1 files changed, 180 insertions, 6 deletions

diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index 15d89a5450..572f37dbbe 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -1335,7 +1335,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 			if (type == SMBntcreateX) {
 				reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 			} else {
-				reply_doserror(req, ERRSRV, ERRinvnid);
+				reply_nterror(req, NT_STATUS_NETWORK_NAME_DELETED);
 			}
 			return NULL;
 		}
@@ -1343,7 +1343,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 		if (!change_to_user(conn,session_tag)) {
 			DEBUG(0, ("Error: Could not change to user. Removing "
 			    "deferred open, mid=%d.\n", req->mid));
-			reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRbaduid));
+			reply_force_doserror(req, ERRSRV, ERRbaduid);
 			return conn;
 		}
 
@@ -1357,7 +1357,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 
 		/* IPC services are limited */
 		if (IS_IPC(conn) && !(flags & CAN_IPC)) {
-			reply_doserror(req, ERRSRV,ERRaccess);
+			reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 			return conn;
 		}
 	} else {
@@ -1382,7 +1382,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 		if (!set_current_service(conn,SVAL(req->inbuf,smb_flg),
 					 (flags & (AS_USER|DO_CHDIR)
 					  ?True:False))) {
-			reply_doserror(req, ERRSRV, ERRaccess);
+			reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 			return conn;
 		}
 		conn->num_smb_operations++;
@@ -1393,7 +1393,7 @@ static connection_struct *switch_message(uint8 type, struct smb_request *req, in
 	    && (!change_to_guest() ||
 		!check_access(smbd_server_fd(), lp_hostsallow(-1),
 			      lp_hostsdeny(-1)))) {
-		reply_doserror(req, ERRSRV, ERRaccess);
+		reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 		return conn;
 	}
 
@@ -1608,6 +1608,180 @@ static void fixup_chain_error_packet(struct smb_request *req)
 	SCVAL(req->outbuf, smb_vwv0, 0xff);
 }
 
+/**
+ * @brief Find the smb_cmd offset of the last command pushed
+ * @param[in] buf	The buffer we're building up
+ * @retval		Where can we put our next andx cmd?
+ *
+ * While chaining requests, the "next" request we're looking at needs to put
+ * its SMB_Command before the data the previous request already built up added
+ * to the chain. Find the offset to the place where we have to put our cmd.
+ */
+
+static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
+{
+	uint8_t cmd;
+	size_t ofs;
+
+	cmd = CVAL(buf, smb_com);
+
+	SMB_ASSERT(is_andx_req(cmd));
+
+	ofs = smb_vwv0;
+
+	while (CVAL(buf, ofs) != 0xff) {
+
+		if (!is_andx_req(CVAL(buf, ofs))) {
+			return false;
+		}
+
+		/*
+		 * ofs is from start of smb header, so add the 4 length
+		 * bytes. The next cmd is right after the wct field.
+		 */
+		ofs = SVAL(buf, ofs+2) + 4 + 1;
+
+		SMB_ASSERT(ofs+4 < talloc_get_size(buf));
+	}
+
+	*pofs = ofs;
+	return true;
+}
+
+/**
+ * @brief Do the smb chaining at a buffer level
+ * @param[in] poutbuf		Pointer to the talloc'ed buffer to be modified
+ * @param[in] smb_command	The command that we want to issue
+ * @param[in] wct		How many words?
+ * @param[in] vwv		The words, already in network order
+ * @param[in] bytes_alignment	How shall we align "bytes"?
+ * @param[in] num_bytes		How many bytes?
+ * @param[in] bytes		The data the request ships
+ *
+ * smb_splice_chain() adds the vwv and bytes to the request already present in
+ * *poutbuf.
+ */
+
+static bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
+			     uint8_t wct, const uint16_t *vwv,
+			     size_t bytes_alignment,
+			     uint32_t num_bytes, const uint8_t *bytes)
+{
+	uint8_t *outbuf;
+	size_t old_size, new_size;
+	size_t ofs;
+	size_t chain_padding = 0;
+	size_t bytes_padding = 0;
+	bool first_request;
+
+	old_size = talloc_get_size(*poutbuf);
+
+	/*
+	 * old_size == smb_wct means we're pushing the first request in for
+	 * libsmb/
+	 */
+
+	first_request = (old_size == smb_wct);
+
+	if (!first_request && ((old_size % 4) != 0)) {
+		/*
+		 * Align the wct field of subsequent requests to a 4-byte
+		 * boundary
+		 */
+		chain_padding = 4 - (old_size % 4);
+	}
+
+	/*
+	 * After the old request comes the new wct field (1 byte), the vwv's
+	 * and the num_bytes field. After at we might need to align the bytes
+	 * given to us to "bytes_alignment", increasing the num_bytes value.
+	 */
+
+	new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
+
+	if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
+		bytes_padding = bytes_alignment - (new_size % bytes_alignment);
+	}
+
+	new_size += bytes_padding + num_bytes;
+
+	if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
+		DEBUG(1, ("splice_chain: %u bytes won't fit\n",
+			  (unsigned)new_size));
+		return false;
+	}
+
+	outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
+	if (outbuf == NULL) {
+		DEBUG(0, ("talloc failed\n"));
+		return false;
+	}
+	*poutbuf = outbuf;
+
+	if (first_request) {
+		SCVAL(outbuf, smb_com, smb_command);
+	} else {
+		size_t andx_cmd_ofs;
+
+		if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
+			DEBUG(1, ("invalid command chain\n"));
+			*poutbuf = TALLOC_REALLOC_ARRAY(
+				NULL, *poutbuf, uint8_t, old_size);
+			return false;
+		}
+
+		if (chain_padding != 0) {
+			memset(outbuf + old_size, 0, chain_padding);
+			old_size += chain_padding;
+		}
+
+		SCVAL(outbuf, andx_cmd_ofs, smb_command);
+		SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
+	}
+
+	ofs = old_size;
+
+	/*
+	 * Push the chained request:
+	 *
+	 * wct field
+	 */
+
+	SCVAL(outbuf, ofs, wct);
+	ofs += 1;
+
+	/*
+	 * vwv array
+	 */
+
+	memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
+	ofs += sizeof(uint16_t) * wct;
+
+	/*
+	 * bcc (byte count)
+	 */
+
+	SSVAL(outbuf, ofs, num_bytes + bytes_padding);
+	ofs += sizeof(uint16_t);
+
+	/*
+	 * padding
+	 */
+
+	if (bytes_padding != 0) {
+		memset(outbuf + ofs, 0, bytes_padding);
+		ofs += bytes_padding;
+	}
+
+	/*
+	 * The bytes field
+	 */
+
+	memcpy(outbuf + ofs, bytes, num_bytes);
+
+	return true;
+}
+
 /****************************************************************************
  Construct a chained reply and add it to the already made reply
 ****************************************************************************/
@@ -1809,7 +1983,7 @@ void chain_reply(struct smb_request *req)
 	 * We end up here if there's any error in the chain syntax. Report a
 	 * DOS error, just like Windows does.
 	 */
-	reply_nterror(req, NT_STATUS_DOS(ERRSRV, ERRerror));
+	reply_force_doserror(req, ERRSRV, ERRerror);
 	fixup_chain_error_packet(req);
 
  done: