Home | History | Annotate | Download | only in smbsrv
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 /*
     27  * This module provides the common open functionality to the various
     28  * open and create SMB interface functions.
     29  */
     30 
     31 #include <sys/types.h>
     32 #include <sys/cmn_err.h>
     33 #include <sys/fcntl.h>
     34 #include <sys/nbmlock.h>
     35 #include <smbsrv/string.h>
     36 #include <smbsrv/smb_kproto.h>
     37 #include <smbsrv/smb_fsops.h>
     38 #include <smbsrv/smbinfo.h>
     39 
     40 volatile uint32_t smb_fids = 0;
     41 
     42 static uint32_t smb_open_subr(smb_request_t *);
     43 extern uint32_t smb_is_executable(char *);
     44 static void smb_delete_new_object(smb_request_t *);
     45 static int smb_set_open_timestamps(smb_request_t *, smb_ofile_t *, boolean_t);
     46 
     47 /*
     48  * smb_access_generic_to_file
     49  *
     50  * Search MSDN for IoCreateFile to see following mapping.
     51  *
     52  * GENERIC_READ		STANDARD_RIGHTS_READ, FILE_READ_DATA,
     53  *			FILE_READ_ATTRIBUTES and FILE_READ_EA
     54  *
     55  * GENERIC_WRITE	STANDARD_RIGHTS_WRITE, FILE_WRITE_DATA,
     56  *               FILE_WRITE_ATTRIBUTES, FILE_WRITE_EA, and FILE_APPEND_DATA
     57  *
     58  * GENERIC_EXECUTE	STANDARD_RIGHTS_EXECUTE, SYNCHRONIZE, and FILE_EXECUTE.
     59  */
     60 uint32_t
     61 smb_access_generic_to_file(uint32_t desired_access)
     62 {
     63 	uint32_t access = 0;
     64 
     65 	if (desired_access & GENERIC_ALL)
     66 		return (FILE_ALL_ACCESS & ~SYNCHRONIZE);
     67 
     68 	if (desired_access & GENERIC_EXECUTE) {
     69 		desired_access &= ~GENERIC_EXECUTE;
     70 		access |= (STANDARD_RIGHTS_EXECUTE |
     71 		    SYNCHRONIZE | FILE_EXECUTE);
     72 	}
     73 
     74 	if (desired_access & GENERIC_WRITE) {
     75 		desired_access &= ~GENERIC_WRITE;
     76 		access |= (FILE_GENERIC_WRITE & ~SYNCHRONIZE);
     77 	}
     78 
     79 	if (desired_access & GENERIC_READ) {
     80 		desired_access &= ~GENERIC_READ;
     81 		access |= FILE_GENERIC_READ;
     82 	}
     83 
     84 	return (access | desired_access);
     85 }
     86 
     87 /*
     88  * smb_omode_to_amask
     89  *
     90  * This function converts open modes used by Open and Open AndX
     91  * commands to desired access bits used by NT Create AndX command.
     92  */
     93 uint32_t
     94 smb_omode_to_amask(uint32_t desired_access)
     95 {
     96 	switch (desired_access & SMB_DA_ACCESS_MASK) {
     97 	case SMB_DA_ACCESS_READ:
     98 		return (FILE_GENERIC_READ);
     99 
    100 	case SMB_DA_ACCESS_WRITE:
    101 		return (FILE_GENERIC_WRITE);
    102 
    103 	case SMB_DA_ACCESS_READ_WRITE:
    104 		return (FILE_GENERIC_READ | FILE_GENERIC_WRITE);
    105 
    106 	case SMB_DA_ACCESS_EXECUTE:
    107 		return (FILE_GENERIC_EXECUTE);
    108 
    109 	default:
    110 		return (FILE_GENERIC_ALL);
    111 	}
    112 }
    113 
    114 /*
    115  * smb_denymode_to_sharemode
    116  *
    117  * This function converts deny modes used by Open and Open AndX
    118  * commands to share access bits used by NT Create AndX command.
    119  */
    120 uint32_t
    121 smb_denymode_to_sharemode(uint32_t desired_access, char *fname)
    122 {
    123 	switch (desired_access & SMB_DA_SHARE_MASK) {
    124 	case SMB_DA_SHARE_COMPATIBILITY:
    125 		if (smb_is_executable(fname))
    126 			return (FILE_SHARE_READ | FILE_SHARE_WRITE);
    127 
    128 		return (FILE_SHARE_ALL);
    129 
    130 	case SMB_DA_SHARE_EXCLUSIVE:
    131 		return (FILE_SHARE_NONE);
    132 
    133 	case SMB_DA_SHARE_DENY_WRITE:
    134 		return (FILE_SHARE_READ);
    135 
    136 	case SMB_DA_SHARE_DENY_READ:
    137 		return (FILE_SHARE_WRITE);
    138 
    139 	case SMB_DA_SHARE_DENY_NONE:
    140 	default:
    141 		return (FILE_SHARE_READ | FILE_SHARE_WRITE);
    142 	}
    143 }
    144 
    145 /*
    146  * smb_ofun_to_crdisposition
    147  *
    148  * This function converts open function values used by Open and Open AndX
    149  * commands to create disposition values used by NT Create AndX command.
    150  */
    151 uint32_t
    152 smb_ofun_to_crdisposition(uint16_t  ofun)
    153 {
    154 	static int ofun_cr_map[3][2] =
    155 	{
    156 		{ -1,			FILE_CREATE },
    157 		{ FILE_OPEN,		FILE_OPEN_IF },
    158 		{ FILE_OVERWRITE,	FILE_OVERWRITE_IF }
    159 	};
    160 
    161 	int row = ofun & SMB_OFUN_OPEN_MASK;
    162 	int col = (ofun & SMB_OFUN_CREATE_MASK) >> 4;
    163 
    164 	if (row == 3)
    165 		return (FILE_MAXIMUM_DISPOSITION + 1);
    166 
    167 	return (ofun_cr_map[row][col]);
    168 }
    169 
    170 /*
    171  * Retry opens to avoid spurious sharing violations, due to timing
    172  * issues between closes and opens.  The client that already has the
    173  * file open may be in the process of closing it.
    174  */
    175 uint32_t
    176 smb_common_open(smb_request_t *sr)
    177 {
    178 	open_param_t	*parg;
    179 	uint32_t	status = NT_STATUS_SUCCESS;
    180 	int		count;
    181 
    182 	parg = kmem_alloc(sizeof (*parg), KM_SLEEP);
    183 	bcopy(&sr->arg.open, parg, sizeof (*parg));
    184 
    185 	for (count = 0; count <= 4; count++) {
    186 		if (count != 0)
    187 			delay(MSEC_TO_TICK(400));
    188 
    189 		status = smb_open_subr(sr);
    190 		if (status != NT_STATUS_SHARING_VIOLATION)
    191 			break;
    192 
    193 		bcopy(parg, &sr->arg.open, sizeof (*parg));
    194 	}
    195 
    196 	if (status == NT_STATUS_SHARING_VIOLATION) {
    197 		smbsr_error(sr, NT_STATUS_SHARING_VIOLATION,
    198 		    ERRDOS, ERROR_SHARING_VIOLATION);
    199 	}
    200 
    201 	if (status == NT_STATUS_NO_SUCH_FILE) {
    202 		smbsr_error(sr, NT_STATUS_OBJECT_NAME_NOT_FOUND,
    203 		    ERRDOS, ERROR_FILE_NOT_FOUND);
    204 	}
    205 
    206 	kmem_free(parg, sizeof (*parg));
    207 
    208 	return (status);
    209 }
    210 
    211 /*
    212  * smb_open_subr
    213  *
    214  * Notes on write-through behaviour. It looks like pre-LM0.12 versions
    215  * of the protocol specify the write-through mode when a file is opened,
    216  * (SmbOpen, SmbOpenAndX) so the write calls (SmbWrite, SmbWriteAndClose,
    217  * SmbWriteAndUnlock) don't need to contain a write-through flag.
    218  *
    219  * With LM0.12, the open calls (SmbCreateAndX, SmbNtTransactCreate)
    220  * don't indicate which write-through mode to use. Instead the write
    221  * calls (SmbWriteAndX, SmbWriteRaw) specify the mode on a per call
    222  * basis.
    223  *
    224  * We don't care which open call was used to get us here, we just need
    225  * to ensure that the write-through mode flag is copied from the open
    226  * parameters to the node. We test the omode write-through flag in all
    227  * write functions.
    228  *
    229  * This function will return NT status codes but it also raises errors,
    230  * in which case it won't return to the caller. Be careful how you
    231  * handle things in here.
    232  *
    233  * The following rules apply when processing a file open request:
    234  *
    235  * - Oplocks must be broken prior to share checking to prevent open
    236  * starvation due to batch oplocks.  Checking share reservations first
    237  * could potentially result in unnecessary open failures due to
    238  * open/close batching on the client.
    239  *
    240  * - Share checks must take place prior to access checks for correct
    241  * Windows semantics and to prevent unnecessary NFS delegation recalls.
    242  *
    243  * - Oplocks must be acquired after open to ensure the correct
    244  * synchronization with NFS delegation and FEM installation.
    245  *
    246  *
    247  * DOS readonly bit rules
    248  *
    249  * 1. The creator of a readonly file can write to/modify the size of the file
    250  * using the original create fid, even though the file will appear as readonly
    251  * to all other fids and via a CIFS getattr call.
    252  * The readonly bit therefore cannot be set in the filesystem until the file
    253  * is closed (smb_ofile_close). It is accounted for via ofile and node flags.
    254  *
    255  * 2. A setinfo operation (using either an open fid or a path) to set/unset
    256  * readonly will be successful regardless of whether a creator of a readonly
    257  * file has an open fid (and has the special privilege mentioned in #1,
    258  * above).  I.e., the creator of a readonly fid holding that fid will no longer
    259  * have a special privilege.
    260  *
    261  * 3. The DOS readonly bit affects only data and some metadata.
    262  * The following metadata can be changed regardless of the readonly bit:
    263  * 	- security descriptors
    264  *	- DOS attributes
    265  *	- timestamps
    266  *
    267  * In the current implementation, the file size cannot be changed (except for
    268  * the exceptions in #1 and #2, above).
    269  *
    270  *
    271  * DOS attribute rules
    272  *
    273  * These rules are specific to creating / opening files and directories.
    274  * How the attribute value (specifically ZERO or FILE_ATTRIBUTE_NORMAL)
    275  * should be interpreted may differ in other requests.
    276  *
    277  * - An attribute value equal to ZERO or FILE_ATTRIBUTE_NORMAL means that the
    278  *   file's attributes should be cleared.
    279  * - If FILE_ATTRIBUTE_NORMAL is specified with any other attributes,
    280  *   FILE_ATTRIBUTE_NORMAL is ignored.
    281  *
    282  * 1. Creating a new file
    283  * - The request attributes + FILE_ATTRIBUTE_ARCHIVE are applied to the file.
    284  *
    285  * 2. Creating a new directory
    286  * - The request attributes + FILE_ATTRIBUTE_DIRECTORY are applied to the file.
    287  * - FILE_ATTRIBUTE_ARCHIVE does not get set.
    288  *
    289  * 3. Overwriting an existing file
    290  * - the request attributes are used as search attributes. If the existing
    291  *   file does not meet the search criteria access is denied.
    292  * - otherwise, applies attributes + FILE_ATTRIBUTE_ARCHIVE.
    293  *
    294  * 4. Opening an existing file or directory
    295  *    The request attributes are ignored.
    296  */
    297 static uint32_t
    298 smb_open_subr(smb_request_t *sr)
    299 {
    300 	boolean_t	created = B_FALSE;
    301 	boolean_t	last_comp_found = B_FALSE;
    302 	smb_node_t	*node = NULL;
    303 	smb_node_t	*dnode = NULL;
    304 	smb_node_t	*cur_node = NULL;
    305 	open_param_t	*op = &sr->arg.open;
    306 	int		rc;
    307 	smb_ofile_t	*of;
    308 	smb_attr_t	new_attr;
    309 	int		max_requested = 0;
    310 	uint32_t	max_allowed;
    311 	uint32_t	status = NT_STATUS_SUCCESS;
    312 	int		is_dir;
    313 	smb_error_t	err;
    314 	boolean_t	is_stream = B_FALSE;
    315 	int		lookup_flags = SMB_FOLLOW_LINKS;
    316 	uint32_t	uniq_fid;
    317 	smb_pathname_t	*pn = &op->fqi.fq_path;
    318 
    319 	is_dir = (op->create_options & FILE_DIRECTORY_FILE) ? 1 : 0;
    320 
    321 	/*
    322 	 * If the object being created or opened is a directory
    323 	 * the Disposition parameter must be one of FILE_CREATE,
    324 	 * FILE_OPEN, or FILE_OPEN_IF
    325 	 */
    326 	if (is_dir) {
    327 		if ((op->create_disposition != FILE_CREATE) &&
    328 		    (op->create_disposition != FILE_OPEN_IF) &&
    329 		    (op->create_disposition != FILE_OPEN)) {
    330 			smbsr_error(sr, NT_STATUS_INVALID_PARAMETER,
    331 			    ERRDOS, ERROR_INVALID_ACCESS);
    332 			return (NT_STATUS_INVALID_PARAMETER);
    333 		}
    334 	}
    335 
    336 	if (op->desired_access & MAXIMUM_ALLOWED) {
    337 		max_requested = 1;
    338 		op->desired_access &= ~MAXIMUM_ALLOWED;
    339 	}
    340 	op->desired_access = smb_access_generic_to_file(op->desired_access);
    341 
    342 	if (sr->session->s_file_cnt >= SMB_SESSION_OFILE_MAX) {
    343 		ASSERT(sr->uid_user);
    344 		cmn_err(CE_NOTE, "smbd[%s\\%s]: %s", sr->uid_user->u_domain,
    345 		    sr->uid_user->u_name,
    346 		    xlate_nt_status(NT_STATUS_TOO_MANY_OPENED_FILES));
    347 
    348 		smbsr_error(sr, NT_STATUS_TOO_MANY_OPENED_FILES,
    349 		    ERRDOS, ERROR_TOO_MANY_OPEN_FILES);
    350 		return (NT_STATUS_TOO_MANY_OPENED_FILES);
    351 	}
    352 
    353 	/* This must be NULL at this point */
    354 	sr->fid_ofile = NULL;
    355 
    356 	op->devstate = 0;
    357 
    358 	switch (sr->tid_tree->t_res_type & STYPE_MASK) {
    359 	case STYPE_DISKTREE:
    360 	case STYPE_PRINTQ:
    361 		break;
    362 
    363 	case STYPE_IPC:
    364 		/*
    365 		 * No further processing for IPC, we need to either
    366 		 * raise an exception or return success here.
    367 		 */
    368 		if ((status = smb_opipe_open(sr)) != NT_STATUS_SUCCESS)
    369 			smbsr_error(sr, status, 0, 0);
    370 		return (status);
    371 
    372 	default:
    373 		smbsr_error(sr, NT_STATUS_BAD_DEVICE_TYPE,
    374 		    ERRDOS, ERROR_BAD_DEV_TYPE);
    375 		return (NT_STATUS_BAD_DEVICE_TYPE);
    376 	}
    377 
    378 	smb_pathname_init(sr, pn, pn->pn_path);
    379 	if (!smb_pathname_validate(sr, pn))
    380 		return (sr->smb_error.status);
    381 
    382 	if (strlen(pn->pn_path) >= MAXPATHLEN) {
    383 		smbsr_error(sr, 0, ERRSRV, ERRfilespecs);
    384 		return (NT_STATUS_NAME_TOO_LONG);
    385 	}
    386 
    387 	if (is_dir) {
    388 		if (!smb_validate_dirname(sr, pn))
    389 			return (sr->smb_error.status);
    390 	} else {
    391 		if (!smb_validate_object_name(sr, pn))
    392 			return (sr->smb_error.status);
    393 	}
    394 
    395 	cur_node = op->fqi.fq_dnode ?
    396 	    op->fqi.fq_dnode : sr->tid_tree->t_snode;
    397 
    398 	/*
    399 	 * if no path or filename are specified the stream should be
    400 	 * created on cur_node
    401 	 */
    402 	if (!is_dir && !pn->pn_pname && !pn->pn_fname && pn->pn_sname) {
    403 
    404 		/* can't currently create a stream on the tree root */
    405 		if (cur_node == sr->tid_tree->t_snode) {
    406 			smbsr_error(sr, NT_STATUS_ACCESS_DENIED, ERRDOS,
    407 			    ERROR_ACCESS_DENIED);
    408 			return (NT_STATUS_ACCESS_DENIED);
    409 		}
    410 
    411 		(void) snprintf(op->fqi.fq_last_comp,
    412 		    sizeof (op->fqi.fq_last_comp),
    413 		    "%s%s", cur_node->od_name, pn->pn_sname);
    414 
    415 		op->fqi.fq_dnode = cur_node->n_dnode;
    416 		smb_node_ref(op->fqi.fq_dnode);
    417 	} else {
    418 		if (rc = smb_pathname_reduce(sr, sr->user_cr, pn->pn_path,
    419 		    sr->tid_tree->t_snode, cur_node, &op->fqi.fq_dnode,
    420 		    op->fqi.fq_last_comp)) {
    421 			smbsr_errno(sr, rc);
    422 			return (sr->smb_error.status);
    423 		}
    424 	}
    425 
    426 	/*
    427 	 * If the access mask has only DELETE set (ignore
    428 	 * FILE_READ_ATTRIBUTES), then assume that this
    429 	 * is a request to delete the link (if a link)
    430 	 * and do not follow links.  Otherwise, follow
    431 	 * the link to the target.
    432 	 */
    433 	if ((op->desired_access & ~FILE_READ_ATTRIBUTES) == DELETE)
    434 		lookup_flags &= ~SMB_FOLLOW_LINKS;
    435 
    436 	rc = smb_fsop_lookup_name(sr, kcred, lookup_flags,
    437 	    sr->tid_tree->t_snode, op->fqi.fq_dnode, op->fqi.fq_last_comp,
    438 	    &op->fqi.fq_fnode);
    439 
    440 	if (rc == 0) {
    441 		last_comp_found = B_TRUE;
    442 		rc = smb_node_getattr(sr, op->fqi.fq_fnode,
    443 		    &op->fqi.fq_fattr);
    444 		if (rc != 0) {
    445 			smb_node_release(op->fqi.fq_fnode);
    446 			smb_node_release(op->fqi.fq_dnode);
    447 			smbsr_error(sr, NT_STATUS_INTERNAL_ERROR,
    448 			    ERRDOS, ERROR_INTERNAL_ERROR);
    449 			return (sr->smb_error.status);
    450 		}
    451 	} else if (rc == ENOENT) {
    452 		last_comp_found = B_FALSE;
    453 		op->fqi.fq_fnode = NULL;
    454 		rc = 0;
    455 	} else {
    456 		smb_node_release(op->fqi.fq_dnode);
    457 		smbsr_errno(sr, rc);
    458 		return (sr->smb_error.status);
    459 	}
    460 
    461 
    462 	/*
    463 	 * The uniq_fid is a CIFS-server-wide unique identifier for an ofile
    464 	 * which is used to uniquely identify open instances for the
    465 	 * VFS share reservation and POSIX locks.
    466 	 */
    467 
    468 	uniq_fid = SMB_UNIQ_FID();
    469 
    470 	if (last_comp_found) {
    471 
    472 		if ((op->fqi.fq_fattr.sa_vattr.va_type != VREG) &&
    473 		    (op->fqi.fq_fattr.sa_vattr.va_type != VDIR) &&
    474 		    (op->fqi.fq_fattr.sa_vattr.va_type != VLNK)) {
    475 
    476 			smb_node_release(op->fqi.fq_fnode);
    477 			smb_node_release(op->fqi.fq_dnode);
    478 			smbsr_error(sr, NT_STATUS_ACCESS_DENIED, ERRDOS,
    479 			    ERRnoaccess);
    480 			return (NT_STATUS_ACCESS_DENIED);
    481 		}
    482 
    483 		node = op->fqi.fq_fnode;
    484 		dnode = op->fqi.fq_dnode;
    485 
    486 		/*
    487 		 * Reject this request if either:
    488 		 * - the target IS a directory and the client requires that
    489 		 *   it must NOT be (required by Lotus Notes)
    490 		 * - the target is NOT a directory and client requires that
    491 		 *   it MUST be.
    492 		 */
    493 		if (op->fqi.fq_fattr.sa_vattr.va_type == VDIR) {
    494 			if (op->create_options & FILE_NON_DIRECTORY_FILE) {
    495 				smb_node_release(node);
    496 				smb_node_release(dnode);
    497 				smbsr_error(sr, NT_STATUS_FILE_IS_A_DIRECTORY,
    498 				    ERRDOS, ERROR_ACCESS_DENIED);
    499 				return (NT_STATUS_FILE_IS_A_DIRECTORY);
    500 			}
    501 		} else {
    502 			if ((op->create_options & FILE_DIRECTORY_FILE) ||
    503 			    (op->nt_flags & NT_CREATE_FLAG_OPEN_TARGET_DIR)) {
    504 				smb_node_release(node);
    505 				smb_node_release(dnode);
    506 				smbsr_error(sr, NT_STATUS_NOT_A_DIRECTORY,
    507 				    ERRDOS, ERROR_DIRECTORY);
    508 				return (NT_STATUS_NOT_A_DIRECTORY);
    509 			}
    510 		}
    511 
    512 		/*
    513 		 * No more open should be accepted when "Delete on close"
    514 		 * flag is set.
    515 		 */
    516 		if (node->flags & NODE_FLAGS_DELETE_ON_CLOSE) {
    517 			smb_node_release(node);
    518 			smb_node_release(dnode);
    519 			smbsr_error(sr, NT_STATUS_DELETE_PENDING,
    520 			    ERRDOS, ERROR_ACCESS_DENIED);
    521 			return (NT_STATUS_DELETE_PENDING);
    522 		}
    523 
    524 		/*
    525 		 * Specified file already exists so the operation should fail.
    526 		 */
    527 		if (op->create_disposition == FILE_CREATE) {
    528 			smb_node_release(node);
    529 			smb_node_release(dnode);
    530 			smbsr_error(sr, NT_STATUS_OBJECT_NAME_COLLISION,
    531 			    ERRDOS, ERROR_FILE_EXISTS);
    532 			return (NT_STATUS_OBJECT_NAME_COLLISION);
    533 		}
    534 
    535 		/*
    536 		 * Windows seems to check read-only access before file
    537 		 * sharing check.
    538 		 *
    539 		 * Check to see if the file is currently readonly (irrespective
    540 		 * of whether this open will make it readonly).
    541 		 */
    542 		if (SMB_PATHFILE_IS_READONLY(sr, node)) {
    543 			/* Files data only */
    544 			if (!smb_node_is_dir(node)) {
    545 				if (op->desired_access & (FILE_WRITE_DATA |
    546 				    FILE_APPEND_DATA)) {
    547 					smb_node_release(node);
    548 					smb_node_release(dnode);
    549 					smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
    550 					    ERRDOS, ERRnoaccess);
    551 					return (NT_STATUS_ACCESS_DENIED);
    552 				}
    553 			}
    554 		}
    555 
    556 		if (smb_oplock_conflict(node, sr->session, op))
    557 			(void) smb_oplock_break(node, sr->session, B_FALSE);
    558 
    559 		smb_node_wrlock(node);
    560 
    561 		if ((op->create_disposition == FILE_SUPERSEDE) ||
    562 		    (op->create_disposition == FILE_OVERWRITE_IF) ||
    563 		    (op->create_disposition == FILE_OVERWRITE)) {
    564 
    565 			if ((!(op->desired_access &
    566 			    (FILE_WRITE_DATA | FILE_APPEND_DATA |
    567 			    FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA))) ||
    568 			    (!smb_sattr_check(op->fqi.fq_fattr.sa_dosattr,
    569 			    op->dattr))) {
    570 				smb_node_unlock(node);
    571 				smb_node_release(node);
    572 				smb_node_release(dnode);
    573 				smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
    574 				    ERRDOS, ERRnoaccess);
    575 				return (NT_STATUS_ACCESS_DENIED);
    576 			}
    577 		}
    578 
    579 		status = smb_fsop_shrlock(sr->user_cr, node, uniq_fid,
    580 		    op->desired_access, op->share_access);
    581 
    582 		if (status == NT_STATUS_SHARING_VIOLATION) {
    583 			smb_node_unlock(node);
    584 			smb_node_release(node);
    585 			smb_node_release(dnode);
    586 			return (status);
    587 		}
    588 
    589 		status = smb_fsop_access(sr, sr->user_cr, node,
    590 		    op->desired_access);
    591 
    592 		if (status != NT_STATUS_SUCCESS) {
    593 			smb_fsop_unshrlock(sr->user_cr, node, uniq_fid);
    594 
    595 			smb_node_unlock(node);
    596 			smb_node_release(node);
    597 			smb_node_release(dnode);
    598 
    599 			if (status == NT_STATUS_PRIVILEGE_NOT_HELD) {
    600 				smbsr_error(sr, status,
    601 				    ERRDOS, ERROR_PRIVILEGE_NOT_HELD);
    602 				return (status);
    603 			} else {
    604 				smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
    605 				    ERRDOS, ERROR_ACCESS_DENIED);
    606 				return (NT_STATUS_ACCESS_DENIED);
    607 			}
    608 		}
    609 
    610 		switch (op->create_disposition) {
    611 		case FILE_SUPERSEDE:
    612 		case FILE_OVERWRITE_IF:
    613 		case FILE_OVERWRITE:
    614 			if (smb_node_is_dir(node)) {
    615 				smb_fsop_unshrlock(sr->user_cr, node, uniq_fid);
    616 				smb_node_unlock(node);
    617 				smb_node_release(node);
    618 				smb_node_release(dnode);
    619 				smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
    620 				    ERRDOS, ERROR_ACCESS_DENIED);
    621 				return (NT_STATUS_ACCESS_DENIED);
    622 			}
    623 
    624 			op->dattr |= FILE_ATTRIBUTE_ARCHIVE;
    625 			/* Don't apply readonly bit until smb_ofile_close */
    626 			if (op->dattr & FILE_ATTRIBUTE_READONLY) {
    627 				op->created_readonly = B_TRUE;
    628 				op->dattr &= ~FILE_ATTRIBUTE_READONLY;
    629 			}
    630 
    631 			bzero(&new_attr, sizeof (new_attr));
    632 			new_attr.sa_dosattr = op->dattr;
    633 			new_attr.sa_vattr.va_size = op->dsize;
    634 			new_attr.sa_mask = SMB_AT_DOSATTR | SMB_AT_SIZE;
    635 			rc = smb_fsop_setattr(sr, sr->user_cr, node, &new_attr);
    636 			if (rc != 0) {
    637 				smb_fsop_unshrlock(sr->user_cr, node, uniq_fid);
    638 				smb_node_unlock(node);
    639 				smb_node_release(node);
    640 				smb_node_release(dnode);
    641 				smbsr_errno(sr, rc);
    642 				return (sr->smb_error.status);
    643 			}
    644 
    645 			/*
    646 			 * If file is being replaced, remove existing streams
    647 			 */
    648 			if (SMB_IS_STREAM(node) == 0) {
    649 				rc = smb_fsop_remove_streams(sr, sr->user_cr,
    650 				    node);
    651 				if (rc != 0) {
    652 					smb_fsop_unshrlock(sr->user_cr, node,
    653 					    uniq_fid);
    654 					smb_node_unlock(node);
    655 					smb_node_release(node);
    656 					smb_node_release(dnode);
    657 					return (sr->smb_error.status);
    658 				}
    659 			}
    660 
    661 			op->action_taken = SMB_OACT_TRUNCATED;
    662 			break;
    663 
    664 		default:
    665 			/*
    666 			 * FILE_OPEN or FILE_OPEN_IF.
    667 			 */
    668 			op->action_taken = SMB_OACT_OPENED;
    669 			break;
    670 		}
    671 	} else {
    672 		/* Last component was not found. */
    673 		dnode = op->fqi.fq_dnode;
    674 
    675 		if (is_dir == 0)
    676 			is_stream = smb_is_stream_name(pn->pn_path);
    677 
    678 		if ((op->create_disposition == FILE_OPEN) ||
    679 		    (op->create_disposition == FILE_OVERWRITE)) {
    680 			smb_node_release(dnode);
    681 			smbsr_error(sr, NT_STATUS_OBJECT_NAME_NOT_FOUND,
    682 			    ERRDOS, ERROR_FILE_NOT_FOUND);
    683 			return (NT_STATUS_OBJECT_NAME_NOT_FOUND);
    684 		}
    685 
    686 		if (smb_is_invalid_filename(pn->pn_fname)) {
    687 			smb_node_release(dnode);
    688 			smbsr_error(sr, NT_STATUS_OBJECT_NAME_INVALID,
    689 			    ERRDOS, ERROR_INVALID_NAME);
    690 			return (NT_STATUS_OBJECT_NAME_INVALID);
    691 		}
    692 
    693 		/*
    694 		 * lock the parent dir node in case another create
    695 		 * request to the same parent directory comes in.
    696 		 */
    697 		smb_node_wrlock(dnode);
    698 
    699 		/* Don't apply readonly bit until smb_ofile_close */
    700 		if (op->dattr & FILE_ATTRIBUTE_READONLY) {
    701 			op->dattr &= ~FILE_ATTRIBUTE_READONLY;
    702 			op->created_readonly = B_TRUE;
    703 		}
    704 
    705 		bzero(&new_attr, sizeof (new_attr));
    706 		if ((op->crtime.tv_sec != 0) &&
    707 		    (op->crtime.tv_sec != UINT_MAX)) {
    708 
    709 			new_attr.sa_mask |= SMB_AT_CRTIME;
    710 			new_attr.sa_crtime = op->crtime;
    711 		}
    712 
    713 		if (is_dir == 0) {
    714 			op->dattr |= FILE_ATTRIBUTE_ARCHIVE;
    715 			new_attr.sa_dosattr = op->dattr;
    716 			new_attr.sa_vattr.va_type = VREG;
    717 			new_attr.sa_vattr.va_mode = is_stream ? S_IRUSR :
    718 			    S_IRUSR | S_IRGRP | S_IROTH |
    719 			    S_IWUSR | S_IWGRP | S_IWOTH;
    720 			new_attr.sa_mask |=
    721 			    SMB_AT_DOSATTR | SMB_AT_TYPE | SMB_AT_MODE;
    722 
    723 			if (op->dsize) {
    724 				new_attr.sa_vattr.va_size = op->dsize;
    725 				new_attr.sa_mask |= SMB_AT_SIZE;
    726 			}
    727 
    728 			rc = smb_fsop_create(sr, sr->user_cr, dnode,
    729 			    op->fqi.fq_last_comp, &new_attr, &op->fqi.fq_fnode);
    730 
    731 			if (rc != 0) {
    732 				smb_node_unlock(dnode);
    733 				smb_node_release(dnode);
    734 				smbsr_errno(sr, rc);
    735 				return (sr->smb_error.status);
    736 			}
    737 
    738 			node = op->fqi.fq_fnode;
    739 			smb_node_wrlock(node);
    740 
    741 			status = smb_fsop_shrlock(sr->user_cr, node, uniq_fid,
    742 			    op->desired_access, op->share_access);
    743 
    744 			if (status == NT_STATUS_SHARING_VIOLATION) {
    745 				smb_node_unlock(node);
    746 				smb_delete_new_object(sr);
    747 				smb_node_release(node);
    748 				smb_node_unlock(dnode);
    749 				smb_node_release(dnode);
    750 				return (status);
    751 			}
    752 		} else {
    753 			op->dattr |= FILE_ATTRIBUTE_DIRECTORY;
    754 			new_attr.sa_dosattr = op->dattr;
    755 			new_attr.sa_vattr.va_type = VDIR;
    756 			new_attr.sa_vattr.va_mode = 0777;
    757 			new_attr.sa_mask |=
    758 			    SMB_AT_DOSATTR | SMB_AT_TYPE | SMB_AT_MODE;
    759 
    760 			rc = smb_fsop_mkdir(sr, sr->user_cr, dnode,
    761 			    op->fqi.fq_last_comp, &new_attr, &op->fqi.fq_fnode);
    762 			if (rc != 0) {
    763 				smb_node_unlock(dnode);
    764 				smb_node_release(dnode);
    765 				smbsr_errno(sr, rc);
    766 				return (sr->smb_error.status);
    767 			}
    768 
    769 			node = op->fqi.fq_fnode;
    770 			smb_node_wrlock(node);
    771 		}
    772 
    773 		created = B_TRUE;
    774 		op->action_taken = SMB_OACT_CREATED;
    775 	}
    776 
    777 	if (max_requested) {
    778 		smb_fsop_eaccess(sr, sr->user_cr, node, &max_allowed);
    779 		op->desired_access |= max_allowed;
    780 	}
    781 
    782 	status = NT_STATUS_SUCCESS;
    783 
    784 	of = smb_ofile_open(sr->tid_tree, node, sr->smb_pid, op, SMB_FTYPE_DISK,
    785 	    uniq_fid, &err);
    786 	if (of == NULL) {
    787 		smbsr_error(sr, err.status, err.errcls, err.errcode);
    788 		status = err.status;
    789 	}
    790 
    791 	if (status == NT_STATUS_SUCCESS) {
    792 		if (!smb_tree_is_connected(sr->tid_tree)) {
    793 			smbsr_error(sr, 0, ERRSRV, ERRinvnid);
    794 			status = NT_STATUS_UNSUCCESSFUL;
    795 		}
    796 	}
    797 
    798 	/*
    799 	 * This MUST be done after ofile creation, so that explicitly
    800 	 * set timestamps can be remembered on the ofile.
    801 	 */
    802 	if (status == NT_STATUS_SUCCESS) {
    803 		if ((rc = smb_set_open_timestamps(sr, of, created)) != 0) {
    804 			smbsr_errno(sr, rc);
    805 			status = sr->smb_error.status;
    806 		}
    807 	}
    808 
    809 	if (status == NT_STATUS_SUCCESS) {
    810 		if (smb_node_getattr(sr, node,  &op->fqi.fq_fattr) != 0) {
    811 			smbsr_error(sr, NT_STATUS_INTERNAL_ERROR,
    812 			    ERRDOS, ERROR_INTERNAL_ERROR);
    813 			status = NT_STATUS_INTERNAL_ERROR;
    814 		}
    815 	}
    816 
    817 	/*
    818 	 * smb_fsop_unshrlock is a no-op if node is a directory
    819 	 * smb_fsop_unshrlock is done in smb_ofile_close
    820 	 */
    821 	if (status != NT_STATUS_SUCCESS) {
    822 		if (of == NULL) {
    823 			smb_fsop_unshrlock(sr->user_cr, node, uniq_fid);
    824 		} else {
    825 			smb_ofile_close(of, 0);
    826 			smb_ofile_release(of);
    827 		}
    828 		if (created)
    829 			smb_delete_new_object(sr);
    830 		smb_node_unlock(node);
    831 		smb_node_release(node);
    832 		if (created)
    833 			smb_node_unlock(dnode);
    834 		smb_node_release(dnode);
    835 		return (status);
    836 	}
    837 
    838 	/*
    839 	 * Propagate the write-through mode from the open params
    840 	 * to the node: see the notes in the function header.
    841 	 */
    842 	if (sr->sr_cfg->skc_sync_enable ||
    843 	    (op->create_options & FILE_WRITE_THROUGH))
    844 		node->flags |= NODE_FLAGS_WRITE_THROUGH;
    845 
    846 	/*
    847 	 * Set up the fileid and dosattr in open_param for response
    848 	 */
    849 	op->fileid = op->fqi.fq_fattr.sa_vattr.va_nodeid;
    850 	op->dattr = op->fqi.fq_fattr.sa_dosattr;
    851 
    852 	/*
    853 	 * Set up the file type in open_param for the response
    854 	 */
    855 	op->ftype = SMB_FTYPE_DISK;
    856 	sr->smb_fid = of->f_fid;
    857 	sr->fid_ofile = of;
    858 
    859 	smb_node_unlock(node);
    860 	if (created)
    861 		smb_node_unlock(dnode);
    862 
    863 	if (op->fqi.fq_fattr.sa_vattr.va_type == VREG) {
    864 		smb_oplock_acquire(node, of, op);
    865 		op->dsize = op->fqi.fq_fattr.sa_vattr.va_size;
    866 	} else { /* VDIR or VLNK */
    867 		op->op_oplock_level = SMB_OPLOCK_NONE;
    868 		op->dsize = 0;
    869 	}
    870 
    871 	smb_node_release(node);
    872 	smb_node_release(dnode);
    873 
    874 	return (NT_STATUS_SUCCESS);
    875 }
    876 
    877 /*
    878  * smb_set_open_timestamps
    879  *
    880  * Last write time:
    881  * - If the last_write time specified in the open params is not 0 or -1,
    882  *   use it as file's mtime. This will be considered an explicitly set
    883  *   timestamps, not reset by subsequent writes.
    884  *
    885  * Opening existing file (not directory):
    886  * - If opening an existing file for overwrite set initial ATIME, MTIME
    887  *   & CTIME to now. (This is achieved by setting them as pending then forcing
    888  *   an smb_node_setattr() to apply pending times.)
    889  *
    890  * - Note  If opening an existing file NOT for overwrite, windows would
    891  *   set the atime on file close, however setting the atime would cause
    892  *   the ARCHIVE attribute to be set, which does not occur on windows,
    893  *   so we do not do the atime update.
    894  *
    895  * Returns: errno
    896  */
    897 static int
    898 smb_set_open_timestamps(smb_request_t *sr, smb_ofile_t *of, boolean_t created)
    899 {
    900 	int		rc = 0;
    901 	open_param_t	*op = &sr->arg.open;
    902 	smb_node_t	*node = of->f_node;
    903 	boolean_t	existing_file, set_times;
    904 	smb_attr_t	attr;
    905 
    906 	bzero(&attr, sizeof (smb_attr_t));
    907 	set_times = B_FALSE;
    908 
    909 	if ((op->mtime.tv_sec != 0) && (op->mtime.tv_sec != UINT_MAX)) {
    910 		attr.sa_mask = SMB_AT_MTIME;
    911 		attr.sa_vattr.va_mtime = op->mtime;
    912 		set_times = B_TRUE;
    913 	}
    914 
    915 	existing_file = !(created || smb_node_is_dir(node));
    916 	if (existing_file) {
    917 		switch (op->create_disposition) {
    918 		case FILE_SUPERSEDE:
    919 		case FILE_OVERWRITE_IF:
    920 		case FILE_OVERWRITE:
    921 			smb_ofile_set_write_time_pending(of);
    922 			set_times = B_TRUE;
    923 			break;
    924 		default:
    925 			break;
    926 		}
    927 	}
    928 
    929 	if (set_times)
    930 		rc = smb_node_setattr(sr, node, sr->user_cr, of, &attr);
    931 
    932 	return (rc);
    933 }
    934 
    935 /*
    936  * This function is used to delete a newly created object (file or
    937  * directory) if an error occurs after creation of the object.
    938  */
    939 static void
    940 smb_delete_new_object(smb_request_t *sr)
    941 {
    942 	open_param_t	*op = &sr->arg.open;
    943 	smb_fqi_t	*fqi = &(op->fqi);
    944 	uint32_t	flags = 0;
    945 
    946 	if (SMB_TREE_IS_CASEINSENSITIVE(sr))
    947 		flags |= SMB_IGNORE_CASE;
    948 	if (SMB_TREE_SUPPORTS_CATIA(sr))
    949 		flags |= SMB_CATIA;
    950 
    951 	if (op->create_options & FILE_DIRECTORY_FILE)
    952 		(void) smb_fsop_rmdir(sr, sr->user_cr, fqi->fq_dnode,
    953 		    fqi->fq_last_comp, flags);
    954 	else
    955 		(void) smb_fsop_remove(sr, sr->user_cr, fqi->fq_dnode,
    956 		    fqi->fq_last_comp, flags);
    957 }
    958