diff options
| -rw-r--r-- | source4/libcli/raw/rawtrans.c | 247 |
1 files changed, 145 insertions, 102 deletions
diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c index 0f15b2151b..9fa52eedae 100644 --- a/source4/libcli/raw/rawtrans.c +++ b/source4/libcli/raw/rawtrans.c @@ -405,146 +405,177 @@ _PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree, return smb_raw_trans_recv(req, mem_ctx, parms); } +struct smb_raw_nttrans_recv_state { + bool got_first; + uint32_t recvd_data; + uint32_t recvd_param; + struct smb_nttrans io; +}; -/**************************************************************************** - receive a SMB nttrans response allocating the necessary memory - ****************************************************************************/ NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, struct smb_nttrans *parms) { - uint32_t total_data, recvd_data=0; - uint32_t total_param, recvd_param=0; + struct smb_raw_nttrans_recv_state *state; if (!smbcli_request_receive(req) || smbcli_request_is_error(req)) { - return smbcli_request_destroy(req); + goto failed; + } + + state = talloc_get_type(req->recv_helper.private_data, + struct smb_raw_nttrans_recv_state); + + parms->out = state->io.out; + talloc_steal(mem_ctx, parms->out.setup); + talloc_steal(mem_ctx, parms->out.params.data); + talloc_steal(mem_ctx, parms->out.data.data); + talloc_free(state); + + ZERO_STRUCT(req->recv_helper); + +failed: + return smbcli_request_destroy(req); +} + +/* + * This helper returns SMBCLI_REQUEST_RECV until all data has arrived + */ +static enum smbcli_request_state smb_raw_nttrans_recv_helper(struct smbcli_request *req) +{ + struct smb_raw_nttrans_recv_state *state = talloc_get_type(req->recv_helper.private_data, + struct smb_raw_nttrans_recv_state); + uint32_t param_count, param_ofs, param_disp; + uint32_t data_count, data_ofs, data_disp; + uint32_t total_data, total_param; + uint8_t setup_count; + + /* + * An NT RPC pipe call can return ERRDOS, ERRmoredata + * to a trans call. This is not an error and should not + * be treated as such. + */ + if (smbcli_request_is_error(req)) { + goto failed; } /* sanity check */ if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) { - DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n", + DEBUG(0,("smb_raw_nttrans_recv_helper: Expected %s response, got command 0x%02x\n", "SMBnttrans", CVAL(req->in.hdr,HDR_COM))); - req->status = NT_STATUS_UNSUCCESSFUL; - return smbcli_request_destroy(req); + req->status = NT_STATUS_INVALID_NETWORK_RESPONSE; + goto failed; } + /* this is the first packet of the response */ SMBCLI_CHECK_MIN_WCT(req, 18); - /* parse out the lengths */ total_param = IVAL(req->in.vwv, 3); total_data = IVAL(req->in.vwv, 7); + setup_count = CVAL(req->in.vwv, 35); + + param_count = IVAL(req->in.vwv, 11); + param_ofs = IVAL(req->in.vwv, 15); + param_disp = IVAL(req->in.vwv, 19); + + data_count = IVAL(req->in.vwv, 23); + data_ofs = IVAL(req->in.vwv, 27); + data_disp = IVAL(req->in.vwv, 31); + + if (!state->got_first) { + if (total_param > 0) { + state->io.out.params = data_blob_talloc(state, NULL, total_param); + if (!state->io.out.params.data) { + goto nomem; + } + } - parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data); - parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param); - - if (parms->out.data.length != total_data || - parms->out.params.length != total_param) { - req->status = NT_STATUS_NO_MEMORY; - return smbcli_request_destroy(req); - } - - parms->out.setup_count = CVAL(req->in.vwv, 35); - SMBCLI_CHECK_WCT(req, 18 + parms->out.setup_count); + if (total_data > 0) { + state->io.out.data = data_blob_talloc(state, NULL, total_data); + if (!state->io.out.data.data) { + goto nomem; + } + } - if (parms->out.setup_count > 0) { - parms->out.setup = talloc_array(mem_ctx, uint8_t, - parms->out.setup_count*2); - if (!parms->out.setup) { - req->status = NT_STATUS_NO_MEMORY; - return smbcli_request_destroy(req); + if (setup_count > 0) { + SMBCLI_CHECK_WCT(req, 18 + setup_count); + + state->io.out.setup_count = setup_count; + state->io.out.setup = talloc_array(state, uint8_t, + setup_count * VWV(1)); + if (!state->io.out.setup) { + goto nomem; + } + memcpy(state->io.out.setup, (uint8_t *)req->out.vwv + VWV(18), + setup_count * VWV(1)); } - memcpy(parms->out.setup, VWV(18) + (uint8_t *)req->out.vwv, - sizeof(uint16_t) * parms->out.setup_count); + + state->got_first = true; } - - while (recvd_data < total_data || - recvd_param < total_param) { - uint32_t param_count, param_ofs, param_disp; - uint32_t data_count, data_ofs, data_disp; - uint32_t total_data2, total_param2; - /* parse out the total lengths again - they can shrink! */ - total_param2 = IVAL(req->in.vwv, 3); - total_data2 = IVAL(req->in.vwv, 7); + if (total_data > state->io.out.data.length || + total_param > state->io.out.params.length) { + /* they must *only* shrink */ + DEBUG(1,("smb_raw_nttrans_recv_helper: data/params expanded!\n")); + req->status = NT_STATUS_BUFFER_TOO_SMALL; + goto failed; + } - if (total_data2 > total_data || - total_param2 > total_param) { - /* they must *only* shrink */ - DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - return smbcli_request_destroy(req); - } + state->io.out.data.length = total_data; + state->io.out.params.length = total_param; - total_data = total_data2; - total_param = total_param2; - parms->out.data.length = total_data; - parms->out.params.length = total_param; + if (data_count + data_disp > total_data || + param_count + param_disp > total_param) { + DEBUG(1,("smb_raw_nttrans_recv_helper: Buffer overflow\n")); + req->status = NT_STATUS_BUFFER_TOO_SMALL; + goto failed; + } - /* parse params for this lump */ - param_count = IVAL(req->in.vwv, 11); - param_ofs = IVAL(req->in.vwv, 15); - param_disp = IVAL(req->in.vwv, 19); + /* check the server isn't being nasty */ + if (raw_trans_oob(req, param_ofs, param_count) || + raw_trans_oob(req, data_ofs, data_count)) { + DEBUG(1,("smb_raw_nttrans_recv_helper: out of bounds parameters!\n")); + req->status = NT_STATUS_BUFFER_TOO_SMALL; + goto failed; + } - data_count = IVAL(req->in.vwv, 23); - data_ofs = IVAL(req->in.vwv, 27); - data_disp = IVAL(req->in.vwv, 31); + if (data_count) { + memcpy(state->io.out.data.data + data_disp, + req->in.hdr + data_ofs, + data_count); + } - if (data_count + data_disp > total_data || - param_count + param_disp > total_param) { - DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - return smbcli_request_destroy(req); - } - - /* check the server isn't being nasty */ - if (raw_trans_oob(req, param_ofs, param_count) || - raw_trans_oob(req, data_ofs, data_count)) { - DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - return smbcli_request_destroy(req); - } + if (param_count) { + memcpy(state->io.out.params.data + param_disp, + req->in.hdr + param_ofs, + param_count); + } - if (data_count) { - memcpy(parms->out.data.data + data_disp, - req->in.hdr + data_ofs, - data_count); - } + state->recvd_param += param_count; + state->recvd_data += data_count; - if (param_count) { - memcpy(parms->out.params.data + param_disp, - req->in.hdr + param_ofs, - param_count); - } + if (state->recvd_data < total_data || + state->recvd_param < total_param) { - recvd_param += param_count; - recvd_data += data_count; + /* we don't need the in buffer any more */ + talloc_free(req->in.buffer); + ZERO_STRUCT(req->in); - if (recvd_data >= total_data && - recvd_param >= total_param) { - break; - } - - if (!smbcli_request_receive(req) || - smbcli_request_is_error(req)) { - return smbcli_request_destroy(req); - } - - /* sanity check */ - if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) { - DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n", - CVAL(req->in.hdr, HDR_COM))); - req->status = NT_STATUS_UNSUCCESSFUL; - return smbcli_request_destroy(req); - } + /* we still wait for more data */ + DEBUG(10,("smb_raw_nttrans_recv_helper: more data needed\n")); + return SMBCLI_REQUEST_RECV; } + DEBUG(10,("smb_raw_nttrans_recv_helper: done\n")); + return SMBCLI_REQUEST_DONE; + +nomem: + req->status = NT_STATUS_NO_MEMORY; failed: - return smbcli_request_destroy(req); + return SMBCLI_REQUEST_ERROR; } - /**************************************************************************** nttrans raw - only BLOBs used in this interface. at the moment we only handle a single primary request @@ -553,6 +584,7 @@ struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree, struct smb_nttrans *parms) { struct smbcli_request *req; + struct smb_raw_nttrans_recv_state *state; uint8_t *outdata, *outparam; int align = 0; @@ -569,7 +601,13 @@ struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree, if (!req) { return NULL; } - + + state = talloc_zero(req, struct smb_raw_nttrans_recv_state); + if (!state) { + talloc_free(req); + return NULL; + } + /* fill in SMB parameters */ outparam = req->out.data + align; outdata = outparam + parms->in.params.length; @@ -599,6 +637,11 @@ struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree, memcpy(outdata, parms->in.data.data, parms->in.data.length); } + /* add the helper which will check that all multi-part replies are + in before an async client callack will be issued */ + req->recv_helper.fn = smb_raw_nttrans_recv_helper; + req->recv_helper.private_data = state; + if (!smbcli_request_send(req)) { smbcli_request_destroy(req); return NULL; |