Changeset 860 for vendor/current/source3/smbd

Timestamp:

May 12, 2014, 8:58:38 PM (11 years ago)

Author:

Silvan Scherrer

Message:

Samba 3.6: updated vendor to latest version

Location:

vendor/current/source3/smbd

Files:

• conn.c (modified) (2 diffs)
• dir.c (modified) (10 diffs)
• dosmode.c (modified) (1 diff)
• filename.c (modified) (5 diffs)
• globals.h (modified) (3 diffs)
• lanman.c (modified) (3 diffs)
• mangle_hash2.c (modified) (2 diffs)
• msdfs.c (modified) (1 diff)
• nttrans.c (modified) (4 diffs)
• open.c (modified) (6 diffs)
• oplock_linux.c (modified) (1 diff)
• posix_acls.c (modified) (2 diffs)
• process.c (modified) (3 diffs)
• proto.h (modified) (2 diffs)
• reply.c (modified) (16 diffs)
• server.c (modified) (5 diffs)
• server_reload.c (modified) (6 diffs)
• service.c (modified) (2 diffs)
• sesssetup.c (modified) (3 diffs)
• smb2_create.c (modified) (3 diffs)
• smb2_getinfo.c (modified) (13 diffs)
• smb2_server.c (modified) (10 diffs)
• smb2_tcon.c (modified) (1 diff)
• trans2.c (modified) (55 diffs)

vendor/current/source3/smbd/conn.c

@@ -482 +482 @@
                 DEBUG(1,("Forcing close of all shares\n"));
                 conn_close_all(sconn);
-                return;
+                goto done;
         }
 
@@ -513 +513 @@
                 }
         }
-}
+
+ done:
+
+        change_to_root_user();
+        reload_services(msg, -1, true);
+}

vendor/current/source3/smbd/dir.c

@@ -50 +50 @@
         unsigned int name_cache_index;
         unsigned int file_number;
+        files_struct *fsp; /* Back pointer to containing fsp, only
+                              set from OpenDir_fsp(). */
 };
 
@@ -591 +593 @@
 {
         if (fsp->dptr) {
-/*
- * Ugly hack. We have defined fdopendir to return ENOSYS if dirfd also isn't
- * present. I hate Solaris. JRA.
- */
-#ifdef HAVE_DIRFD
-                if (fsp->fh->fd != -1 &&
-                                fsp->dptr->dir_hnd &&
-                                dirfd(fsp->dptr->dir_hnd->dir)) {
-                        /* The call below closes the underlying fd. */
-                        fsp->fh->fd = -1;
-                }
-#endif
+                /*
+                 * The destructor for the struct smb_Dir
+                 * (fsp->dptr->dir_hnd) now handles
+                 * all resource deallocation.
+                 */
                 dptr_close_internal(fsp->dptr);
                 fsp->dptr = NULL;
@@ -942 +937 @@
 {
         connection_struct *conn = dirptr->conn;
-        bool needslash;
+        size_t slashlen;
+        size_t pathlen;
 
         *_smb_fname = NULL;
         *_mode = 0;
 
-        needslash = ( dirptr->path[strlen(dirptr->path) -1] != '/');
+        pathlen = strlen(dirptr->path);
+        slashlen = ( dirptr->path[pathlen-1] != '/') ? 1 : 0;
 
         while (true) {
@@ -991 +988 @@
                 }
 
-                pathreal = talloc_asprintf(ctx, "%s%s%s",
-                                           dirptr->path,
-                                           needslash?"/":"",
-                                           dname);
+                /*
+                 * This used to be
+                 * pathreal = talloc_asprintf(ctx, "%s%s%s", dirptr->path,
+                 *                            needslash?"/":"", dname);
+                 * but this was measurably slower than doing the memcpy.
+                 */
+
+                pathreal = talloc_array(
+                        ctx, char,
+                        pathlen + slashlen + talloc_get_size(dname));
                 if (!pathreal) {
                         TALLOC_FREE(dname);
@@ -1000 +1003 @@
                         return false;
                 }
+
+                memcpy(pathreal, dirptr->path, pathlen);
+                pathreal[pathlen] = '/';
+                memcpy(pathreal + slashlen + pathlen, dname,
+                       talloc_get_size(dname));
 
                 /* Create smb_fname with NULL stream_name. */
@@ -1333 +1341 @@
 static int smb_Dir_destructor(struct smb_Dir *dirp)
 {
-        if (dirp->dir) {
-#ifdef HAVE_DIRFD
-                if (dirp->conn->sconn) {
-                        files_struct *fsp = file_find_fd(dirp->conn->sconn,
-                                                dirfd(dirp->dir));
-                        if (fsp) {
-                                /* The call below closes the underlying fd. */
-                                fsp->fh->fd = -1;
+        if (dirp->dir != NULL) {
+                SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir);
+                if (dirp->fsp != NULL) {
+                        /*
+                         * The SMB_VFS_CLOSEDIR above
+                         * closes the underlying fd inside
+                         * dirp->fsp.
+                         */
+                        dirp->fsp->fh->fd = -1;
+                        if (dirp->fsp->dptr != NULL) {
+                                SMB_ASSERT(dirp->fsp->dptr->dir_hnd == dirp);
+                                dirp->fsp->dptr->dir_hnd = NULL;
                         }
-                }
-#endif
-                SMB_VFS_CLOSEDIR(dirp->conn,dirp->dir);
+                        dirp->fsp = NULL;
+                }
         }
         if (dirp->conn->sconn && !dirp->conn->sconn->using_smb2) {
@@ -1428 +1439 @@
         if (fsp->is_directory && fsp->fh->fd != -1) {
                 dirp->dir = SMB_VFS_FDOPENDIR(fsp, mask, attr);
-                if (dirp->dir == NULL) {
+                if (dirp->dir != NULL) {
+                        dirp->fsp = fsp;
+                } else {
                         DEBUG(10,("OpenDir_fsp: SMB_VFS_FDOPENDIR on %s returned "
                                 "NULL (%s)\n",
@@ -1644 +1657 @@
 *****************************************************************/
 
-NTSTATUS can_delete_directory(struct connection_struct *conn,
-                                const char *dirname)
+NTSTATUS can_delete_directory_fsp(files_struct *fsp)
 {
         NTSTATUS status = NT_STATUS_OK;
@@ -1652 +1664 @@
         char *talloced = NULL;
         SMB_STRUCT_STAT st;
-        struct smb_Dir *dir_hnd = OpenDir(talloc_tos(), conn,
-                                        dirname, NULL, 0);
+        struct connection_struct *conn = fsp->conn;
+        struct smb_Dir *dir_hnd = OpenDir_fsp(talloc_tos(),
+                                        conn,
+                                        fsp,
+                                        NULL,
+                                        0);
 
         if (!dir_hnd) {
@@ -1668 +1684 @@
                 }
 
-                if (!is_visible_file(conn, dirname, dname, &st, True)) {
+                if (!is_visible_file(conn, fsp->fsp_name->base_name, dname, &st, True)) {
                         TALLOC_FREE(talloced);
                         continue;
                 }
 
-                DEBUG(10,("can_delete_directory: got name %s - can't delete\n",
+                DEBUG(10,("can_delete_directory_fsp: got name %s - can't delete\n",
                          dname ));
                 status = NT_STATUS_DIRECTORY_NOT_EMPTY;

vendor/current/source3/smbd/dosmode.c

@@ -485 +485 @@
         result = filter_mode_by_protocol(result);
 
+        /*
+         * Add in that it is a reparse point
+         */
+        result |= FILE_ATTRIBUTE_REPARSE_POINT;
+
         DEBUG(8,("dos_mode_msdfs returning "));
 

vendor/current/source3/smbd/filename.c

@@ -446 +446 @@
                 if (errno == ENOENT) {
                         /* Optimization when creating a new file - only
-                           the last component doesn't exist. */
+                           the last component doesn't exist.
+                           NOTE : check_parent_exists() doesn't preserve errno.
+                        */
+                        int saved_errno = errno;
                         status = check_parent_exists(ctx,
                                                 conn,
@@ -453 +456 @@
                                                 &dirpath,
                                                 &start);
+                        errno = saved_errno;
                         if (!NT_STATUS_IS_OK(status)) {
                                 goto fail;
@@ -525 +529 @@
                  * is in the last component and the client already
                  * sent the correct case.
+                 * NOTE : check_parent_exists() doesn't preserve errno.
                  */
+                int saved_errno = errno;
                 status = check_parent_exists(ctx,
                                         conn,
@@ -532 +538 @@
                                         &dirpath,
                                         &start);
+                errno = saved_errno;
                 if (!NT_STATUS_IS_OK(status)) {
                         goto fail;
@@ -707 +714 @@
                                 /*
                                  * ENOENT/EACCESS are the only valid errors
-                                 * here. EACCESS needs handling here for
-                                 * "dropboxes", i.e. directories where users
-                                 * can only put stuff with permission -wx.
+                                 * here.
                                  */
-                                if ((errno != 0) && (errno != ENOENT)
-                                    && (errno != EACCES)) {
+                                if (errno == EACCES) {
+                                        if (ucf_flags & UCF_CREATING_FILE) {
+                                                /*
+                                                 * This is the dropbox
+                                                 * behaviour. A dropbox is a
+                                                 * directory with only -wx
+                                                 * permissions, so
+                                                 * get_real_filename fails
+                                                 * with EACCESS, it needs to
+                                                 * list the directory. We
+                                                 * nevertheless want to allow
+                                                 * users creating a file.
+                                                 */
+                                                status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
+                                        } else {
+                                                status = NT_STATUS_ACCESS_DENIED;
+                                        }
+                                        goto fail;
+                                }
+
+                                if ((errno != 0) && (errno != ENOENT)) {
                                         /*
                                          * ENOTDIR and ELOOP both map to

vendor/current/source3/smbd/globals.h

@@ -163 +163 @@
                                uint16_t flags2,
                                unsigned int max_data_bytes,
+                               size_t *fixed_portion,
                                char **ppdata,
                                unsigned int *pdata_size);
@@ -180 +181 @@
                          uint16_t flags2,
                          unsigned int max_data_bytes,
+                         size_t *fixed_portion,
+                         struct smb_filename *smb_fname,
                          char **ppdata,
                          int *ret_data_len);
@@ -647 +650 @@
                 uint32_t max_read;
                 uint32_t max_write;
-                bool compound_related_in_progress;
         } smb2;
 };

vendor/current/source3/smbd/lanman.c

@@ -2629 +2629 @@
                 goto close_domain;
         }
+        if (rid.count != 1) {
+                status = NT_STATUS_INVALID_NETWORK_RESPONSE;
+                goto close_domain;
+        }
+        if (type.count != 1) {
+                status = NT_STATUS_INVALID_NETWORK_RESPONSE;
+                goto close_domain;
+        }
 
         if (type.ids[0] != SID_NAME_USER) {
@@ -2937 +2945 @@
 
         return True;
-}
-
-/****************************************************************************
- Set the user password.
-*****************************************************************************/
-
-static bool api_SetUserPassword(struct smbd_server_connection *sconn,
-                                connection_struct *conn,uint16 vuid,
-                                char *param, int tpscnt,
-                                char *data, int tdscnt,
-                                int mdrcnt,int mprcnt,
-                                char **rdata,char **rparam,
-                                int *rdata_len,int *rparam_len)
-{
-        char *np = get_safe_str_ptr(param,tpscnt,param,2);
-        char *p = NULL;
-        fstring user;
-        fstring pass1,pass2;
-        TALLOC_CTX *mem_ctx = talloc_tos();
-        NTSTATUS status, result;
-        struct rpc_pipe_client *cli = NULL;
-        struct policy_handle connect_handle, domain_handle, user_handle;
-        struct lsa_String domain_name;
-        struct dom_sid2 *domain_sid;
-        struct lsa_String names;
-        struct samr_Ids rids;
-        struct samr_Ids types;
-        struct samr_Password old_lm_hash;
-        struct samr_Password new_lm_hash;
-        int errcode = NERR_badpass;
-        uint32_t rid;
-        int encrypted;
-        int min_pwd_length;
-        struct dcerpc_binding_handle *b = NULL;
-
-        /* Skip 2 strings. */
-        p = skip_string(param,tpscnt,np);
-        p = skip_string(param,tpscnt,p);
-
-        if (!np || !p) {
-                return False;
-        }
-
-        /* Do we have a string ? */
-        if (skip_string(param,tpscnt,p) == NULL) {
-                return False;
-        }
-        pull_ascii_fstring(user,p);
-
-        p = skip_string(param,tpscnt,p);
-        if (!p) {
-                return False;
-        }
-
-        memset(pass1,'\0',sizeof(pass1));
-        memset(pass2,'\0',sizeof(pass2));
-        /*
-         * We use 31 here not 32 as we're checking
-         * the last byte we want to access is safe.
-         */
-        if (!is_offset_safe(param,tpscnt,p,31)) {
-                return False;
-        }
-        memcpy(pass1,p,16);
-        memcpy(pass2,p+16,16);
-
-        encrypted = get_safe_SVAL(param,tpscnt,p+32,0,-1);
-        if (encrypted == -1) {
-                errcode = W_ERROR_V(WERR_INVALID_PARAM);
-                goto out;
-        }
-
-        min_pwd_length = get_safe_SVAL(param,tpscnt,p+34,0,-1);
-        if (min_pwd_length == -1) {
-                errcode = W_ERROR_V(WERR_INVALID_PARAM);
-                goto out;
-        }
-
-        *rparam_len = 4;
-        *rparam = smb_realloc_limit(*rparam,*rparam_len);
-        if (!*rparam) {
-                return False;
-        }
-
-        *rdata_len = 0;
-
-        DEBUG(3,("Set password for <%s> (encrypted: %d, min_pwd_length: %d)\n",
-                user, encrypted, min_pwd_length));
-
-        ZERO_STRUCT(connect_handle);
-        ZERO_STRUCT(domain_handle);
-        ZERO_STRUCT(user_handle);
-
-        status = rpc_pipe_open_interface(mem_ctx, &ndr_table_samr.syntax_id,
-                                        conn->session_info,
-                                        &conn->sconn->client_id,
-                                        conn->sconn->msg_ctx,
-                                        &cli);
-        if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("api_SetUserPassword: could not connect to samr: %s\n",
-                          nt_errstr(status)));
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-
-        b = cli->binding_handle;
-
-        status = dcerpc_samr_Connect2(b, mem_ctx,
-                                      global_myname(),
-                                      SAMR_ACCESS_CONNECT_TO_SERVER |
-                                      SAMR_ACCESS_ENUM_DOMAINS |
-                                      SAMR_ACCESS_LOOKUP_DOMAIN,
-                                      &connect_handle,
-                                      &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        init_lsa_String(&domain_name, get_global_sam_name());
-
-        status = dcerpc_samr_LookupDomain(b, mem_ctx,
-                                          &connect_handle,
-                                          &domain_name,
-                                          &domain_sid,
-                                          &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        status = dcerpc_samr_OpenDomain(b, mem_ctx,
-                                        &connect_handle,
-                                        SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
-                                        domain_sid,
-                                        &domain_handle,
-                                        &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        init_lsa_String(&names, user);
-
-        status = dcerpc_samr_LookupNames(b, mem_ctx,
-                                         &domain_handle,
-                                         1,
-                                         &names,
-                                         &rids,
-                                         &types,
-                                         &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        if (rids.count != 1) {
-                errcode = W_ERROR_V(WERR_NO_SUCH_USER);
-                goto out;
-        }
-        if (rids.count != types.count) {
-                errcode = W_ERROR_V(WERR_INVALID_PARAM);
-                goto out;
-        }
-        if (types.ids[0] != SID_NAME_USER) {
-                errcode = W_ERROR_V(WERR_INVALID_PARAM);
-                goto out;
-        }
-
-        rid = rids.ids[0];
-
-        status = dcerpc_samr_OpenUser(b, mem_ctx,
-                                      &domain_handle,
-                                      SAMR_USER_ACCESS_CHANGE_PASSWORD,
-                                      rid,
-                                      &user_handle,
-                                      &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        if (encrypted == 0) {
-                E_deshash(pass1, old_lm_hash.hash);
-                E_deshash(pass2, new_lm_hash.hash);
-        } else {
-                ZERO_STRUCT(old_lm_hash);
-                ZERO_STRUCT(new_lm_hash);
-                memcpy(old_lm_hash.hash, pass1, MIN(strlen(pass1), 16));
-                memcpy(new_lm_hash.hash, pass1, MIN(strlen(pass2), 16));
-        }
-
-        status = dcerpc_samr_ChangePasswordUser(b, mem_ctx,
-                                                &user_handle,
-                                                true, /* lm_present */
-                                                &old_lm_hash,
-                                                &new_lm_hash,
-                                                false, /* nt_present */
-                                                NULL, /* old_nt_crypted */
-                                                NULL, /* new_nt_crypted */
-                                                false, /* cross1_present */
-                                                NULL, /* nt_cross */
-                                                false, /* cross2_present */
-                                                NULL, /* lm_cross */
-                                                &result);
-        if (!NT_STATUS_IS_OK(status)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(status));
-                goto out;
-        }
-        if (!NT_STATUS_IS_OK(result)) {
-                errcode = W_ERROR_V(ntstatus_to_werror(result));
-                goto out;
-        }
-
-        errcode = NERR_Success;
- out:
-
-        if (b && is_valid_policy_hnd(&user_handle)) {
-                dcerpc_samr_Close(b, mem_ctx, &user_handle, &result);
-        }
-        if (b && is_valid_policy_hnd(&domain_handle)) {
-                dcerpc_samr_Close(b, mem_ctx, &domain_handle, &result);
-        }
-        if (b && is_valid_policy_hnd(&connect_handle)) {
-                dcerpc_samr_Close(b, mem_ctx, &connect_handle, &result);
-        }
-
-        memset((char *)pass1,'\0',sizeof(fstring));
-        memset((char *)pass2,'\0',sizeof(fstring));
-
-        SSVAL(*rparam,0,errcode);
-        SSVAL(*rparam,2,0);             /* converter word */
-        return(True);
 }
 
@@ -5785 +5540 @@
         {"NetServerEnum3",      RAP_NetServerEnum3,     api_RNetServerEnum3}, /* anon OK */
         {"WAccessGetUserPerms",RAP_WAccessGetUserPerms,api_WAccessGetUserPerms},
-        {"SetUserPassword",     RAP_WUserPasswordSet2,  api_SetUserPassword},
         {"WWkstaUserLogon",     RAP_WWkstaUserLogon,    api_WWkstaUserLogon},
         {"PrintJobInfo",        RAP_WPrintJobSetInfo,   api_PrintJobInfo},

vendor/current/source3/smbd/mangle_hash2.c

@@ -627 +627 @@
                 if (((unsigned int)name[0]) > 128 && (name[1] != 0)) {
                         /* Possible start of mb character. */
-                        char mbc[2];
+                        size_t size = 0;
+                        (void)next_codepoint(name, &size);
                         /*
                          * Note that if CH_UNIX is utf8 a string may be 3
@@ -635 +636 @@
                          * JRA.
                          */
-                        if (convert_string(CH_UNIX, CH_UTF16LE, name, 2, mbc, 2, False) == 2) {
-                                /* Was a good mb string. */
-                                name += 2;
+                        if (size > 1) {
+                                /* Was a mb string. */
+                                name += size;
                                 continue;
                         }

vendor/current/source3/smbd/msdfs.c

@@ -975 +975 @@
                 DEBUG(3,("get_referred_path: No valid referrals for path %s\n",
                         dfs_path));
+                if (NT_STATUS_IS_OK(status)) {
+                        /*
+                         * We are in an error path here (we
+                         * know it's not a DFS path), but
+                         * dfs_path_lookup() can return
+                         * NT_STATUS_OK. Ensure we always
+                         * return a valid error code.
+                         *
+                         * #9588 - ACLs are not inherited to directories
+                         *         for DFS shares.
+                         */
+                        status = NT_STATUS_NOT_FOUND;
+                }
                 goto err_exit;
         }

vendor/current/source3/smbd/nttrans.c

@@ -537 +537 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                (create_disposition == FILE_CREATE)
+                                        ? UCF_CREATING_FILE : 0,
                                 NULL,
                                 &smb_fname);
@@ -886 +887 @@
         /* Ensure we have at least one thing set. */
         if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
-                if (security_info_sent & SECINFO_LABEL) {
-                        /* Only consider SECINFO_LABEL if no other
-                           bits are set. Just like W2K3 we don't
-                           store this. */
-                        return NT_STATUS_OK;
-                }
-                return NT_STATUS_INVALID_PARAMETER;
+                /* Just like W2K3 */
+                return NT_STATUS_OK;
         }
 
@@ -990 +986 @@
                         break;
                 }
+
+                /* Integer wrap protection for the increment. */
+                if (offset + next_offset < offset) {
+                        break;
+                }
+
                 offset += next_offset;
+
+                /* Integer wrap protection for while loop. */
+                if (offset + 4 < offset) {
+                        break;
+                }
+
         }
 
@@ -1159 +1167 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                (create_disposition == FILE_CREATE)
+                                        ? UCF_CREATING_FILE : 0,
                                 NULL,
                                 &smb_fname);

vendor/current/source3/smbd/open.c

@@ -59 +59 @@
         }
 
+        /*
+         * If we can access the path to this file, by
+         * default we have FILE_READ_ATTRIBUTES from the
+         * containing directory. See the section:
+         * "Algorithm to Check Access to an Existing File"
+         * in MS-FSA.pdf.
+         */
         return se_access_check(sd,
                                 token,
@@ -143 +150 @@
 
         return status;
+}
+
+/****************************************************************************
+ Ensure when opening a base file for a stream open that we have permissions
+ to do so given the access mask on the base file.
+****************************************************************************/
+
+static NTSTATUS check_base_file_access(struct connection_struct *conn,
+                                struct smb_filename *smb_fname,
+                                uint32_t access_mask)
+{
+        uint32_t access_granted = 0;
+        NTSTATUS status;
+
+        status = smbd_calculate_access_mask(conn, smb_fname,
+                                        false,
+                                        access_mask,
+                                        &access_mask);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(10, ("smbd_calculate_access_mask "
+                        "on file %s returned %s\n",
+                        smb_fname_str_dbg(smb_fname),
+                        nt_errstr(status)));
+                return status;
+        }
+
+        if (access_mask & (FILE_WRITE_DATA|FILE_APPEND_DATA)) {
+                uint32_t dosattrs;
+                if (!CAN_WRITE(conn)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+                dosattrs = dos_mode(conn, smb_fname);
+                if (IS_DOS_READONLY(dosattrs)) {
+                        return NT_STATUS_ACCESS_DENIED;
+                }
+        }
+
+
+        return smbd_check_open_rights(conn,
+                                smb_fname,
+                                access_mask,
+                                &access_granted);
 }
 
@@ -1417 +1466 @@
                         }
 
-                        access_mask = access_granted;
+                        /*
+                         * If we can access the path to this file, by
+                         * default we have FILE_READ_ATTRIBUTES from the
+                         * containing directory. See the section.
+                         * "Algorithm to Check Access to an Existing File"
+                         * in MS-FSA.pdf.
+                         */
+                        access_mask = access_granted | FILE_READ_ATTRIBUTES;
                 } else {
                         access_mask = FILE_GENERIC_ALL;
@@ -1989 +2045 @@
                         /*
                          * If we're returning a share violation, ensure we
-                         * cope with the braindead 1 second delay.
+                         * cope with the braindead 1 second delay (SMB1 only).
                          */
 
                         if (!(oplock_request & INTERNAL_OPEN_ONLY) &&
+                            !conn->sconn->using_smb2 &&
                             lp_defer_sharing_violations()) {
                                 struct timeval timeout;
@@ -2753 +2810 @@
         mtimespec = smb_dname->st.st_ex_mtime;
 
-        /* Temporary access mask used to open the directory fd. */
-        fsp->access_mask = FILE_READ_DATA | FILE_READ_ATTRIBUTES;
+        fsp->access_mask = access_mask;
+
 #ifdef O_DIRECTORY
         status = fd_open(conn, fsp, O_RDONLY|O_DIRECTORY, 0);
@@ -3213 +3270 @@
                         DEBUG(10, ("Unable to stat stream: %s\n",
                                    smb_fname_str_dbg(smb_fname_base)));
+                } else {
+                        /*
+                         * https://bugzilla.samba.org/show_bug.cgi?id=10229
+                         * We need to check if the requested access mask
+                         * could be used to open the underlying file (if
+                         * it existed), as we're passing in zero for the
+                         * access mask to the base filename.
+                         */
+                        status = check_base_file_access(conn,
+                                                        smb_fname_base,
+                                                        access_mask);
+
+                        if (!NT_STATUS_IS_OK(status)) {
+                                DEBUG(10, ("Permission check "
+                                        "for base %s failed: "
+                                        "%s\n", smb_fname->base_name,
+                                        nt_errstr(status)));
+                                goto fail;
+                        }
                 }
 

vendor/current/source3/smbd/oplock_linux.c

@@ -76 +76 @@
 {
         int ret;
+        int saved_errno;
+
+        /*
+         * Ensure the lease owner is root to allow
+         * correct delivery of lease-break signals.
+         */
+
+        become_root();
 
         /* First set the signal handler. */
         if (linux_set_lease_sighandler(fd) == -1) {
-                return -1;
+                saved_errno = errno;
+                ret = -1;
+                goto out;
         }
         ret = fcntl(fd, F_SETLEASE, leasetype);
-        if (ret == -1 && errno == EACCES) {
-                set_effective_capability(LEASE_CAPABILITY);
-                /*
-                 * Bug 8974 - work around Linux kernel bug
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=43336.
-                 * "fcntl(F_SETLEASE) resets signal number when
-                 *  called multiple times"
-                 */
-                if (linux_set_lease_sighandler(fd) == -1) {
-                        return -1;
-                }
-                ret = fcntl(fd, F_SETLEASE, leasetype);
-        }
-
+        if (ret == -1) {
+                saved_errno = errno;
+        }
+
+  out:
+
+        unbecome_root();
+
+        if (ret == -1) {
+                errno = saved_errno;
+        }
         return ret;
 }

vendor/current/source3/smbd/posix_acls.c

@@ -1373 +1373 @@
                 if (pace->type == SMB_ACL_USER_OBJ) {
 
-                        if (setting_acl && !is_default_acl) {
+                        if (setting_acl) {
+                                /*
+                                 * Ensure we have default parameters for the
+                                 * user (owner) even on default ACLs.
+                                 */
                                 apply_default_perms(params, is_directory, pace, S_IRUSR);
                         }
@@ -1453 +1457 @@
                         }
 
-                        if (!is_default_acl) {
-                                apply_default_perms(params, is_directory, pace, S_IRUSR);
-                        }
+                        /*
+                         * Ensure we have default parameters for the
+                         * user (owner) even on default ACLs.
+                         */
+                        apply_default_perms(params, is_directory, pace, S_IRUSR);
                 } else {
                         pace->perms = unix_perms_to_acl_perms(pst->st_ex_mode, S_IRUSR, S_IWUSR, S_IXUSR);

vendor/current/source3/smbd/process.c

@@ -152 +152 @@
         }
 
-        len = smb_len(buf_out) + 4;
+        len = smb_len_large(buf_out) + 4;
 
         ret = write_data(sconn->sock, buf_out+nwritten, len - nwritten);
@@ -920 +920 @@
         DEBUG(10,("event_add_idle: %s %p\n", result->name, result->te));
         return result;
-}
-
-static void smbd_sig_term_handler(struct tevent_context *ev,
-                                  struct tevent_signal *se,
-                                  int signum,
-                                  int count,
-                                  void *siginfo,
-                                  void *private_data)
-{
-        exit_server_cleanly("termination signal");
-}
-
-void smbd_setup_sig_term_handler(void)
-{
-        struct tevent_signal *se;
-
-        se = tevent_add_signal(smbd_event_context(),
-                               smbd_event_context(),
-                               SIGTERM, 0,
-                               smbd_sig_term_handler,
-                               NULL);
-        if (!se) {
-                exit_server("failed to setup SIGTERM handler");
-        }
-}
-
-static void smbd_sig_hup_handler(struct tevent_context *ev,
-                                  struct tevent_signal *se,
-                                  int signum,
-                                  int count,
-                                  void *siginfo,
-                                  void *private_data)
-{
-        struct messaging_context *msg_ctx = talloc_get_type_abort(
-                private_data, struct messaging_context);
-        change_to_root_user();
-        DEBUG(1,("Reloading services after SIGHUP\n"));
-        reload_services(msg_ctx, smbd_server_conn->sock, False);
-        if (am_parent) {
-                pcap_cache_reload(ev, msg_ctx, &reload_pcap_change_notify);
-        }
-}
-
-void smbd_setup_sig_hup_handler(struct tevent_context *ev,
-                                struct messaging_context *msg_ctx)
-{
-        struct tevent_signal *se;
-
-        se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
-                               msg_ctx);
-        if (!se) {
-                exit_server("failed to setup SIGHUP handler");
-        }
 }
 
@@ -2031 +1978 @@
                  */
                 req->chain_outbuf = TALLOC_REALLOC_ARRAY(
-                        req, req->outbuf, uint8_t, smb_len(req->outbuf) + 4);
+                        req, req->outbuf, uint8_t,
+                        smb_len_large(req->outbuf) + 4);
                 if (req->chain_outbuf == NULL) {
                         smb_panic("talloc failed");

vendor/current/source3/smbd/proto.h

@@ -770 +770 @@
 /* The following definitions come from smbd/process.c  */
 
-void smbd_setup_sig_term_handler(void);
-void smbd_setup_sig_hup_handler(struct tevent_context *ev,
-                                struct messaging_context *msg_ctx);
 bool srv_send_smb(struct smbd_server_connection *sconn, char *buffer,
                   bool no_signing, uint32_t seqnum,
@@ -981 +978 @@
 void reload_printers(struct tevent_context *ev,
                      struct messaging_context *msg_ctx);
+void reload_printers_full(struct tevent_context *ev,
+                          struct messaging_context *msg_ctx);
 bool reload_services(struct messaging_context *msg_ctx, int smb_sock,
                      bool test);
-void reload_pcap_change_notify(struct tevent_context *ev,
-                               struct messaging_context *msg_ctx);
 void exit_server(const char *const explanation);
 void exit_server_cleanly(const char *const explanation);

vendor/current/source3/smbd/reply.c

@@ -1749 +1749 @@
         }
 
+        if (!map_open_params_to_ntcreate(fname, deny_mode,
+                                        OPENX_FILE_EXISTS_OPEN, &access_mask,
+                                        &share_mode, &create_disposition,
+                                        &create_options, &private_flags)) {
+                reply_force_doserror(req, ERRDOS, ERRbadaccess);
+                goto out;
+        }
+
         status = filename_convert(ctx,
                                 conn,
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                (create_disposition == FILE_CREATE)
+                                        ? UCF_CREATING_FILE : 0,
                                 NULL,
                                 &smb_fname);
@@ -1764 +1773 @@
                 }
                 reply_nterror(req, status);
-                goto out;
-        }
-
-        if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
-                                         OPENX_FILE_EXISTS_OPEN, &access_mask,
-                                         &share_mode, &create_disposition,
-                                         &create_options, &private_flags)) {
-                reply_force_doserror(req, ERRDOS, ERRbadaccess);
                 goto out;
         }
@@ -1924 +1925 @@
         }
 
+        if (!map_open_params_to_ntcreate(fname, deny_mode,
+                                        smb_ofun,
+                                        &access_mask, &share_mode,
+                                        &create_disposition,
+                                        &create_options,
+                                        &private_flags)) {
+                reply_force_doserror(req, ERRDOS, ERRbadaccess);
+                goto out;
+        }
+
         status = filename_convert(ctx,
                                 conn,
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                (create_disposition == FILE_CREATE)
+                                        ? UCF_CREATING_FILE : 0,
                                 NULL,
                                 &smb_fname);
@@ -1939 +1951 @@
                 }
                 reply_nterror(req, status);
-                goto out;
-        }
-
-        if (!map_open_params_to_ntcreate(smb_fname->base_name, deny_mode,
-                                         smb_ofun,
-                                         &access_mask, &share_mode,
-                                         &create_disposition,
-                                         &create_options,
-                                         &private_flags)) {
-                reply_force_doserror(req, ERRDOS, ERRbadaccess);
                 goto out;
         }
@@ -2146 +2148 @@
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                UCF_CREATING_FILE,
                                 NULL,
                                 &smb_fname);
@@ -2240 +2242 @@
         connection_struct *conn = req->conn;
         struct smb_filename *smb_fname = NULL;
+        char *wire_name = NULL;
         char *fname = NULL;
         uint32 fattr;
         files_struct *fsp;
         int oplock_request;
-        int tmpfd;
         char *s;
         NTSTATUS status;
+        int i;
         TALLOC_CTX *ctx = talloc_tos();
 
@@ -2259 +2262 @@
         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
 
-        srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
+        srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
                             STR_TERMINATE, &status);
         if (!NT_STATUS_IS_OK(status)) {
@@ -2265 +2268 @@
                 goto out;
         }
-        if (*fname) {
-                fname = talloc_asprintf(ctx,
-                                "%s/TMXXXXXX",
-                                fname);
-        } else {
-                fname = talloc_strdup(ctx, "TMXXXXXX");
-        }
-
-        if (!fname) {
-                reply_nterror(req, NT_STATUS_NO_MEMORY);
-                goto out;
-        }
-
-        status = filename_convert(ctx, conn,
+
+        for (i = 0; i < 10; i++) {
+                if (*wire_name) {
+                        fname = talloc_asprintf(ctx,
+                                        "%s/TMP%s",
+                                        wire_name,
+                                        generate_random_str_list(ctx, 5, "0123456789"));
+                } else {
+                        fname = talloc_asprintf(ctx,
+                                        "TMP%s",
+                                        generate_random_str_list(ctx, 5, "0123456789"));
+                }
+
+                if (!fname) {
+                        reply_nterror(req, NT_STATUS_NO_MEMORY);
+                        goto out;
+                }
+
+                status = filename_convert(ctx, conn,
                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
                                 fname,
-                                0,
+                                UCF_CREATING_FILE,
                                 NULL,
                                 &smb_fname);
-        if (!NT_STATUS_IS_OK(status)) {
-                if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
-                        reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
+                if (!NT_STATUS_IS_OK(status)) {
+                        if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
+                                reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
                                         ERRSRV, ERRbadpath);
+                                goto out;
+                        }
+                        reply_nterror(req, status);
                         goto out;
                 }
+
+                /* Create the file. */
+                status = SMB_VFS_CREATE_FILE(
+                        conn,                                   /* conn */
+                        req,                                    /* req */
+                        0,                                      /* root_dir_fid */
+                        smb_fname,                              /* fname */
+                        FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
+                        FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
+                        FILE_CREATE,                            /* create_disposition*/
+                        0,                                      /* create_options */
+                        fattr,                                  /* file_attributes */
+                        oplock_request,                         /* oplock_request */
+                        0,                                      /* allocation_size */
+                        0,                                      /* private_flags */
+                        NULL,                                   /* sd */
+                        NULL,                                   /* ea_list */
+                        &fsp,                                   /* result */
+                        NULL);                                  /* pinfo */
+
+                if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
+                        TALLOC_FREE(fname);
+                        TALLOC_FREE(smb_fname);
+                        continue;
+                }
+
+                if (!NT_STATUS_IS_OK(status)) {
+                        if (open_was_deferred(req->mid)) {
+                                /* We have re-scheduled this call. */
+                                goto out;
+                        }
+                        reply_openerror(req, status);
+                        goto out;
+                }
+
+                break;
+        }
+
+        if (i == 10) {
+                /* Collision after 10 times... */
                 reply_nterror(req, status);
-                goto out;
-        }
-
-        tmpfd = mkstemp(smb_fname->base_name);
-        if (tmpfd == -1) {
-                reply_nterror(req, map_nt_error_from_unix(errno));
-                goto out;
-        }
-
-        SMB_VFS_STAT(conn, smb_fname);
-
-        /* We should fail if file does not exist. */
-        status = SMB_VFS_CREATE_FILE(
-                conn,                                   /* conn */
-                req,                                    /* req */
-                0,                                      /* root_dir_fid */
-                smb_fname,                              /* fname */
-                FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
-                FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
-                FILE_OPEN,                              /* create_disposition*/
-                0,                                      /* create_options */
-                fattr,                                  /* file_attributes */
-                oplock_request,                         /* oplock_request */
-                0,                                      /* allocation_size */
-                0,                                      /* private_flags */
-                NULL,                                   /* sd */
-                NULL,                                   /* ea_list */
-                &fsp,                                   /* result */
-                NULL);                                  /* pinfo */
-
-        /* close fd from mkstemp() */
-        close(tmpfd);
-
-        if (!NT_STATUS_IS_OK(status)) {
-                if (open_was_deferred(req->mid)) {
-                        /* We have re-scheduled this call. */
-                        goto out;
-                }
-                reply_openerror(req, status);
                 goto out;
         }
@@ -2370 +2382 @@
  out:
         TALLOC_FREE(smb_fname);
+        TALLOC_FREE(fname);
+        TALLOC_FREE(wire_name);
         END_PROFILE(SMBctemp);
         return;
@@ -3137 +3151 @@
         START_PROFILE(SMBreadbraw);
 
-        if (srv_is_signing_active(sconn) ||
-            is_encrypted_packet(req->inbuf)) {
+        if (srv_is_signing_active(sconn) || req->encrypted) {
                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
                         "raw reads/writes are disallowed.");
@@ -3531 +3544 @@
         int saved_errno = 0;
 
-        if(fsp_stat(fsp) == -1) {
-                reply_nterror(req, map_nt_error_from_unix(errno));
-                return;
-        }
-
         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
@@ -3543 +3551 @@
                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
                 return;
-        }
-
-        if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
-                        (startpos > fsp->fsp_name->st.st_ex_size)
-                        || (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
-                /*
-                 * We already know that we would do a short read, so don't
-                 * try the sendfile() path.
-                 */
-                goto nosendfile_read;
         }
 
@@ -3562 +3560 @@
 
         if (!req_is_in_chain(req) &&
-            !is_encrypted_packet(req->inbuf) && (fsp->base_fsp == NULL) &&
+            !req->encrypted && (fsp->base_fsp == NULL) &&
             (fsp->wcp == NULL) &&
             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
                 uint8 headerbuf[smb_size + 12 * 2];
                 DATA_BLOB header;
+
+                if(fsp_stat(fsp) == -1) {
+                        reply_nterror(req, map_nt_error_from_unix(errno));
+                        goto strict_unlock;
+                }
+
+                if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
+                    (startpos > fsp->fsp_name->st.st_ex_size) ||
+                    (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
+                        /*
+                         * We already know that we would do a short read, so don't
+                         * try the sendfile() path.
+                         */
+                        goto nosendfile_read;
+                }
 
                 /*
@@ -3766 +3779 @@
                         }
                         /* We currently don't do this on signed or sealed data. */
-                        if (srv_is_signing_active(req->sconn) ||
-                            is_encrypted_packet(req->inbuf)) {
+                        if (srv_is_signing_active(req->sconn) || req->encrypted) {
                                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
                                 END_PROFILE(SMBreadX);
@@ -5530 +5542 @@
                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
                                  directory,
-                                 0,
+                                 UCF_CREATING_FILE,
                                  NULL,
                                  &smb_dname);
@@ -6188 +6200 @@
                           smb_fname_str_dbg(smb_fname_dst)));
 
-                if (!lp_posix_pathnames() &&
+                if (!fsp->is_directory &&
+                    !lp_posix_pathnames() &&
                     (lp_map_archive(SNUM(conn)) ||
                     lp_store_dos_attributes(SNUM(conn)))) {

vendor/current/source3/smbd/server.c

@@ -109 +109 @@
         change_to_root_user();
         reload_services(msg, smbd_server_conn->sock, False);
-        if (am_parent) {
-                pcap_cache_reload(ev_ctx, msg,
-                                  &reload_pcap_change_notify);
-        }
+        /* printer reload triggered by background printing process */
 }
 
@@ -132 +129 @@
         reload_printers(ev_ctx, msg);
 }
+
+static void smbd_sig_term_handler(struct tevent_context *ev,
+                                  struct tevent_signal *se,
+                                  int signum,
+                                  int count,
+                                  void *siginfo,
+                                  void *private_data)
+{
+        exit_server_cleanly("termination signal");
+}
+
+static void smbd_setup_sig_term_handler(void)
+{
+        struct tevent_signal *se;
+
+        se = tevent_add_signal(smbd_event_context(),
+                               smbd_event_context(),
+                               SIGTERM, 0,
+                               smbd_sig_term_handler,
+                               NULL);
+        if (!se) {
+                exit_server("failed to setup SIGTERM handler");
+        }
+}
+
+static void smbd_sig_hup_handler(struct tevent_context *ev,
+                                 struct tevent_signal *se,
+                                 int signum,
+                                 int count,
+                                 void *siginfo,
+                                 void *private_data)
+{
+        struct messaging_context *msg_ctx = talloc_get_type_abort(
+                private_data, struct messaging_context);
+        change_to_root_user();
+        DEBUG(1,("Reloading services after SIGHUP\n"));
+        reload_services(msg_ctx, smbd_server_conn->sock, false);
+}
+
+static void smbd_setup_sig_hup_handler(struct tevent_context *ev,
+                                       struct messaging_context *msg_ctx)
+{
+        struct tevent_signal *se;
+
+        se = tevent_add_signal(ev, ev, SIGHUP, 0, smbd_sig_hup_handler,
+                               msg_ctx);
+        if (!se) {
+                exit_server("failed to setup SIGHUP handler");
+        }
+}
+
 
 /*******************************************************************
@@ -773 +821 @@
                            smb_stat_cache_delete);
         messaging_register(msg_ctx, NULL, MSG_DEBUG, smbd_msg_debug);
-        messaging_register(msg_ctx, server_event_context(), MSG_PRINTER_PCAP,
-                           smb_pcap_updated);
         brl_register_msgs(msg_ctx);
 
@@ -1235 +1281 @@
                 exit(1);
 
-        /* Publish nt printers, this requires a working winreg pipe */
-        pcap_cache_reload(server_event_context(), smbd_messaging_context(),
-                          &reload_printers);
-
         /* only start the background queue daemon if we are 
            running as a daemon -- bad things will happen if
@@ -1246 +1288 @@
         if (is_daemon && !interactive
             && lp_parm_bool(-1, "smbd", "backgroundqueue", true)) {
-                start_background_queue(smbd_event_context(),
-                                       smbd_messaging_context());
+                /* background queue is responsible for printcap cache updates */
+                messaging_register(smbd_server_conn->msg_ctx,
+                                   smbd_event_context(),
+                                   MSG_PRINTER_PCAP, smb_pcap_updated);
+                start_background_queue(server_event_context(),
+                                       smbd_server_conn->msg_ctx);
+        } else {
+                DEBUG(3, ("running without background printer process, dynamic "
+                          "printer updates disabled\n"));
+                /* Publish nt printers, this requires a working winreg pipe */
+                pcap_cache_reload(server_event_context(),
+                                  smbd_messaging_context(),
+                                  &reload_printers_full);
         }
 

vendor/current/source3/smbd/server_reload.c

@@ -37 +37 @@
                      struct messaging_context *msg_ctx)
 {
+        int n_services;
+        int pnum;
+        int snum;
+        const char *pname;
+
+        n_services = lp_numservices();
+        pnum = lp_servicenumber(PRINTERS_NAME);
+
+        DEBUG(10, ("reloading printer services from pcap cache\n"));
+
+        /*
+         * Add default config for printers added to smb.conf file and remove
+         * stale printers
+         */
+        for (snum = 0; snum < n_services; snum++) {
+                /* avoid removing PRINTERS_NAME */
+                if (snum == pnum) {
+                        continue;
+                }
+
+                /* skip no-printer services */
+                if (!(lp_snum_ok(snum) && lp_print_ok(snum))) {
+                        continue;
+                }
+
+                pname = lp_printername(snum);
+
+                /* check printer, but avoid removing non-autoloaded printers */
+                if (lp_autoloaded(snum) && !pcap_printername_ok(pname)) {
+                        DEBUG(3, ("removing stale printer %s\n", pname));
+                        lp_killservice(snum);
+                }
+        }
+
+        /* Make sure deleted printers are gone */
+        load_printers(ev, msg_ctx);
+}
+
+/****************************************************************************
+ purge stale printers and reload from pre-populated pcap cache
+**************************************************************************/
+void reload_printers_full(struct tevent_context *ev,
+                          struct messaging_context *msg_ctx)
+{
         struct auth_serversupplied_info *session_info = NULL;
-        struct spoolss_PrinterInfo2 *pinfo2 = NULL;
         int n_services;
         int pnum;
@@ -46 +89 @@
         NTSTATUS status;
 
-        load_printers(ev, msg_ctx);
-
         n_services = lp_numservices();
         pnum = lp_servicenumber(PRINTERS_NAME);
 
-        DEBUG(10, ("reloading printer services from pcap cache\n"));
-
-        status = make_session_info_system(talloc_tos(), &session_info);
+        status = make_session_info_system(talloc_new(NULL), &session_info);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(3, ("reload_printers: "
-                          "Could not create system session_info\n"));
+                DEBUG(3, ("Could not create system session_info\n"));
                 /* can't remove stale printers before we
                  * are fully initilized */
@@ -82 +120 @@
                 /* check printer, but avoid removing non-autoloaded printers */
                 if (lp_autoloaded(snum) && !pcap_printername_ok(pname)) {
-                        DEBUG(3, ("removing stale printer %s\n", pname));
-
+                        struct spoolss_PrinterInfo2 *pinfo2 = NULL;
                         if (is_printer_published(session_info, session_info,
                                                  msg_ctx,
-                                                 NULL, lp_servicename(snum),
-                                                 NULL, &pinfo2)) {
+                                                 NULL,
+                                                 lp_servicename(snum),
+                                                 &pinfo2)) {
                                 nt_printer_publish(session_info,
                                                    session_info,
@@ -97 +135 @@
                         nt_printer_remove(session_info, session_info, msg_ctx,
                                           pname);
-                        lp_killservice(snum);
                 } else {
                         DEBUG(8, ("Adding default registry entry for printer "
@@ -106 +143 @@
         }
 
-        /* Make sure deleted printers are gone */
-        load_printers(ev, msg_ctx);
+        /* finally, purge old snums */
+        reload_printers(ev, msg_ctx);
 
         TALLOC_FREE(session_info);
@@ -161 +198 @@
         return(ret);
 }
-
-/****************************************************************************
- Notify smbds of new printcap data
-**************************************************************************/
-void reload_pcap_change_notify(struct tevent_context *ev,
-                               struct messaging_context *msg_ctx)
-{
-        /*
-         * Reload the printers first in the background process so that
-         * newly added printers get default values created in the registry.
-         *
-         * This will block the process for some time (~1 sec per printer), but
-         * it doesn't block smbd's servering clients.
-         */
-        reload_printers(ev, msg_ctx);
-
-        message_send_all(msg_ctx, MSG_PRINTER_PCAP, NULL, 0, NULL);
-}

vendor/current/source3/smbd/service.c

@@ -657 +657 @@
                 }
 
-                return make_serverinfo_from_username(mem_ctx, user, guest,
+                return make_serverinfo_from_username(mem_ctx, user, guest, guest,
                                                      presult);
         }
@@ -691 +691 @@
 
                 status = make_serverinfo_from_username(
-                        conn, fuser, conn->session_info->guest,
+                        conn, fuser, false, conn->session_info->guest,
                         &forced_serverinfo);
                 if (!NT_STATUS_IS_OK(status)) {

vendor/current/source3/smbd/sesssetup.c

@@ -906 +906 @@
                         (unsigned int)pblob->length ));
 
+                if (pblob->length > pad->needed_len) {
+                        DEBUG(2, ("subsequent security token data length %u "
+                                  "exceeds expected length %u\n",
+                                  (unsigned int)pblob->length,
+                                  (unsigned int)pad->needed_len));
+                }
+
                 tmp_blob = data_blob(NULL,
                                 pad->partial_data.length + copy_len);
@@ -1166 +1173 @@
         status = check_spnego_blob_complete(sconn, smbpid, vuid, &blob1);
         if (!NT_STATUS_IS_OK(status)) {
+                /*
+                 * Pack error response, ensuring to fill NativeOS, NativeLanMan
+                 * & PrimaryDomain fields on NT_STATUS_MORE_PROCESSING_REQUIRED
+                 */
+                reply_outbuf(req, 4, 0);
+                reply_sesssetup_blob(req, data_blob_null, status);
                 if (!NT_STATUS_EQUAL(status,
                                 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
@@ -1172 +1185 @@
                 }
                 data_blob_free(&blob1);
-                reply_nterror(req, nt_status_squash(status));
                 return;
         }

vendor/current/source3/smbd/smb2_create.c

@@ -695 +695 @@
                                           smb1req->flags2 & FLAGS2_DFS_PATHNAMES,
                                           fname,
-                                          0,
+                                          (in_create_disposition == FILE_CREATE) ?
+                                                UCF_CREATING_FILE : 0,
                                           NULL,
                                           &smb_fname);
@@ -894 +895 @@
                 return false;
         }
-        if (!smb2req->async) {
-                return false;
-        }
         req = smb2req->subreq;
         if (!req) {
@@ -903 +901 @@
         state = tevent_req_data(req, struct smbd_smb2_create_state);
         if (!state) {
+                return false;
+        }
+        if (!state->open_was_deferred) {
                 return false;
         }

vendor/current/source3/smbd/smb2_getinfo.c

@@ -149 +149 @@
         }
 
-        if (!NT_STATUS_IS_OK(call_status)) {
+        /* some GetInfo responses set STATUS_BUFFER_OVERFLOW and return partial,
+           but valid data */
+        if (!(NT_STATUS_IS_OK(call_status) ||
+              NT_STATUS_EQUAL(call_status, STATUS_BUFFER_OVERFLOW))) {
                 /* Return a specific error with data. */
                 error = smbd_smb2_request_error_ex(req,
@@ -186 +189 @@
         outdyn = out_output_buffer;
 
-        error = smbd_smb2_request_done(req, outbody, &outdyn);
+        error = smbd_smb2_request_done_ex(req, call_status, outbody, &outdyn, __location__);
         if (!NT_STATUS_IS_OK(error)) {
                 smbd_server_connection_terminate(req->sconn,
@@ -271 +274 @@
 
         switch (in_info_type) {
-        case 0x01:/* SMB2_GETINFO_FILE */
+        case SMB2_GETINFO_FILE:
         {
                 uint16_t file_info_level;
@@ -282 +285 @@
                 int lock_data_count = 0;
                 char *lock_data = NULL;
+                size_t fixed_portion;
 
                 ZERO_STRUCT(write_time_ts);
@@ -369 +373 @@
                                                STR_UNICODE,
                                                in_output_buffer_length,
+                                               &fixed_portion,
                                                &data,
                                                &data_size);
@@ -377 +382 @@
                         }
                         tevent_req_nterror(req, status);
+                        return tevent_req_post(req, ev);
+                }
+                if (in_output_buffer_length < fixed_portion) {
+                        SAFE_FREE(data);
+                        tevent_req_nterror(
+                                req, NT_STATUS_INFO_LENGTH_MISMATCH);
                         return tevent_req_post(req, ev);
                 }
@@ -387 +398 @@
                                 return tevent_req_post(req, ev);
                         }
+                        if (data_size > in_output_buffer_length) {
+                                state->out_output_buffer.length =
+                                        in_output_buffer_length;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
                 }
                 SAFE_FREE(data);
@@ -392 +408 @@
         }
 
-        case 0x02:/* SMB2_GETINFO_FS */
+        case SMB2_GETINFO_FS:
         {
                 uint16_t file_info_level;
                 char *data = NULL;
                 int data_size = 0;
+                size_t fixed_portion;
 
                 /* the levels directly map to the passthru levels */
@@ -405 +422 @@
                                          STR_UNICODE,
                                          in_output_buffer_length,
+                                         &fixed_portion,
+                                         fsp->fsp_name,
                                          &data,
                                          &data_size);
-                if (!NT_STATUS_IS_OK(status)) {
+                /* some responses set STATUS_BUFFER_OVERFLOW and return
+                   partial, but valid data */
+                if (!(NT_STATUS_IS_OK(status) ||
+                      NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW))) {
                         SAFE_FREE(data);
                         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) {
@@ -413 +435 @@
                         }
                         tevent_req_nterror(req, status);
+                        return tevent_req_post(req, ev);
+                }
+                if (in_output_buffer_length < fixed_portion) {
+                        SAFE_FREE(data);
+                        tevent_req_nterror(
+                                req, NT_STATUS_INFO_LENGTH_MISMATCH);
                         return tevent_req_post(req, ev);
                 }
@@ -423 +451 @@
                                 return tevent_req_post(req, ev);
                         }
+                        if (data_size > in_output_buffer_length) {
+                                state->out_output_buffer.length =
+                                        in_output_buffer_length;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
                 }
                 SAFE_FREE(data);
@@ -428 +461 @@
         }
 
-        case 0x03:/* SMB2_GETINFO_SEC */
+        case SMB2_GETINFO_SECURITY:
         {
                 uint8_t *p_marshalled_sd = NULL;
@@ -485 +518 @@
         }
 
+        state->status = status;
         tevent_req_done(req);
         return tevent_req_post(req, ev);

vendor/current/source3/smbd/smb2_server.c

@@ -928 +928 @@
         uint64_t message_id = 0;
         uint64_t async_id = 0;
-        struct iovec *outvec = NULL;
 
         if (!tevent_req_is_in_progress(subreq)) {
@@ -945 +944 @@
                 /*
                  * We're trying to go async in a compound
-                 * request chain. This is not allowed.
-                 * Cancel the outstanding request.
-                 */
-                bool ok = tevent_req_cancel(req->subreq);
-                if (ok) {
-                        return NT_STATUS_OK;
-                }
-                TALLOC_FREE(req->subreq);
-                return smbd_smb2_request_error(req,
-                        NT_STATUS_INTERNAL_ERROR);
+                 * request chain.
+                 * This is only allowed for opens that
+                 * cause an oplock break, otherwise it
+                 * is not allowed. See [MS-SMB2].pdf
+                 * note <194> on Section 3.3.5.2.7.
+                 */
+                const uint8_t *inhdr =
+                        (const uint8_t *)req->in.vector[i].iov_base;
+
+                if (SVAL(inhdr, SMB2_HDR_OPCODE) != SMB2_OP_CREATE) {
+                        /*
+                         * Cancel the outstanding request.
+                         */
+                        bool ok = tevent_req_cancel(req->subreq);
+                        if (ok) {
+                                return NT_STATUS_OK;
+                        }
+                        TALLOC_FREE(req->subreq);
+                        return smbd_smb2_request_error(req,
+                                NT_STATUS_INTERNAL_ERROR);
+                }
         }
 
@@ -963 +973 @@
         }
 
-        if (req->out.vector_count > 4) {
-                /* This is a compound reply. We
-                 * must do an interim response
-                 * followed by the async response
-                 * to match W2K8R2.
+        if (i > 1) {
+                /*
+                 * We're going async in a compound
+                 * chain after the first request has
+                 * already been processed. Send an
+                 * interim response containing the
+                 * set of replies already generated.
                  */
                 status = smb2_send_async_interim_response(req);
@@ -974 +986 @@
                 }
 
-                /*
-                 * We're splitting off the last SMB2
-                 * request in a compound set, and the
-                 * smb2_send_async_interim_response()
-                 * call above just sent all the replies
-                 * for the previous SMB2 requests in
-                 * this compound set. So we're no longer
-                 * in the "compound_related_in_progress"
-                 * state, and this is no longer a compound
-                 * request.
-                 */
-                req->compound_related = false;
-                req->sconn->smb2.compound_related_in_progress = false;
+                req->current_idx = 1;
+
+                /*
+                 * Re-arrange the in.vectors to remove what
+                 * we just sent.
+                 */
+                memmove(&req->in.vector[1],
+                        &req->in.vector[i],
+                        sizeof(req->in.vector[0])*(req->in.vector_count - i));
+                req->in.vector_count = 1 + (req->in.vector_count - i);
+
+                smb2_setup_nbt_length(req->in.vector, req->in.vector_count);
+
+                /* Re-arrange the out.vectors to match. */
+                memmove(&req->out.vector[1],
+                        &req->out.vector[i],
+                        sizeof(req->out.vector[0])*(req->out.vector_count - i));
+                req->out.vector_count = 1 + (req->out.vector_count - i);
+
+                if (req->in.vector_count == 4) {
+                        uint8_t *outhdr = (uint8_t *)req->out.vector[i].iov_base;
+                        /*
+                         * We only have one remaining request as
+                         * we've processed everything else.
+                         * This is no longer a compound request.
+                         */
+                        req->compound_related = false;
+                        flags = (IVAL(outhdr, SMB2_HDR_FLAGS) & ~SMB2_HDR_FLAG_CHAINED);
+                        SIVAL(outhdr, SMB2_HDR_FLAGS, flags);
+                }
         }
 
         /* Don't return an intermediate packet on a pipe read/write. */
         if (req->tcon && req->tcon->compat_conn && IS_IPC(req->tcon->compat_conn)) {
-                goto ipc_out;
+                goto out;
         }
 
@@ -1081 +1110 @@
         /* Note we're going async with this request. */
         req->async = true;
-
-  ipc_out:
-
-        /*
-         * Now manipulate req so that the outstanding async request
-         * is the only one left in the struct smbd_smb2_request.
-         */
-
-        if (req->current_idx == 1) {
-                /* There was only one. */
-                goto out;
-        }
-
-        /* Re-arrange the in.vectors. */
-        req->in.vector[1] = req->in.vector[i];
-        req->in.vector[2] = req->in.vector[i+1];
-        req->in.vector[3] = req->in.vector[i+2];
-        req->in.vector_count = 4;
-        /* Reset the new in size. */
-        smb2_setup_nbt_length(req->in.vector, 4);
-
-        /* Now recreate the out.vectors. */
-        outvec = talloc_zero_array(req, struct iovec, 4);
-        if (!outvec) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        /* 0 is always boilerplate and must
-         * be of size 4 for the length field. */
-
-        outvec[0].iov_base = req->out.nbt_hdr;
-        outvec[0].iov_len = 4;
-        SIVAL(req->out.nbt_hdr, 0, 0);
-
-        if (!dup_smb2_vec3(outvec, &outvec[1], &req->out.vector[i])) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        TALLOC_FREE(req->out.vector);
-
-        req->out.vector = outvec;
-
-        req->current_idx = 1;
-        req->out.vector_count = 4;
 
   out:
@@ -1178 +1163 @@
                 uint64_t message_id;
                 uint64_t async_id;
+
+                if (cur->compound_related) {
+                        /*
+                         * Never cancel anything in a compound request.
+                         * Way too hard to deal with the result.
+                         */
+                        continue;
+                }
 
                 i = cur->current_idx;
@@ -1361 +1354 @@
         if (flags & SMB2_HDR_FLAG_CHAINED) {
                 req->compound_related = true;
-                req->sconn->smb2.compound_related_in_progress = true;
         }
 
@@ -1803 +1795 @@
                         return NT_STATUS_NO_MEMORY;
                 }
+
+                if (req->do_signing) {
+                        /*
+                         * We sign each reply as we go along.
+                         * We can do this as smb2_calculate_credits()
+                         * grants zero credits on every part of a
+                         * compound reply except the last one,
+                         * which is signed just before calling
+                         * tstream_writev_queue_send().
+                         */
+                        NTSTATUS status;
+                        status = smb2_signing_sign_pdu(req->session->session_key,
+                                               &req->out.vector[i], 3);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                TALLOC_FREE(im);
+                                return status;
+                        }
+                }
+
                 tevent_schedule_immediate(im,
                                         req->sconn->smb2.event_ctx,
@@ -1812 +1823 @@
         if (req->compound_related) {
                 req->compound_related = false;
-                req->sconn->smb2.compound_related_in_progress = false;
         }
 
@@ -2529 +2539 @@
         struct tevent_req *subreq;
 
-        if (sconn->smb2.compound_related_in_progress) {
-                /*
-                 * Can't read another until the related
-                 * compound is done.
-                 */
-                return NT_STATUS_OK;
-        }
-
         if (tevent_queue_length(sconn->smb2.recv_queue) > 0) {
                 /*

vendor/current/source3/smbd/smb2_tcon.c

@@ -208 +208 @@
         }
 
+        /* Don't allow connection if encryption is required. */
+        if (lp_smb_encrypt(snum) == Required) {
+                DEBUG(0,("Connection refused on share %s as encryption is"
+                        " required on this share and SMB2 does not support"
+                        " this.\n",
+                        lp_servicename(snum)));
+                return NT_STATUS_ACCESS_DENIED;
+        }
+
         /* create a new tcon as child of the session */
         tcon = talloc_zero(req->session, struct smbd_smb2_tcon);

vendor/current/source3/smbd/trans2.c

@@ -25 +25 @@
 
 #include "includes.h"
+#include "ntioctl.h"
 #include "system/filesys.h"
 #include "version.h"
@@ -329 +330 @@
                 }
 
+                if (listp->ea.value.length == 0) {
+                        /*
+                         * We can never return a zero length EA.
+                         * Windows reports the EA's as corrupted.
+                         */
+                        TALLOC_FREE(listp);
+                        continue;
+                }
+
                 push_ascii_fstring(dos_ea_name, listp->ea.name);
 
@@ -412 +422 @@
         uint8_t *p = (uint8_t *)pdata;
         uint8_t *last_start = NULL;
+        bool store_data = (pdata != NULL);
 
         *ret_data_size = 0;
@@ -423 +434 @@
                 fstring dos_ea_name;
                 size_t this_size;
-
-                if (last_start) {
+                size_t pad = 0;
+
+                if (last_start && store_data) {
                         SIVAL(last_start, 0, PTR_DIFF(p, last_start));
                 }
@@ -441 +453 @@
 
                 if (ea_list->next) {
-                        size_t pad = 4 - (this_size % 4);
+                        pad = (4 - (this_size % 4)) % 4;
                         this_size += pad;
                 }
@@ -450 +462 @@
 
                 /* We know we have room. */
-                SIVAL(p, 0x00, 0); /* next offset */
-                SCVAL(p, 0x04, ea_list->ea.flags);
-                SCVAL(p, 0x05, dos_namelen);
-                SSVAL(p, 0x06, ea_list->ea.value.length);
-                fstrcpy((char *)(p+0x08), dos_ea_name);
-                memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
+                if (store_data) {
+                        SIVAL(p, 0x00, 0); /* next offset */
+                        SCVAL(p, 0x04, ea_list->ea.flags);
+                        SCVAL(p, 0x05, dos_namelen);
+                        SSVAL(p, 0x06, ea_list->ea.value.length);
+                        fstrcpy((char *)(p+0x08), dos_ea_name);
+                        memcpy(p + 0x08 + dos_namelen + 1, ea_list->ea.value.data, ea_list->ea.value.length);
+                        if (pad) {
+                                memset(p + 0x08 + dos_namelen + 1 + ea_list->ea.value.length,
+                                        '\0',
+                                        pad);
+                        }
+                }
 
                 total_data_size -= this_size;
@@ -469 +488 @@
 {
         size_t total_ea_len = 0;
+        struct ea_list *ea_list = NULL;
         TALLOC_CTX *mem_ctx = NULL;
 
@@ -475 +495 @@
         }
         mem_ctx = talloc_tos();
-        (void)get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
+        ea_list = get_ea_list_from_file(mem_ctx, conn, fsp, fname, &total_ea_len);
+        if (ea_list == NULL) {
+                return 0;
+        }
+        if(conn->sconn->using_smb2) {
+                NTSTATUS status;
+                unsigned int ret_data_size;
+                /*
+                 * We're going to be using fill_ea_chained_buffer() to
+                 * marshall EA's - this size is significantly larger
+                 * than the SMB1 buffer. Re-calculate the size without
+                 * marshalling.
+                 */
+                status = fill_ea_chained_buffer(mem_ctx,
+                                                NULL,
+                                                65535,
+                                                &ret_data_size,
+                                                conn,
+                                                ea_list);
+                if (!NT_STATUS_IS_OK(status)) {
+                        ret_data_size = 0;
+                }
+                total_ea_len = ret_data_size;
+        }
+
         return total_ea_len;
 }
@@ -1731 +1775 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length. */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p += 4;
-                }
+                }
+                p += 4;
                 /* Clear the short name buffer. This is
                  * IMPORTANT as not doing so will trigger
@@ -1908 +1954 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length. */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p +=4;
-                }
+                }
+                p +=4;
                 SIVAL(p,0,0); p += 4; /* Unknown - reserved ? */
                 SBVAL(p,0,file_index); p += 8;
@@ -1954 +2002 @@
                 SIVAL(p,0,mode); p += 4;
                 q = p; p += 4; /* q is placeholder for name length */
-                {
+                if (mode & FILE_ATTRIBUTE_REPARSE_POINT) {
+                        SIVAL(p, 0, IO_REPARSE_TAG_DFS);
+                } else {
                         unsigned int ea_size = estimate_ea_size(conn, NULL,
                                                                 smb_fname->base_name);
                         SIVAL(p,0,ea_size); /* Extended attributes */
-                        p +=4;
-                }
+                }
+                p +=4;
                 /* Clear the short name buffer. This is
                  * IMPORTANT as not doing so will trigger
@@ -2922 +2972 @@
                          uint16_t flags2,
                          unsigned int max_data_bytes,
+                         size_t *fixed_portion,
+                         struct smb_filename *fname,
                          char **ppdata,
                          int *ret_data_len)
@@ -2930 +2982 @@
         int snum = SNUM(conn);
         char *fstype = lp_fstype(SNUM(conn));
+        const char *filename = NULL;
         uint32 additional_flags = 0;
-        struct smb_filename smb_fname_dot;
+        struct smb_filename smb_fname;
         SMB_STRUCT_STAT st;
+        NTSTATUS status = NT_STATUS_OK;
+
+        if (fname == NULL || fname->base_name == NULL) {
+                filename = ".";
+        } else {
+                filename = fname->base_name;
+        }
 
         if (IS_IPC(conn)) {
@@ -2945 +3005 @@
         DEBUG(3,("smbd_do_qfsinfo: level = %d\n", info_level));
 
-        ZERO_STRUCT(smb_fname_dot);
-        smb_fname_dot.base_name = discard_const_p(char, ".");
-
-        if(SMB_VFS_STAT(conn, &smb_fname_dot) != 0) {
+        ZERO_STRUCT(smb_fname);
+        smb_fname.base_name = discard_const_p(char, filename);
+
+        if(SMB_VFS_STAT(conn, &smb_fname) != 0) {
                 DEBUG(2,("stat of . failed (%s)\n", strerror(errno)));
                 return map_nt_error_from_unix(errno);
         }
 
-        st = smb_fname_dot.st;
+        st = smb_fname.st;
 
         *ppdata = (char *)SMB_REALLOC(
@@ -2964 +3024 @@
         memset((char *)pdata,'\0',max_data_bytes + DIR_ENTRY_SAFETY_MARGIN);
         end_data = pdata + max_data_bytes + DIR_ENTRY_SAFETY_MARGIN - 1;
+
+        *fixed_portion = 0;
 
         switch (info_level) {
@@ -2970 +3032 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 18;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3057 +3119 @@
                         SIVAL(pdata,8,len);
                         data_len = 12 + len;
+                        if (max_data_bytes >= 16 && data_len > max_data_bytes) {
+                                /* the client only requested a portion of the
+                                   file system name */
+                                data_len = max_data_bytes;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
+                        *fixed_portion = 16;
                         break;
 
@@ -3086 +3155 @@
                         DEBUG(5,("smbd_do_qfsinfo : SMB_QUERY_FS_VOLUME_INFO namelen = %d, vol=%s serv=%s\n",
                                 (int)strlen(vname),vname, lp_servicename(snum)));
+                        if (max_data_bytes >= 24 && data_len > max_data_bytes) {
+                                /* the client only requested a portion of the
+                                   volume label */
+                                data_len = max_data_bytes;
+                                status = STATUS_BUFFER_OVERFLOW;
+                        }
+
                         break;
 
@@ -3093 +3169 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 24;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3118 +3194 @@
                         SIVAL(pdata,16,sectors_per_unit);
                         SIVAL(pdata,20,bytes_per_sector);
+                        *fixed_portion = 24;
                         break;
                 }
@@ -3125 +3202 @@
                         uint64_t dfree,dsize,bsize,block_size,sectors_per_unit,bytes_per_sector;
                         data_len = 32;
-                        if (get_dfree_info(conn,".",False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
+                        if (get_dfree_info(conn,filename,False,&bsize,&dfree,&dsize) == (uint64_t)-1) {
                                 return map_nt_error_from_unix(errno);
                         }
@@ -3151 +3228 @@
                         SIVAL(pdata,24,sectors_per_unit); /* Sectors per allocation unit. */
                         SIVAL(pdata,28,bytes_per_sector); /* Bytes per sector. */
+                        *fixed_portion = 32;
                         break;
                 }
@@ -3165 +3243 @@
                         SIVAL(pdata,0,FILE_DEVICE_DISK); /* dev type */
                         SIVAL(pdata,4,characteristics);
+                        *fixed_portion = 8;
                         break;
                 }
@@ -3318 +3397 @@
                         }
 
-                        rc = SMB_VFS_STATVFS(conn, ".", &svfs);
+                        rc = SMB_VFS_STATVFS(conn, filename, &svfs);
 
                         if (!rc) {
@@ -3339 +3418 @@
                                 return NT_STATUS_DOS(ERRSRV, ERRerror);
                         }
+                        *fixed_portion = 24;
                         break;
                 }
@@ -3469 +3549 @@
 
         *ret_data_len = data_len;
-        return NT_STATUS_OK;
+        return status;
 }
 
@@ -3485 +3565 @@
         uint16_t info_level;
         int data_len = 0;
+        size_t fixed_portion;
         NTSTATUS status;
 
@@ -3511 +3592 @@
                                  req->flags2,
                                  max_data_bytes,
+                                 &fixed_portion,
+                                 NULL,
                                  ppdata, &data_len);
         if (!NT_STATUS_IS_OK(status)) {
@@ -4063 +4146 @@
         unsigned int ofs = 0;
 
-        for (i = 0; i < num_streams && ofs <= max_data_bytes; i++) {
+        if (max_data_bytes < 32) {
+                return NT_STATUS_INFO_LENGTH_MISMATCH;
+        }
+
+        for (i = 0; i < num_streams; i++) {
                 unsigned int next_offset;
                 size_t namelen;
@@ -4082 +4169 @@
                 namelen -= 2;
 
+                /*
+                 * We cannot overflow ...
+                 */
+                if ((ofs + 24 + namelen) > max_data_bytes) {
+                        DEBUG(10, ("refusing to overflow reply at stream %u\n",
+                                i));
+                        TALLOC_FREE(namebuf);
+                        return STATUS_BUFFER_OVERFLOW;
+                }
+
                 SIVAL(data, ofs+4, namelen);
                 SOFF_T(data, ofs+8, streams[i].size);
@@ -4096 +4193 @@
                         unsigned int align = ndr_align_size(next_offset, 8);
 
+                        if ((next_offset + align) > max_data_bytes) {
+                                DEBUG(10, ("refusing to overflow align "
+                                        "reply at stream %u\n",
+                                        i));
+                                TALLOC_FREE(namebuf);
+                                return STATUS_BUFFER_OVERFLOW;
+                        }
+
                         memset(data+next_offset, 0, align);
                         next_offset += align;
@@ -4105 +4210 @@
                 ofs = next_offset;
         }
+
+        DEBUG(10, ("max_data: %u, data_size: %u\n", max_data_bytes, ofs));
 
         *data_size = ofs;
@@ -4194 +4301 @@
                                uint16_t flags2,
                                unsigned int max_data_bytes,
+                               size_t *fixed_portion,
                                char **ppdata,
                                unsigned int *pdata_size)
@@ -4329 +4437 @@
         file_index = get_FileIndex(conn, psbuf);
 
+        *fixed_portion = 0;
+
         switch (info_level) {
                 case SMB_INFO_STANDARD:
@@ -4466 +4576 @@
                         DEBUG(5,("change: %s ", ctime(&c_time)));
                         DEBUG(5,("mode: %x\n", mode));
+                        *fixed_portion = data_size;
                         break;
 
@@ -4479 +4590 @@
                         SCVAL(pdata,21,(mode&FILE_ATTRIBUTE_DIRECTORY)?1:0);
                         SSVAL(pdata,22,0); /* Padding. */
+                        *fixed_portion = 24;
                         break;
 
@@ -4488 +4600 @@
                         DEBUG(10,("smbd_do_qfilepathinfo: SMB_FILE_EA_INFORMATION\n"));
                         data_size = 4;
+                        *fixed_portion = 4;
                         SIVAL(pdata,0,ea_size);
                         break;
@@ -4509 +4622 @@
                         data_size = 4 + len;
                         SIVAL(pdata,0,len);
+                        *fixed_portion = 8;
                         break;
                 }
@@ -4572 +4686 @@
                         pdata += 4 + len;
                         data_size = PTR_DIFF(pdata,(*ppdata));
+                        *fixed_portion = 10;
                         break;
                 }
@@ -4609 +4724 @@
                         pdata += 4 + len;
                         data_size = PTR_DIFF(pdata,(*ppdata));
+                        *fixed_portion = 104;
                         break;
                 }
@@ -4616 +4732 @@
                         SBVAL(pdata, 0, file_index);
                         data_size = 8;
+                        *fixed_portion = 8;
                         break;
 
@@ -4622 +4739 @@
                         SIVAL(pdata, 0, access_mask);
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4639 +4757 @@
                         data_size = 1;
                         SCVAL(pdata,0,delete_pending);
+                        *fixed_portion = 1;
                         break;
 
@@ -4645 +4764 @@
                         data_size = 8;
                         SOFF_T(pdata,0,pos);
+                        *fixed_portion = 8;
                         break;
 
@@ -4651 +4771 @@
                         SIVAL(pdata,0,mode);
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4657 +4778 @@
                         SIVAL(pdata,0,0); /* No alignment needed. */
                         data_size = 4;
+                        *fixed_portion = 4;
                         break;
 
@@ -4695 +4817 @@
                                 DEBUG(10, ("marshall_stream_info failed: %s\n",
                                            nt_errstr(status)));
+                                TALLOC_FREE(streams);
                                 return status;
                         }
 
                         TALLOC_FREE(streams);
+
+                        *fixed_portion = 32;
 
                         break;
@@ -4709 +4834 @@
                         SIVAL(pdata,12,0); /* ??? */
                         data_size = 16;
+                        *fixed_portion = 16;
                         break;
 
@@ -4722 +4848 @@
                         SIVAL(pdata,52,0); /* ??? */
                         data_size = 56;
+                        *fixed_portion = 56;
                         break;
 
@@ -4729 +4856 @@
                         SIVAL(pdata,4,0);
                         data_size = 8;
+                        *fixed_portion = 8;
                         break;
 
@@ -4998 +5126 @@
         int lock_data_count = 0;
         char *lock_data = NULL;
+        size_t fixed_portion;
         NTSTATUS status = NT_STATUS_OK;
 
@@ -5359 +5488 @@
                                        lock_data_count, lock_data,
                                        req->flags2, max_data_bytes,
+                                       &fixed_portion,
                                        ppdata, &data_size);
         if (!NT_STATUS_IS_OK(status)) {
                 reply_nterror(req, status);
+                return;
+        }
+        if (fixed_portion > max_data_bytes) {
+                reply_nterror(req, NT_STATUS_INFO_LENGTH_MISMATCH);
                 return;
         }
@@ -7308 +7442 @@
                         create_disp = FILE_OPEN_IF;
                         break;
+                case SMB_O_EXCL:
+                        /* O_EXCL on its own without O_CREAT is undefined.
+                           We deliberately ignore it as some versions of
+                           Linux CIFSFS can send a bare O_EXCL on the
+                           wire which other filesystems in the kernel
+                           ignore. See bug 9519 for details. */
+
+                        /* Fallthrough. */
+
                 case 0:
                         /* File exists open. File not exist fail. */
                         create_disp = FILE_OPEN;
                         break;
-                case SMB_O_EXCL:
-                        /* O_EXCL on its own without O_CREAT is undefined. */
                 default:
                         DEBUG(5,("smb_posix_open: invalid create mode 0x%x\n",
@@ -7566 +7707 @@
                         }
                         /* Fail with sharing violation. */
+                        TALLOC_FREE(lck);
                         close_file(req, fsp, NORMAL_CLOSE);
-                        TALLOC_FREE(lck);
                         return NT_STATUS_SHARING_VIOLATION;
                 }
@@ -7581 +7722 @@
                                                 smb_fname);
 
+        TALLOC_FREE(lck);
+
         if (!NT_STATUS_IS_OK(status)) {
                 close_file(req, fsp, NORMAL_CLOSE);
-                TALLOC_FREE(lck);
                 return status;
         }
-        TALLOC_FREE(lck);
         return close_file(req, fsp, NORMAL_CLOSE);
 }