9 files changed, 630 insertions, 62 deletions

diff --git a/source3/client/client.c b/source3/client/client.c
index c88b918dc8..03bc15c68c 100644
--- a/source3/client/client.c
+++ b/source3/client/client.c
@@ -190,7 +190,7 @@ static int writefile(int f, char *b, int n)
  number read. read approx n bytes.
 ****************************************************************************/
 
-static int readfile(char *b, int n, XFILE *f)
+static int readfile(uint8_t *b, int n, XFILE *f)
 {
 	int i;
 	int c;
@@ -214,6 +214,25 @@ static int readfile(char *b, int n, XFILE *f)
 	return(i);
 }
 
+struct push_state {
+	XFILE *f;
+	SMB_OFF_T nread;
+};
+
+static size_t push_source(uint8_t *buf, size_t n, void *priv)
+{
+	struct push_state *state = (struct push_state *)priv;
+	int result;
+
+	if (x_feof(state->f)) {
+		return 0;
+	}
+
+	result = readfile(buf, n, state->f);
+	state->nread += result;
+	return result;
+}
+
 /****************************************************************************
  Send a message.
 ****************************************************************************/
@@ -1587,13 +1606,12 @@ static int do_put(const char *rname, const char *lname, bool reput)
 	int fnum;
 	XFILE *f;
 	SMB_OFF_T start = 0;
-	off_t nread = 0;
-	char *buf = NULL;
-	int maxwrite = io_bufsize;
 	int rc = 0;
 	struct timeval tp_start;
 	struct cli_state *targetcli;
 	char *targetname = NULL;
+	struct push_state state;
+	NTSTATUS status;
 
 	if (!cli_resolve_path(ctx, "", cli, rname, &targetcli, &targetname)) {
 		d_printf("Failed to open %s: %s\n", rname, cli_errstr(cli));
@@ -1646,42 +1664,20 @@ static int do_put(const char *rname, const char *lname, bool reput)
 	DEBUG(1,("putting file %s as %s ",lname,
 		 rname));
 
-	buf = (char *)SMB_MALLOC(maxwrite);
-	if (!buf) {
-		d_printf("ERROR: Not enough memory!\n");
-		return 1;
-	}
+	x_setvbuf(f, NULL, X_IOFBF, io_bufsize);
 
-	x_setvbuf(f, NULL, X_IOFBF, maxwrite);
+	state.f = f;
+	state.nread = 0;
 
-	while (!x_feof(f)) {
-		int n = maxwrite;
-		int ret;
-
-		if ((n = readfile(buf,n,f)) < 1) {
-			if((n == 0) && x_feof(f))
-				break; /* Empty local file. */
-
-			d_printf("Error reading local file: %s\n", strerror(errno));
-			rc = 1;
-			break;
-		}
-
-		ret = cli_write(targetcli, fnum, 0, buf, nread + start, n);
-
-		if (n != ret) {
-			d_printf("Error writing file: %s\n", cli_errstr(cli));
-			rc = 1;
-			break;
-		}
-
-		nread += n;
+	status = cli_push(targetcli, fnum, 0, 0, io_bufsize, push_source,
+			  &state);
+	if (!NT_STATUS_IS_OK(status)) {
+		d_fprintf(stderr, "cli_push returned %s\n", nt_errstr(status));
 	}
 
 	if (!cli_close(targetcli, fnum)) {
 		d_printf("%s closing remote file %s\n",cli_errstr(cli),rname);
 		x_fclose(f);
-		SAFE_FREE(buf);
 		return 1;
 	}
 
@@ -1689,8 +1685,6 @@ static int do_put(const char *rname, const char *lname, bool reput)
 		x_fclose(f);
 	}
 
-	SAFE_FREE(buf);
-
 	{
 		struct timeval tp_end;
 		int this_time;
@@ -1700,10 +1694,10 @@ static int do_put(const char *rname, const char *lname, bool reput)
 			(tp_end.tv_sec - tp_start.tv_sec)*1000 +
 			(tp_end.tv_usec - tp_start.tv_usec)/1000;
 		put_total_time_ms += this_time;
-		put_total_size += nread;
+		put_total_size += state.nread;
 
 		DEBUG(1,("(%3.1f kb/s) (average %3.1f kb/s)\n",
-			 nread / (1.024*this_time + 1.0e-4),
+			 state.nread / (1.024*this_time + 1.0e-4),
 			 put_total_size / (1.024*put_total_time_ms)));
 	}
 
diff --git a/source3/include/async_smb.h b/source3/include/async_smb.h
index ef53ee2163..7fc4ff7d27 100644
--- a/source3/include/async_smb.h
+++ b/source3/include/async_smb.h
@@ -122,6 +122,8 @@ struct async_req *cli_request_send(TALLOC_CTX *mem_ctx,
 				   size_t bytes_alignment,
 				   uint32_t num_bytes, const uint8_t *bytes);
 
+uint16_t cli_wct_ofs(const struct cli_state *cli);
+
 bool cli_chain_cork(struct cli_state *cli, struct event_context *ev,
 		    size_t size_hint);
 void cli_chain_uncork(struct cli_state *cli);
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 212bbf0df7..cffb8f7325 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -2800,6 +2800,25 @@ ssize_t cli_write(struct cli_state *cli,
 		 const char *buf, off_t offset, size_t size);
 ssize_t cli_smbwrite(struct cli_state *cli,
 		     int fnum, char *buf, off_t offset, size_t size1);
+struct async_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
+				      struct event_context *ev,
+				      struct cli_state *cli, uint16_t fnum,
+				      uint16_t mode, const uint8_t *buf,
+				      off_t offset, size_t size);
+NTSTATUS cli_write_andx_recv(struct async_req *req, size_t *pwritten);
+
+struct async_req *cli_push_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
+				struct cli_state *cli,
+				uint16_t fnum, uint16_t mode,
+				off_t start_offset, size_t window_size,
+				size_t (*source)(uint8_t *buf, size_t n,
+						 void *priv),
+				void *priv);
+NTSTATUS cli_push_recv(struct async_req *req);
+NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
+		  off_t start_offset, size_t window_size,
+		  size_t (*source)(uint8_t *buf, size_t n, void *priv),
+		  void *priv);
 
 /* The following definitions come from libsmb/clisecdesc.c  */
 
@@ -7489,8 +7508,6 @@ struct idle_event *event_add_idle(struct event_context *event_ctx,
 				  void *private_data);
 NTSTATUS allow_new_trans(struct trans_state *list, int mid);
 void respond_to_all_remaining_local_messages(void);
-bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
-		   uint8_t num_words, uint32_t num_bytes);
 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes);
 const char *smb_fn_name(int type);
 void add_to_common_flags2(uint32 v);
diff --git a/source3/libsmb/async_smb.c b/source3/libsmb/async_smb.c
index fdcbb00206..82a919455a 100644
--- a/source3/libsmb/async_smb.c
+++ b/source3/libsmb/async_smb.c
@@ -552,6 +552,7 @@ bool cli_chain_cork(struct cli_state *cli, struct event_context *ev,
 void cli_chain_uncork(struct cli_state *cli)
 {
 	struct cli_request *req = cli->chain_accumulator;
+	size_t smblen;
 
 	SMB_ASSERT(req != NULL);
 
@@ -561,7 +562,19 @@ void cli_chain_uncork(struct cli_state *cli)
 	cli->chain_accumulator = NULL;
 
 	SSVAL(req->outbuf, smb_mid, req->mid);
-	smb_setlen((char *)req->outbuf, talloc_get_size(req->outbuf) - 4);
+
+	smblen = talloc_get_size(req->outbuf) - 4;
+
+	smb_setlen((char *)req->outbuf, smblen);
+
+	if (smblen > 0x1ffff) {
+		/*
+		 * This is a POSIX 14 word large write. Overwrite just the
+		 * size field, the '0xFFSMB' has been set by smb_setlen which
+		 * _smb_setlen_large does not do.
+		 */
+		_smb_setlen_large(((char *)req->outbuf), smblen);
+	}
 
 	cli_calculate_sign_mac(cli, (char *)req->outbuf);
 
@@ -639,6 +652,37 @@ struct async_req *cli_request_send(TALLOC_CTX *mem_ctx,
 }
 
 /**
+ * Calculate the current ofs to wct for requests like write&x
+ * @param[in] req	The smb request we're currently building
+ * @retval how many bytes offset have we accumulated?
+ */
+
+uint16_t cli_wct_ofs(const struct cli_state *cli)
+{
+	size_t buf_size;
+
+	if (cli->chain_accumulator == NULL) {
+		return smb_wct - 4;
+	}
+
+	buf_size = talloc_get_size(cli->chain_accumulator->outbuf);
+
+	if (buf_size == smb_wct) {
+		return smb_wct - 4;
+	}
+
+	/*
+	 * Add alignment for subsequent requests
+	 */
+
+	if ((buf_size % 4) != 0) {
+		buf_size += (4 - (buf_size % 4));
+	}
+
+	return buf_size - 4;
+}
+
+/**
  * Figure out if there is an andx command behind the current one
  * @param[in] buf	The smb buffer to look at
  * @param[in] ofs	The offset to the wct field that is followed by the cmd
diff --git a/source3/libsmb/clireadwrite.c b/source3/libsmb/clireadwrite.c
index 0c65505793..b33d0f0938 100644
--- a/source3/libsmb/clireadwrite.c
+++ b/source3/libsmb/clireadwrite.c
@@ -744,3 +744,409 @@ ssize_t cli_smbwrite(struct cli_state *cli,
 
 	return total;
 }
+
+/*
+ * Send a write&x request
+ */
+
+struct async_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
+				      struct event_context *ev,
+				      struct cli_state *cli, uint16_t fnum,
+				      uint16_t mode, const uint8_t *buf,
+				      off_t offset, size_t size)
+{
+	bool bigoffset = ((cli->capabilities & CAP_LARGE_FILES) != 0);
+	uint8_t wct = bigoffset ? 14 : 12;
+	size_t max_write = cli_write_max_bufsize(cli, mode);
+	uint16_t vwv[14];
+
+	size = MIN(size, max_write);
+
+	SCVAL(vwv+0, 0, 0xFF);
+	SCVAL(vwv+0, 1, 0);
+	SSVAL(vwv+1, 0, 0);
+	SSVAL(vwv+2, 0, fnum);
+	SIVAL(vwv+3, 0, offset);
+	SIVAL(vwv+5, 0, 0);
+	SSVAL(vwv+7, 0, mode);
+	SSVAL(vwv+8, 0, 0);
+	SSVAL(vwv+9, 0, (size>>16));
+	SSVAL(vwv+10, 0, size);
+
+	SSVAL(vwv+11, 0,
+	      cli_wct_ofs(cli)
+	      + 1		/* the wct field */
+	      + wct * 2		/* vwv */
+	      + 2		/* num_bytes field */
+	      + 1		/* pad */);
+
+	if (bigoffset) {
+		SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
+	}
+
+	return cli_request_send(mem_ctx, ev, cli, SMBwriteX, 0, wct, vwv,
+				2, size, buf);
+}
+
+NTSTATUS cli_write_andx_recv(struct async_req *req, size_t *pwritten)
+{
+	uint8_t wct;
+	uint16_t *vwv;
+	uint16_t num_bytes;
+	uint8_t *bytes;
+	NTSTATUS status;
+	size_t written;
+
+	if (async_req_is_error(req, &status)) {
+		return status;
+	}
+
+	status = cli_pull_reply(req, &wct, &vwv, &num_bytes, &bytes);
+
+	if (NT_STATUS_IS_ERR(status)) {
+		return status;
+	}
+
+	if (wct < 6) {
+		return NT_STATUS_INVALID_NETWORK_RESPONSE;
+	}
+
+	written = SVAL(vwv+2, 0);
+	written |= SVAL(vwv+4, 0)<<16;
+	*pwritten = written;
+
+	return NT_STATUS_OK;
+}
+
+struct cli_writeall_state {
+	struct event_context *ev;
+	struct cli_state *cli;
+	uint16_t fnum;
+	uint16_t mode;
+	const uint8_t *buf;
+	off_t offset;
+	size_t size;
+	size_t written;
+};
+
+static void cli_writeall_written(struct async_req *req);
+
+static struct async_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
+					   struct event_context *ev,
+					   struct cli_state *cli,
+					   uint16_t fnum,
+					   uint16_t mode,
+					   const uint8_t *buf,
+					   off_t offset, size_t size)
+{
+	struct async_req *result;
+	struct async_req *subreq;
+	struct cli_writeall_state *state;
+
+	result = async_req_new(mem_ctx, ev);
+	if (result == NULL) {
+		goto fail;
+	}
+	state = talloc(result, struct cli_writeall_state);
+	if (state == NULL) {
+		goto fail;
+	}
+	result->private_data = state;
+
+	state->ev = ev;
+	state->cli = cli;
+	state->fnum = fnum;
+	state->mode = mode;
+	state->buf = buf;
+	state->offset = offset;
+	state->size = size;
+	state->written = 0;
+
+	subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
+				     state->mode, state->buf, state->offset,
+				     state->size);
+	if (subreq == NULL) {
+		goto fail;
+	}
+
+	subreq->async.fn = cli_writeall_written;
+	subreq->async.priv = result;
+	return result;
+
+ fail:
+	TALLOC_FREE(result);
+	return NULL;
+}
+
+static void cli_writeall_written(struct async_req *subreq)
+{
+	struct async_req *req = talloc_get_type_abort(
+		subreq->async.priv, struct async_req);
+	struct cli_writeall_state *state = talloc_get_type_abort(
+		req->private_data, struct cli_writeall_state);
+	NTSTATUS status;
+	size_t written, to_write;
+
+	status = cli_write_andx_recv(subreq, &written);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		async_req_error(req, status);
+		return;
+	}
+
+	state->written += written;
+
+	if (state->written > state->size) {
+		async_req_error(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
+		return;
+	}
+
+	to_write = state->size - state->written;
+
+	if (to_write == 0) {
+		async_req_done(req);
+		return;
+	}
+
+	subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
+				     state->mode,
+				     state->buf + state->written,
+				     state->offset + state->written, to_write);
+	if (subreq == NULL) {
+		async_req_error(req, NT_STATUS_NO_MEMORY);
+		return;
+	}
+
+	subreq->async.fn = cli_writeall_written;
+	subreq->async.priv = req;
+}
+
+static NTSTATUS cli_writeall_recv(struct async_req *req)
+{
+	return async_req_simple_recv(req);
+}
+
+struct cli_push_state {
+	struct async_req *req;
+
+	struct event_context *ev;
+	struct cli_state *cli;
+	uint16_t fnum;
+	uint16_t mode;
+	off_t start_offset;
+	size_t window_size;
+
+	size_t (*source)(uint8_t *buf, size_t n, void *priv);
+	void *priv;
+
+	size_t chunk_size;
+
+	size_t sent;
+	bool eof;
+
+	/*
+	 * Outstanding requests
+	 */
+	int num_reqs;
+	struct async_req **reqs;
+
+	int pending;
+
+	uint8_t *buf;
+};
+
+static void cli_push_written(struct async_req *req);
+
+struct async_req *cli_push_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
+				struct cli_state *cli,
+				uint16_t fnum, uint16_t mode,
+				off_t start_offset, size_t window_size,
+				size_t (*source)(uint8_t *buf, size_t n,
+						 void *priv),
+				void *priv)
+{
+	struct async_req *result;
+	struct cli_push_state *state;
+	int i;
+
+	result = async_req_new(mem_ctx, ev);
+	if (result == NULL) {
+		goto failed;
+	}
+	state = talloc(result, struct cli_push_state);
+	if (state == NULL) {
+		goto failed;
+	}
+	result->private_data = state;
+	state->req = result;
+
+	state->cli = cli;
+	state->ev = ev;
+	state->fnum = fnum;
+	state->start_offset = start_offset;
+	state->mode = mode;
+	state->source = source;
+	state->priv = priv;
+	state->eof = false;
+	state->sent = 0;
+	state->pending = 0;
+
+	state->chunk_size = cli_write_max_bufsize(cli, mode);
+
+	state->num_reqs = MAX(window_size/state->chunk_size, 1);
+	state->num_reqs = MIN(state->num_reqs, cli->max_mux);
+
+	state->reqs = TALLOC_ZERO_ARRAY(state, struct async_req *,
+					state->num_reqs);
+	if (state->reqs == NULL) {
+		goto failed;
+	}
+
+	state->buf = TALLOC_ARRAY(
+		state, uint8_t, state->chunk_size * state->num_reqs);
+	if (state->buf == NULL) {
+		goto failed;
+	}
+
+	for (i=0; i<state->num_reqs; i++) {
+		size_t to_write;
+		uint8_t *buf = state->buf + i*state->chunk_size;
+
+		to_write = state->source(buf, state->chunk_size, state->priv);
+		if (to_write == 0) {
+			state->eof = true;
+			break;
+		}
+
+		state->reqs[i] = cli_writeall_send(
+			state->reqs, state->ev, state->cli, state->fnum,
+			state->mode, buf, state->start_offset + state->sent,
+			to_write);
+		if (state->reqs[i] == NULL) {
+			goto failed;
+		}
+
+		state->reqs[i]->async.fn = cli_push_written;
+		state->reqs[i]->async.priv = state;
+
+		state->sent += to_write;
+		state->pending += 1;
+	}
+
+	if (i == 0) {
+		if (!async_post_status(result, NT_STATUS_OK)) {
+			goto failed;
+		}
+		return result;
+	}
+
+	return result;
+
+ failed:
+	TALLOC_FREE(result);
+	return NULL;
+}
+
+static void cli_push_written(struct async_req *req)
+{
+	struct cli_push_state *state = talloc_get_type_abort(
+		req->async.priv, struct cli_push_state);
+	NTSTATUS status;
+	int i;
+	uint8_t *buf;
+	size_t to_write;
+
+	for (i=0; i<state->num_reqs; i++) {
+		if (state->reqs[i] == req) {
+			break;
+		}
+	}
+
+	if (i == state->num_reqs) {
+		async_req_error(state->req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	status = cli_writeall_recv(req);
+	TALLOC_FREE(state->reqs[i]);
+	req = NULL;
+	if (!NT_STATUS_IS_OK(status)) {
+		async_req_error(state->req, status);
+		return;
+	}
+
+	state->pending -= 1;
+	if (state->pending == 0) {
+		async_req_done(state->req);
+		return;
+	}
+
+	if (state->eof) {
+		return;
+	}
+
+	buf = state->buf + i * state->chunk_size;
+
+	to_write = state->source(buf, state->chunk_size, state->priv);
+	if (to_write == 0) {
+		state->eof = true;
+		return;
+	}
+
+	state->reqs[i] = cli_writeall_send(
+		state->reqs, state->ev, state->cli, state->fnum,
+		state->mode, buf, state->start_offset + state->sent, to_write);
+	if (state->reqs[i] == NULL) {
+		async_req_error(state->req, NT_STATUS_NO_MEMORY);
+		return;
+	}
+
+	state->reqs[i]->async.fn = cli_push_written;
+	state->reqs[i]->async.priv = state;
+
+	state->sent += to_write;
+	state->pending += 1;
+}
+
+NTSTATUS cli_push_recv(struct async_req *req)
+{
+	return async_req_simple_recv(req);
+}
+
+NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
+		  off_t start_offset, size_t window_size,
+		  size_t (*source)(uint8_t *buf, size_t n, void *priv),
+		  void *priv)
+{
+	TALLOC_CTX *frame = talloc_stackframe();
+	struct event_context *ev;
+	struct async_req *req;
+	NTSTATUS result = NT_STATUS_NO_MEMORY;
+
+	if (cli->fd_event != NULL) {
+		/*
+		 * Can't use sync call while an async call is in flight
+		 */
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	ev = event_context_init(frame);
+	if (ev == NULL) {
+		goto nomem;
+	}
+
+	req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
+			    window_size, source, priv);
+	if (req == NULL) {
+		goto nomem;
+	}
+
+	while (req->state < ASYNC_REQ_DONE) {
+		event_loop_once(ev);
+	}
+
+	result = cli_push_recv(req);
+ nomem:
+	TALLOC_FREE(frame);
+	return result;
+}
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index b3cd2f26c8..e4d15d87d6 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -37,7 +37,8 @@ SIG_ATOMIC_T got_sig_term = 0;
 extern bool global_machine_password_needs_changing;
 extern int max_send;
 
-static void construct_reply_common(const char *inbuf, char *outbuf);
+static void construct_reply_common(struct smb_request *req, const char *inbuf,
+				   char *outbuf);
 
 /* Accessor function for smb_read_error for smbd functions. */
 
@@ -1248,8 +1249,9 @@ static const struct smb_message_struct {
  allocate and initialize a reply packet
 ********************************************************************/
 
-bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
-		   uint8_t num_words, uint32_t num_bytes)
+static bool create_outbuf(TALLOC_CTX *mem_ctx, struct smb_request *req,
+			  const char *inbuf, char **outbuf, uint8_t num_words,
+			  uint32_t num_bytes)
 {
 	/*
          * Protect against integer wrap
@@ -1270,7 +1272,7 @@ bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
 		return false;
 	}
 
-	construct_reply_common(inbuf, *outbuf);
+	construct_reply_common(req, inbuf, *outbuf);
 	srv_set_message(*outbuf, num_words, num_bytes, false);
 	/*
 	 * Zero out the word area, the caller has to take care of the bcc area
@@ -1286,7 +1288,7 @@ bool create_outbuf(TALLOC_CTX *mem_ctx, const char *inbuf, char **outbuf,
 void reply_outbuf(struct smb_request *req, uint8 num_words, uint32 num_bytes)
 {
 	char *outbuf;
-	if (!create_outbuf(req, (char *)req->inbuf, &outbuf, num_words,
+	if (!create_outbuf(req, req, (char *)req->inbuf, &outbuf, num_words,
 			   num_bytes)) {
 		smb_panic("could not allocate output buffer\n");
 	}
@@ -1592,11 +1594,12 @@ void remove_from_common_flags2(uint32 v)
 	common_flags2 &= ~v;
 }
 
-static void construct_reply_common(const char *inbuf, char *outbuf)
+static void construct_reply_common(struct smb_request *req, const char *inbuf,
+				   char *outbuf)
 {
 	srv_set_message(outbuf,0,0,false);
 	
-	SCVAL(outbuf,smb_com,CVAL(inbuf,smb_com));
+	SCVAL(outbuf, smb_com, req->cmd);
 	SIVAL(outbuf,smb_rcls,0);
 	SCVAL(outbuf,smb_flg, FLAG_REPLY | (CVAL(inbuf,smb_flg) & FLAG_CASELESS_PATHNAMES)); 
 	SSVAL(outbuf,smb_flg2,
@@ -1612,7 +1615,7 @@ static void construct_reply_common(const char *inbuf, char *outbuf)
 
 void construct_reply_common_req(struct smb_request *req, char *outbuf)
 {
-	construct_reply_common((char *)req->inbuf, outbuf);
+	construct_reply_common(req, (char *)req->inbuf, outbuf);
 }
 
 /****************************************************************************
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 9f7a1896b8..b8be3ed304 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -5515,7 +5515,9 @@ NTSTATUS rename_internals_fsp(connection_struct *conn,
 	}
 
 	if(replace_if_exists && dst_exists) {
-		if (is_ntfs_stream_name(newname)) {
+		/* Ensure both or neither are stream names. */
+		if (is_ntfs_stream_name(fsp->fsp_name) !=
+				is_ntfs_stream_name(newname)) {
 			return NT_STATUS_INVALID_PARAMETER;
 		}
 	}
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index 606e656795..27e29515e4 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -5372,6 +5372,8 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 	char *newname = NULL;
 	char *base_name = NULL;
 	bool dest_has_wcard = False;
+	SMB_STRUCT_STAT sbuf;
+	char *newname_last_component = NULL;
 	NTSTATUS status = NT_STATUS_OK;
 	char *p;
 	TALLOC_CTX *ctx = talloc_tos();
@@ -5380,6 +5382,8 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
+	ZERO_STRUCT(sbuf);
+
 	overwrite = (CVAL(pdata,0) ? True : False);
 	root_fid = IVAL(pdata,4);
 	len = IVAL(pdata,8);
@@ -5413,6 +5417,7 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 	}
 
 	if (fsp && fsp->base_fsp) {
+		/* newname must be a stream name. */
 		if (newname[0] != ':') {
 			return NT_STATUS_NOT_SUPPORTED;
 		}
@@ -5423,6 +5428,7 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 			return NT_STATUS_NO_MEMORY;
 		}
 	} else {
+		/* newname must *not* be a stream name. */
 		if (is_ntfs_stream_name(newname)) {
 			return NT_STATUS_NOT_SUPPORTED;
 		}
@@ -5448,18 +5454,11 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 		if (!base_name) {
 			return NT_STATUS_NO_MEMORY;
 		}
-	}
-
-	if (fsp) {
-		SMB_STRUCT_STAT sbuf;
-		char *newname_last_component = NULL;
-
-		ZERO_STRUCT(sbuf);
 
 		status = unix_convert(ctx, conn, newname, False,
-					&newname,
-					&newname_last_component,
-					&sbuf);
+				&newname,
+				&newname_last_component,
+				&sbuf);
 
 		/* If an error we expect this to be
 		 * NT_STATUS_OBJECT_PATH_NOT_FOUND */
@@ -5469,7 +5468,9 @@ static NTSTATUS smb_file_rename_information(connection_struct *conn,
 					status)) {
 			return status;
 		}
+	}
 
+	if (fsp) {
 		DEBUG(10,("smb_file_rename_information: SMB_FILE_RENAME_INFORMATION (fnum %d) %s -> %s\n",
 			fsp->fnum, fsp->fsp_name, base_name ));
 		status = rename_internals_fsp(conn, fsp, base_name,
diff --git a/source3/torture/torture.c b/source3/torture/torture.c
index 5584c22a8f..6bf7aa8e25 100644
--- a/source3/torture/torture.c
+++ b/source3/torture/torture.c
@@ -28,6 +28,7 @@ static const char *sockops="TCP_NODELAY";
 static int nprocs=1;
 static int port_to_use=0;
 int torture_numops=100;
+int torture_blocksize=1024*1024;
 static int procnum; /* records process count number when forking */
 static struct cli_state *current_cli;
 static fstring randomfname;
@@ -4927,6 +4928,23 @@ static void chain1_read_completion(struct async_req *req)
 	TALLOC_FREE(req);
 }
 
+static void chain1_write_completion(struct async_req *req)
+{
+	NTSTATUS status;
+	size_t written;
+
+	status = cli_write_andx_recv(req, &written);
+	if (!NT_STATUS_IS_OK(status)) {
+		TALLOC_FREE(req);
+		d_printf("cli_write_andx_recv returned %s\n",
+			 nt_errstr(status));
+		return;
+	}
+
+	d_printf("wrote %d bytes\n", (int)written);
+	TALLOC_FREE(req);
+}
+
 static void chain1_close_completion(struct async_req *req)
 {
 	NTSTATUS status;
@@ -4945,6 +4963,7 @@ static bool run_chain1(int dummy)
 	struct event_context *evt = event_context_init(NULL);
 	struct async_req *reqs[4];
 	bool done = false;
+	const char *text = "hallo";
 
 	printf("starting chain1 test\n");
 	if (!torture_open_connection(&cli1, 0)) {
@@ -4957,8 +4976,9 @@ static bool run_chain1(int dummy)
 	reqs[0] = cli_open_send(talloc_tos(), evt, cli1, "\\test",
 				O_CREAT|O_RDWR, 0);
 	reqs[0]->async.fn = chain1_open_completion;
-	reqs[1] = cli_read_andx_send(talloc_tos(), evt, cli1, 0, 0, 10);
-	reqs[1]->async.fn = chain1_read_completion;
+	reqs[1] = cli_write_andx_send(talloc_tos(), evt, cli1, 0, 0,
+				      (uint8_t *)text, 0, strlen(text));
+	reqs[1]->async.fn = chain1_write_completion;
 	reqs[2] = cli_read_andx_send(talloc_tos(), evt, cli1, 0, 1, 10);
 	reqs[2]->async.fn = chain1_read_completion;
 	reqs[3] = cli_close_send(talloc_tos(), evt, cli1, 0);
@@ -4974,6 +4994,81 @@ static bool run_chain1(int dummy)
 	return True;
 }
 
+static size_t null_source(uint8_t *buf, size_t n, void *priv)
+{
+	size_t *to_pull = (size_t *)priv;
+	size_t thistime = *to_pull;
+
+	thistime = MIN(thistime, n);
+	if (thistime == 0) {
+		return 0;
+	}
+
+	memset(buf, 0, thistime);
+	*to_pull -= thistime;
+	return thistime;
+}
+
+static bool run_windows_write(int dummy)
+{
+	struct cli_state *cli1;
+	int fnum;
+	int i;
+	bool ret = false;
+	const char *fname = "\\writetest.txt";
+	double seconds;
+	double kbytes;
+
+	printf("starting windows_write test\n");
+	if (!torture_open_connection(&cli1, 0)) {
+		return False;
+	}
+
+	fnum = cli_open(cli1, fname, O_RDWR|O_CREAT|O_EXCL, DENY_NONE);
+	if (fnum == -1) {
+		printf("open failed (%s)\n", cli_errstr(cli1));
+		return False;
+	}
+
+	cli_sockopt(cli1, sockops);
+
+	start_timer();
+
+	for (i=0; i<torture_numops; i++) {
+		char c = 0;
+		off_t start = i * torture_blocksize;
+		NTSTATUS status;
+		size_t to_pull = torture_blocksize - 1;
+
+		if (cli_write(cli1, fnum, 0, &c,
+			      start + torture_blocksize - 1, 1) != 1) {
+			printf("cli_write failed: %s\n", cli_errstr(cli1));
+			goto fail;
+		}
+
+		status = cli_push(cli1, fnum, 0, i * torture_blocksize, torture_blocksize,
+				  null_source, &to_pull);
+		if (!NT_STATUS_IS_OK(status)) {
+			printf("cli_push returned: %s\n", nt_errstr(status));
+			goto fail;
+		}
+	}
+
+	seconds = end_timer();
+	kbytes = (double)torture_blocksize * torture_numops;
+	kbytes /= 1024;
+
+	printf("Wrote %d kbytes in %.2f seconds: %d kb/sec\n", (int)kbytes,
+	       (double)seconds, (int)(kbytes/seconds));
+
+	ret = true;
+ fail:
+	cli_close(cli1, fnum);
+	cli_unlink(cli1, fname);
+	torture_close_connection(cli1);
+	return ret;
+}
+
 static bool run_cli_echo(int dummy)
 {
 	struct cli_state *cli;
@@ -5535,6 +5630,7 @@ static struct {
 	{ "EATEST", run_eatest, 0},
 	{ "SESSSETUP_BENCH", run_sesssetup_bench, 0},
 	{ "CHAIN1", run_chain1, 0},
+	{ "WINDOWS-WRITE", run_windows_write, 0},
 	{ "CLI_ECHO", run_cli_echo, 0},
 	{ "LOCAL-SUBSTITUTE", run_local_substitute, 0},
 	{ "LOCAL-GENCACHE", run_local_gencache, 0},
@@ -5693,7 +5789,7 @@ static void usage(void)
 
 	fstrcpy(workgroup, lp_workgroup());
 
-	while ((opt = getopt(argc, argv, "p:hW:U:n:N:O:o:m:Ld:Aec:ks:b:")) != EOF) {
+	while ((opt = getopt(argc, argv, "p:hW:U:n:N:O:o:m:Ld:Aec:ks:b:B:")) != EOF) {
 		switch (opt) {
 		case 'p':
 			port_to_use = atoi(optarg);
@@ -5756,6 +5852,9 @@ static void usage(void)
 			fstrcpy(multishare_conn_fname, optarg);
 			use_multishare_conn = True;
 			break;
+		case 'B':
+			torture_blocksize = atoi(optarg);
+			break;
 		default:
 			printf("Unknown option %c (%d)\n", (char)opt, opt);
 			usage();