4 files changed, 51 insertions, 10 deletions

diff --git a/source4/libcli/smb2/find.c b/source4/libcli/smb2/find.c
index 273c3cad6a..aa14347022 100644
--- a/source4/libcli/smb2/find.c
+++ b/source4/libcli/smb2/find.c
@@ -40,7 +40,6 @@ struct smb2_request *smb2_find_send(struct smb2_tree *tree, struct smb2_find *io
 	SCVAL(req->out.body, 0x03, io->in.continue_flags);
 	SIVAL(req->out.body, 0x04, io->in.unknown);
 	smb2_push_handle(req->out.body+0x08, &io->in.handle);
-	SIVAL(req->out.body, 0x1C, io->in.max_response_size);
 
 	status = smb2_push_o16s16_string(&req->out, 0x18, io->in.pattern);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -48,6 +47,8 @@ struct smb2_request *smb2_find_send(struct smb2_tree *tree, struct smb2_find *io
 		return NULL;
 	}
 
+	SIVAL(req->out.body, 0x1C, io->in.max_response_size);
+
 	smb2_transport_send(req);
 
 	return req;
diff --git a/source4/libcli/smb2/setinfo.c b/source4/libcli/smb2/setinfo.c
index d6c5555a33..ce03a69482 100644
--- a/source4/libcli/smb2/setinfo.c
+++ b/source4/libcli/smb2/setinfo.c
@@ -30,13 +30,20 @@
 */
 struct smb2_request *smb2_setinfo_send(struct smb2_tree *tree, struct smb2_setinfo *io)
 {
+	NTSTATUS status;
 	struct smb2_request *req;
 
 	req = smb2_request_init_tree(tree, SMB2_OP_SETINFO, 0x20, io->in.blob.length);
 	if (req == NULL) return NULL;
 
 	SSVAL(req->out.body, 0x02, io->in.level);
-	smb2_push_s32o32_blob(&req->out, 0x04, io->in.blob);
+
+	status = smb2_push_s32o32_blob(&req->out, 0x04, io->in.blob);
+	if (!NT_STATUS_IS_OK(status)) {
+		talloc_free(req);
+		return NULL;
+	}
+
 	SIVAL(req->out.body, 0x0C, io->in.flags);
 	smb2_push_handle(req->out.body+0x10, &io->in.handle);
 
diff --git a/source4/libcli/smb2/smb2_calls.h b/source4/libcli/smb2/smb2_calls.h
index e0a78937d5..cd0e80f5ae 100644
--- a/source4/libcli/smb2/smb2_calls.h
+++ b/source4/libcli/smb2/smb2_calls.h
@@ -291,15 +291,27 @@ struct smb2_read {
 
 struct smb2_find {
 	struct {
+		/* static body buffer 32 (0x20) bytes */
+		/* uint16_t buffer_code;  0x21 = 0x20 + 1 */
 		uint8_t level;
 		uint8_t continue_flags; /* SMB2_CONTINUE_FLAG_* */
 		uint32_t unknown; /* perhaps a continue token? */
 		struct smb2_handle handle;
+		/* uint16_t pattern_ofs; */
+		/* uint32_t pattern_size; */
 		uint32_t max_response_size;
+
+		/* dynamic body */
 		const char *pattern;
 	} in;
 
 	struct {
+		/* static body buffer 8 (0x08) bytes */
+		/* uint16_t buffer_code;  0x08 */
+		/* uint16_t blob_ofs; */
+		/* uint32_t blob_size; */
+
+		/* dynamic body */
 		DATA_BLOB blob;
 	} out;
 };
@@ -308,20 +320,38 @@ struct smb2_find {
 
 struct smb2_trans {
 	struct {
+		/* static body buffer 56 (0x38) bytes */
+		/* uint16_t buffer_code;  0x39 = 0x38 + 1 */
+		uint16_t _pad;
 		uint32_t pipe_flags;
 		struct smb2_handle handle;
+		/* uint32_t out_ofs; */
+		/* uint32_t out_size; */
 		uint32_t unknown2;
+		/* uint32_t in_ofs; */
+		/* uint32_t in_size; */
 		uint32_t max_response_size;
 		uint64_t flags;
-		DATA_BLOB in;
+
+		/* dynamic body */
 		DATA_BLOB out;
+		DATA_BLOB in;
 	} in;
 
 	struct {
-		uint32_t unknown1;
+		/* static body buffer 48 (0x30) bytes */
+		/* uint16_t buffer_code;  0x31 = 0x30 + 1 */
+		uint16_t _pad;
+		uint32_t pipe_flags;
 		struct smb2_handle handle;
+		/* uint32_t in_ofs; */
+		/* uint32_t in_size; */
+		/* uint32_t out_ofs; */
+		/* uint32_t out_size; */
 		uint32_t unknown2;
 		uint32_t unknown3;
+
+		/* dynamic body */
 		DATA_BLOB in;
 		DATA_BLOB out;
 	} out;
diff --git a/source4/libcli/smb2/trans.c b/source4/libcli/smb2/trans.c
index cc03209c76..de4ff1d827 100644
--- a/source4/libcli/smb2/trans.c
+++ b/source4/libcli/smb2/trans.c
@@ -37,12 +37,9 @@ struct smb2_request *smb2_trans_send(struct smb2_tree *tree, struct smb2_trans *
 				     io->in.in.length+io->in.out.length);
 	if (req == NULL) return NULL;
 
-	SSVAL(req->out.body, 0x02, 0); /* pad */
+	SSVAL(req->out.body, 0x02, io->in._pad);
 	SIVAL(req->out.body, 0x04, io->in.pipe_flags);
 	smb2_push_handle(req->out.body+0x08, &io->in.handle);
-	SIVAL(req->out.body, 0x20, io->in.unknown2);
-	SIVAL(req->out.body, 0x2C, io->in.max_response_size);
-	SBVAL(req->out.body, 0x30, io->in.flags);
 
 	status = smb2_push_o32s32_blob(&req->out, 0x18, io->in.out);
 	if (!NT_STATUS_IS_OK(status)) {
@@ -50,12 +47,17 @@ struct smb2_request *smb2_trans_send(struct smb2_tree *tree, struct smb2_trans *
 		return NULL;
 	}
 
+	SIVAL(req->out.body, 0x20, io->in.unknown2);
+
 	status = smb2_push_o32s32_blob(&req->out, 0x24, io->in.in);
 	if (!NT_STATUS_IS_OK(status)) {
 		talloc_free(req);
 		return NULL;
 	}
 
+	SIVAL(req->out.body, 0x2C, io->in.max_response_size);
+	SBVAL(req->out.body, 0x30, io->in.flags);
+
 	smb2_transport_send(req);
 
 	return req;
@@ -77,8 +79,10 @@ NTSTATUS smb2_trans_recv(struct smb2_request *req,
 
 	SMB2_CHECK_PACKET_RECV(req, 0x30, True);
 
-	io->out.unknown1 = IVAL(req->in.body, 0x04);
+	io->out._pad       = SVAL(req->in.body, 0x02);
+	io->out.pipe_flags = IVAL(req->in.body, 0x04);
 	smb2_pull_handle(req->in.body+0x08, &io->out.handle);
+
 	status = smb2_pull_o32s32_blob(&req->in, mem_ctx, req->in.body+0x18, &io->out.in);
 	if (!NT_STATUS_IS_OK(status)) {
 		smb2_request_destroy(req);
@@ -91,7 +95,6 @@ NTSTATUS smb2_trans_recv(struct smb2_request *req,
 		return status;
 	}
 
-
 	io->out.unknown2 = IVAL(req->in.body, 0x28);
 	io->out.unknown3 = IVAL(req->in.body, 0x2C);