s4:libcli/raw: implement on top of smbXcli_conn/req

metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Wed Nov 30 15:13:36 CET 2011 on sn-devel-104

1 files changed, 293 insertions, 833 deletions

diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c
index dd017715c7..8e16e5b911 100644
--- a/source4/libcli/raw/rawtrans.c
+++ b/source4/libcli/raw/rawtrans.c
@@ -19,513 +19,201 @@
 */
 
 #include "includes.h"
-#include "../lib/util/dlinklist.h"
+#include <tevent.h>
 #include "libcli/raw/libcliraw.h"
 #include "libcli/raw/raw_proto.h"
+#include "../libcli/smb/smbXcli_base.h"
 
-#define TORTURE_TRANS_DATA 0
+static void smb_raw_trans_backend_done(struct tevent_req *subreq);
 
-/*
-  check out of bounds for incoming data
-*/
-static bool raw_trans_oob(struct smbcli_request *req,
-			  unsigned int offset, unsigned int count)
-{
-	uint8_t *ptr;
-
-	if (count == 0) {
-		return false;
-	}
-
-	ptr = req->in.hdr + offset;
-	
-	/* be careful with wraparound! */
-	if ((uintptr_t)ptr < (uintptr_t)req->in.data ||
-	    (uintptr_t)ptr >= (uintptr_t)req->in.data + req->in.data_size ||
-	    count > req->in.data_size ||
-	    (uintptr_t)ptr + count > (uintptr_t)req->in.data + req->in.data_size) {
-		return true;
-	}
-	return false;	
-}
-
-static size_t raw_trans_space_left(struct smbcli_request *req)
-{
-	if (req->transport->negotiate.max_xmit <= req->out.size) {
-		return 0;
-	}
-
-	return req->transport->negotiate.max_xmit - req->out.size;
-}
-
-struct smb_raw_trans2_recv_state {
-	uint8_t command;
-	uint32_t params_total;
-	uint32_t data_total;
-	uint32_t params_left;
-	uint32_t data_left;
-	bool got_first;
-	uint32_t recvd_data;
-	uint32_t recvd_param;
-	struct smb_trans2 io;
-};
-
-NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
-			     TALLOC_CTX *mem_ctx,
-			     struct smb_trans2 *parms)
-{
-	struct smb_raw_trans2_recv_state *state;
-
-	if (!smbcli_request_receive(req) ||
-	    smbcli_request_is_error(req)) {
-		goto failed;
-	}
-
-	state = talloc_get_type(req->recv_helper.private_data,
-				struct smb_raw_trans2_recv_state);
-
-	parms->out = state->io.out;
-	talloc_steal(mem_ctx, parms->out.setup);
-	talloc_steal(mem_ctx, parms->out.params.data);
-	talloc_steal(mem_ctx, parms->out.data.data);
-	talloc_free(state);
-
-	ZERO_STRUCT(req->recv_helper);
-
-failed:
-	return smbcli_request_destroy(req);
-}
-
-static enum smbcli_request_state smb_raw_trans2_ship_rest(struct smbcli_request *req,
-							  struct smb_raw_trans2_recv_state *state);
-
-/*
- * This helper returns SMBCLI_REQUEST_RECV until all data has arrived
- */
-static enum smbcli_request_state smb_raw_trans2_recv_helper(struct smbcli_request *req)
-{
-	struct smb_raw_trans2_recv_state *state = talloc_get_type(req->recv_helper.private_data,
-						  struct smb_raw_trans2_recv_state);
-	uint16_t param_count, param_ofs, param_disp;
-	uint16_t data_count, data_ofs, data_disp;
-	uint16_t total_data, total_param;
-	uint8_t setup_count;
-
-	/*
-	 * An NT RPC pipe call can return ERRDOS, ERRmoredata
-	 * to a trans call. This is not an error and should not
-	 * be treated as such.
-	 */
-	if (smbcli_request_is_error(req)) {
-		goto failed;
-	}
-
-	if (state->params_left > 0 || state->data_left > 0) {
-		return smb_raw_trans2_ship_rest(req, state);
-	}
-
-	SMBCLI_CHECK_MIN_WCT(req, 10);
-
-	total_data = SVAL(req->in.vwv, VWV(1));
-	total_param = SVAL(req->in.vwv, VWV(0));
-	setup_count = CVAL(req->in.vwv, VWV(9));
-
-	param_count = SVAL(req->in.vwv, VWV(3));
-	param_ofs   = SVAL(req->in.vwv, VWV(4));
-	param_disp  = SVAL(req->in.vwv, VWV(5));
-
-	data_count = SVAL(req->in.vwv, VWV(6));
-	data_ofs   = SVAL(req->in.vwv, VWV(7));
-	data_disp  = SVAL(req->in.vwv, VWV(8));
-
-	if (!state->got_first) {
-		if (total_param > 0) {
-			state->io.out.params = data_blob_talloc(state, NULL, total_param);
-			if (!state->io.out.params.data) {
-				goto nomem;
-			}
-		}
-
-		if (total_data > 0) {
-			state->io.out.data = data_blob_talloc(state, NULL, total_data);
-			if (!state->io.out.data.data) {
-				goto nomem;
-			}
-		}
-
-		if (setup_count > 0) {
-			uint16_t i;
-
-			SMBCLI_CHECK_WCT(req, 10 + setup_count);
-
-			state->io.out.setup_count = setup_count;
-			state->io.out.setup = talloc_array(state, uint16_t, setup_count);
-			if (!state->io.out.setup) {
-				goto nomem;
-			}
-			for (i=0; i < setup_count; i++) {
-				state->io.out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
-			}
-		}
-
-		state->got_first = true;
-	}
-
-	if (total_data > state->io.out.data.length ||
-	    total_param > state->io.out.params.length) {
-		/* they must *only* shrink */
-		DEBUG(1,("smb_raw_trans2_recv_helper: data/params expanded!\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	state->io.out.data.length = total_data;
-	state->io.out.params.length = total_param;
-
-	if (data_count + data_disp > total_data ||
-	    param_count + param_disp > total_param) {
-		DEBUG(1,("smb_raw_trans2_recv_helper: Buffer overflow\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	/* check the server isn't being nasty */
-	if (raw_trans_oob(req, param_ofs, param_count) ||
-	    raw_trans_oob(req, data_ofs, data_count)) {
-		DEBUG(1,("smb_raw_trans2_recv_helper: out of bounds parameters!\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	if (data_count) {
-		memcpy(state->io.out.data.data + data_disp,
-		       req->in.hdr + data_ofs,
-		       data_count);
-	}
-
-	if (param_count) {
-		memcpy(state->io.out.params.data + param_disp,
-		       req->in.hdr + param_ofs,
-		       param_count);
-	}
-
-	state->recvd_param += param_count;
-	state->recvd_data += data_count;
-
-	if (state->recvd_data < total_data ||
-	    state->recvd_param < total_param) {
-
-		/* we don't need the in buffer any more */
-		talloc_free(req->in.buffer);
-		ZERO_STRUCT(req->in);
-
-		/* we still wait for more data */
-		DEBUG(10,("smb_raw_trans2_recv_helper: more data needed\n"));
-		return SMBCLI_REQUEST_RECV;
-	}
-
-	DEBUG(10,("smb_raw_trans2_recv_helper: done\n"));
-	return SMBCLI_REQUEST_DONE;
-
-nomem:
-	req->status = NT_STATUS_NO_MEMORY;
-failed:
-	return SMBCLI_REQUEST_ERROR;
-}
-
-_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
-			     TALLOC_CTX *mem_ctx,
-			     struct smb_trans2 *parms)
+static struct smbcli_request *smb_raw_trans_backend_send(struct smbcli_tree *tree,
+						         struct smb_trans2 *parms,
+						         uint8_t command)
 {
-	return smb_raw_trans2_recv(req, mem_ctx, parms);
-}
-
-
-/*
-  trans/trans2 raw async interface - only BLOBs used in this interface.
-*/
-struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
-						  struct smb_trans2 *parms,
-						  uint8_t command)
-{
-	struct smb_raw_trans2_recv_state *state;
 	struct smbcli_request *req;
-	int i;
-	int padding;
-	size_t space_left;
-	size_t namelen = 0;
-	DATA_BLOB params_chunk;
-	uint16_t ofs;
-	uint16_t params_ofs = 0;
-	DATA_BLOB data_chunk;
-	uint16_t data_ofs = 0;
-
-	if (parms->in.params.length > UINT16_MAX ||
-	    parms->in.data.length > UINT16_MAX) {
-		DEBUG(3,("Attempt to send invalid trans2 request (params %u, data %u)\n",
-			 (unsigned)parms->in.params.length, (unsigned)parms->in.data.length));
+	uint8_t additional_flags;
+	uint8_t clear_flags;
+	uint16_t additional_flags2;
+	uint16_t clear_flags2;
+	uint32_t pid;
+	uint16_t tid;
+	uint16_t uid;
+	const char *pipe_name = NULL;
+	uint8_t s;
+	uint32_t timeout_msec;
+	uint32_t tmp;
+
+	tmp = parms->in.params.length + parms->in.data.length;
+
+	req = smbcli_request_setup(tree, command, parms->in.setup_count, tmp);
+	if (req == NULL) {
 		return NULL;
 	}
-	    
-
-	if (command == SMBtrans)
-		padding = 1;
-	else
-		padding = 3;
-	
-	req = smbcli_request_setup(tree, command,
-				   14 + parms->in.setup_count,
-				   padding);
-	if (!req) {
-		return NULL;
-	}
-
-	state = talloc_zero(req, struct smb_raw_trans2_recv_state);
-	if (!state) {
-		smbcli_request_destroy(req);
-		return NULL;
-	}
-
-	state->command = command;
-
-	/* make sure we don't leak data via the padding */
-	memset(req->out.data, 0, padding);
-
-	/* Watch out, this changes the req->out.* pointers */
-	if (command == SMBtrans && parms->in.trans_name) {
-		namelen = smbcli_req_append_string(req, parms->in.trans_name, 
-						STR_TERMINATE);
-	}
-
-	ofs = PTR_DIFF(req->out.data,req->out.hdr)+padding+namelen;
-
-	/* see how much bytes of the params block we can ship in the first request */
-	space_left = raw_trans_space_left(req);
-
-	params_chunk.length = MIN(parms->in.params.length, space_left);
-	params_chunk.data = parms->in.params.data;
-	params_ofs = ofs;
-
-	state->params_left = parms->in.params.length - params_chunk.length;
-
-	if (state->params_left > 0) {
-		/* we copy the whole params block, if needed we can optimize that latter */
-		state->io.in.params = data_blob_talloc(state, NULL, parms->in.params.length);
-		if (!state->io.in.params.data) {
-			smbcli_request_destroy(req);
-			return NULL;
-		}
-		memcpy(state->io.in.params.data,
-		       parms->in.params.data,
-		       parms->in.params.length);
-	}
 
-	/* see how much bytes of the data block we can ship in the first request */
-	space_left -= params_chunk.length;
+	additional_flags = CVAL(req->out.hdr, HDR_FLG);
+	additional_flags2 = SVAL(req->out.hdr, HDR_FLG2);
+	pid  = SVAL(req->out.hdr, HDR_PID);
+	pid |= SVAL(req->out.hdr, HDR_PIDHIGH)<<16;
+	tid = SVAL(req->out.hdr, HDR_TID);
+	uid = SVAL(req->out.hdr, HDR_UID);
 
-#if TORTURE_TRANS_DATA
-	if (space_left > 1) {
-		space_left /= 2;
-	}
-#endif
-
-	data_chunk.length = MIN(parms->in.data.length, space_left);
-	data_chunk.data = parms->in.data.data;
-	data_ofs = params_ofs + params_chunk.length;
-
-	state->data_left = parms->in.data.length - data_chunk.length;
+	clear_flags = ~additional_flags;
+	clear_flags2 = ~additional_flags2;
 
-	if (state->data_left > 0) {
-		/* we copy the whole params block, if needed we can optimize that latter */
-		state->io.in.data = data_blob_talloc(state, NULL, parms->in.data.length);
-		if (!state->io.in.data.data) {
-			smbcli_request_destroy(req);
-			return NULL;
-		}
-		memcpy(state->io.in.data.data,
-		       parms->in.data.data,
-		       parms->in.data.length);
-	}
+	timeout_msec = req->transport->options.request_timeout * 1000;
 
-	state->params_total = parms->in.params.length;
-	state->data_total = parms->in.data.length;
-
-	/* primary request */
-	SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
-	SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
-	SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
-	SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
-	SCVAL(req->out.vwv,VWV(4),parms->in.max_setup);
-	SCVAL(req->out.vwv,VWV(4)+1,0); /* reserved */
-	SSVAL(req->out.vwv,VWV(5),parms->in.flags);
-	SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
-	SSVAL(req->out.vwv,VWV(8),0); /* reserved */
-	SSVAL(req->out.vwv,VWV(9),params_chunk.length);
-	SSVAL(req->out.vwv,VWV(10),params_ofs);
-	SSVAL(req->out.vwv,VWV(11),data_chunk.length);
-	SSVAL(req->out.vwv,VWV(12),data_ofs);
-	SCVAL(req->out.vwv,VWV(13),parms->in.setup_count);
-	SCVAL(req->out.vwv,VWV(13)+1,0); /* reserved */
-	for (i=0;i<parms->in.setup_count;i++)	{
-		SSVAL(req->out.vwv,VWV(14)+VWV(i),parms->in.setup[i]);
+	for (s=0; s < parms->in.setup_count; s++) {
+		SSVAL(req->out.vwv, VWV(s), parms->in.setup[s]);
 	}
-	smbcli_req_append_blob(req, &params_chunk);
-	smbcli_req_append_blob(req, &data_chunk);
 
-	/* add the helper which will check that all multi-part replies are
-	   in before an async client callack will be issued */
-	req->recv_helper.fn = smb_raw_trans2_recv_helper;
-	req->recv_helper.private_data = state;
+	memcpy(req->out.data,
+	       parms->in.params.data,
+	       parms->in.params.length);
+	memcpy(req->out.data + parms->in.params.length,
+	       parms->in.data.data,
+	       parms->in.data.length);
 
-	if (!smbcli_request_send(req)) {
-		smbcli_request_destroy(req);
+	if (command == SMBtrans && parms->in.trans_name) {
+		pipe_name = parms->in.trans_name;
+	}
+
+	req->subreqs[0] = smb1cli_trans_send(req,
+					     req->transport->ev,
+					     req->transport->conn,
+					     command,
+					     additional_flags,
+					     clear_flags,
+					     additional_flags2,
+					     clear_flags2,
+					     timeout_msec,
+					     pid, tid, uid,
+					     pipe_name,
+					     0xFFFF, /* fid */
+					     0, /* function */
+					     parms->in.flags,
+					     (uint16_t *)req->out.vwv,
+					     parms->in.setup_count,
+					     parms->in.max_setup,
+					     req->out.data,
+					     parms->in.params.length,
+					     parms->in.max_param,
+					     req->out.data+
+					     parms->in.params.length,
+					     parms->in.data.length,
+					     parms->in.max_data);
+	if (req->subreqs[0] == NULL) {
+		talloc_free(req);
 		return NULL;
 	}
+	tevent_req_set_callback(req->subreqs[0],
+				smb_raw_trans_backend_done,
+				req);
 
 	return req;
 }
 
-static enum smbcli_request_state smb_raw_trans2_ship_next(struct smbcli_request *req,
-							  struct smb_raw_trans2_recv_state *state)
+static void smb_raw_trans_backend_done(struct tevent_req *subreq)
 {
-	struct smbcli_request *req2;
-	size_t space_left;
-	DATA_BLOB params_chunk;
-	uint16_t ofs;
-	uint16_t params_ofs = 0;
-	uint16_t params_disp = 0;
-	DATA_BLOB data_chunk;
-	uint16_t data_ofs = 0;
-	uint16_t data_disp = 0;
-	uint8_t wct;
-
-	if (state->command == SMBtrans2) {
-		wct = 9;
-	} else {
-		wct = 8;
+	struct smbcli_request *req =
+		tevent_req_callback_data(subreq,
+		struct smbcli_request);
+	struct smbcli_transport *transport = req->transport;
+	uint16_t *setup = NULL;
+	uint8_t num_setup = 0;
+	uint8_t s;
+	uint8_t *param = NULL;
+	uint32_t num_param = 0;
+	uint8_t *data = NULL;
+	uint32_t num_data = 0;
+
+	req->status = smb1cli_trans_recv(req->subreqs[0], req,
+					 &req->flags2,
+					 &setup,
+					 0, /* min_setup */
+					 &num_setup,
+					 &param,
+					 0, /* min_param */
+					 &num_param,
+					 &data,
+					 0, /* min_data */
+					 &num_data);
+	TALLOC_FREE(req->subreqs[0]);
+	if (NT_STATUS_IS_ERR(req->status)) {
+		req->state = SMBCLI_REQUEST_ERROR;
+		transport->error.e.nt_status = req->status;
+		transport->error.etype = ETYPE_SMB;
+		if (req->async.fn) {
+			req->async.fn(req);
+		}
+		return;
+	}
+
+	req->trans2.out.setup_count = num_setup;
+	req->trans2.out.setup = talloc_array(req, uint16_t, num_setup);
+	if (req->trans2.out.setup == NULL) {
+		req->state = SMBCLI_REQUEST_ERROR;
+		req->status = NT_STATUS_NO_MEMORY;
+		transport->error.e.nt_status = req->status;
+		transport->error.etype = ETYPE_SMB;
+		if (req->async.fn) {
+			req->async.fn(req);
+		}
+		return;
 	}
-
-	req2 = smbcli_request_setup(req->tree, state->command+1, wct, 0);
-	if (!req2) {
-		goto nomem;
+	for (s = 0; s < num_setup; s++) {
+		req->trans2.out.setup[s] = SVAL(setup, VWV(s));
 	}
-	req2->mid = req->mid;
-	SSVAL(req2->out.hdr, HDR_MID, req2->mid);
-
-	ofs = PTR_DIFF(req2->out.data,req2->out.hdr);
-
-	/* see how much bytes of the params block we can ship in the first request */
-	space_left = raw_trans_space_left(req2);
-
-	params_disp = state->io.in.params.length - state->params_left;
-	params_chunk.length = MIN(state->params_left, space_left);
-	params_chunk.data = state->io.in.params.data + params_disp;
-	params_ofs = ofs;
 
-	state->params_left -= params_chunk.length;
-
-	/* see how much bytes of the data block we can ship in the first request */
-	space_left -= params_chunk.length;
-
-#if TORTURE_TRANS_DATA
-	if (space_left > 1) {
-		space_left /= 2;
-	}
-#endif
-
-	data_disp = state->io.in.data.length - state->data_left;
-	data_chunk.length = MIN(state->data_left, space_left);
-	data_chunk.data = state->io.in.data.data + data_disp;
-	data_ofs = params_ofs+params_chunk.length;
-
-	state->data_left -= data_chunk.length;
-
-	SSVAL(req2->out.vwv,VWV(0), state->params_total);
-	SSVAL(req2->out.vwv,VWV(1), state->data_total);
-	SSVAL(req2->out.vwv,VWV(2), params_chunk.length);
-	SSVAL(req2->out.vwv,VWV(3), params_ofs);
-	SSVAL(req2->out.vwv,VWV(4), params_disp);
-	SSVAL(req2->out.vwv,VWV(5), data_chunk.length);
-	SSVAL(req2->out.vwv,VWV(6), data_ofs);
-	SSVAL(req2->out.vwv,VWV(7), data_disp);
-	if (wct == 9) {
-		SSVAL(req2->out.vwv,VWV(8), 0xFFFF);
-	}
+	req->trans2.out.params.data = param;
+	req->trans2.out.params.length = num_param;
 
-	smbcli_req_append_blob(req2, &params_chunk);
-	smbcli_req_append_blob(req2, &data_chunk);
+	req->trans2.out.data.data = data;
+	req->trans2.out.data.length = num_data;
 
-	/*
-	 * it's a one way request but we need
-	 * the seq_num, so we destroy req2 by hand
-	 */
-	if (!smbcli_request_send(req2)) {
-		goto failed;
+	transport->error.e.nt_status = req->status;
+	if (NT_STATUS_IS_OK(req->status)) {
+		transport->error.etype = ETYPE_NONE;
+	} else {
+		transport->error.etype = ETYPE_SMB;
 	}
 
-	req->seq_num = req2->seq_num;
-	smbcli_request_destroy(req2);
-
-	return SMBCLI_REQUEST_RECV;
-
-nomem:
-	req->status = NT_STATUS_NO_MEMORY;
-failed:
-	if (req2) {
-		req->status = smbcli_request_destroy(req2);
+	req->state = SMBCLI_REQUEST_DONE;
+	if (req->async.fn) {
+		req->async.fn(req);
 	}
-	return SMBCLI_REQUEST_ERROR;
 }
 
-static enum smbcli_request_state smb_raw_trans2_ship_rest(struct smbcli_request *req,
-							  struct smb_raw_trans2_recv_state *state)
+static NTSTATUS smb_raw_trans_backend_recv(struct smbcli_request *req,
+					   TALLOC_CTX *mem_ctx,
+					   struct smb_trans2 *parms)
 {
-	enum smbcli_request_state ret = SMBCLI_REQUEST_ERROR;
-
-	while (state->params_left > 0 || state->data_left > 0) {
-		ret = smb_raw_trans2_ship_next(req, state);
-		if (ret != SMBCLI_REQUEST_RECV) {
-			break;
-		}
+	if (!smbcli_request_receive(req) ||
+	    smbcli_request_is_error(req)) {
+		goto failed;
 	}
 
-	return ret;
-}
-
+	parms->out = req->trans2.out;
+	talloc_steal(mem_ctx, parms->out.setup);
+	talloc_steal(mem_ctx, parms->out.params.data);
+	talloc_steal(mem_ctx, parms->out.data.data);
 
-/*
-  trans/trans2 raw async interface - only BLOBs used in this interface.
-  note that this doesn't yet support multi-part requests
-*/
-_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
-				       struct smb_trans2 *parms)
-{
-	return smb_raw_trans_send_backend(tree, parms, SMBtrans);
+failed:
+	return smbcli_request_destroy(req);
 }
 
-struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
+_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
 				       struct smb_trans2 *parms)
 {
-	return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
+	return smb_raw_trans_backend_send(tree, parms, SMBtrans);
 }
 
-/*
-  trans2 synchronous blob interface
-*/
-NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
-			TALLOC_CTX *mem_ctx,
-			struct smb_trans2 *parms)
+_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
+			     TALLOC_CTX *mem_ctx,
+			     struct smb_trans2 *parms)
 {
-	struct smbcli_request *req;
-	req = smb_raw_trans2_send(tree, parms);
-	if (!req) return NT_STATUS_UNSUCCESSFUL;
-	return smb_raw_trans2_recv(req, mem_ctx, parms);
+	return smb_raw_trans_backend_recv(req, mem_ctx, parms);
 }
 
-
-/*
-  trans synchronous blob interface
-*/
 _PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
 		       TALLOC_CTX *mem_ctx,
 		       struct smb_trans2 *parms)
@@ -536,413 +224,185 @@ _PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
 	return smb_raw_trans_recv(req, mem_ctx, parms);
 }
 
-struct smb_raw_nttrans_recv_state {
-	uint32_t params_total;
-	uint32_t data_total;
-	uint32_t params_left;
-	uint32_t data_left;
-	bool got_first;
-	uint32_t recvd_data;
-	uint32_t recvd_param;
-	struct smb_nttrans io;
-};
-
-NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
-			      TALLOC_CTX *mem_ctx,
-			      struct smb_nttrans *parms)
+struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
+				       struct smb_trans2 *parms)
 {
-	struct smb_raw_nttrans_recv_state *state;
-
-	if (!smbcli_request_receive(req) ||
-	    smbcli_request_is_error(req)) {
-		goto failed;
-	}
-
-	state = talloc_get_type(req->recv_helper.private_data,
-				struct smb_raw_nttrans_recv_state);
-
-	parms->out = state->io.out;
-	talloc_steal(mem_ctx, parms->out.setup);
-	talloc_steal(mem_ctx, parms->out.params.data);
-	talloc_steal(mem_ctx, parms->out.data.data);
-	talloc_free(state);
-
-	ZERO_STRUCT(req->recv_helper);
-
-failed:
-	return smbcli_request_destroy(req);
+	return smb_raw_trans_backend_send(tree, parms, SMBtrans2);
 }
 
-static enum smbcli_request_state smb_raw_nttrans_ship_rest(struct smbcli_request *req,
-							   struct smb_raw_nttrans_recv_state *state);
-
-/*
- * This helper returns SMBCLI_REQUEST_RECV until all data has arrived
- */
-static enum smbcli_request_state smb_raw_nttrans_recv_helper(struct smbcli_request *req)
+NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
+			     TALLOC_CTX *mem_ctx,
+			     struct smb_trans2 *parms)
 {
-	struct smb_raw_nttrans_recv_state *state = talloc_get_type(req->recv_helper.private_data,
-						   struct smb_raw_nttrans_recv_state);
-	uint32_t param_count, param_ofs, param_disp;
-	uint32_t data_count, data_ofs, data_disp;
-	uint32_t total_data, total_param;
-	uint8_t setup_count;
-
-	/*
-	 * An NT RPC pipe call can return ERRDOS, ERRmoredata
-	 * to a trans call. This is not an error and should not
-	 * be treated as such.
-	 */
-	if (smbcli_request_is_error(req)) {
-		goto failed;
-	}
-
-	/* sanity check */
-	if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
-		DEBUG(0,("smb_raw_nttrans_recv_helper: Expected %s response, got command 0x%02x\n",
-			 "SMBnttrans", 
-			 CVAL(req->in.hdr,HDR_COM)));
-		req->status = NT_STATUS_INVALID_NETWORK_RESPONSE;
-		goto failed;
-	}
-
-	if (state->params_left > 0 || state->data_left > 0) {
-		return smb_raw_nttrans_ship_rest(req, state);
-	}
-
-	/* this is the first packet of the response */
-	SMBCLI_CHECK_MIN_WCT(req, 18);
-
-	total_param = IVAL(req->in.vwv, 3);
-	total_data  = IVAL(req->in.vwv, 7);
-	setup_count = CVAL(req->in.vwv, 35);
-
-	param_count = IVAL(req->in.vwv, 11);
-	param_ofs   = IVAL(req->in.vwv, 15);
-	param_disp  = IVAL(req->in.vwv, 19);
-
-	data_count = IVAL(req->in.vwv, 23);
-	data_ofs   = IVAL(req->in.vwv, 27);
-	data_disp  = IVAL(req->in.vwv, 31);
-
-	if (!state->got_first) {
-		if (total_param > 0) {
-			state->io.out.params = data_blob_talloc(state, NULL, total_param);
-			if (!state->io.out.params.data) {
-				goto nomem;
-			}
-		}
-
-		if (total_data > 0) {
-			state->io.out.data = data_blob_talloc(state, NULL, total_data);
-			if (!state->io.out.data.data) {
-				goto nomem;
-			}
-		}
-
-		if (setup_count > 0) {
-			SMBCLI_CHECK_WCT(req, 18 + setup_count);
-
-			state->io.out.setup_count = setup_count;
-			state->io.out.setup = talloc_array(state, uint8_t,
-							   setup_count * VWV(1));
-			if (!state->io.out.setup) {
-				goto nomem;
-			}
-			memcpy(state->io.out.setup, (uint8_t *)req->out.vwv + VWV(18),
-			       setup_count * VWV(1));
-		}
-
-		state->got_first = true;
-	}
-
-	if (total_data > state->io.out.data.length ||
-	    total_param > state->io.out.params.length) {
-		/* they must *only* shrink */
-		DEBUG(1,("smb_raw_nttrans_recv_helper: data/params expanded!\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	state->io.out.data.length = total_data;
-	state->io.out.params.length = total_param;
-
-	if (data_count + data_disp > total_data ||
-	    param_count + param_disp > total_param) {
-		DEBUG(1,("smb_raw_nttrans_recv_helper: Buffer overflow\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	/* check the server isn't being nasty */
-	if (raw_trans_oob(req, param_ofs, param_count) ||
-	    raw_trans_oob(req, data_ofs, data_count)) {
-		DEBUG(1,("smb_raw_nttrans_recv_helper: out of bounds parameters!\n"));
-		req->status = NT_STATUS_BUFFER_TOO_SMALL;
-		goto failed;
-	}
-
-	if (data_count) {
-		memcpy(state->io.out.data.data + data_disp,
-		       req->in.hdr + data_ofs,
-		       data_count);
-	}
-
-	if (param_count) {
-		memcpy(state->io.out.params.data + param_disp,
-		       req->in.hdr + param_ofs,
-		       param_count);
-	}
-
-	state->recvd_param += param_count;
-	state->recvd_data += data_count;
-
-	if (state->recvd_data < total_data ||
-	    state->recvd_param < total_param) {
-
-		/* we don't need the in buffer any more */
-		talloc_free(req->in.buffer);
-		ZERO_STRUCT(req->in);
-
-		/* we still wait for more data */
-		DEBUG(10,("smb_raw_nttrans_recv_helper: more data needed\n"));
-		return SMBCLI_REQUEST_RECV;
-	}
-
-	DEBUG(10,("smb_raw_nttrans_recv_helper: done\n"));
-	return SMBCLI_REQUEST_DONE;
+	return smb_raw_trans_backend_recv(req, mem_ctx, parms);
+}
 
-nomem:
-	req->status = NT_STATUS_NO_MEMORY;
-failed:
-	return SMBCLI_REQUEST_ERROR;
+NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
+			TALLOC_CTX *mem_ctx,
+			struct smb_trans2 *parms)
+{
+	struct smbcli_request *req;
+	req = smb_raw_trans2_send(tree, parms);
+	if (!req) return NT_STATUS_UNSUCCESSFUL;
+	return smb_raw_trans2_recv(req, mem_ctx, parms);
 }
 
-/****************************************************************************
- nttrans raw - only BLOBs used in this interface.
- at the moment we only handle a single primary request 
-****************************************************************************/
+static void smb_raw_nttrans_done(struct tevent_req *subreq);
+
 struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
-					 struct smb_nttrans *parms)
+					    struct smb_nttrans *parms)
 {
-	struct smbcli_request *req; 
-	struct smb_raw_nttrans_recv_state *state;
-	uint32_t ofs;
-	size_t space_left;
-	DATA_BLOB params_chunk;
-	uint32_t params_ofs;
-	DATA_BLOB data_chunk;
-	uint32_t data_ofs;
-	int align = 0;
-
-	/* only align if there are parameters or data */
-	if (parms->in.params.length || parms->in.data.length) {
-		align = 3;
-	}
-	
-	req = smbcli_request_setup(tree, SMBnttrans, 
-				19 + parms->in.setup_count, align);
-	if (!req) {
+	struct smbcli_request *req;
+	uint8_t additional_flags;
+	uint8_t clear_flags;
+	uint16_t additional_flags2;
+	uint16_t clear_flags2;
+	uint32_t pid;
+	uint16_t tid;
+	uint16_t uid;
+	uint32_t timeout_msec;
+	uint32_t tmp;
+
+	tmp = parms->in.params.length + parms->in.data.length;
+
+	req = smbcli_request_setup(tree, SMBnttrans, parms->in.setup_count, tmp);
+	if (req == NULL) {
 		return NULL;
 	}
 
-	state = talloc_zero(req, struct smb_raw_nttrans_recv_state);
-	if (!state) {
+	additional_flags = CVAL(req->out.hdr, HDR_FLG);
+	additional_flags2 = SVAL(req->out.hdr, HDR_FLG2);
+	pid  = SVAL(req->out.hdr, HDR_PID);
+	pid |= SVAL(req->out.hdr, HDR_PIDHIGH)<<16;
+	tid = SVAL(req->out.hdr, HDR_TID);
+	uid = SVAL(req->out.hdr, HDR_UID);
+
+	clear_flags = ~additional_flags;
+	clear_flags2 = ~additional_flags2;
+
+	timeout_msec = req->transport->options.request_timeout * 1000;
+
+	memcpy(req->out.vwv,
+	       parms->in.setup,
+	       parms->in.setup_count * 2);
+
+	memcpy(req->out.data,
+	       parms->in.params.data,
+	       parms->in.params.length);
+	memcpy(req->out.data + parms->in.params.length,
+	       parms->in.data.data,
+	       parms->in.data.length);
+
+	req->subreqs[0] = smb1cli_trans_send(req,
+					     req->transport->ev,
+					     req->transport->conn,
+					     SMBnttrans,
+					     additional_flags,
+					     clear_flags,
+					     additional_flags2,
+					     clear_flags2,
+					     timeout_msec,
+					     pid, tid, uid,
+					     NULL, /* pipe_name */
+					     0xFFFF, /* fid */
+					     parms->in.function,
+					     0, /* flags */
+					     (uint16_t *)req->out.vwv,
+					     parms->in.setup_count,
+					     parms->in.max_setup,
+					     req->out.data,
+					     parms->in.params.length,
+					     parms->in.max_param,
+					     req->out.data+
+					     parms->in.params.length,
+					     parms->in.data.length,
+					     parms->in.max_data);
+	if (req->subreqs[0] == NULL) {
 		talloc_free(req);
 		return NULL;
 	}
+	tevent_req_set_callback(req->subreqs[0],
+				smb_raw_nttrans_done,
+				req);
 
-	/* fill in SMB parameters */
-
-	if (align != 0) {
-		memset(req->out.data, 0, align);
-	}
-
-	ofs = PTR_DIFF(req->out.data,req->out.hdr)+align;
-
-	/* see how much bytes of the params block we can ship in the first request */
-	space_left = raw_trans_space_left(req);
-
-	params_chunk.length = MIN(parms->in.params.length, space_left);
-	params_chunk.data = parms->in.params.data;
-	params_ofs = ofs;
-
-	state->params_left = parms->in.params.length - params_chunk.length;
+	return req;
+}
 
-	if (state->params_left > 0) {
-		/* we copy the whole params block, if needed we can optimize that latter */
-		state->io.in.params = data_blob_talloc(state, NULL, parms->in.params.length);
-		if (!state->io.in.params.data) {
-			smbcli_request_destroy(req);
-			return NULL;
+static void smb_raw_nttrans_done(struct tevent_req *subreq)
+{
+	struct smbcli_request *req =
+		tevent_req_callback_data(subreq,
+		struct smbcli_request);
+	struct smbcli_transport *transport = req->transport;
+	uint16_t *setup = NULL;
+	uint8_t num_setup = 0;
+	uint8_t *param = NULL;
+	uint32_t num_param = 0;
+	uint8_t *data = NULL;
+	uint32_t num_data = 0;
+
+	req->status = smb1cli_trans_recv(req->subreqs[0], req,
+					 &req->flags2,
+					 &setup,
+					 0, /* min_setup */
+					 &num_setup,
+					 &param,
+					 0, /* min_param */
+					 &num_param,
+					 &data,
+					 0, /* min_data */
+					 &num_data);
+	TALLOC_FREE(req->subreqs[0]);
+	if (NT_STATUS_IS_ERR(req->status)) {
+		req->state = SMBCLI_REQUEST_ERROR;
+		transport->error.e.nt_status = req->status;
+		transport->error.etype = ETYPE_SMB;
+		if (req->async.fn) {
+			req->async.fn(req);
 		}
-		memcpy(state->io.in.params.data,
-		       parms->in.params.data,
-		       parms->in.params.length);
+		return;
 	}
 
-	/* see how much bytes of the data block we can ship in the first request */
-	space_left -= params_chunk.length;
-
-#if TORTURE_TRANS_DATA
-	if (space_left > 1) {
-		space_left /= 2;
-	}
-#endif
+	req->nttrans.out.setup_count = num_setup;
+	req->nttrans.out.setup = (uint8_t *)setup;
 
-	data_chunk.length = MIN(parms->in.data.length, space_left);
-	data_chunk.data = parms->in.data.data;
-	data_ofs = params_ofs + params_chunk.length;
+	req->nttrans.out.params.data = param;
+	req->nttrans.out.params.length = num_param;
 
-	state->data_left = parms->in.data.length - data_chunk.length;
+	req->nttrans.out.data.data = data;
+	req->nttrans.out.data.length = num_data;
 
-	if (state->data_left > 0) {
-		/* we copy the whole params block, if needed we can optimize that latter */
-		state->io.in.data = data_blob_talloc(state, NULL, parms->in.data.length);
-		if (!state->io.in.data.data) {
-			smbcli_request_destroy(req);
-			return NULL;
-		}
-		memcpy(state->io.in.data.data,
-		       parms->in.data.data,
-		       parms->in.data.length);
+	transport->error.e.nt_status = req->status;
+	if (NT_STATUS_IS_OK(req->status)) {
+		transport->error.etype = ETYPE_NONE;
+	} else {
+		transport->error.etype = ETYPE_SMB;
 	}
 
-	state->params_total = parms->in.params.length;
-	state->data_total = parms->in.data.length;
-
-	SCVAL(req->out.vwv,  0, parms->in.max_setup);
-	SSVAL(req->out.vwv,  1, 0); /* reserved */
-	SIVAL(req->out.vwv,  3, parms->in.params.length);
-	SIVAL(req->out.vwv,  7, parms->in.data.length);
-	SIVAL(req->out.vwv, 11, parms->in.max_param);
-	SIVAL(req->out.vwv, 15, parms->in.max_data);
-	SIVAL(req->out.vwv, 19, params_chunk.length);
-	SIVAL(req->out.vwv, 23, params_ofs);
-	SIVAL(req->out.vwv, 27, data_chunk.length);
-	SIVAL(req->out.vwv, 31, data_ofs);
-	SCVAL(req->out.vwv, 35, parms->in.setup_count);
-	SSVAL(req->out.vwv, 36, parms->in.function);
-	memcpy(req->out.vwv + VWV(19), parms->in.setup,
-	       sizeof(uint16_t) * parms->in.setup_count);
-
-	smbcli_req_append_blob(req, &params_chunk);
-	smbcli_req_append_blob(req, &data_chunk);
-
-	/* add the helper which will check that all multi-part replies are
-	   in before an async client callack will be issued */
-	req->recv_helper.fn = smb_raw_nttrans_recv_helper;
-	req->recv_helper.private_data = state;
-
-	if (!smbcli_request_send(req)) {
-		smbcli_request_destroy(req);
-		return NULL;
+	req->state = SMBCLI_REQUEST_DONE;
+	if (req->async.fn) {
+		req->async.fn(req);
 	}
-
-	return req;
 }
 
-static enum smbcli_request_state smb_raw_nttrans_ship_next(struct smbcli_request *req,
-							   struct smb_raw_nttrans_recv_state *state)
+NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
+			      TALLOC_CTX *mem_ctx,
+			      struct smb_nttrans *parms)
 {
-	struct smbcli_request *req2;
-	size_t space_left;
-	DATA_BLOB params_chunk;
-	uint32_t ofs;
-	uint32_t params_ofs = 0;
-	uint32_t params_disp = 0;
-	DATA_BLOB data_chunk;
-	uint32_t data_ofs = 0;
-	uint32_t data_disp = 0;
-
-	req2 = smbcli_request_setup(req->tree, SMBnttranss, 18, 0);
-	if (!req2) {
-		goto nomem;
-	}
-	req2->mid = req->mid;
-	SSVAL(req2->out.hdr, HDR_MID, req2->mid);
-
-	ofs = PTR_DIFF(req2->out.data,req2->out.hdr);
-
-	/* see how much bytes of the params block we can ship in the first request */
-	space_left = raw_trans_space_left(req2);
-
-	params_disp = state->io.in.params.length - state->params_left;
-	params_chunk.length = MIN(state->params_left, space_left);
-	params_chunk.data = state->io.in.params.data + params_disp;
-	params_ofs = ofs;
-
-	state->params_left -= params_chunk.length;
-
-	/* see how much bytes of the data block we can ship in the first request */
-	space_left -= params_chunk.length;
-
-#if TORTURE_TRANS_DATA
-	if (space_left > 1) {
-		space_left /= 2;
-	}
-#endif
-
-	data_disp = state->io.in.data.length - state->data_left;
-	data_chunk.length = MIN(state->data_left, space_left);
-	data_chunk.data = state->io.in.data.data + data_disp;
-	data_ofs = params_ofs+params_chunk.length;
-
-	state->data_left -= data_chunk.length;
-
-	SSVAL(req2->out.vwv,0, 0); /* reserved */
-	SCVAL(req2->out.vwv,2, 0); /* reserved */
-	SIVAL(req2->out.vwv,3, state->params_total);
-	SIVAL(req2->out.vwv,7, state->data_total);
-	SIVAL(req2->out.vwv,11, params_chunk.length);
-	SIVAL(req2->out.vwv,15, params_ofs);
-	SIVAL(req2->out.vwv,19, params_disp);
-	SIVAL(req2->out.vwv,23, data_chunk.length);
-	SIVAL(req2->out.vwv,27, data_ofs);
-	SIVAL(req2->out.vwv,31, data_disp);
-	SCVAL(req2->out.vwv,35, 0); /* reserved */
-
-	smbcli_req_append_blob(req2, &params_chunk);
-	smbcli_req_append_blob(req2, &data_chunk);
-
-	/*
-	 * it's a one way request but we need
-	 * the seq_num, so we destroy req2 by hand
-	 */
-	if (!smbcli_request_send(req2)) {
+	if (!smbcli_request_receive(req) ||
+	    smbcli_request_is_error(req)) {
 		goto failed;
 	}
 
-	req->seq_num = req2->seq_num;
-	smbcli_request_destroy(req2);
-
-	return SMBCLI_REQUEST_RECV;
+	parms->out = req->nttrans.out;
+	talloc_steal(mem_ctx, parms->out.setup);
+	talloc_steal(mem_ctx, parms->out.params.data);
+	talloc_steal(mem_ctx, parms->out.data.data);
 
-nomem:
-	req->status = NT_STATUS_NO_MEMORY;
 failed:
-	if (req2) {
-		req->status = smbcli_request_destroy(req2);
-	}
-	return SMBCLI_REQUEST_ERROR;
-}
-
-static enum smbcli_request_state smb_raw_nttrans_ship_rest(struct smbcli_request *req,
-							   struct smb_raw_nttrans_recv_state *state)
-{
-	enum smbcli_request_state ret = SMBCLI_REQUEST_ERROR;
-
-	while (state->params_left > 0 || state->data_left > 0) {
-		ret = smb_raw_nttrans_ship_next(req, state);
-		if (ret != SMBCLI_REQUEST_RECV) {
-			break;
-		}
-	}
-
-	return ret;
+	return smbcli_request_destroy(req);
 }
 
-
 /****************************************************************************
   receive a SMB nttrans response allocating the necessary memory
   ****************************************************************************/