in_name_string_size) {
+                return smbd_smb2_request_error(smb2req, NT_STATUS_OBJECT_NAME_INVALID);
         }
 
@@ -386 +387 @@
         struct smbd_smb2_request *smb2req;
         struct smb_request *smb1req;
+        bool open_was_deferred;
         struct timed_event *te;
         struct tevent_immediate *im;
@@ -538 +540 @@
                 if (exta) {
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req,NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -553 +555 @@
                 if (mxac) {
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -571 +573 @@
 
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -593 +595 @@
                 if (dhnq) {
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -619 +621 @@
                 if (alsi) {
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -636 +638 @@
 
                         if (dhnc) {
-                                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                                tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND);
                                 return tevent_req_post(req, ev);
                         }
@@ -821 +823 @@
                                         result->fsp_name));
         state->out_allocation_size =
-                        result->fsp_name->st.st_ex_blksize *
-                        result->fsp_name->st.st_ex_blocks;
+                        SMB_VFS_GET_ALLOC_SIZE(smb1req->conn, result,
+                                               &(result->fsp_name->st));
         state->out_end_of_file = result->fsp_name->st.st_ex_size;
         if (state->out_file_attributes == 0) {
                 state->out_file_attributes = FILE_ATTRIBUTE_NORMAL;
         }
-        state->out_file_id_persistent = result->fnum;
+        state->out_file_id_persistent = fsp_persistent_id(result);
         state->out_file_id_volatile = result->fnum;
         state->out_context_blobs = out_context_blobs;
@@ -964 +966 @@
         }
         /* It's not in progress if there's no timeout event. */
-        if (!state->te) {
+        if (!state->open_was_deferred) {
                 return false;
         }
@@ -995 +997 @@
                 (unsigned long long)mid ));
 
+        state->open_was_deferred = false;
         /* Ensure we don't have any outstanding timer event. */
         TALLOC_FREE(state->te);
@@ -1238 +1241 @@
                                 true) ));
 
+        state->open_was_deferred = true;
         state->te = event_add_timed(smb2req->sconn->smb2.event_ctx,
                                 state,

vendor/current/source3/smbd/smb2_find.c

@@ -29 +29 @@
                                               struct tevent_context *ev,
                                               struct smbd_smb2_request *smb2req,
+                                              struct files_struct *in_fsp,
                                               uint8_t in_file_info_class,
                                               uint8_t in_flags,
                                               uint32_t in_file_index,
-                                              uint64_t in_file_id_volatile,
                                               uint32_t in_output_buffer_length,
                                               const char *in_file_name);
@@ -42 +42 @@
 NTSTATUS smbd_smb2_request_process_find(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x21;
-        size_t body_size;
         uint8_t in_file_info_class;
         uint8_t in_flags;
@@ -52 +50 @@
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         uint16_t in_file_name_offset;
         uint16_t in_file_name_length;
@@ -61 +60 @@
         bool ok;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x21);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_file_info_class              = CVAL(inbody, 0x02);
@@ -85 +78 @@
                 /* This is ok */
         } else if (in_file_name_offset !=
-                   (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+                   (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -116 +109 @@
         }
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        if (in_file_name_buffer.length == 0) {
+                in_file_name_string_size = 0;
+        }
+
+        if (strlen(in_file_name_string) != in_file_name_string_size) {
+                return smbd_smb2_request_error(req, NT_STATUS_OBJECT_NAME_INVALID);
+        }
+
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_find_send(req,
-                                     req->sconn->smb2.event_ctx,
-                                     req,
+        subreq = smbd_smb2_find_send(req, req->sconn->smb2.event_ctx,
+                                     req, in_fsp,
                                      in_file_info_class,
                                      in_flags,
                                      in_file_index,
-                                     in_file_id_volatile,
                                      in_output_buffer_length,
                                      in_file_name_string);
@@ -208 +206 @@
                                               struct tevent_context *ev,
                                               struct smbd_smb2_request *smb2req,
+                                              struct files_struct *fsp,
                                               uint8_t in_file_info_class,
                                               uint8_t in_flags,
                                               uint32_t in_file_index,
-                                              uint64_t in_file_id_volatile,
                                               uint32_t in_output_buffer_length,
                                               const char *in_file_name)
@@ -219 +217 @@
         struct smb_request *smbreq;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp;
         NTSTATUS status;
         NTSTATUS empty_status;
@@ -242 +239 @@
         state->out_output_buffer = data_blob_null;
 
-        DEBUG(10,("smbd_smb2_find_send: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_find_send: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
@@ -250 +247 @@
         }
 
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-
         if (!fsp->is_directory) {
                 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
@@ -282 +265 @@
         }
 
-        if (in_output_buffer_length > 0x10000) {
+        if (in_output_buffer_length > smb2req->sconn->smb2.max_trans) {
                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
                 return tevent_req_post(req, ev);

vendor/current/source3/smbd/smb2_flush.c

@@ -28 +28 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
-                                               uint64_t in_file_id_volatile);
+                                               struct files_struct *fsp);
 static NTSTATUS smbd_smb2_flush_recv(struct tevent_req *req);
 
@@ -34 +34 @@
 NTSTATUS smbd_smb2_request_process_flush(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x18;
-        size_t body_size;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        status = smbd_smb2_request_verify_sizes(req, 0x18);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_file_id_persistent   = BVAL(inbody, 0x08);
         in_file_id_volatile     = BVAL(inbody, 0x10);
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_flush_send(req,
-                                      req->sconn->smb2.event_ctx,
-                                      req,
-                                      in_file_id_volatile);
+        subreq = smbd_smb2_flush_send(req, req->sconn->smb2.event_ctx,
+                                      req, in_fsp);
         if (subreq == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -96 +86 @@
         }
 
-        outbody = data_blob_talloc(req->out.vector, NULL, 0x10);
+        outbody = data_blob_talloc(req->out.vector, NULL, 0x04);
         if (outbody.data == NULL) {
                 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -125 +115 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
-                                               uint64_t in_file_id_volatile)
+                                               struct files_struct *fsp)
 {
         struct tevent_req *req;
@@ -131 +121 @@
         NTSTATUS status;
         struct smb_request *smbreq;
-        files_struct *fsp;
 
         req = tevent_req_create(mem_ctx, &state,
@@ -140 +129 @@
         state->smb2req = smb2req;
 
-        DEBUG(10,("smbd_smb2_flush: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_flush: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
@@ -150 +139 @@
         if (IS_IPC(smbreq->conn)) {
                 tevent_req_nterror(req, NT_STATUS_NOT_IMPLEMENTED);
-                return tevent_req_post(req, ev);
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smbreq->conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
                 return tevent_req_post(req, ev);
         }

vendor/current/source3/smbd/smb2_getinfo.c

@@ -30 +30 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *in_fsp,
                                                  uint8_t in_info_type,
                                                  uint8_t in_file_info_class,
@@ -35 +36 @@
                                                  DATA_BLOB in_input_buffer,
                                                  uint32_t in_additional_information,
-                                                 uint32_t in_flags,
-                                                 uint64_t in_file_id_volatile);
+                                                 uint32_t in_flags);
 static NTSTATUS smbd_smb2_getinfo_recv(struct tevent_req *req,
                                        TALLOC_CTX *mem_ctx,
@@ -45 +45 @@
 NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x29;
-        size_t body_size;
         uint8_t in_info_type;
         uint8_t in_file_info_class;
@@ -60 +58 @@
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x29);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_info_type                    = CVAL(inbody, 0x02);
@@ -88 +81 @@
                 /* This is ok */
         } else if (in_input_buffer_offset !=
-                   (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+                   (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -99 +92 @@
         in_input_buffer.length = in_input_buffer_length;
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        if (in_input_buffer.length > req->sconn->smb2.max_trans) {
+                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        }
+        if (in_output_buffer_length > req->sconn->smb2.max_trans) {
+                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        }
+
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_getinfo_send(req,
-                                        req->sconn->smb2.event_ctx,
-                                        req,
+        subreq = smbd_smb2_getinfo_send(req, req->sconn->smb2.event_ctx,
+                                        req, in_fsp,
                                         in_info_type,
                                         in_file_info_class,
@@ -113 +111 @@
                                         in_input_buffer,
                                         in_additional_information,
-                                        in_flags,
-                                        in_file_id_volatile);
+                                        in_flags);
         if (subreq == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -236 +233 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *fsp,
                                                  uint8_t in_info_type,
                                                  uint8_t in_file_info_class,
@@ -241 +239 @@
                                                  DATA_BLOB in_input_buffer,
                                                  uint32_t in_additional_information,
-                                                 uint32_t in_flags,
-                                                 uint64_t in_file_id_volatile)
+                                                 uint32_t in_flags)
 {
         struct tevent_req *req;
@@ -248 +245 @@
         struct smb_request *smbreq;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp;
         NTSTATUS status;
 
@@ -260 +256 @@
         state->out_output_buffer = data_blob_null;
 
-        DEBUG(10,("smbd_smb2_getinfo_send: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_getinfo_send: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
         if (tevent_req_nomem(smbreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
                 return tevent_req_post(req, ev);
         }

vendor/current/source3/smbd/smb2_ioctl.c

@@ -30 +30 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
+                                               struct files_struct *in_fsp,
                                                uint32_t in_ctl_code,
-                                               uint64_t in_file_id_volatile,
                                                DATA_BLOB in_input,
                                                uint32_t in_max_output,
@@ -42 +42 @@
 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x39;
-        size_t body_size;
         uint32_t in_ctl_code;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp = NULL;
         uint32_t in_input_offset;
         uint32_t in_input_length;
@@ -57 +56 @@
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x39);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_ctl_code             = IVAL(inbody, 0x04);
@@ -77 +70 @@
         in_flags                = IVAL(inbody, 0x30);
 
-        if (in_input_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+        /*
+         * InputOffset (4 bytes): The offset, in bytes, from the beginning of
+         * the SMB2 header to the input data buffer. If no input data is
+         * required for the FSCTL/IOCTL command being issued, the client SHOULD
+         * set this value to 0.<49>
+         * <49> If no input data is required for the FSCTL/IOCTL command being
+         * issued, Windows-based clients set this field to any value.
+         */
+        if ((in_input_length > 0)
+         && (in_input_offset != (SMB2_HDR_BODY + req->in.vector[i+1].iov_len))) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -88 +90 @@
         in_input_buffer.length = in_input_length;
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent == UINT64_MAX &&
-                   in_file_id_volatile == UINT64_MAX) {
-                /* without a handle */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
-                return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
+        switch (in_ctl_code) {
+        case FSCTL_DFS_GET_REFERRALS:
+        case FSCTL_DFS_GET_REFERRALS_EX:
+        case FSCTL_PIPE_WAIT:
+        case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
+        case FSCTL_VALIDATE_NEGOTIATE_INFO:
+        case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
+                /*
+                 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
+                 * FSCTL_PIPE_WAIT does not take a file handle.
+                 *
+                 * If FileId in the SMB2 Header of the request is not
+                 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
+                 * with STATUS_INVALID_PARAMETER.
+                 */
+                if (in_file_id_persistent != UINT64_MAX ||
+                    in_file_id_volatile != UINT64_MAX) {
+                        return smbd_smb2_request_error(req,
+                                NT_STATUS_INVALID_PARAMETER);
+                }
+                break;
+        default:
+                in_fsp = file_fsp_smb2(req, in_file_id_persistent,
+                                        in_file_id_volatile);
+                if (in_fsp == NULL) {
+                        return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
+                }
+                break;
         }
 
         subreq = smbd_smb2_ioctl_send(req,
                                       req->sconn->smb2.event_ctx,
-                                      req,
+                                      req, in_fsp,
                                       in_ctl_code,
-                                      in_file_id_volatile,
                                       in_input_buffer,
                                       in_max_output_length,
@@ -222 +244 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
+                                               struct files_struct *fsp,
                                                uint32_t in_ctl_code,
-                                               uint64_t in_file_id_volatile,
                                                DATA_BLOB in_input,
                                                uint32_t in_max_output,
@@ -231 +253 @@
         struct smbd_smb2_ioctl_state *state;
         struct smb_request *smbreq;
-        files_struct *fsp = NULL;
         struct tevent_req *subreq;
 
@@ -241 +262 @@
         state->smb2req = smb2req;
         state->smbreq = NULL;
-        state->fsp = NULL;
+        state->fsp = fsp;
         state->in_input = in_input;
         state->in_max_output = in_max_output;
         state->out_output = data_blob_null;
 
-        DEBUG(10,("smbd_smb2_ioctl: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s fnum[%d]\n",
+                (unsigned)in_ctl_code,
+                fsp ? fsp_str_dbg(fsp) : "<no handle>",
+                fsp ? fsp->fnum : -1));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
@@ -254 +277 @@
         }
         state->smbreq = smbreq;
-
-        if (in_file_id_volatile != UINT64_MAX) {
-                fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-                if (fsp == NULL) {
-                        tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                        return tevent_req_post(req, ev);
-                }
-                if (smbreq->conn != fsp->conn) {
-                        tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                        return tevent_req_post(req, ev);
-                }
-                if (smb2req->session->vuid != fsp->vuid) {
-                        tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                        return tevent_req_post(req, ev);
-                }
-                state->fsp = fsp;
-        }
 
         switch (in_ctl_code) {
@@ -379 +385 @@
                 return req;
 
-        case 0x00144064:        /* FSCTL_SRV_ENUMERATE_SNAPSHOTS */
-        {
-                /*
-                 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
-                 * and return their volume names.  If max_data_count is 16, then it is just
-                 * asking for the number of volumes and length of the combined names.
-                 *
-                 * pdata is the data allocated by our caller, but that uses
-                 * total_data_count (which is 0 in our case) rather than max_data_count.
-                 * Allocate the correct amount and return the pointer to let
-                 * it be deallocated when we return.
-                 */
-                struct shadow_copy_data *shadow_data = NULL;
-                bool labels = False;
-                uint32_t labels_data_count = 0;
-                uint32_t data_count;
-                uint32_t i;
-                char *pdata;
+        default: {
+                uint8_t *out_data = NULL;
+                uint32_t out_data_len = 0;
                 NTSTATUS status;
 
@@ -404 +395 @@
                 }
 
-                if (in_max_output < 16) {
-                        DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
-                                 "in_max_output(%u) < 16 is invalid!\n",
-                                 in_max_output));
-                        tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
-                        return tevent_req_post(req, ev);
-                }
-
-                if (in_max_output > 16) {
-                        labels = True;
-                }
-
-                shadow_data = TALLOC_ZERO_P(talloc_tos(),
-                                            struct shadow_copy_data);
-                if (tevent_req_nomem(shadow_data, req)) {
-                        DEBUG(0,("TALLOC_ZERO() failed!\n"));
-                        return tevent_req_post(req, ev);
-                }
-
-                /*
-                 * Call the VFS routine to actually do the work.
-                 */
-                if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp, shadow_data, labels)
-                    != 0) {
-                        if (errno == ENOSYS) {
-                                DEBUG(5, ("FSCTL_GET_SHADOW_COPY_DATA: "
-                                          "connectpath %s, not supported.\n",
-                                          smbreq->conn->connectpath));
-                                status = NT_STATUS_NOT_SUPPORTED;
+                status = smb_fsctl(fsp,
+                                       state,
+                                       in_ctl_code,
+                                       smbreq->flags2,
+                                       in_input.data,
+                                       in_input.length,
+                                       &out_data,
+                                       in_max_output,
+                                       &out_data_len);
+                state->out_output = data_blob_const(out_data, out_data_len);
+                if (NT_STATUS_IS_OK(status)) {
+                        tevent_req_done(req);
+                        return tevent_req_post(req, ev);
+                }
+
+                if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
+                        if (IS_IPC(smbreq->conn)) {
+                                status = NT_STATUS_FS_DRIVER_REQUIRED;
                         } else {
-                                DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
-                                         "connectpath %s, failed.\n",
-                                         smbreq->conn->connectpath));
-                                status = map_nt_error_from_unix(errno);
+                                status = NT_STATUS_INVALID_DEVICE_REQUEST;
                         }
-                        TALLOC_FREE(shadow_data);
-                        tevent_req_nterror(req, status);
-                        return tevent_req_post(req, ev);
-                }
-
-                labels_data_count =
-                        (shadow_data->num_volumes*2*sizeof(SHADOW_COPY_LABEL))
-                        + 2;
-
-                if (labels) {
-                        data_count = 12+labels_data_count+4;
-                } else {
-                        data_count = 16;
-                }
-
-                if (labels && (in_max_output < data_count)) {
-                        DEBUG(0, ("FSCTL_GET_SHADOW_COPY_DATA: "
-                                  "in_max_output(%u) too small (%u) bytes "
-                                  "needed!\n", in_max_output, data_count));
-                        TALLOC_FREE(shadow_data);
-                        tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
-                        return tevent_req_post(req, ev);
-                }
-
-                state->out_output = data_blob_talloc(state, NULL, data_count);
-                if (tevent_req_nomem(state->out_output.data, req)) {
-                        return tevent_req_post(req, ev);
-                }
-
-                pdata = (char *)state->out_output.data;
-
-                /* num_volumes 4 bytes */
-                SIVAL(pdata, 0, shadow_data->num_volumes);
-
-                if (labels) {
-                        /* num_labels 4 bytes */
-                        SIVAL(pdata, 4, shadow_data->num_volumes);
-                }
-
-                /* needed_data_count 4 bytes */
-                SIVAL(pdata, 8, labels_data_count+4);
-
-                pdata += 12;
-
-                DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for "
-                          "path[%s].\n",
-                          shadow_data->num_volumes, fsp_str_dbg(fsp)));
-                if (labels && shadow_data->labels) {
-                        for (i=0; i<shadow_data->num_volumes; i++) {
-                                srvstr_push(pdata, smbreq->flags2,
-                                            pdata, shadow_data->labels[i],
-                                            2*sizeof(SHADOW_COPY_LABEL),
-                                            STR_UNICODE|STR_TERMINATE);
-                                pdata += 2*sizeof(SHADOW_COPY_LABEL);
-                                DEBUGADD(10, ("Label[%u]: '%s'\n", i,
-                                              shadow_data->labels[i]));
-                        }
-                }
-
-                TALLOC_FREE(shadow_data);
-
-                tevent_req_done(req);
+                }
+
+                tevent_req_nterror(req, status);
                 return tevent_req_post(req, ev);
-        }
-
-        default:
-                if (IS_IPC(smbreq->conn)) {
-                        tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED);
-                        return tevent_req_post(req, ev);
-                }
-                tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
-                return tevent_req_post(req, ev);
+        }
         }
 

vendor/current/source3/smbd/smb2_keepalive.c

@@ -26 +26 @@
 NTSTATUS smbd_smb2_request_process_keepalive(struct smbd_smb2_request *req)
 {
-        const uint8_t *inbody;
-        int i = req->current_idx;
         DATA_BLOB outbody;
-        size_t expected_body_size = 0x04;
-        size_t body_size;
+        NTSTATUS status;
 
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
-        inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        status = smbd_smb2_request_verify_sizes(req, 0x04);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
 

vendor/current/source3/smbd/smb2_lock.c

@@ -47 +47 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *in_fsp,
                                                  uint32_t in_smbpid,
-                                                 uint64_t in_file_id_volatile,
                                                  uint16_t in_lock_count,
                                                  struct smbd_smb2_lock_element *in_locks);
@@ -59 +59 @@
         const uint8_t *inbody;
         const int i = req->current_idx;
-        size_t expected_body_size = 0x30;
-        size_t body_size;
         uint32_t in_smbpid;
         uint16_t in_lock_count;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         struct smbd_smb2_lock_element *in_locks;
         struct tevent_req *subreq;
         const uint8_t *lock_buffer;
         uint16_t l;
-
+        NTSTATUS status;
+
+        status = smbd_smb2_request_verify_sizes(req, 0x30);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_smbpid                       = IVAL(inhdr, SMB2_HDR_PID);
@@ -95 +90 @@
         if (((in_lock_count - 1) * 0x18) > req->in.vector[i+2].iov_len) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
-                return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
@@ -128 +117 @@
         }
 
-        subreq = smbd_smb2_lock_send(req,
-                                     req->sconn->smb2.event_ctx,
-                                     req,
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
+                return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
+        }
+
+        subreq = smbd_smb2_lock_send(req, req->sconn->smb2.event_ctx,
+                                     req, in_fsp,
                                      in_smbpid,
-                                     in_file_id_volatile,
                                      in_lock_count,
                                      in_locks);
@@ -214 +206 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *fsp,
                                                  uint32_t in_smbpid,
-                                                 uint64_t in_file_id_volatile,
                                                  uint16_t in_lock_count,
                                                  struct smbd_smb2_lock_element *in_locks)
@@ -222 +214 @@
         struct smbd_smb2_lock_state *state;
         struct smb_request *smb1req;
-        connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp;
         int32_t timeout = -1;
         bool isunlock = false;
@@ -245 +235 @@
         state->smb1req = smb1req;
 
-        DEBUG(10,("smbd_smb2_lock_send: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
-
-        fsp = file_fsp(smb1req, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
+        DEBUG(10,("smbd_smb2_lock_send: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         locks = talloc_array(state, struct smbd_lock_element, in_lock_count);
@@ -342 +318 @@
                 }
 
-                locks[i].smblctx = in_file_id_volatile;
+                locks[i].smblctx = fsp->fnum;
                 locks[i].offset = in_locks[i].offset;
                 locks[i].count  = in_locks[i].length;
@@ -873 +849 @@
                 files_struct *fsp_curr = NULL;
                 int i = smb2req->current_idx;
-                uint64_t in_file_id_volatile;
                 struct blocking_lock_record *blr = NULL;
                 const uint8_t *inhdr;
-                const uint8_t *inbody;
 
                 nextreq = smb2req->next;
@@ -894 +868 @@
                         continue;
                 }
-
-                inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
-                in_file_id_volatile = BVAL(inbody, 0x10);
 
                 state = tevent_req_data(smb2req->subreq,
@@ -905 +876 @@
                 }
 
-                fsp_curr = file_fsp(state->smb1req, (uint16_t)in_file_id_volatile);
+                fsp_curr = smb2req->compat_chain_fsp;
                 if (fsp_curr == NULL) {
                         /* Strange - is this even possible ? */

vendor/current/source3/smbd/smb2_negprot.c

@@ -62 +62 @@
 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
 {
+        NTSTATUS status;
         const uint8_t *inbody;
         const uint8_t *indyn = NULL;
@@ -70 +71 @@
         uint16_t security_offset;
         DATA_BLOB security_buffer;
-        size_t expected_body_size = 0x24;
-        size_t body_size;
         size_t expected_dyn_size = 0;
         size_t c;
@@ -78 +77 @@
         uint16_t dialect = 0;
         uint32_t capabilities;
+        uint32_t max_limit;
+        uint32_t max_trans = lp_smb2_max_trans();
+        uint32_t max_read = lp_smb2_max_read();
+        uint32_t max_write = lp_smb2_max_write();
 
-/* TODO: drop the connection with INVALID_PARAMETER */
-
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        status = smbd_smb2_request_verify_sizes(req, 0x24);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         dialect_count = SVAL(inbody, 0x02);
@@ -140 +136 @@
         }
 
+        /*
+         * Unless we implement SMB2_CAP_LARGE_MTU,
+         * 0x10000 (65536) is the maximum allowed message size
+         */
+        max_limit = 0x10000;
+
+        max_trans = MIN(max_limit, max_trans);
+        max_read  = MIN(max_limit, max_read);
+        max_write = MIN(max_limit, max_write);
+
         security_offset = SMB2_HDR_BODY + 0x40;
 
@@ -165 +171 @@
         SIVAL(outbody.data, 0x18,
               capabilities);                    /* capabilities */
-        SIVAL(outbody.data, 0x1C, lp_smb2_max_trans()); /* max transact size */
-        SIVAL(outbody.data, 0x20, lp_smb2_max_read());  /* max read size */
-        SIVAL(outbody.data, 0x24, lp_smb2_max_write()); /* max write size */
+        SIVAL(outbody.data, 0x1C, max_trans);   /* max transact size */
+        SIVAL(outbody.data, 0x20, max_trans);   /* max read size */
+        SIVAL(outbody.data, 0x24, max_trans);   /* max write size */
         SBVAL(outbody.data, 0x28, 0);           /* system time */
         SBVAL(outbody.data, 0x30, 0);           /* server start time */
@@ -179 +185 @@
 
         req->sconn->using_smb2 = true;
+        req->sconn->smb2.max_trans = max_trans;
+        req->sconn->smb2.max_read  = max_read;
+        req->sconn->smb2.max_write = max_write;
 
         return smbd_smb2_request_done(req, outbody, &outdyn);

vendor/current/source3/smbd/smb2_notify.c

@@ -37 +37 @@
                                                 struct tevent_context *ev,
                                                 struct smbd_smb2_request *smb2req,
+                                                struct files_struct *in_fsp,
                                                 uint16_t in_flags,
                                                 uint32_t in_output_buffer_length,
-                                                uint64_t in_file_id_volatile,
                                                 uint64_t in_completion_filter);
 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
@@ -48 +48 @@
 NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x20;
-        size_t body_size;
         uint16_t in_flags;
         uint32_t in_output_buffer_length;
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         uint64_t in_completion_filter;
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x20);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_flags                = SVAL(inbody, 0x02);
@@ -82 +75 @@
          * Windows 2008 uses 0x00080000
          */
-        if (in_output_buffer_length > lp_smb2_max_trans()) {
+        if (in_output_buffer_length > req->sconn->smb2.max_trans) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_notify_send(req,
-                                       req->sconn->smb2.event_ctx,
-                                       req,
+        subreq = smbd_smb2_notify_send(req, req->sconn->smb2.event_ctx,
+                                       req, in_fsp,
                                        in_flags,
                                        in_output_buffer_length,
-                                       in_file_id_volatile,
                                        in_completion_filter);
         if (subreq == NULL) {
@@ -194 +184 @@
                                                 struct tevent_context *ev,
                                                 struct smbd_smb2_request *smb2req,
+                                                struct files_struct *fsp,
                                                 uint16_t in_flags,
                                                 uint32_t in_output_buffer_length,
-                                                uint64_t in_file_id_volatile,
                                                 uint64_t in_completion_filter)
 {
@@ -203 +193 @@
         struct smb_request *smbreq;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp;
         bool recursive = (in_flags & 0x0001) ? true : false;
         NTSTATUS status;
@@ -217 +206 @@
         state->im = NULL;
 
-        DEBUG(10,("smbd_smb2_notify_send: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_notify_send: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
@@ -227 +216 @@
         state->smbreq = smbreq;
         smbreq->async_priv = (void *)req;
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
 
         {
@@ -383 +358 @@
                                                struct smbd_smb2_notify_state);
 
+        state->smb2req->cancelled = true;
         smbd_notify_cancel_by_smbreq(state->smbreq);
 
-        state->smb2req->cancelled = true;
-        tevent_req_done(req);
         return true;
 }

vendor/current/source3/smbd/smb2_read.c

@@ -31 +31 @@
                                               struct tevent_context *ev,
                                               struct smbd_smb2_request *smb2req,
+                                              struct files_struct *in_fsp,
                                               uint32_t in_smbpid,
-                                              uint64_t in_file_id_volatile,
                                               uint32_t in_length,
                                               uint64_t in_offset,
@@ -45 +45 @@
 NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 {
+        NTSTATUS status;
         const uint8_t *inhdr;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x31;
-        size_t body_size;
         uint32_t in_smbpid;
         uint32_t in_length;
@@ -55 +54 @@
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         uint32_t in_minimum_count;
         uint32_t in_remaining_bytes;
         struct tevent_req *subreq;
 
+        status = smbd_smb2_request_verify_sizes(req, 0x31);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
@@ -81 +76 @@
 
         /* check the max read size */
-        if (in_length > lp_smb2_max_read()) {
+        if (in_length > req->sconn->smb2.max_read) {
                 DEBUG(0,("here:%s: 0x%08X: 0x%08X\n",
-                        __location__, in_length, lp_smb2_max_read()));
+                        __location__, in_length, req->sconn->smb2.max_read));
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_read_send(req,
-                                     req->sconn->smb2.event_ctx,
-                                     req,
+        subreq = smbd_smb2_read_send(req, req->sconn->smb2.event_ctx,
+                                     req, in_fsp,
                                      in_smbpid,
-                                     in_file_id_volatile,
                                      in_length,
                                      in_offset,
@@ -177 +169 @@
         struct smbd_smb2_request *smb2req;
         files_struct *fsp;
-        uint64_t in_file_id_volatile;
         uint32_t in_length;
         uint64_t in_offset;
@@ -259 +250 @@
 
         init_strict_lock_struct(fsp,
-                                state->in_file_id_volatile,
+                                fsp->fnum,
                                 in_offset,
                                 in_length,
@@ -374 +365 @@
                                               struct tevent_context *ev,
                                               struct smbd_smb2_request *smb2req,
+                                              struct files_struct *fsp,
                                               uint32_t in_smbpid,
-                                              uint64_t in_file_id_volatile,
                                               uint32_t in_length,
                                               uint64_t in_offset,
@@ -386 +377 @@
         struct smb_request *smbreq = NULL;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp = NULL;
         ssize_t nread = -1;
         struct lock_struct lock;
@@ -403 +393 @@
         state->out_remaining = 0;
 
-        DEBUG(10,("smbd_smb2_read: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_read: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
@@ -411 +401 @@
         }
 
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
         if (fsp->is_directory) {
                 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
@@ -430 +407 @@
 
         state->fsp = fsp;
-        state->in_file_id_volatile = in_file_id_volatile;
 
         if (IS_IPC(smbreq->conn)) {
@@ -493 +469 @@
 
         init_strict_lock_struct(fsp,
-                                in_file_id_volatile,
+                                fsp->fnum,
                                 in_offset,
                                 in_length,
@@ -533 +509 @@
         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
 
-        DEBUG(10,("smbd_smb2_read: file %s handle [0x%016llX] offset=%llu "
+        DEBUG(10,("smbd_smb2_read: file %s fnum[%d] offset=%llu "
                 "len=%llu returned %lld\n",
                 fsp_str_dbg(fsp),
-                (unsigned long long)in_file_id_volatile,
+                fsp->fnum,
                 (unsigned long long)in_offset,
                 (unsigned long long)in_length,

vendor/current/source3/smbd/smb2_server.c

@@ -115 +115 @@
         sconn->smb2.sessions.list = NULL;
         sconn->smb2.seqnum_low = 0;
-        sconn->smb2.credits_granted = 0;
+        sconn->smb2.seqnum_range = 1;
+        sconn->smb2.credits_granted = 1;
         sconn->smb2.max_credits = lp_smb2_max_credits();
         sconn->smb2.credits_bitmap = bitmap_talloc(sconn,
-                        DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR*sconn->smb2.max_credits);
+                                                   sconn->smb2.max_credits);
         if (sconn->smb2.credits_bitmap == NULL) {
                 return NT_STATUS_NO_MEMORY;
@@ -207 +208 @@
         req->parent     = parent;
 
+        req->last_session_id = UINT64_MAX;
+        req->last_tid = UINT32_MAX;
+
         talloc_set_destructor(parent, smbd_smb2_request_parent_destructor);
         talloc_set_destructor(req, smbd_smb2_request_destructor);
@@ -296 +300 @@
 }
 
+static bool smb2_validate_sequence_number(struct smbd_server_connection *sconn,
+                                          uint64_t message_id, uint64_t seq_id)
+{
+        struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
+        unsigned int offset;
+
+        if (seq_id < sconn->smb2.seqnum_low) {
+                DEBUG(0,("smb2_validate_sequence_number: bad message_id "
+                        "%llu (sequence id %llu) "
+                        "(granted = %u, low = %llu, range = %u)\n",
+                        (unsigned long long)message_id,
+                        (unsigned long long)seq_id,
+                        (unsigned int)sconn->smb2.credits_granted,
+                        (unsigned long long)sconn->smb2.seqnum_low,
+                        (unsigned int)sconn->smb2.seqnum_range));
+                return false;
+        }
+
+        if (seq_id >= sconn->smb2.seqnum_low + sconn->smb2.seqnum_range) {
+                DEBUG(0,("smb2_validate_sequence_number: bad message_id "
+                        "%llu (sequence id %llu) "
+                        "(granted = %u, low = %llu, range = %u)\n",
+                        (unsigned long long)message_id,
+                        (unsigned long long)seq_id,
+                        (unsigned int)sconn->smb2.credits_granted,
+                        (unsigned long long)sconn->smb2.seqnum_low,
+                        (unsigned int)sconn->smb2.seqnum_range));
+                return false;
+        }
+
+        offset = seq_id % sconn->smb2.max_credits;
+
+        if (bitmap_query(credits_bm, offset)) {
+                DEBUG(0,("smb2_validate_sequence_number: duplicate message_id "
+                        "%llu (sequence id %llu) "
+                        "(granted = %u, low = %llu, range = %u) "
+                        "(bm offset %u)\n",
+                        (unsigned long long)message_id,
+                        (unsigned long long)seq_id,
+                        (unsigned int)sconn->smb2.credits_granted,
+                        (unsigned long long)sconn->smb2.seqnum_low,
+                        (unsigned int)sconn->smb2.seqnum_range,
+                        offset));
+                return false;
+        }
+
+        /* Mark the message_ids as seen in the bitmap. */
+        bitmap_set(credits_bm, offset);
+
+        if (seq_id != sconn->smb2.seqnum_low) {
+                return true;
+        }
+
+        /*
+         * Move the window forward by all the message_id's
+         * already seen.
+         */
+        while (bitmap_query(credits_bm, offset)) {
+                DEBUG(10,("smb2_validate_sequence_number: clearing "
+                          "id %llu (position %u) from bitmap\n",
+                          (unsigned long long)(sconn->smb2.seqnum_low),
+                          offset));
+                bitmap_clear(credits_bm, offset);
+
+                sconn->smb2.seqnum_low += 1;
+                sconn->smb2.seqnum_range -= 1;
+                offset = sconn->smb2.seqnum_low % sconn->smb2.max_credits;
+        }
+
+        return true;
+}
+
 static bool smb2_validate_message_id(struct smbd_server_connection *sconn,
                                 const uint8_t *inhdr)
 {
         uint64_t message_id = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
-        struct bitmap *credits_bm = sconn->smb2.credits_bitmap;
         uint16_t opcode = IVAL(inhdr, SMB2_HDR_OPCODE);
-        unsigned int bitmap_offset;
+        bool ok;
 
         if (opcode == SMB2_OP_CANCEL) {
@@ -309 +384 @@
         }
 
-        if (message_id < sconn->smb2.seqnum_low ||
-                        message_id > (sconn->smb2.seqnum_low +
-                        (sconn->smb2.max_credits * DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR))) {
-                DEBUG(0,("smb2_validate_message_id: bad message_id "
-                        "%llu (low = %llu, max = %lu)\n",
-                        (unsigned long long)message_id,
-                        (unsigned long long)sconn->smb2.seqnum_low,
-                        (unsigned long)sconn->smb2.max_credits ));
+        DEBUG(11, ("smb2_validate_message_id: mid %llu, credits_granted %llu, "
+                   "seqnum low/range: %llu/%llu\n",
+                   (unsigned long long) message_id,
+                   (unsigned long long) sconn->smb2.credits_granted,
+                   (unsigned long long) sconn->smb2.seqnum_low,
+                   (unsigned long long) sconn->smb2.seqnum_range));
+
+        if (sconn->smb2.credits_granted < 1) {
+                DEBUG(0, ("smb2_validate_message_id: client used more "
+                          "credits than granted, mid %llu, credits_granted %llu, "
+                          "seqnum low/range: %llu/%llu\n",
+                          (unsigned long long) message_id,
+                          (unsigned long long) sconn->smb2.credits_granted,
+                          (unsigned long long) sconn->smb2.seqnum_low,
+                          (unsigned long long) sconn->smb2.seqnum_range));
                 return false;
         }
 
-        /* client just used a credit. */
-        SMB_ASSERT(sconn->smb2.credits_granted > 0);
+        ok = smb2_validate_sequence_number(sconn, message_id, message_id);
+        if (!ok) {
+                return false;
+        }
+
+        /* substract used credits */
         sconn->smb2.credits_granted -= 1;
-
-        /* Mark the message_id as seen in the bitmap. */
-        bitmap_offset = (unsigned int)(message_id %
-                        (uint64_t)(sconn->smb2.max_credits * DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR));
-        if (bitmap_query(credits_bm, bitmap_offset)) {
-                DEBUG(0,("smb2_validate_message_id: duplicate message_id "
-                        "%llu (bm offset %u)\n",
-                        (unsigned long long)message_id,
-                        bitmap_offset));
-                return false;
-        }
-        bitmap_set(credits_bm, bitmap_offset);
-
-        if (message_id == sconn->smb2.seqnum_low + 1) {
-                /* Move the window forward by all the message_id's
-                   already seen. */
-                while (bitmap_query(credits_bm, bitmap_offset)) {
-                        DEBUG(10,("smb2_validate_message_id: clearing "
-                                "id %llu (position %u) from bitmap\n",
-                                (unsigned long long)(sconn->smb2.seqnum_low + 1),
-                                bitmap_offset ));
-                        bitmap_clear(credits_bm, bitmap_offset);
-                        sconn->smb2.seqnum_low += 1;
-                        bitmap_offset = (bitmap_offset + 1) %
-                                (sconn->smb2.max_credits * DEFAULT_SMB2_MAX_CREDIT_BITMAP_FACTOR);
-                }
-        }
 
         return true;
@@ -358 +417 @@
         int count;
         int idx;
-        bool compound_related = false;
 
         count = req->in.vector_count;
@@ -369 +427 @@
         for (idx=1; idx < count; idx += 3) {
                 const uint8_t *inhdr = NULL;
-                uint32_t flags;
 
                 if (req->in.vector[idx].iov_len != SMB2_HDR_BODY) {
@@ -388 +445 @@
                 if (!smb2_validate_message_id(req->sconn, inhdr)) {
                         return NT_STATUS_INVALID_PARAMETER;
-                }
-
-                flags = IVAL(inhdr, SMB2_HDR_FLAGS);
-                if (idx == 1) {
-                        /*
-                         * the 1st request should never have the
-                         * SMB2_HDR_FLAG_CHAINED flag set
-                         */
-                        if (flags & SMB2_HDR_FLAG_CHAINED) {
-                                req->next_status = NT_STATUS_INVALID_PARAMETER;
-                                return NT_STATUS_OK;
-                        }
-                } else if (idx == 4) {
-                        /*
-                         * the 2nd request triggers related vs. unrelated
-                         * compounded requests
-                         */
-                        if (flags & SMB2_HDR_FLAG_CHAINED) {
-                                compound_related = true;
-                        }
-                } else if (idx > 4) {
-#if 0
-                        /*
-                         * It seems the this tests are wrong
-                         * see the SMB2-COMPOUND test
-                         */
-
-                        /*
-                         * all other requests should match the 2nd one
-                         */
-                        if (flags & SMB2_HDR_FLAG_CHAINED) {
-                                if (!compound_related) {
-                                        req->next_status =
-                                                NT_STATUS_INVALID_PARAMETER;
-                                        return NT_STATUS_OK;
-                                }
-                        } else {
-                                if (compound_related) {
-                                        req->next_status =
-                                                NT_STATUS_INVALID_PARAMETER;
-                                        return NT_STATUS_OK;
-                                }
-                        }
-#endif
                 }
         }
@@ -446 +459 @@
         uint16_t credits_requested;
         uint32_t out_flags;
+        uint16_t cmd;
+        NTSTATUS out_status;
         uint16_t credits_granted = 0;
-
+        uint64_t credits_possible;
+        uint16_t current_max_credits;
+
+        /*
+         * first we grant only 1/16th of the max range.
+         *
+         * Windows also starts with the 1/16th and then grants
+         * more later. I was only able to trigger higher
+         * values, when using a verify high credit charge.
+         *
+         * TODO: scale up depending one load, free memory
+         *       or other stuff.
+         *       Maybe also on the relationship between number
+         *       of requests and the used sequence number.
+         *       Which means we would grant more credits
+         *       for client which use multi credit requests.
+         */
+        current_max_credits = sconn->smb2.max_credits / 16;
+        current_max_credits = MAX(current_max_credits, 1);
+
+        cmd = SVAL(inhdr, SMB2_HDR_OPCODE);
         credits_requested = SVAL(inhdr, SMB2_HDR_CREDIT);
         out_flags = IVAL(outhdr, SMB2_HDR_FLAGS);
+        out_status = NT_STATUS(IVAL(outhdr, SMB2_HDR_STATUS));
 
         SMB_ASSERT(sconn->smb2.max_credits >= sconn->smb2.credits_granted);
@@ -459 +495 @@
                  * credits on the final response.
                  */
-                credits_requested = 0;
-        }
-
-        if (credits_requested) {
-                uint16_t modified_credits_requested;
-                uint32_t multiplier;
-
-                /*
-                 * Split up max_credits into 1/16ths, and then scale
-                 * the requested credits by how many 16ths have been
-                 * currently granted. Less than 1/16th == grant all
-                 * requested (100%), scale down as more have been
-                 * granted. Never ask for less than 1 as the client
-                 * asked for at least 1. JRA.
-                 */
-
-                multiplier = 16 - (((sconn->smb2.credits_granted * 16) / sconn->smb2.max_credits) % 16);
-
-                modified_credits_requested = (multiplier * credits_requested) / 16;
-                if (modified_credits_requested == 0) {
-                        modified_credits_requested = 1;
-                }
-
-                /* Remember what we gave out. */
-                credits_granted = MIN(modified_credits_requested,
-                                        (sconn->smb2.max_credits - sconn->smb2.credits_granted));
-        }
-
-        if (credits_granted == 0 && sconn->smb2.credits_granted == 0) {
-                /* First negprot packet, or ensure the client credits can
-                   never drop to zero. */
+                credits_granted = 0;
+        } else if (credits_requested > 0) {
+                uint16_t additional_max = 0;
+                uint16_t additional_credits = credits_requested - 1;
+
+                switch (cmd) {
+                case SMB2_OP_NEGPROT:
+                        break;
+                case SMB2_OP_SESSSETUP:
+                        /*
+                         * Windows 2012 RC1 starts to grant
+                         * additional credits
+                         * with a successful session setup
+                         */
+                        if (NT_STATUS_IS_OK(out_status)) {
+                                additional_max = 32;
+                        }
+                        break;
+                default:
+                        /*
+                         * We match windows and only grant additional credits
+                         * in chunks of 32.
+                         */
+                        additional_max = 32;
+                        break;
+                }
+
+                additional_credits = MIN(additional_credits, additional_max);
+
+                credits_granted = 1 + additional_credits;
+        } else if (sconn->smb2.credits_granted == 0) {
+                /*
+                 * Make sure the client has always at least one credit
+                 */
                 credits_granted = 1;
         }
+
+        /*
+         * sequence numbers should not wrap
+         *
+         * 1. calculate the possible credits until
+         *    the sequence numbers start to wrap on 64-bit.
+         *
+         * 2. UINT64_MAX is used for Break Notifications.
+         *
+         * 2. truncate the possible credits to the maximum
+         *    credits we want to grant to the client in total.
+         *
+         * 3. remove the range we'll already granted to the client
+         *    this makes sure the client consumes the lowest sequence
+         *    number, before we can grant additional credits.
+         */
+        credits_possible = UINT64_MAX - sconn->smb2.seqnum_low;
+        if (credits_possible > 0) {
+                /* remove UINT64_MAX */
+                credits_possible -= 1;
+        }
+        credits_possible = MIN(credits_possible, current_max_credits);
+        credits_possible -= sconn->smb2.seqnum_range;
+
+        credits_granted = MIN(credits_granted, credits_possible);
 
         SSVAL(outhdr, SMB2_HDR_CREDIT, credits_granted);
         sconn->smb2.credits_granted += credits_granted;
+        sconn->smb2.seqnum_range += credits_granted;
 
         DEBUG(10,("smb2_set_operation_credit: requested %u, "
-                "granted %u, total granted %u\n",
+                "granted %u, current possible/max %u/%u, "
+                "total granted/max/low/range %u/%u/%llu/%u\n",
                 (unsigned int)credits_requested,
                 (unsigned int)credits_granted,
-                (unsigned int)sconn->smb2.credits_granted ));
+                (unsigned int)credits_possible,
+                (unsigned int)current_max_credits,
+                (unsigned int)sconn->smb2.credits_granted,
+                (unsigned int)sconn->smb2.max_credits,
+                (unsigned long long)sconn->smb2.seqnum_low,
+                (unsigned int)sconn->smb2.seqnum_range));
 }
 
@@ -507 +578 @@
 {
         int count, idx;
+        uint16_t total_credits = 0;
 
         count = outreq->out.vector_count;
 
         for (idx=1; idx < count; idx += 3) {
+                uint8_t *outhdr = (uint8_t *)outreq->out.vector[idx].iov_base;
                 smb2_set_operation_credit(outreq->sconn,
                         &inreq->in.vector[idx],
                         &outreq->out.vector[idx]);
+                /* To match Windows, count up what we
+                   just granted. */
+                total_credits += SVAL(outhdr, SMB2_HDR_CREDIT);
+                /* Set to zero in all but the last reply. */
+                if (idx + 3 < count) {
+                        SSVAL(outhdr, SMB2_HDR_CREDIT, 0);
+                } else {
+                        SSVAL(outhdr, SMB2_HDR_CREDIT, total_credits);
+                }
         }
 }
@@ -570 +652 @@
                 SIVAL(outhdr, SMB2_HDR_PROTOCOL_ID,     SMB2_MAGIC);
                 SSVAL(outhdr, SMB2_HDR_LENGTH,          SMB2_HDR_BODY);
-                SSVAL(outhdr, SMB2_HDR_EPOCH,           0);
+                SSVAL(outhdr, SMB2_HDR_CREDIT_CHARGE,
+                      SVAL(inhdr, SMB2_HDR_CREDIT_CHARGE));
                 SIVAL(outhdr, SMB2_HDR_STATUS,
                       NT_STATUS_V(NT_STATUS_INTERNAL_ERROR));
@@ -586 +669 @@
                 SBVAL(outhdr, SMB2_HDR_SESSION_ID,
                       BVAL(inhdr, SMB2_HDR_SESSION_ID));
-                memset(outhdr + SMB2_HDR_SIGNATURE, 0, 16);
+                memcpy(outhdr + SMB2_HDR_SIGNATURE,
+                       inhdr + SMB2_HDR_SIGNATURE, 16);
 
                 /* setup error body header */
@@ -864 +948 @@
                  * Cancel the outstanding request.
                  */
-                tevent_req_cancel(req->subreq);
+                bool ok = tevent_req_cancel(req->subreq);
+                if (ok) {
+                        return NT_STATUS_OK;
+                }
+                TALLOC_FREE(req->subreq);
                 return smbd_smb2_request_error(req,
-                        NT_STATUS_INSUFFICIENT_RESOURCES);
+                        NT_STATUS_INTERNAL_ERROR);
         }
 
@@ -885 +973 @@
                         return status;
                 }
+
+                /*
+                 * We're splitting off the last SMB2
+                 * request in a compound set, and the
+                 * smb2_send_async_interim_response()
+                 * call above just sent all the replies
+                 * for the previous SMB2 requests in
+                 * this compound set. So we're no longer
+                 * in the "compound_related_in_progress"
+                 * state, and this is no longer a compound
+                 * request.
+                 */
+                req->compound_related = false;
+                req->sconn->smb2.compound_related_in_progress = false;
         }
 
         /* Don't return an intermediate packet on a pipe read/write. */
         if (req->tcon && req->tcon->compat_conn && IS_IPC(req->tcon->compat_conn)) {
-                return NT_STATUS_OK;
+                goto ipc_out;
         }
 
@@ -929 +1031 @@
         SSVAL(hdr, SMB2_HDR_OPCODE, SVAL(reqhdr, SMB2_HDR_OPCODE));
 
-        SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
+        SIVAL(hdr, SMB2_HDR_FLAGS, flags);
         SIVAL(hdr, SMB2_HDR_NEXT_COMMAND, 0);
         SBVAL(hdr, SMB2_HDR_MESSAGE_ID, message_id);
@@ -952 +1054 @@
                         &state->vector[1]);
 
+        SIVAL(hdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
+
         if (req->do_signing) {
                 status = smb2_signing_sign_pdu(req->session->session_key,
@@ -977 +1081 @@
         /* Note we're going async with this request. */
         req->async = true;
+
+  ipc_out:
 
         /*
@@ -1025 +1131 @@
                 req->out.vector_count);
 
-        /* Ensure our final reply matches the interim one. */
-        reqhdr = (uint8_t *)req->out.vector[1].iov_base;
-        SIVAL(reqhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
-        SBVAL(reqhdr, SMB2_HDR_PID, async_id);
-
-        {
-                const uint8_t *inhdr =
-                        (const uint8_t *)req->in.vector[1].iov_base;
-                DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
-                        "going async\n",
-                        smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
-                        (unsigned long long)async_id ));
-        }
+        if (req->async) {
+                /* Ensure our final reply matches the interim one. */
+                reqhdr = (uint8_t *)req->out.vector[1].iov_base;
+                SIVAL(reqhdr, SMB2_HDR_FLAGS, flags | SMB2_HDR_FLAG_ASYNC);
+                SBVAL(reqhdr, SMB2_HDR_PID, async_id);
+
+                {
+                        const uint8_t *inhdr =
+                                (const uint8_t *)req->in.vector[1].iov_base;
+                        DEBUG(10,("smbd_smb2_request_pending_queue: opcode[%s] mid %llu "
+                                "going async\n",
+                                smb2_opcode_name((uint16_t)IVAL(inhdr, SMB2_HDR_OPCODE)),
+                                (unsigned long long)async_id ));
+                }
+        }
+
         return NT_STATUS_OK;
 }
@@ -1102 +1211 @@
 }
 
+NTSTATUS smbd_smb2_request_verify_sizes(struct smbd_smb2_request *req,
+                                        size_t expected_body_size)
+{
+        const uint8_t *inhdr;
+        uint16_t opcode;
+        const uint8_t *inbody;
+        int i = req->current_idx;
+        size_t body_size;
+        size_t min_dyn_size = expected_body_size & 0x00000001;
+
+        /*
+         * The following should be checked already.
+         */
+        if ((i+2) > req->in.vector_count) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (req->in.vector[i+0].iov_len != SMB2_HDR_BODY) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (req->in.vector[i+1].iov_len < 2) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
+        opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
+
+        switch (opcode) {
+        case SMB2_OP_IOCTL:
+        case SMB2_OP_GETINFO:
+                min_dyn_size = 0;
+                break;
+        }
+
+        /*
+         * Now check the expected body size,
+         * where the last byte might be in the
+         * dynnamic section..
+         */
+        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (req->in.vector[i+2].iov_len < min_dyn_size) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
+
+        body_size = SVAL(inbody, 0x00);
+        if (body_size != expected_body_size) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        return NT_STATUS_OK;
+}
+
 NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req)
 {
@@ -1125 +1289 @@
                 (unsigned long long)mid));
 
+        if (get_Protocol() >= PROTOCOL_SMB2) {
+                /*
+                 * once the protocol is negotiated
+                 * SMB2_OP_NEGPROT is not allowed anymore
+                 */
+                if (opcode == SMB2_OP_NEGPROT) {
+                        /* drop the connection */
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        } else {
+                /*
+                 * if the protocol is not negotiated yet
+                 * only SMB2_OP_NEGPROT is allowed.
+                 */
+                if (opcode != SMB2_OP_NEGPROT) {
+                        /* drop the connection */
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+
         allowed_flags = SMB2_HDR_FLAG_CHAINED |
                         SMB2_HDR_FLAG_SIGNED |
@@ -1145 +1329 @@
         session_status = smbd_smb2_request_check_session(req);
 
+        if (flags & SMB2_HDR_FLAG_CHAINED) {
+                /*
+                 * This check is mostly for giving the correct error code
+                 * for compounded requests.
+                 */
+                if (!NT_STATUS_IS_OK(session_status)) {
+                        return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+                }
+        } else {
+                req->compat_chain_fsp = NULL;
+        }
+
         req->do_signing = false;
         if (flags & SMB2_HDR_FLAG_SIGNED) {
@@ -1157 +1353 @@
                         return smbd_smb2_request_error(req, status);
                 }
+        } else if (opcode == SMB2_OP_CANCEL) {
+                /* Cancel requests are allowed to skip the signing */
         } else if (req->session && req->session->do_signing) {
                 return smbd_smb2_request_error(req, NT_STATUS_ACCESS_DENIED);
@@ -1162 +1360 @@
 
         if (flags & SMB2_HDR_FLAG_CHAINED) {
-                /*
-                 * This check is mostly for giving the correct error code
-                 * for compounded requests.
-                 *
-                 * TODO: we may need to move this after the session
-                 *       and tcon checks.
-                 */
-                if (!NT_STATUS_IS_OK(req->next_status)) {
-                        return smbd_smb2_request_error(req, req->next_status);
-                }
-        } else {
-                req->compat_chain_fsp = NULL;
+                req->compound_related = true;
+                req->sconn->smb2.compound_related_in_progress = true;
         }
 
@@ -1622 +1810 @@
         }
 
+        if (req->compound_related) {
+                req->compound_related = false;
+                req->sconn->smb2.compound_related_in_progress = false;
+        }
+
         smb2_setup_nbt_length(req->out.vector, req->out.vector_count);
 
-        /* Set credit for this operation (zero credits if this
+        /* Set credit for these operations (zero credits if this
            is a final reply for an async operation). */
-        smb2_set_operation_credit(req->sconn,
-                        &req->in.vector[i],
-                        &req->out.vector[i]);
+        smb2_calculate_credits(req, req);
 
         if (req->do_signing) {
@@ -1672 +1863 @@
 }
 
+static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn);
+
 void smbd_smb2_request_dispatch_immediate(struct tevent_context *ctx,
                                         struct tevent_immediate *im,
@@ -1690 +1883 @@
 
         status = smbd_smb2_request_dispatch(req);
+        if (!NT_STATUS_IS_OK(status)) {
+                smbd_server_connection_terminate(sconn, nt_errstr(status));
+                return;
+        }
+
+        status = smbd_smb2_request_next_incoming(sconn);
         if (!NT_STATUS_IS_OK(status)) {
                 smbd_server_connection_terminate(sconn, nt_errstr(status));
@@ -1703 +1902 @@
         int ret;
         int sys_errno;
+        NTSTATUS status;
 
         ret = tstream_writev_queue_recv(subreq, &sys_errno);
@@ -1708 +1908 @@
         TALLOC_FREE(req);
         if (ret == -1) {
-                NTSTATUS status = map_nt_error_from_unix(sys_errno);
+                status = map_nt_error_from_unix(sys_errno);
                 DEBUG(2,("smbd_smb2_request_writev_done: client write error %s\n",
                         nt_errstr(status)));
+                smbd_server_connection_terminate(sconn, nt_errstr(status));
+                return;
+        }
+
+        status = smbd_smb2_request_next_incoming(sconn);
+        if (!NT_STATUS_IS_OK(status)) {
                 smbd_server_connection_terminate(sconn, nt_errstr(status));
                 return;
@@ -1853 +2059 @@
 
         /*
-         * if a request fails, all other remaining
-         * compounded requests should fail too
+         * Note: Even if there is an error, continue to process the request.
+         * per MS-SMB2.
          */
-        req->next_status = NT_STATUS_INVALID_PARAMETER;
 
         return smbd_smb2_request_done_ex(req, status, body, info, __location__);
@@ -2318 +2523 @@
 static void smbd_smb2_request_incoming(struct tevent_req *subreq);
 
+static NTSTATUS smbd_smb2_request_next_incoming(struct smbd_server_connection *sconn)
+{
+        size_t max_send_queue_len;
+        size_t cur_send_queue_len;
+        struct tevent_req *subreq;
+
+        if (sconn->smb2.compound_related_in_progress) {
+                /*
+                 * Can't read another until the related
+                 * compound is done.
+                 */
+                return NT_STATUS_OK;
+        }
+
+        if (tevent_queue_length(sconn->smb2.recv_queue) > 0) {
+                /*
+                 * if there is already a smbd_smb2_request_read
+                 * pending, we are done.
+                 */
+                return NT_STATUS_OK;
+        }
+
+        max_send_queue_len = MAX(1, sconn->smb2.max_credits/16);
+        cur_send_queue_len = tevent_queue_length(sconn->smb2.send_queue);
+
+        if (cur_send_queue_len > max_send_queue_len) {
+                /*
+                 * if we have a lot of requests to send,
+                 * we wait until they are on the wire until we
+                 * ask for the next request.
+                 */
+                return NT_STATUS_OK;
+        }
+
+        /* ask for the next request */
+        subreq = smbd_smb2_request_read_send(sconn, sconn->smb2.event_ctx, sconn);
+        if (subreq == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
+
+        return NT_STATUS_OK;
+}
+
 void smbd_smb2_first_negprot(struct smbd_server_connection *sconn,
                              const uint8_t *inbuf, size_t size)
@@ -2323 +2572 @@
         NTSTATUS status;
         struct smbd_smb2_request *req = NULL;
-        struct tevent_req *subreq;
 
         DEBUG(10,("smbd_smb2_first_negprot: packet length %u\n",
@@ -2340 +2588 @@
         }
 
+        status = smbd_smb2_request_validate(req);
+        if (!NT_STATUS_IS_OK(status)) {
+                smbd_server_connection_terminate(sconn, nt_errstr(status));
+                return;
+        }
+
         status = smbd_smb2_request_setup_out(req);
         if (!NT_STATUS_IS_OK(status)) {
@@ -2352 +2606 @@
         }
 
-        /* ask for the next request */
-        subreq = smbd_smb2_request_read_send(sconn, sconn->smb2.event_ctx, sconn);
-        if (subreq == NULL) {
-                smbd_server_connection_terminate(sconn, "no memory for reading");
+        status = smbd_smb2_request_next_incoming(sconn);
+        if (!NT_STATUS_IS_OK(status)) {
+                smbd_server_connection_terminate(sconn, nt_errstr(status));
                 return;
         }
-        tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
 
         sconn->num_requests++;
@@ -2410 +2662 @@
 
 next:
-        /* ask for the next request (this constructs the main loop) */
-        subreq = smbd_smb2_request_read_send(sconn, sconn->smb2.event_ctx, sconn);
-        if (subreq == NULL) {
-                smbd_server_connection_terminate(sconn, "no memory for reading");
+        status = smbd_smb2_request_next_incoming(sconn);
+        if (!NT_STATUS_IS_OK(status)) {
+                smbd_server_connection_terminate(sconn, nt_errstr(status));
                 return;
         }
-        tevent_req_set_callback(subreq, smbd_smb2_request_incoming, sconn);
 
         sconn->num_requests++;

vendor/current/source3/smbd/smb2_sesssetup.c

@@ -48 +48 @@
         DATA_BLOB outbody;
         DATA_BLOB outdyn;
-        size_t expected_body_size = 0x19;
-        size_t body_size;
         uint64_t in_session_id;
         uint8_t in_security_mode;
@@ -58 +56 @@
         uint64_t out_session_id;
         uint16_t out_security_offset;
-        DATA_BLOB out_security_buffer;
+        DATA_BLOB out_security_buffer = data_blob_null;
         NTSTATUS status;
 
+        status = smbd_smb2_request_verify_sizes(smb2req, 0x19);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(smb2req, status);
+        }
         inhdr = (const uint8_t *)smb2req->in.vector[i+0].iov_base;
-
-        if (smb2req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-        }
-
         inbody = (const uint8_t *)smb2req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_security_offset = SVAL(inbody, 0x0C);
         in_security_length = SVAL(inbody, 0x0E);
 
-        if (in_security_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+        if (in_security_offset != (SMB2_HDR_BODY + smb2req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(smb2req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -196 +188 @@
         bool username_was_mapped = false;
         bool map_domainuser_to_guest = false;
+        bool guest = false;
 
         if (!spnego_parse_krb5_wrap(talloc_tos(), *secblob, &ticket, tok_id)) {
@@ -272 +265 @@
                 /* force no signing */
                 session->do_signing = false;
+                guest = true;
         }
 
@@ -324 +318 @@
          */
         smb2req->session = session;
-        if (session->do_signing) {
+        if (!guest) {
                 smb2req->do_signing = true;
         }
@@ -478 +472 @@
 {
         fstring tmp;
+        bool guest = false;
 
         if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
@@ -490 +485 @@
                 /* force no signing */
                 session->do_signing = false;
+                guest = true;
         }
 
@@ -537 +533 @@
          */
         smb2req->session = session;
-        if (session->do_signing) {
+        if (!guest) {
                 smb2req->do_signing = true;
         }
@@ -565 +561 @@
         }
 
-        if (auth.data[0] == ASN1_APPLICATION(0)) {
+        if (auth.length > 0 && auth.data[0] == ASN1_APPLICATION(0)) {
                 /* Might be a second negTokenTarg packet */
                 DATA_BLOB secblob_in = data_blob_null;
@@ -679 +675 @@
         NTSTATUS status;
         DATA_BLOB secblob_out = data_blob_null;
+
+        *out_security_buffer = data_blob_null;
 
         if (session->auth_ntlmssp_state == NULL) {
@@ -820 +818 @@
 {
         const uint8_t *inhdr;
-        const uint8_t *outhdr;
         int i = req->current_idx;
+        uint32_t in_flags;
         uint64_t in_session_id;
         void *p;
         struct smbd_smb2_session *session;
-        bool chained_fixup = false;
+
+        req->session = NULL;
+        req->tcon = NULL;
 
         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
 
+        in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
         in_session_id = BVAL(inhdr, SMB2_HDR_SESSION_ID);
 
-        if (in_session_id == (0xFFFFFFFFFFFFFFFFLL)) {
-                if (req->async) {
-                        /*
-                         * async request - fill in session_id from
-                         * already setup request out.vector[].iov_base.
-                         */
-                        outhdr = (const uint8_t *)req->out.vector[i].iov_base;
-                        in_session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
-                } else if (i > 2) {
-                        /*
-                         * Chained request - fill in session_id from
-                         * the previous request out.vector[].iov_base.
-                         */
-                        outhdr = (const uint8_t *)req->out.vector[i-3].iov_base;
-                        in_session_id = BVAL(outhdr, SMB2_HDR_SESSION_ID);
-                        chained_fixup = true;
-                }
-        }
+        if (in_flags & SMB2_HDR_FLAG_CHAINED) {
+                in_session_id = req->last_session_id;
+        }
+
+        req->last_session_id = UINT64_MAX;
 
         /* lookup an existing session */
@@ -866 +854 @@
 
         req->session = session;
-
-        if (chained_fixup) {
-                /* Fix up our own outhdr. */
-                outhdr = (const uint8_t *)req->out.vector[i].iov_base;
-                SBVAL(outhdr, SMB2_HDR_SESSION_ID, in_session_id);
-        }
+        req->last_session_id = in_session_id;
+
         return NT_STATUS_OK;
 }
@@ -877 +861 @@
 NTSTATUS smbd_smb2_request_process_logoff(struct smbd_smb2_request *req)
 {
-        const uint8_t *inbody;
-        int i = req->current_idx;
+        NTSTATUS status;
         DATA_BLOB outbody;
-        size_t expected_body_size = 0x04;
-        size_t body_size;
-
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
-        inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+
+        status = smbd_smb2_request_verify_sizes(req, 0x04);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
 

vendor/current/source3/smbd/smb2_setinfo.c

@@ -30 +30 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *in_fsp,
                                                  uint8_t in_info_type,
                                                  uint8_t in_file_info_class,
                                                  DATA_BLOB in_input_buffer,
-                                                 uint32_t in_additional_information,
-                                                 uint64_t in_file_id_volatile);
+                                                 uint32_t in_additional_information);
 static NTSTATUS smbd_smb2_setinfo_recv(struct tevent_req *req);
 
@@ -40 +40 @@
 NTSTATUS smbd_smb2_request_process_setinfo(struct smbd_smb2_request *req)
 {
-        const uint8_t *inhdr;
+        NTSTATUS status;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x21;
-        size_t body_size;
         uint8_t in_info_type;
         uint8_t in_file_info_class;
@@ -53 +51 @@
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         struct tevent_req *subreq;
 
-        inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x21);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_info_type                    = CVAL(inbody, 0x02);
@@ -79 +72 @@
                 /* This is ok */
         } else if (in_input_buffer_offset !=
-                   (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+                   (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -90 +83 @@
         in_input_buffer.length = in_input_buffer_length;
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        if (in_input_buffer.length > req->sconn->smb2.max_trans) {
+                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+        }
+
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_setinfo_send(req,
-                                        req->sconn->smb2.event_ctx,
-                                        req,
+        subreq = smbd_smb2_setinfo_send(req, req->sconn->smb2.event_ctx,
+                                        req, in_fsp,
                                         in_info_type,
                                         in_file_info_class,
                                         in_input_buffer,
-                                        in_additional_information,
-                                        in_file_id_volatile);
+                                        in_additional_information);
         if (subreq == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -160 +154 @@
                                                  struct tevent_context *ev,
                                                  struct smbd_smb2_request *smb2req,
+                                                 struct files_struct *fsp,
                                                  uint8_t in_info_type,
                                                  uint8_t in_file_info_class,
                                                  DATA_BLOB in_input_buffer,
-                                                 uint32_t in_additional_information,
-                                                 uint64_t in_file_id_volatile)
+                                                 uint32_t in_additional_information)
 {
         struct tevent_req *req = NULL;
@@ -170 +164 @@
         struct smb_request *smbreq = NULL;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp = NULL;
         NTSTATUS status;
 
@@ -180 +173 @@
         state->smb2req = smb2req;
 
-        DEBUG(10,("smbd_smb2_setinfo_send: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_setinfo_send: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
         if (tevent_req_nomem(smbreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
                 return tevent_req_post(req, ev);
         }
@@ -220 +199 @@
                         /* SMB2_FILE_RENAME_INFORMATION_INTERNAL == 0xFF00 + in_file_info_class */
                         file_info_level = SMB2_FILE_RENAME_INFORMATION_INTERNAL;
-                        if (fsp->oplock_type != FAKE_LEVEL_II_OPLOCK &&
-                            fsp->oplock_type != NO_OPLOCK) {
-                                /* No break, but error. */
-                                tevent_req_nterror(req, NT_STATUS_SHARING_VIOLATION);
-                                return tevent_req_post(req, ev);
-                        }
                 }
 
@@ -326 +299 @@
                 }
 
-                status = set_sd(fsp,
+                status = set_sd_blob(fsp,
                                 in_input_buffer.data,
                                 in_input_buffer.length,

vendor/current/source3/smbd/smb2_tcon.c

@@ -40 +40 @@
         uint8_t *outhdr;
         DATA_BLOB outbody;
-        size_t expected_body_size = 0x09;
-        size_t body_size;
         uint16_t in_path_offset;
         uint16_t in_path_length;
@@ -55 +53 @@
         bool ok;
 
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
+        status = smbd_smb2_request_verify_sizes(req, 0x09);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_path_offset = SVAL(inbody, 0x04);
         in_path_length = SVAL(inbody, 0x06);
 
-        if (in_path_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+        if (in_path_offset != (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -87 +80 @@
         if (!ok) {
                 return smbd_smb2_request_error(req, NT_STATUS_ILLEGAL_CHARACTER);
+        }
+
+        if (in_path_buffer.length == 0) {
+                in_path_string_size = 0;
+        }
+
+        if (strlen(in_path_string) != in_path_string_size) {
+                return smbd_smb2_request_error(req, NT_STATUS_BAD_NETWORK_NAME);
         }
 
@@ -228 +229 @@
         talloc_set_destructor(tcon, smbd_smb2_tcon_destructor);
 
-        compat_conn = make_connection_snum(req->sconn,
-                                        snum, req->session->compat_vuser,
+        compat_conn = make_connection_smb2(req->sconn,
+                                        tcon,
+                                        req->session->compat_vuser,
                                         data_blob_null, "???",
                                         &status);
@@ -237 +239 @@
         }
         tcon->compat_conn = talloc_move(tcon, &compat_conn);
-        tcon->compat_conn->cnum = tcon->tid;
 
         if (IS_PRINT(tcon->compat_conn)) {
@@ -281 +282 @@
 {
         const uint8_t *inhdr;
-        const uint8_t *outhdr;
         int i = req->current_idx;
+        uint32_t in_flags;
         uint32_t in_tid;
         void *p;
         struct smbd_smb2_tcon *tcon;
-        bool chained_fixup = false;
+
+        req->tcon = NULL;
 
         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
 
+        in_flags = IVAL(inhdr, SMB2_HDR_FLAGS);
         in_tid = IVAL(inhdr, SMB2_HDR_TID);
 
-        if (in_tid == (0xFFFFFFFF)) {
-                if (req->async) {
-                        /*
-                         * async request - fill in tid from
-                         * already setup out.vector[].iov_base.
-                         */
-                        outhdr = (const uint8_t *)req->out.vector[i].iov_base;
-                        in_tid = IVAL(outhdr, SMB2_HDR_TID);
-                } else if (i > 2) {
-                        /*
-                         * Chained request - fill in tid from
-                         * the previous request out.vector[].iov_base.
-                         */
-                        outhdr = (const uint8_t *)req->out.vector[i-3].iov_base;
-                        in_tid = IVAL(outhdr, SMB2_HDR_TID);
-                        chained_fixup = true;
-                }
-        }
+        if (in_flags & SMB2_HDR_FLAG_CHAINED) {
+                in_tid = req->last_tid;
+        }
+
+        req->last_tid = UINT32_MAX;
 
         /* lookup an existing session */
@@ -328 +318 @@
 
         req->tcon = tcon;
-
-        if (chained_fixup) {
-                /* Fix up our own outhdr. */
-                outhdr = (const uint8_t *)req->out.vector[i].iov_base;
-                SIVAL(outhdr, SMB2_HDR_TID, in_tid);
-        }
+        req->last_tid = in_tid;
 
         return NT_STATUS_OK;
@@ -340 +325 @@
 NTSTATUS smbd_smb2_request_process_tdis(struct smbd_smb2_request *req)
 {
-        const uint8_t *inbody;
-        int i = req->current_idx;
+        NTSTATUS status;
         DATA_BLOB outbody;
-        size_t expected_body_size = 0x04;
-        size_t body_size;
-
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
-        inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+
+        status = smbd_smb2_request_verify_sizes(req, 0x04);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
         }
 

vendor/current/source3/smbd/smb2_write.c

@@ -29 +29 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
+                                               struct files_struct *in_fsp,
                                                uint32_t in_smbpid,
-                                               uint64_t in_file_id_volatile,
                                                DATA_BLOB in_data,
                                                uint64_t in_offset,
@@ -40 +40 @@
 NTSTATUS smbd_smb2_request_process_write(struct smbd_smb2_request *req)
 {
+        NTSTATUS status;
         const uint8_t *inhdr;
         const uint8_t *inbody;
         int i = req->current_idx;
-        size_t expected_body_size = 0x31;
-        size_t body_size;
         uint32_t in_smbpid;
         uint16_t in_data_offset;
@@ -52 +51 @@
         uint64_t in_file_id_persistent;
         uint64_t in_file_id_volatile;
+        struct files_struct *in_fsp;
         uint32_t in_flags;
         struct tevent_req *subreq;
 
+        status = smbd_smb2_request_verify_sizes(req, 0x31);
+        if (!NT_STATUS_IS_OK(status)) {
+                return smbd_smb2_request_error(req, status);
+        }
         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-        if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
-
         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-        body_size = SVAL(inbody, 0x00);
-        if (body_size != expected_body_size) {
-                return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-        }
 
         in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
@@ -76 +71 @@
         in_flags                = IVAL(inbody, 0x2C);
 
-        if (in_data_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+        if (in_data_offset != (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
         }
@@ -85 +80 @@
 
         /* check the max write size */
-        if (in_data_length > lp_smb2_max_write()) {
-                /* This is a warning. */
+        if (in_data_length > req->sconn->smb2.max_write) {
                 DEBUG(2,("smbd_smb2_request_process_write : "
                         "client ignored max write :%s: 0x%08X: 0x%08X\n",
-                        __location__, in_data_length, lp_smb2_max_write()));
-#if 0
+                        __location__, in_data_length, req->sconn->smb2.max_write));
                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
-#endif
         }
 
@@ -98 +90 @@
         in_data_buffer.length = in_data_length;
 
-        if (req->compat_chain_fsp) {
-                /* skip check */
-        } else if (in_file_id_persistent != in_file_id_volatile) {
+        in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+        if (in_fsp == NULL) {
                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
         }
 
-        subreq = smbd_smb2_write_send(req,
-                                      req->sconn->smb2.event_ctx,
-                                      req,
+        subreq = smbd_smb2_write_send(req, req->sconn->smb2.event_ctx,
+                                      req, in_fsp,
                                       in_smbpid,
-                                      in_file_id_volatile,
                                       in_data_buffer,
                                       in_offset,
@@ -225 +214 @@
                                                struct tevent_context *ev,
                                                struct smbd_smb2_request *smb2req,
+                                               struct files_struct *fsp,
                                                uint32_t in_smbpid,
-                                               uint64_t in_file_id_volatile,
                                                DATA_BLOB in_data,
                                                uint64_t in_offset,
@@ -236 +225 @@
         struct smb_request *smbreq = NULL;
         connection_struct *conn = smb2req->tcon->compat_conn;
-        files_struct *fsp = NULL;
         ssize_t nwritten;
         struct lock_struct lock;
@@ -252 +240 @@
         state->out_count = 0;
 
-        DEBUG(10,("smbd_smb2_write: file_id[0x%016llX]\n",
-                  (unsigned long long)in_file_id_volatile));
+        DEBUG(10,("smbd_smb2_write: %s - fnum[%d]\n",
+                  fsp_str_dbg(fsp), fsp->fnum));
 
         smbreq = smbd_smb2_fake_smb_request(smb2req);
         if (tevent_req_nomem(smbreq, req)) {
-                return tevent_req_post(req, ev);
-        }
-
-        fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
-        if (fsp == NULL) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (conn != fsp->conn) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
-                return tevent_req_post(req, ev);
-        }
-        if (smb2req->session->vuid != fsp->vuid) {
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
                 return tevent_req_post(req, ev);
         }
@@ -325 +299 @@
         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
                 /* Real error in setting up aio. Fail. */
-                tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
+                tevent_req_nterror(req, status);
                 return tevent_req_post(req, ev);
         }
@@ -331 +305 @@
         /* Fallback to synchronous. */
         init_strict_lock_struct(fsp,
-                                in_file_id_volatile,
+                                fsp->fnum,
                                 in_offset,
                                 in_data.length,

vendor/current/source3/smbd/statcache.c

@@ -151 +151 @@
  *
  * @param conn    A connection struct to do the stat() with.
+ * @param posix_paths Whether to lookup using stat() or lstat()
  * @param name    The path we are attempting to cache, modified by this routine
  *                to be correct as far as the cache can tell us. We assume that
@@ -167 +168 @@
 
 bool stat_cache_lookup(connection_struct *conn,
+                        bool posix_paths,
                         char **pp_name,
                         char **pp_dirpath,
@@ -182 +184 @@
         TALLOC_CTX *ctx = talloc_tos();
         struct smb_filename smb_fname;
+        int ret;
 
         *pp_dirpath = NULL;
@@ -284 +287 @@
         smb_fname.base_name = translated_path;
 
-        if (SMB_VFS_STAT(conn, &smb_fname) != 0) {
+        if (posix_paths) {
+                ret = SMB_VFS_LSTAT(conn, &smb_fname);
+        } else {
+                ret = SMB_VFS_STAT(conn, &smb_fname);
+        }
+
+        if (ret != 0) {
                 /* Discard this entry - it doesn't exist in the filesystem. */
                 memcache_delete(smbd_memcache(), STAT_CACHE,

vendor/current/source3/smbd/trans2.c

@@ -863 +863 @@
                 reply_outbuf(req, 10, total_sent_thistime + alignment_offset
                              + data_alignment_offset);
-
-                /*
-                 * We might have SMBtrans2s in req which was transferred to
-                 * the outbuf, fix that.
-                 */
-                SCVAL(req->outbuf, smb_com, SMBtrans2);
 
                 /* Set total params and data to be sent */
@@ -1084 +1078 @@
         }
 
-        if (!map_open_params_to_ntcreate(smb_fname, deny_mode, open_ofun,
+        if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
+                                         open_ofun,
                                          &access_mask, &share_mode,
                                          &create_disposition,
@@ -2271 +2266 @@
         struct dptr_struct *dirptr = NULL;
         struct smbd_server_connection *sconn = req->sconn;
+        uint32_t ucf_flags = (UCF_SAVE_LCOMP | UCF_ALWAYS_ALLOW_WCARD_LCOMP);
 
         if (total_params < 13) {
@@ -2314 +2310 @@
                                 goto out;
                         }
+                        ucf_flags |= UCF_UNIX_NAME_LOOKUP;
                         break;
                 default:
@@ -2331 +2328 @@
                                     req->flags2 & FLAGS2_DFS_PATHNAMES,
                                     directory,
-                                    (UCF_SAVE_LCOMP |
-                                        UCF_ALWAYS_ALLOW_WCARD_LCOMP),
+                                    ucf_flags,
                                     &mask_contains_wcard,
                                     &smb_dname);
@@ -4673 +4669 @@
                 case SMB_QUERY_FILE_STREAM_INFO:
                 case SMB_FILE_STREAM_INFORMATION: {
-                        unsigned int num_streams;
-                        struct stream_struct *streams;
+                        unsigned int num_streams = 0;
+                        struct stream_struct *streams = NULL;
 
                         DEBUG(10,("smbd_do_qfilepathinfo: "
@@ -4683 +4679 @@
                         }
 
-                        status = SMB_VFS_STREAMINFO(
-                                conn, fsp, smb_fname->base_name, talloc_tos(),
-                                &num_streams, &streams);
+                        status = vfs_streaminfo(conn, fsp, smb_fname->base_name,
+                                                talloc_tos(), &num_streams, &streams);
 
                         if (!NT_STATUS_IS_OK(status)) {
@@ -5104 +5099 @@
                 uint32_t name_hash;
                 char *fname = NULL;
+                uint32_t ucf_flags = 0;
 
                 /* qpathinfo */
@@ -5115 +5111 @@
                 DEBUG(3,("call_trans2qfilepathinfo: TRANSACT2_QPATHINFO: level = %d\n", info_level));
 
-                if (INFO_LEVEL_IS_UNIX(info_level) && !lp_unix_extensions()) {
-                        reply_nterror(req, NT_STATUS_INVALID_LEVEL);
-                        return;
+                if (INFO_LEVEL_IS_UNIX(info_level)) {
+                        if (!lp_unix_extensions()) {
+                                reply_nterror(req, NT_STATUS_INVALID_LEVEL);
+                                return;
+                        }
+                        if (info_level == SMB_QUERY_FILE_UNIX_BASIC ||
+                                        info_level == SMB_QUERY_FILE_UNIX_INFO2 ||
+                                        info_level == SMB_QUERY_FILE_UNIX_LINK) {
+                                ucf_flags |= UCF_UNIX_NAME_LOOKUP;
+                        }
                 }
 
@@ -5132 +5135 @@
                                         req->flags2 & FLAGS2_DFS_PATHNAMES,
                                         fname,
-                                        0,
+                                        ucf_flags,
                                         NULL,
                                         &smb_fname);
@@ -5819 +5822 @@
         /* The set is across all open files on this dev/inode pair. */
         if (!set_delete_on_close(fsp, delete_on_close,
+                                 conn->session_info->security_token,
                                  &conn->session_info->utok)) {
                 return NT_STATUS_ACCESS_DENIED;
@@ -7976 +7980 @@
         } else {
                 char *fname = NULL;
+                uint32_t ucf_flags = 0;
 
                 /* set path info */
@@ -7992 +7997 @@
                 }
 
+                if (info_level == SMB_SET_FILE_UNIX_BASIC ||
+                                info_level == SMB_SET_FILE_UNIX_INFO2 ||
+                                info_level == SMB_FILE_RENAME_INFORMATION ||
+                                info_level == SMB_POSIX_PATH_UNLINK) {
+                        ucf_flags |= UCF_UNIX_NAME_LOOKUP;
+                }
+
                 status = filename_convert(req, conn,
                                          req->flags2 & FLAGS2_DFS_PATHNAMES,
                                          fname,
-                                         0,
+                                         ucf_flags,
                                          NULL,
                                          &smb_fname);
@@ -8822 +8834 @@
         show_msg((char *)req->inbuf);
 
+        /* Windows clients expect all replies to
+           a transact secondary (SMBtranss2 0x33)
+           to have a command code of transact
+           (SMBtrans2 0x32). See bug #8989
+           and also [MS-CIFS] section 2.2.4.47.2
+           for details.
+        */
+        req->cmd = SMBtrans2;
+
         if (req->wct < 8) {
                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);

vendor/current/source3/smbd/vfs.c

@@ -1126 +1126 @@
 }
 
+/**
+ * Initialize num_streams and streams, then call VFS op streaminfo
+ */
+NTSTATUS vfs_streaminfo(connection_struct *conn,
+                        struct files_struct *fsp,
+                        const char *fname,
+                        TALLOC_CTX *mem_ctx,
+                        unsigned int *num_streams,
+                        struct stream_struct **streams)
+{
+        *num_streams = 0;
+        *streams = NULL;
+        return SMB_VFS_STREAMINFO(conn, fsp, fname, mem_ctx, num_streams, streams);
+}
+
 /*
   generate a file_id from a stat structure
@@ -1501 +1516 @@
 
                 /* cd into the parent dir to pin it. */
-                ret = SMB_VFS_CHDIR(fsp->conn, parent_dir);
+                ret = vfs_ChDir(fsp->conn, parent_dir);
                 if (ret == -1) {
                         return map_nt_error_from_unix(errno);
@@ -1512 +1527 @@
                 ret = SMB_VFS_LSTAT(fsp->conn, &local_fname);
                 if (ret == -1) {
-                        return map_nt_error_from_unix(errno);
+                        status = map_nt_error_from_unix(errno);
+                        goto out;
                 }
 
                 /* Ensure it matches the fsp stat. */
                 if (!check_same_stat(&local_fname.st, &fsp->fsp_name->st)) {
-                        return NT_STATUS_ACCESS_DENIED;
+                        status = NT_STATUS_ACCESS_DENIED;
+                        goto out;
                 }
                 path = final_component;
@@ -1540 +1557 @@
         }
 
+  out:
+
         if (as_root) {
                 vfs_ChDir(fsp->conn,saved_dir);