diff options
Diffstat (limited to 'source4/libcli/raw/rawtrans.c')
-rw-r--r-- | source4/libcli/raw/rawtrans.c | 1126 |
1 files changed, 293 insertions, 833 deletions
diff --git a/source4/libcli/raw/rawtrans.c b/source4/libcli/raw/rawtrans.c index dd017715c7..8e16e5b911 100644 --- a/source4/libcli/raw/rawtrans.c +++ b/source4/libcli/raw/rawtrans.c @@ -19,513 +19,201 @@ */ #include "includes.h" -#include "../lib/util/dlinklist.h" +#include <tevent.h> #include "libcli/raw/libcliraw.h" #include "libcli/raw/raw_proto.h" +#include "../libcli/smb/smbXcli_base.h" -#define TORTURE_TRANS_DATA 0 +static void smb_raw_trans_backend_done(struct tevent_req *subreq); -/* - check out of bounds for incoming data -*/ -static bool raw_trans_oob(struct smbcli_request *req, - unsigned int offset, unsigned int count) -{ - uint8_t *ptr; - - if (count == 0) { - return false; - } - - ptr = req->in.hdr + offset; - - /* be careful with wraparound! */ - if ((uintptr_t)ptr < (uintptr_t)req->in.data || - (uintptr_t)ptr >= (uintptr_t)req->in.data + req->in.data_size || - count > req->in.data_size || - (uintptr_t)ptr + count > (uintptr_t)req->in.data + req->in.data_size) { - return true; - } - return false; -} - -static size_t raw_trans_space_left(struct smbcli_request *req) -{ - if (req->transport->negotiate.max_xmit <= req->out.size) { - return 0; - } - - return req->transport->negotiate.max_xmit - req->out.size; -} - -struct smb_raw_trans2_recv_state { - uint8_t command; - uint32_t params_total; - uint32_t data_total; - uint32_t params_left; - uint32_t data_left; - bool got_first; - uint32_t recvd_data; - uint32_t recvd_param; - struct smb_trans2 io; -}; - -NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req, - TALLOC_CTX *mem_ctx, - struct smb_trans2 *parms) -{ - struct smb_raw_trans2_recv_state *state; - - if (!smbcli_request_receive(req) || - smbcli_request_is_error(req)) { - goto failed; - } - - state = talloc_get_type(req->recv_helper.private_data, - struct smb_raw_trans2_recv_state); - - parms->out = state->io.out; - talloc_steal(mem_ctx, parms->out.setup); - talloc_steal(mem_ctx, parms->out.params.data); - talloc_steal(mem_ctx, parms->out.data.data); - talloc_free(state); - - ZERO_STRUCT(req->recv_helper); - -failed: - return smbcli_request_destroy(req); -} - -static enum smbcli_request_state smb_raw_trans2_ship_rest(struct smbcli_request *req, - struct smb_raw_trans2_recv_state *state); - -/* - * This helper returns SMBCLI_REQUEST_RECV until all data has arrived - */ -static enum smbcli_request_state smb_raw_trans2_recv_helper(struct smbcli_request *req) -{ - struct smb_raw_trans2_recv_state *state = talloc_get_type(req->recv_helper.private_data, - struct smb_raw_trans2_recv_state); - uint16_t param_count, param_ofs, param_disp; - uint16_t data_count, data_ofs, data_disp; - uint16_t total_data, total_param; - uint8_t setup_count; - - /* - * An NT RPC pipe call can return ERRDOS, ERRmoredata - * to a trans call. This is not an error and should not - * be treated as such. - */ - if (smbcli_request_is_error(req)) { - goto failed; - } - - if (state->params_left > 0 || state->data_left > 0) { - return smb_raw_trans2_ship_rest(req, state); - } - - SMBCLI_CHECK_MIN_WCT(req, 10); - - total_data = SVAL(req->in.vwv, VWV(1)); - total_param = SVAL(req->in.vwv, VWV(0)); - setup_count = CVAL(req->in.vwv, VWV(9)); - - param_count = SVAL(req->in.vwv, VWV(3)); - param_ofs = SVAL(req->in.vwv, VWV(4)); - param_disp = SVAL(req->in.vwv, VWV(5)); - - data_count = SVAL(req->in.vwv, VWV(6)); - data_ofs = SVAL(req->in.vwv, VWV(7)); - data_disp = SVAL(req->in.vwv, VWV(8)); - - if (!state->got_first) { - if (total_param > 0) { - state->io.out.params = data_blob_talloc(state, NULL, total_param); - if (!state->io.out.params.data) { - goto nomem; - } - } - - if (total_data > 0) { - state->io.out.data = data_blob_talloc(state, NULL, total_data); - if (!state->io.out.data.data) { - goto nomem; - } - } - - if (setup_count > 0) { - uint16_t i; - - SMBCLI_CHECK_WCT(req, 10 + setup_count); - - state->io.out.setup_count = setup_count; - state->io.out.setup = talloc_array(state, uint16_t, setup_count); - if (!state->io.out.setup) { - goto nomem; - } - for (i=0; i < setup_count; i++) { - state->io.out.setup[i] = SVAL(req->in.vwv, VWV(10+i)); - } - } - - state->got_first = true; - } - - if (total_data > state->io.out.data.length || - total_param > state->io.out.params.length) { - /* they must *only* shrink */ - DEBUG(1,("smb_raw_trans2_recv_helper: data/params expanded!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - state->io.out.data.length = total_data; - state->io.out.params.length = total_param; - - if (data_count + data_disp > total_data || - param_count + param_disp > total_param) { - DEBUG(1,("smb_raw_trans2_recv_helper: Buffer overflow\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - /* check the server isn't being nasty */ - if (raw_trans_oob(req, param_ofs, param_count) || - raw_trans_oob(req, data_ofs, data_count)) { - DEBUG(1,("smb_raw_trans2_recv_helper: out of bounds parameters!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - if (data_count) { - memcpy(state->io.out.data.data + data_disp, - req->in.hdr + data_ofs, - data_count); - } - - if (param_count) { - memcpy(state->io.out.params.data + param_disp, - req->in.hdr + param_ofs, - param_count); - } - - state->recvd_param += param_count; - state->recvd_data += data_count; - - if (state->recvd_data < total_data || - state->recvd_param < total_param) { - - /* we don't need the in buffer any more */ - talloc_free(req->in.buffer); - ZERO_STRUCT(req->in); - - /* we still wait for more data */ - DEBUG(10,("smb_raw_trans2_recv_helper: more data needed\n")); - return SMBCLI_REQUEST_RECV; - } - - DEBUG(10,("smb_raw_trans2_recv_helper: done\n")); - return SMBCLI_REQUEST_DONE; - -nomem: - req->status = NT_STATUS_NO_MEMORY; -failed: - return SMBCLI_REQUEST_ERROR; -} - -_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req, - TALLOC_CTX *mem_ctx, - struct smb_trans2 *parms) +static struct smbcli_request *smb_raw_trans_backend_send(struct smbcli_tree *tree, + struct smb_trans2 *parms, + uint8_t command) { - return smb_raw_trans2_recv(req, mem_ctx, parms); -} - - -/* - trans/trans2 raw async interface - only BLOBs used in this interface. -*/ -struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree, - struct smb_trans2 *parms, - uint8_t command) -{ - struct smb_raw_trans2_recv_state *state; struct smbcli_request *req; - int i; - int padding; - size_t space_left; - size_t namelen = 0; - DATA_BLOB params_chunk; - uint16_t ofs; - uint16_t params_ofs = 0; - DATA_BLOB data_chunk; - uint16_t data_ofs = 0; - - if (parms->in.params.length > UINT16_MAX || - parms->in.data.length > UINT16_MAX) { - DEBUG(3,("Attempt to send invalid trans2 request (params %u, data %u)\n", - (unsigned)parms->in.params.length, (unsigned)parms->in.data.length)); + uint8_t additional_flags; + uint8_t clear_flags; + uint16_t additional_flags2; + uint16_t clear_flags2; + uint32_t pid; + uint16_t tid; + uint16_t uid; + const char *pipe_name = NULL; + uint8_t s; + uint32_t timeout_msec; + uint32_t tmp; + + tmp = parms->in.params.length + parms->in.data.length; + + req = smbcli_request_setup(tree, command, parms->in.setup_count, tmp); + if (req == NULL) { return NULL; } - - - if (command == SMBtrans) - padding = 1; - else - padding = 3; - - req = smbcli_request_setup(tree, command, - 14 + parms->in.setup_count, - padding); - if (!req) { - return NULL; - } - - state = talloc_zero(req, struct smb_raw_trans2_recv_state); - if (!state) { - smbcli_request_destroy(req); - return NULL; - } - - state->command = command; - - /* make sure we don't leak data via the padding */ - memset(req->out.data, 0, padding); - - /* Watch out, this changes the req->out.* pointers */ - if (command == SMBtrans && parms->in.trans_name) { - namelen = smbcli_req_append_string(req, parms->in.trans_name, - STR_TERMINATE); - } - - ofs = PTR_DIFF(req->out.data,req->out.hdr)+padding+namelen; - - /* see how much bytes of the params block we can ship in the first request */ - space_left = raw_trans_space_left(req); - - params_chunk.length = MIN(parms->in.params.length, space_left); - params_chunk.data = parms->in.params.data; - params_ofs = ofs; - - state->params_left = parms->in.params.length - params_chunk.length; - - if (state->params_left > 0) { - /* we copy the whole params block, if needed we can optimize that latter */ - state->io.in.params = data_blob_talloc(state, NULL, parms->in.params.length); - if (!state->io.in.params.data) { - smbcli_request_destroy(req); - return NULL; - } - memcpy(state->io.in.params.data, - parms->in.params.data, - parms->in.params.length); - } - /* see how much bytes of the data block we can ship in the first request */ - space_left -= params_chunk.length; + additional_flags = CVAL(req->out.hdr, HDR_FLG); + additional_flags2 = SVAL(req->out.hdr, HDR_FLG2); + pid = SVAL(req->out.hdr, HDR_PID); + pid |= SVAL(req->out.hdr, HDR_PIDHIGH)<<16; + tid = SVAL(req->out.hdr, HDR_TID); + uid = SVAL(req->out.hdr, HDR_UID); -#if TORTURE_TRANS_DATA - if (space_left > 1) { - space_left /= 2; - } -#endif - - data_chunk.length = MIN(parms->in.data.length, space_left); - data_chunk.data = parms->in.data.data; - data_ofs = params_ofs + params_chunk.length; - - state->data_left = parms->in.data.length - data_chunk.length; + clear_flags = ~additional_flags; + clear_flags2 = ~additional_flags2; - if (state->data_left > 0) { - /* we copy the whole params block, if needed we can optimize that latter */ - state->io.in.data = data_blob_talloc(state, NULL, parms->in.data.length); - if (!state->io.in.data.data) { - smbcli_request_destroy(req); - return NULL; - } - memcpy(state->io.in.data.data, - parms->in.data.data, - parms->in.data.length); - } + timeout_msec = req->transport->options.request_timeout * 1000; - state->params_total = parms->in.params.length; - state->data_total = parms->in.data.length; - - /* primary request */ - SSVAL(req->out.vwv,VWV(0),parms->in.params.length); - SSVAL(req->out.vwv,VWV(1),parms->in.data.length); - SSVAL(req->out.vwv,VWV(2),parms->in.max_param); - SSVAL(req->out.vwv,VWV(3),parms->in.max_data); - SCVAL(req->out.vwv,VWV(4),parms->in.max_setup); - SCVAL(req->out.vwv,VWV(4)+1,0); /* reserved */ - SSVAL(req->out.vwv,VWV(5),parms->in.flags); - SIVAL(req->out.vwv,VWV(6),parms->in.timeout); - SSVAL(req->out.vwv,VWV(8),0); /* reserved */ - SSVAL(req->out.vwv,VWV(9),params_chunk.length); - SSVAL(req->out.vwv,VWV(10),params_ofs); - SSVAL(req->out.vwv,VWV(11),data_chunk.length); - SSVAL(req->out.vwv,VWV(12),data_ofs); - SCVAL(req->out.vwv,VWV(13),parms->in.setup_count); - SCVAL(req->out.vwv,VWV(13)+1,0); /* reserved */ - for (i=0;i<parms->in.setup_count;i++) { - SSVAL(req->out.vwv,VWV(14)+VWV(i),parms->in.setup[i]); + for (s=0; s < parms->in.setup_count; s++) { + SSVAL(req->out.vwv, VWV(s), parms->in.setup[s]); } - smbcli_req_append_blob(req, ¶ms_chunk); - smbcli_req_append_blob(req, &data_chunk); - /* add the helper which will check that all multi-part replies are - in before an async client callack will be issued */ - req->recv_helper.fn = smb_raw_trans2_recv_helper; - req->recv_helper.private_data = state; + memcpy(req->out.data, + parms->in.params.data, + parms->in.params.length); + memcpy(req->out.data + parms->in.params.length, + parms->in.data.data, + parms->in.data.length); - if (!smbcli_request_send(req)) { - smbcli_request_destroy(req); + if (command == SMBtrans && parms->in.trans_name) { + pipe_name = parms->in.trans_name; + } + + req->subreqs[0] = smb1cli_trans_send(req, + req->transport->ev, + req->transport->conn, + command, + additional_flags, + clear_flags, + additional_flags2, + clear_flags2, + timeout_msec, + pid, tid, uid, + pipe_name, + 0xFFFF, /* fid */ + 0, /* function */ + parms->in.flags, + (uint16_t *)req->out.vwv, + parms->in.setup_count, + parms->in.max_setup, + req->out.data, + parms->in.params.length, + parms->in.max_param, + req->out.data+ + parms->in.params.length, + parms->in.data.length, + parms->in.max_data); + if (req->subreqs[0] == NULL) { + talloc_free(req); return NULL; } + tevent_req_set_callback(req->subreqs[0], + smb_raw_trans_backend_done, + req); return req; } -static enum smbcli_request_state smb_raw_trans2_ship_next(struct smbcli_request *req, - struct smb_raw_trans2_recv_state *state) +static void smb_raw_trans_backend_done(struct tevent_req *subreq) { - struct smbcli_request *req2; - size_t space_left; - DATA_BLOB params_chunk; - uint16_t ofs; - uint16_t params_ofs = 0; - uint16_t params_disp = 0; - DATA_BLOB data_chunk; - uint16_t data_ofs = 0; - uint16_t data_disp = 0; - uint8_t wct; - - if (state->command == SMBtrans2) { - wct = 9; - } else { - wct = 8; + struct smbcli_request *req = + tevent_req_callback_data(subreq, + struct smbcli_request); + struct smbcli_transport *transport = req->transport; + uint16_t *setup = NULL; + uint8_t num_setup = 0; + uint8_t s; + uint8_t *param = NULL; + uint32_t num_param = 0; + uint8_t *data = NULL; + uint32_t num_data = 0; + + req->status = smb1cli_trans_recv(req->subreqs[0], req, + &req->flags2, + &setup, + 0, /* min_setup */ + &num_setup, + ¶m, + 0, /* min_param */ + &num_param, + &data, + 0, /* min_data */ + &num_data); + TALLOC_FREE(req->subreqs[0]); + if (NT_STATUS_IS_ERR(req->status)) { + req->state = SMBCLI_REQUEST_ERROR; + transport->error.e.nt_status = req->status; + transport->error.etype = ETYPE_SMB; + if (req->async.fn) { + req->async.fn(req); + } + return; + } + + req->trans2.out.setup_count = num_setup; + req->trans2.out.setup = talloc_array(req, uint16_t, num_setup); + if (req->trans2.out.setup == NULL) { + req->state = SMBCLI_REQUEST_ERROR; + req->status = NT_STATUS_NO_MEMORY; + transport->error.e.nt_status = req->status; + transport->error.etype = ETYPE_SMB; + if (req->async.fn) { + req->async.fn(req); + } + return; } - - req2 = smbcli_request_setup(req->tree, state->command+1, wct, 0); - if (!req2) { - goto nomem; + for (s = 0; s < num_setup; s++) { + req->trans2.out.setup[s] = SVAL(setup, VWV(s)); } - req2->mid = req->mid; - SSVAL(req2->out.hdr, HDR_MID, req2->mid); - - ofs = PTR_DIFF(req2->out.data,req2->out.hdr); - - /* see how much bytes of the params block we can ship in the first request */ - space_left = raw_trans_space_left(req2); - - params_disp = state->io.in.params.length - state->params_left; - params_chunk.length = MIN(state->params_left, space_left); - params_chunk.data = state->io.in.params.data + params_disp; - params_ofs = ofs; - state->params_left -= params_chunk.length; - - /* see how much bytes of the data block we can ship in the first request */ - space_left -= params_chunk.length; - -#if TORTURE_TRANS_DATA - if (space_left > 1) { - space_left /= 2; - } -#endif - - data_disp = state->io.in.data.length - state->data_left; - data_chunk.length = MIN(state->data_left, space_left); - data_chunk.data = state->io.in.data.data + data_disp; - data_ofs = params_ofs+params_chunk.length; - - state->data_left -= data_chunk.length; - - SSVAL(req2->out.vwv,VWV(0), state->params_total); - SSVAL(req2->out.vwv,VWV(1), state->data_total); - SSVAL(req2->out.vwv,VWV(2), params_chunk.length); - SSVAL(req2->out.vwv,VWV(3), params_ofs); - SSVAL(req2->out.vwv,VWV(4), params_disp); - SSVAL(req2->out.vwv,VWV(5), data_chunk.length); - SSVAL(req2->out.vwv,VWV(6), data_ofs); - SSVAL(req2->out.vwv,VWV(7), data_disp); - if (wct == 9) { - SSVAL(req2->out.vwv,VWV(8), 0xFFFF); - } + req->trans2.out.params.data = param; + req->trans2.out.params.length = num_param; - smbcli_req_append_blob(req2, ¶ms_chunk); - smbcli_req_append_blob(req2, &data_chunk); + req->trans2.out.data.data = data; + req->trans2.out.data.length = num_data; - /* - * it's a one way request but we need - * the seq_num, so we destroy req2 by hand - */ - if (!smbcli_request_send(req2)) { - goto failed; + transport->error.e.nt_status = req->status; + if (NT_STATUS_IS_OK(req->status)) { + transport->error.etype = ETYPE_NONE; + } else { + transport->error.etype = ETYPE_SMB; } - req->seq_num = req2->seq_num; - smbcli_request_destroy(req2); - - return SMBCLI_REQUEST_RECV; - -nomem: - req->status = NT_STATUS_NO_MEMORY; -failed: - if (req2) { - req->status = smbcli_request_destroy(req2); + req->state = SMBCLI_REQUEST_DONE; + if (req->async.fn) { + req->async.fn(req); } - return SMBCLI_REQUEST_ERROR; } -static enum smbcli_request_state smb_raw_trans2_ship_rest(struct smbcli_request *req, - struct smb_raw_trans2_recv_state *state) +static NTSTATUS smb_raw_trans_backend_recv(struct smbcli_request *req, + TALLOC_CTX *mem_ctx, + struct smb_trans2 *parms) { - enum smbcli_request_state ret = SMBCLI_REQUEST_ERROR; - - while (state->params_left > 0 || state->data_left > 0) { - ret = smb_raw_trans2_ship_next(req, state); - if (ret != SMBCLI_REQUEST_RECV) { - break; - } + if (!smbcli_request_receive(req) || + smbcli_request_is_error(req)) { + goto failed; } - return ret; -} - + parms->out = req->trans2.out; + talloc_steal(mem_ctx, parms->out.setup); + talloc_steal(mem_ctx, parms->out.params.data); + talloc_steal(mem_ctx, parms->out.data.data); -/* - trans/trans2 raw async interface - only BLOBs used in this interface. - note that this doesn't yet support multi-part requests -*/ -_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree, - struct smb_trans2 *parms) -{ - return smb_raw_trans_send_backend(tree, parms, SMBtrans); +failed: + return smbcli_request_destroy(req); } -struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree, +_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree, struct smb_trans2 *parms) { - return smb_raw_trans_send_backend(tree, parms, SMBtrans2); + return smb_raw_trans_backend_send(tree, parms, SMBtrans); } -/* - trans2 synchronous blob interface -*/ -NTSTATUS smb_raw_trans2(struct smbcli_tree *tree, - TALLOC_CTX *mem_ctx, - struct smb_trans2 *parms) +_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req, + TALLOC_CTX *mem_ctx, + struct smb_trans2 *parms) { - struct smbcli_request *req; - req = smb_raw_trans2_send(tree, parms); - if (!req) return NT_STATUS_UNSUCCESSFUL; - return smb_raw_trans2_recv(req, mem_ctx, parms); + return smb_raw_trans_backend_recv(req, mem_ctx, parms); } - -/* - trans synchronous blob interface -*/ _PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, struct smb_trans2 *parms) @@ -536,413 +224,185 @@ _PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree, return smb_raw_trans_recv(req, mem_ctx, parms); } -struct smb_raw_nttrans_recv_state { - uint32_t params_total; - uint32_t data_total; - uint32_t params_left; - uint32_t data_left; - bool got_first; - uint32_t recvd_data; - uint32_t recvd_param; - struct smb_nttrans io; -}; - -NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req, - TALLOC_CTX *mem_ctx, - struct smb_nttrans *parms) +struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree, + struct smb_trans2 *parms) { - struct smb_raw_nttrans_recv_state *state; - - if (!smbcli_request_receive(req) || - smbcli_request_is_error(req)) { - goto failed; - } - - state = talloc_get_type(req->recv_helper.private_data, - struct smb_raw_nttrans_recv_state); - - parms->out = state->io.out; - talloc_steal(mem_ctx, parms->out.setup); - talloc_steal(mem_ctx, parms->out.params.data); - talloc_steal(mem_ctx, parms->out.data.data); - talloc_free(state); - - ZERO_STRUCT(req->recv_helper); - -failed: - return smbcli_request_destroy(req); + return smb_raw_trans_backend_send(tree, parms, SMBtrans2); } -static enum smbcli_request_state smb_raw_nttrans_ship_rest(struct smbcli_request *req, - struct smb_raw_nttrans_recv_state *state); - -/* - * This helper returns SMBCLI_REQUEST_RECV until all data has arrived - */ -static enum smbcli_request_state smb_raw_nttrans_recv_helper(struct smbcli_request *req) +NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req, + TALLOC_CTX *mem_ctx, + struct smb_trans2 *parms) { - struct smb_raw_nttrans_recv_state *state = talloc_get_type(req->recv_helper.private_data, - struct smb_raw_nttrans_recv_state); - uint32_t param_count, param_ofs, param_disp; - uint32_t data_count, data_ofs, data_disp; - uint32_t total_data, total_param; - uint8_t setup_count; - - /* - * An NT RPC pipe call can return ERRDOS, ERRmoredata - * to a trans call. This is not an error and should not - * be treated as such. - */ - if (smbcli_request_is_error(req)) { - goto failed; - } - - /* sanity check */ - if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) { - DEBUG(0,("smb_raw_nttrans_recv_helper: Expected %s response, got command 0x%02x\n", - "SMBnttrans", - CVAL(req->in.hdr,HDR_COM))); - req->status = NT_STATUS_INVALID_NETWORK_RESPONSE; - goto failed; - } - - if (state->params_left > 0 || state->data_left > 0) { - return smb_raw_nttrans_ship_rest(req, state); - } - - /* this is the first packet of the response */ - SMBCLI_CHECK_MIN_WCT(req, 18); - - total_param = IVAL(req->in.vwv, 3); - total_data = IVAL(req->in.vwv, 7); - setup_count = CVAL(req->in.vwv, 35); - - param_count = IVAL(req->in.vwv, 11); - param_ofs = IVAL(req->in.vwv, 15); - param_disp = IVAL(req->in.vwv, 19); - - data_count = IVAL(req->in.vwv, 23); - data_ofs = IVAL(req->in.vwv, 27); - data_disp = IVAL(req->in.vwv, 31); - - if (!state->got_first) { - if (total_param > 0) { - state->io.out.params = data_blob_talloc(state, NULL, total_param); - if (!state->io.out.params.data) { - goto nomem; - } - } - - if (total_data > 0) { - state->io.out.data = data_blob_talloc(state, NULL, total_data); - if (!state->io.out.data.data) { - goto nomem; - } - } - - if (setup_count > 0) { - SMBCLI_CHECK_WCT(req, 18 + setup_count); - - state->io.out.setup_count = setup_count; - state->io.out.setup = talloc_array(state, uint8_t, - setup_count * VWV(1)); - if (!state->io.out.setup) { - goto nomem; - } - memcpy(state->io.out.setup, (uint8_t *)req->out.vwv + VWV(18), - setup_count * VWV(1)); - } - - state->got_first = true; - } - - if (total_data > state->io.out.data.length || - total_param > state->io.out.params.length) { - /* they must *only* shrink */ - DEBUG(1,("smb_raw_nttrans_recv_helper: data/params expanded!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - state->io.out.data.length = total_data; - state->io.out.params.length = total_param; - - if (data_count + data_disp > total_data || - param_count + param_disp > total_param) { - DEBUG(1,("smb_raw_nttrans_recv_helper: Buffer overflow\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - /* check the server isn't being nasty */ - if (raw_trans_oob(req, param_ofs, param_count) || - raw_trans_oob(req, data_ofs, data_count)) { - DEBUG(1,("smb_raw_nttrans_recv_helper: out of bounds parameters!\n")); - req->status = NT_STATUS_BUFFER_TOO_SMALL; - goto failed; - } - - if (data_count) { - memcpy(state->io.out.data.data + data_disp, - req->in.hdr + data_ofs, - data_count); - } - - if (param_count) { - memcpy(state->io.out.params.data + param_disp, - req->in.hdr + param_ofs, - param_count); - } - - state->recvd_param += param_count; - state->recvd_data += data_count; - - if (state->recvd_data < total_data || - state->recvd_param < total_param) { - - /* we don't need the in buffer any more */ - talloc_free(req->in.buffer); - ZERO_STRUCT(req->in); - - /* we still wait for more data */ - DEBUG(10,("smb_raw_nttrans_recv_helper: more data needed\n")); - return SMBCLI_REQUEST_RECV; - } - - DEBUG(10,("smb_raw_nttrans_recv_helper: done\n")); - return SMBCLI_REQUEST_DONE; + return smb_raw_trans_backend_recv(req, mem_ctx, parms); +} -nomem: - req->status = NT_STATUS_NO_MEMORY; -failed: - return SMBCLI_REQUEST_ERROR; +NTSTATUS smb_raw_trans2(struct smbcli_tree *tree, + TALLOC_CTX *mem_ctx, + struct smb_trans2 *parms) +{ + struct smbcli_request *req; + req = smb_raw_trans2_send(tree, parms); + if (!req) return NT_STATUS_UNSUCCESSFUL; + return smb_raw_trans2_recv(req, mem_ctx, parms); } -/**************************************************************************** - nttrans raw - only BLOBs used in this interface. - at the moment we only handle a single primary request -****************************************************************************/ +static void smb_raw_nttrans_done(struct tevent_req *subreq); + struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree, - struct smb_nttrans *parms) + struct smb_nttrans *parms) { - struct smbcli_request *req; - struct smb_raw_nttrans_recv_state *state; - uint32_t ofs; - size_t space_left; - DATA_BLOB params_chunk; - uint32_t params_ofs; - DATA_BLOB data_chunk; - uint32_t data_ofs; - int align = 0; - - /* only align if there are parameters or data */ - if (parms->in.params.length || parms->in.data.length) { - align = 3; - } - - req = smbcli_request_setup(tree, SMBnttrans, - 19 + parms->in.setup_count, align); - if (!req) { + struct smbcli_request *req; + uint8_t additional_flags; + uint8_t clear_flags; + uint16_t additional_flags2; + uint16_t clear_flags2; + uint32_t pid; + uint16_t tid; + uint16_t uid; + uint32_t timeout_msec; + uint32_t tmp; + + tmp = parms->in.params.length + parms->in.data.length; + + req = smbcli_request_setup(tree, SMBnttrans, parms->in.setup_count, tmp); + if (req == NULL) { return NULL; } - state = talloc_zero(req, struct smb_raw_nttrans_recv_state); - if (!state) { + additional_flags = CVAL(req->out.hdr, HDR_FLG); + additional_flags2 = SVAL(req->out.hdr, HDR_FLG2); + pid = SVAL(req->out.hdr, HDR_PID); + pid |= SVAL(req->out.hdr, HDR_PIDHIGH)<<16; + tid = SVAL(req->out.hdr, HDR_TID); + uid = SVAL(req->out.hdr, HDR_UID); + + clear_flags = ~additional_flags; + clear_flags2 = ~additional_flags2; + + timeout_msec = req->transport->options.request_timeout * 1000; + + memcpy(req->out.vwv, + parms->in.setup, + parms->in.setup_count * 2); + + memcpy(req->out.data, + parms->in.params.data, + parms->in.params.length); + memcpy(req->out.data + parms->in.params.length, + parms->in.data.data, + parms->in.data.length); + + req->subreqs[0] = smb1cli_trans_send(req, + req->transport->ev, + req->transport->conn, + SMBnttrans, + additional_flags, + clear_flags, + additional_flags2, + clear_flags2, + timeout_msec, + pid, tid, uid, + NULL, /* pipe_name */ + 0xFFFF, /* fid */ + parms->in.function, + 0, /* flags */ + (uint16_t *)req->out.vwv, + parms->in.setup_count, + parms->in.max_setup, + req->out.data, + parms->in.params.length, + parms->in.max_param, + req->out.data+ + parms->in.params.length, + parms->in.data.length, + parms->in.max_data); + if (req->subreqs[0] == NULL) { talloc_free(req); return NULL; } + tevent_req_set_callback(req->subreqs[0], + smb_raw_nttrans_done, + req); - /* fill in SMB parameters */ - - if (align != 0) { - memset(req->out.data, 0, align); - } - - ofs = PTR_DIFF(req->out.data,req->out.hdr)+align; - - /* see how much bytes of the params block we can ship in the first request */ - space_left = raw_trans_space_left(req); - - params_chunk.length = MIN(parms->in.params.length, space_left); - params_chunk.data = parms->in.params.data; - params_ofs = ofs; - - state->params_left = parms->in.params.length - params_chunk.length; + return req; +} - if (state->params_left > 0) { - /* we copy the whole params block, if needed we can optimize that latter */ - state->io.in.params = data_blob_talloc(state, NULL, parms->in.params.length); - if (!state->io.in.params.data) { - smbcli_request_destroy(req); - return NULL; +static void smb_raw_nttrans_done(struct tevent_req *subreq) +{ + struct smbcli_request *req = + tevent_req_callback_data(subreq, + struct smbcli_request); + struct smbcli_transport *transport = req->transport; + uint16_t *setup = NULL; + uint8_t num_setup = 0; + uint8_t *param = NULL; + uint32_t num_param = 0; + uint8_t *data = NULL; + uint32_t num_data = 0; + + req->status = smb1cli_trans_recv(req->subreqs[0], req, + &req->flags2, + &setup, + 0, /* min_setup */ + &num_setup, + ¶m, + 0, /* min_param */ + &num_param, + &data, + 0, /* min_data */ + &num_data); + TALLOC_FREE(req->subreqs[0]); + if (NT_STATUS_IS_ERR(req->status)) { + req->state = SMBCLI_REQUEST_ERROR; + transport->error.e.nt_status = req->status; + transport->error.etype = ETYPE_SMB; + if (req->async.fn) { + req->async.fn(req); } - memcpy(state->io.in.params.data, - parms->in.params.data, - parms->in.params.length); + return; } - /* see how much bytes of the data block we can ship in the first request */ - space_left -= params_chunk.length; - -#if TORTURE_TRANS_DATA - if (space_left > 1) { - space_left /= 2; - } -#endif + req->nttrans.out.setup_count = num_setup; + req->nttrans.out.setup = (uint8_t *)setup; - data_chunk.length = MIN(parms->in.data.length, space_left); - data_chunk.data = parms->in.data.data; - data_ofs = params_ofs + params_chunk.length; + req->nttrans.out.params.data = param; + req->nttrans.out.params.length = num_param; - state->data_left = parms->in.data.length - data_chunk.length; + req->nttrans.out.data.data = data; + req->nttrans.out.data.length = num_data; - if (state->data_left > 0) { - /* we copy the whole params block, if needed we can optimize that latter */ - state->io.in.data = data_blob_talloc(state, NULL, parms->in.data.length); - if (!state->io.in.data.data) { - smbcli_request_destroy(req); - return NULL; - } - memcpy(state->io.in.data.data, - parms->in.data.data, - parms->in.data.length); + transport->error.e.nt_status = req->status; + if (NT_STATUS_IS_OK(req->status)) { + transport->error.etype = ETYPE_NONE; + } else { + transport->error.etype = ETYPE_SMB; } - state->params_total = parms->in.params.length; - state->data_total = parms->in.data.length; - - SCVAL(req->out.vwv, 0, parms->in.max_setup); - SSVAL(req->out.vwv, 1, 0); /* reserved */ - SIVAL(req->out.vwv, 3, parms->in.params.length); - SIVAL(req->out.vwv, 7, parms->in.data.length); - SIVAL(req->out.vwv, 11, parms->in.max_param); - SIVAL(req->out.vwv, 15, parms->in.max_data); - SIVAL(req->out.vwv, 19, params_chunk.length); - SIVAL(req->out.vwv, 23, params_ofs); - SIVAL(req->out.vwv, 27, data_chunk.length); - SIVAL(req->out.vwv, 31, data_ofs); - SCVAL(req->out.vwv, 35, parms->in.setup_count); - SSVAL(req->out.vwv, 36, parms->in.function); - memcpy(req->out.vwv + VWV(19), parms->in.setup, - sizeof(uint16_t) * parms->in.setup_count); - - smbcli_req_append_blob(req, ¶ms_chunk); - smbcli_req_append_blob(req, &data_chunk); - - /* add the helper which will check that all multi-part replies are - in before an async client callack will be issued */ - req->recv_helper.fn = smb_raw_nttrans_recv_helper; - req->recv_helper.private_data = state; - - if (!smbcli_request_send(req)) { - smbcli_request_destroy(req); - return NULL; + req->state = SMBCLI_REQUEST_DONE; + if (req->async.fn) { + req->async.fn(req); } - - return req; } -static enum smbcli_request_state smb_raw_nttrans_ship_next(struct smbcli_request *req, - struct smb_raw_nttrans_recv_state *state) +NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req, + TALLOC_CTX *mem_ctx, + struct smb_nttrans *parms) { - struct smbcli_request *req2; - size_t space_left; - DATA_BLOB params_chunk; - uint32_t ofs; - uint32_t params_ofs = 0; - uint32_t params_disp = 0; - DATA_BLOB data_chunk; - uint32_t data_ofs = 0; - uint32_t data_disp = 0; - - req2 = smbcli_request_setup(req->tree, SMBnttranss, 18, 0); - if (!req2) { - goto nomem; - } - req2->mid = req->mid; - SSVAL(req2->out.hdr, HDR_MID, req2->mid); - - ofs = PTR_DIFF(req2->out.data,req2->out.hdr); - - /* see how much bytes of the params block we can ship in the first request */ - space_left = raw_trans_space_left(req2); - - params_disp = state->io.in.params.length - state->params_left; - params_chunk.length = MIN(state->params_left, space_left); - params_chunk.data = state->io.in.params.data + params_disp; - params_ofs = ofs; - - state->params_left -= params_chunk.length; - - /* see how much bytes of the data block we can ship in the first request */ - space_left -= params_chunk.length; - -#if TORTURE_TRANS_DATA - if (space_left > 1) { - space_left /= 2; - } -#endif - - data_disp = state->io.in.data.length - state->data_left; - data_chunk.length = MIN(state->data_left, space_left); - data_chunk.data = state->io.in.data.data + data_disp; - data_ofs = params_ofs+params_chunk.length; - - state->data_left -= data_chunk.length; - - SSVAL(req2->out.vwv,0, 0); /* reserved */ - SCVAL(req2->out.vwv,2, 0); /* reserved */ - SIVAL(req2->out.vwv,3, state->params_total); - SIVAL(req2->out.vwv,7, state->data_total); - SIVAL(req2->out.vwv,11, params_chunk.length); - SIVAL(req2->out.vwv,15, params_ofs); - SIVAL(req2->out.vwv,19, params_disp); - SIVAL(req2->out.vwv,23, data_chunk.length); - SIVAL(req2->out.vwv,27, data_ofs); - SIVAL(req2->out.vwv,31, data_disp); - SCVAL(req2->out.vwv,35, 0); /* reserved */ - - smbcli_req_append_blob(req2, ¶ms_chunk); - smbcli_req_append_blob(req2, &data_chunk); - - /* - * it's a one way request but we need - * the seq_num, so we destroy req2 by hand - */ - if (!smbcli_request_send(req2)) { + if (!smbcli_request_receive(req) || + smbcli_request_is_error(req)) { goto failed; } - req->seq_num = req2->seq_num; - smbcli_request_destroy(req2); - - return SMBCLI_REQUEST_RECV; + parms->out = req->nttrans.out; + talloc_steal(mem_ctx, parms->out.setup); + talloc_steal(mem_ctx, parms->out.params.data); + talloc_steal(mem_ctx, parms->out.data.data); -nomem: - req->status = NT_STATUS_NO_MEMORY; failed: - if (req2) { - req->status = smbcli_request_destroy(req2); - } - return SMBCLI_REQUEST_ERROR; -} - -static enum smbcli_request_state smb_raw_nttrans_ship_rest(struct smbcli_request *req, - struct smb_raw_nttrans_recv_state *state) -{ - enum smbcli_request_state ret = SMBCLI_REQUEST_ERROR; - - while (state->params_left > 0 || state->data_left > 0) { - ret = smb_raw_nttrans_ship_next(req, state); - if (ret != SMBCLI_REQUEST_RECV) { - break; - } - } - - return ret; + return smbcli_request_destroy(req); } - /**************************************************************************** receive a SMB nttrans response allocating the necessary memory ****************************************************************************/ |