summaryrefslogtreecommitdiff
path: root/source4/libcli/raw/rawrequest.c
blob: 9c2b2c7367e778b0128c407da9779e1d53a68c9c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
/* 
   Unix SMB/CIFS implementation.
   
   Copyright (C) Andrew Tridgell  2003
   Copyright (C) James Myers 2003 <myersjj@samba.org>
   
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.
   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   
   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/

/*
  this file implements functions for manipulating the 'struct cli_request' structure in libsmb
*/

#include "includes.h"

/* we over allocate the data buffer to prevent too many realloc calls */
#define REQ_OVER_ALLOCATION 256

/* assume that a character will not consume more than 3 bytes per char */
#define MAX_BYTES_PER_CHAR 3

/* destroy a request structure and return final status */
NTSTATUS cli_request_destroy(struct cli_request *req)
{
	NTSTATUS status;

	/* this is the error code we give the application for when a
	   _send() call fails completely */
	if (!req) return NT_STATUS_UNSUCCESSFUL;

	/* remove it from the list of pending requests (a null op if
	   its not in the list) */
	DLIST_REMOVE(req->transport->pending_requests, req);

	/* ahh, its so nice to destroy a complex structure in such a
	   simple way! */
	status = req->status;
	talloc_destroy(req->mem_ctx);
	return status;
}


/*
  low-level function to setup a request buffer for a non-SMB packet 
  at the transport level
*/
struct cli_request *cli_request_setup_nonsmb(struct cli_transport *transport, uint_t size)
{
	struct cli_request *req;
	TALLOC_CTX *mem_ctx;
	
	/* each request gets its own talloc context. The request
	   structure itself is also allocated inside this context,
	   so we need to allocate it before we construct the request
	*/
	mem_ctx = talloc_init("cli_request");
	if (!mem_ctx) {
		return NULL;
	}

	req = talloc(mem_ctx, sizeof(struct cli_request));
	if (!req) {
		return NULL;
	}
	ZERO_STRUCTP(req);

	/* setup the request context */
	req->mem_ctx = mem_ctx;
	req->transport = transport;
	req->session = NULL;
	req->tree = NULL;
	req->out.size = size;

	/* over allocate by a small amount */
	req->out.allocated = req->out.size + REQ_OVER_ALLOCATION; 

	req->out.buffer = talloc(req->mem_ctx, req->out.allocated);
	if (!req->out.buffer) {
		return NULL;
	}

	SIVAL(req->out.buffer, 0, 0);

	return req;
}


/*
  setup a SMB packet at transport level
*/
struct cli_request *cli_request_setup_transport(struct cli_transport *transport,
						uint8 command, unsigned wct, unsigned buflen)
{
	struct cli_request *req;

	req = cli_request_setup_nonsmb(transport, NBT_HDR_SIZE + MIN_SMB_SIZE + wct*2 + buflen);

	if (!req) return NULL;
	
	req->out.hdr = req->out.buffer + NBT_HDR_SIZE;
	req->out.vwv = req->out.hdr + HDR_VWV;
	req->out.wct = wct;
	req->out.data = req->out.vwv + VWV(wct) + 2;
	req->out.data_size = buflen;
	req->out.ptr = req->out.data;

	SCVAL(req->out.hdr, HDR_WCT, wct);
	SSVAL(req->out.vwv, VWV(wct), buflen);

	memcpy(req->out.hdr, "\377SMB", 4);
	SCVAL(req->out.hdr,HDR_COM,command);

	SCVAL(req->out.hdr,HDR_FLG, FLAG_CASELESS_PATHNAMES);
	SSVAL(req->out.hdr,HDR_FLG2, 0);

	/* assign a mid */
	req->mid = cli_transport_next_mid(transport);

	/* copy the pid, uid and mid to the request */
	SSVAL(req->out.hdr, HDR_PID, 0);
	SSVAL(req->out.hdr, HDR_UID, 0);
	SSVAL(req->out.hdr, HDR_MID, req->mid);
	SSVAL(req->out.hdr, HDR_TID,0);
	SSVAL(req->out.hdr, HDR_PIDHIGH,0);
	SIVAL(req->out.hdr, HDR_RCLS, 0);
	memset(req->out.hdr+HDR_SS_FIELD, 0, 10);
	
	return req;
}

/*
  setup a reply in req->out with the given word count and initial data
  buffer size.  the caller will then fill in the command words and
  data before calling cli_request_send() to send the reply on its
  way. This interface is used before a session is setup.
*/
struct cli_request *cli_request_setup_session(struct cli_session *session,
					      uint8 command, unsigned wct, unsigned buflen)
{
	struct cli_request *req;
	uint16 flags2;
	uint32 capabilities;

	req = cli_request_setup_transport(session->transport, command, wct, buflen);

	if (!req) return NULL;

	req->session = session;
	
	flags2 = FLAGS2_LONG_PATH_COMPONENTS;
	capabilities = session->transport->negotiate.capabilities;

	if (capabilities & CAP_UNICODE) {
		flags2 |= FLAGS2_UNICODE_STRINGS;
	}
	if (capabilities & CAP_STATUS32) {
		flags2 |= FLAGS2_32_BIT_ERROR_CODES;
	}
	if (capabilities & CAP_EXTENDED_SECURITY) {
		flags2 |= FLAGS2_EXTENDED_SECURITY;
	}
	if (session->transport->negotiate.sign_info.doing_signing) {
		flags2 |= FLAGS2_SMB_SECURITY_SIGNATURES;
	}

	SSVAL(req->out.hdr, HDR_FLG2, flags2);
	SSVAL(req->out.hdr, HDR_PID, session->pid);
	SSVAL(req->out.hdr, HDR_UID, session->vuid);
	
	return req;
}

/*
  setup a request for tree based commands
*/
struct cli_request *cli_request_setup(struct cli_tree *tree,
				      uint8 command, 
				      unsigned wct, unsigned buflen)
{
	struct cli_request *req;

	req = cli_request_setup_session(tree->session, command, wct, buflen);
	if (req) {
		req->tree = tree;
		SSVAL(req->out.hdr,HDR_TID,tree->tid);
	}
	return req;
}

/*
  grow the allocation of the data buffer portion of a reply
  packet. Note that as this can reallocate the packet buffer this
  invalidates any local pointers into the packet.

  To cope with this req->out.ptr is supplied. This will be updated to
  point at the same offset into the packet as before this call
*/
static void cli_req_grow_allocation(struct cli_request *req, unsigned new_size)
{
	int delta;
	char *buf2;

	delta = new_size - req->out.data_size;
	if (delta + req->out.size <= req->out.allocated) {
		/* it fits in the preallocation */
		return;
	}

	/* we need to realloc */
	req->out.allocated = req->out.size + delta + REQ_OVER_ALLOCATION;
	buf2 = talloc_realloc(req->mem_ctx, req->out.buffer, req->out.allocated);
	if (buf2 == NULL) {
		smb_panic("out of memory in req_grow_allocation");
	}

	if (buf2 == req->out.buffer) {
		/* the malloc library gave us the same pointer */
		return;
	}
	
	/* update the pointers into the packet */
	req->out.data = buf2 + PTR_DIFF(req->out.data, req->out.buffer);
	req->out.ptr  = buf2 + PTR_DIFF(req->out.ptr,  req->out.buffer);
	req->out.vwv  = buf2 + PTR_DIFF(req->out.vwv,  req->out.buffer);
	req->out.hdr  = buf2 + PTR_DIFF(req->out.hdr,  req->out.buffer);

	req->out.buffer = buf2;
}


/*
  grow the data buffer portion of a reply packet. Note that as this
  can reallocate the packet buffer this invalidates any local pointers
  into the packet. 

  To cope with this req->out.ptr is supplied. This will be updated to
  point at the same offset into the packet as before this call
*/
static void cli_req_grow_data(struct cli_request *req, unsigned new_size)
{
	int delta;

	cli_req_grow_allocation(req, new_size);

	delta = new_size - req->out.data_size;

	req->out.size += delta;
	req->out.data_size += delta;

	/* set the BCC to the new data size */
	SSVAL(req->out.vwv, VWV(req->out.wct), new_size);
}

/*
  send a message
*/
BOOL cli_request_send(struct cli_request *req)
{
	if (IVAL(req->out.buffer, 0) == 0) {
		_smb_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
	}

	cli_request_calculate_sign_mac(req);

	if (req->out.size != cli_sock_write(req->transport->socket, req->out.buffer, req->out.size)) {
		req->transport->error.etype = ETYPE_SOCKET;
		req->transport->error.e.socket_error = SOCKET_WRITE_ERROR;
		DEBUG(0,("Error writing %d bytes to server - %s\n",
			 (int)req->out.size, strerror(errno)));
		return False;
	}

	/* add it to the list of pending requests */
	DLIST_ADD(req->transport->pending_requests, req);
	
	return True;
}


/*
  receive a response to a packet
*/
BOOL cli_request_receive(struct cli_request *req)
{
	/* req can be NULL when a send has failed. This eliminates lots of NULL
	   checks in each module */
	if (!req) return False;

	/* keep receiving packets until this one is replied to */
	while (!req->in.buffer) {
		if (!cli_transport_select(req->transport)) {
			return False;
		}

		cli_request_receive_next(req->transport);
	}

	return True;
}


/*
  handle oplock break requests from the server - return True if the request was
  an oplock break
*/
static BOOL handle_oplock_break(struct cli_transport *transport, uint_t len, const char *hdr, const char *vwv)
{
	/* we must be very fussy about what we consider an oplock break to avoid
	   matching readbraw replies */
	if (len != MIN_SMB_SIZE + VWV(8) ||
	    (CVAL(hdr, HDR_FLG) & FLAG_REPLY) ||
	    CVAL(hdr,HDR_COM) != SMBlockingX ||
	    SVAL(hdr, HDR_MID) != 0xFFFF ||
	    SVAL(vwv,VWV(6)) != 0 ||
	    SVAL(vwv,VWV(7)) != 0) {
		return False;
	}

	if (transport->oplock.handler) {
		uint16 tid = SVAL(hdr, HDR_TID);
		uint16 fnum = SVAL(vwv,VWV(2));
		uint8 level = CVAL(vwv,VWV(3));
		transport->oplock.handler(transport, tid, fnum, level, transport->oplock.private);
	}

	return True;
}


/*
  receive an async message from the server
  this function assumes that the caller already knows that the socket is readable
  and that there is a packet waiting

  The packet is not actually returned by this function, instead any
  registered async message handlers are called

  return True if a packet was successfully received and processed
  return False if the socket appears to be dead
*/
BOOL cli_request_receive_next(struct cli_transport *transport)
{
	BOOL ret;
	int len;
	char header[NBT_HDR_SIZE];
	char *buffer, *hdr, *vwv;
	TALLOC_CTX *mem_ctx;
	struct cli_request *req;
	uint16 wct, mid = 0;

	len = cli_sock_read(transport->socket, header, 4);
	if (len != 4) {
		return False;
	}
	
	len = smb_len(header);

	mem_ctx = talloc_init("cli_request_receive_next");
	
	/* allocate the incoming buffer at the right size */
	buffer = talloc(mem_ctx, len+NBT_HDR_SIZE);
	if (!buffer) {
		talloc_destroy(mem_ctx);
		return False;
	}

	/* fill in the already received header */
	memcpy(buffer, header, NBT_HDR_SIZE);

	ret = cli_sock_read(transport->socket, buffer + NBT_HDR_SIZE, len);
	/* If the server is not responding, note that now */
	if (ret != len) {
		return False;
	}

	hdr = buffer+NBT_HDR_SIZE;
	vwv = hdr + HDR_VWV;

	/* see if it could be an oplock break request */
	if (handle_oplock_break(transport, len, hdr, vwv)) {
		goto done;
	}

	/* at this point we need to check for a readbraw reply, as these can be any length */
	if (transport->readbraw_pending) {
		transport->readbraw_pending = 0;

		/* it must match the first entry in the pending queue as the client is not allowed
		   to have outstanding readbraw requests */
		req = transport->pending_requests;
		if (!req) goto done;

		req->in.buffer = buffer;
		talloc_steal(mem_ctx, req->mem_ctx, buffer);
		req->in.size = len + NBT_HDR_SIZE;
		req->in.allocated = req->in.size;
		goto async;
	}

	if (len >= MIN_SMB_SIZE) {
		/* extract the mid for matching to pending requests */
		mid = SVAL(hdr, HDR_MID);
		wct = CVAL(hdr, HDR_WCT);
	}

	/* match the incoming request against the list of pending requests */
	for (req=transport->pending_requests; req; req=req->next) {
		if (req->mid == mid) break;
	}

	if (!req) {
		DEBUG(3,("Discarding unmatched reply with mid %d\n", mid));
		goto done;
	}

	/* fill in the 'in' portion of the matching request */
	req->in.buffer = buffer;
	talloc_steal(mem_ctx, req->mem_ctx, buffer);
	req->in.size = len + NBT_HDR_SIZE;
	req->in.allocated = req->in.size;

	/* handle non-SMB replies */
	if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
		goto done;
	}

	if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
		DEBUG(2,("bad reply size for mid %d\n", mid));
		req->status = NT_STATUS_UNSUCCESSFUL;
		goto done;
	}

	req->in.hdr = hdr;
	req->in.vwv = vwv;
	req->in.wct = wct;
	if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
		req->in.data = req->in.vwv + VWV(wct) + 2;
		req->in.data_size = SVAL(req->in.vwv, VWV(wct));
		if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
			DEBUG(3,("bad data size for mid %d\n", mid));
			/* blergh - w2k3 gives a bogus data size values in some
			   openX replies */
			req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
		}
	}
	req->in.ptr = req->in.data;
	req->flags2 = SVAL(req->in.hdr, HDR_FLG2);

	if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
		transport->error.etype = ETYPE_DOS;
		transport->error.e.dos.eclass = CVAL(req->in.hdr,HDR_RCLS);
		transport->error.e.dos.ecode = SVAL(req->in.hdr,HDR_ERR);
		req->status = dos_to_ntstatus(transport->error.e.dos.eclass, 
					      transport->error.e.dos.ecode);
	} else {
		transport->error.etype = ETYPE_NT;
		transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
		req->status = transport->error.e.nt_status;
	}

	if (!cli_request_check_sign_mac(req)) {
		transport->error.etype = ETYPE_SOCKET;
		transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
		return False;
	};

async:
	/* if this request has an async handler then call that to
	   notify that the reply has been received. This might destroy
	   the request so it must happen last */
	if (req->async.fn) {
		req->async.fn(req);
	}

done:
	talloc_destroy(mem_ctx);
	return True;
}


/*
  wait for a reply to be received for a packet that just returns an error
  code and nothing more
*/
NTSTATUS cli_request_simple_recv(struct cli_request *req)
{
	cli_request_receive(req);
	return cli_request_destroy(req);
}


/* Return true if the last packet was in error */
BOOL cli_request_is_error(struct cli_request *req)
{
	return NT_STATUS_IS_ERR(req->status);
}

/*
  append a string into the data portion of the request packet

  return the number of bytes added to the packet
*/
size_t cli_req_append_string(struct cli_request *req, const char *str, unsigned flags)
{
	size_t len;

	/* determine string type to use */
	if (!(flags & (STR_ASCII|STR_UNICODE))) {
		flags |= (req->transport->negotiate.capabilities & CAP_UNICODE) ? STR_UNICODE : STR_ASCII;
	}

	len = (strlen(str)+2) * MAX_BYTES_PER_CHAR;		

	cli_req_grow_allocation(req, len + req->out.data_size);

	len = push_string(NULL, req->out.data + req->out.data_size, str, len, flags);

	cli_req_grow_data(req, len + req->out.data_size);

	return len;
}

/*
  this is like cli_req_append_string but it also return the
  non-terminated string byte length, which can be less than the number
  of bytes consumed in the packet for 2 reasons:

   1) the string in the packet may be null terminated
   2) the string in the packet may need a 1 byte UCS2 alignment

 this is used in places where the non-terminated string byte length is
 placed in the packet as a separate field  
*/
size_t cli_req_append_string_len(struct cli_request *req, const char *str, unsigned flags, int *len)
{
	int diff = 0;
	size_t ret;

	/* determine string type to use */
	if (!(flags & (STR_ASCII|STR_UNICODE))) {
		flags |= (req->transport->negotiate.capabilities & CAP_UNICODE) ? STR_UNICODE : STR_ASCII;
	}

	/* see if an alignment byte will be used */
	if ((flags & STR_UNICODE) && !(flags & STR_NOALIGN)) {
		diff = ucs2_align(NULL, req->out.data + req->out.data_size, flags);
	}

	/* do the hard work */
	ret = cli_req_append_string(req, str, flags);

	/* see if we need to subtract the termination */
	if (flags & STR_TERMINATE) {
		diff += (flags & STR_UNICODE) ? 2 : 1;
	}

	if (ret >= diff) {
		(*len) = ret - diff;
	} else {
		(*len) = ret;
	}

	return ret;
}


/*
  push a string into the data portion of the request packet, growing it if necessary
  this gets quite tricky - please be very careful to cover all cases when modifying this

  if dest is NULL, then put the string at the end of the data portion of the packet

  if dest_len is -1 then no limit applies
*/
size_t cli_req_append_ascii4(struct cli_request *req, const char *str, unsigned flags)
{
	size_t size;
	cli_req_append_bytes(req, (const uint8 *)"\4", 1);
	size = cli_req_append_string(req, str, flags);
	return size + 1;
}


/*
  push a blob into the data portion of the request packet, growing it if necessary
  this gets quite tricky - please be very careful to cover all cases when modifying this

  if dest is NULL, then put the blob at the end of the data portion of the packet
*/
size_t cli_req_append_blob(struct cli_request *req, const DATA_BLOB *blob)
{
	cli_req_grow_allocation(req, req->out.data_size + blob->length);
	memcpy(req->out.data + req->out.data_size, blob->data, blob->length);
	cli_req_grow_data(req, req->out.data_size + blob->length);
	return blob->length;
}

/*
  append raw bytes into the data portion of the request packet
  return the number of bytes added
*/
size_t cli_req_append_bytes(struct cli_request *req, const uint8 *bytes, size_t byte_len)
{
	cli_req_grow_allocation(req, byte_len + req->out.data_size);
	memcpy(req->out.data + req->out.data_size, bytes, byte_len);
	cli_req_grow_data(req, byte_len + req->out.data_size);
	return byte_len;
}

/*
  append variable block (type 5 buffer) into the data portion of the request packet
  return the number of bytes added
*/
size_t cli_req_append_var_block(struct cli_request *req, const uint8 *bytes, uint16 byte_len)
{
	cli_req_grow_allocation(req, byte_len + 3 + req->out.data_size);
	SCVAL(req->out.data + req->out.data_size, 0, 5);
	SSVAL(req->out.data + req->out.data_size, 1, byte_len);		/* add field length */
	if (byte_len > 0) {
		memcpy(req->out.data + req->out.data_size + 3, bytes, byte_len);
	}
	cli_req_grow_data(req, byte_len + 3 + req->out.data_size);
	return byte_len + 3;
}


/*
  pull a UCS2 string from a request packet, returning a talloced unix string

  the string length is limited by the 3 things:
   - the data size in the request (end of packet)
   - the passed 'byte_len' if it is not -1
   - the end of string (null termination)

  Note that 'byte_len' is the number of bytes in the packet

  on failure zero is returned and *dest is set to NULL, otherwise the number
  of bytes consumed in the packet is returned
*/
static size_t cli_req_pull_ucs2(struct cli_request *req, TALLOC_CTX *mem_ctx,
				char **dest, const char *src, int byte_len, unsigned flags)
{
	int src_len, src_len2, alignment=0;
	ssize_t ret;

	if (!(flags & STR_NOALIGN) && ucs2_align(req->in.buffer, src, flags)) {
		src++;
		alignment=1;
		if (byte_len != -1) {
			byte_len--;
		}
	}

	src_len = req->in.data_size - PTR_DIFF(src, req->in.data);
	if (src_len < 0) {
		*dest = NULL;
		return 0;
	}
	if (byte_len != -1 && src_len > byte_len) {
		src_len = byte_len;
	}

	src_len2 = strnlen_w((const smb_ucs2_t *)src, src_len/2) * 2;
	if (src_len2 < src_len - 2) {
		/* include the termination if we didn't reach the end of the packet */
		src_len2 += 2;
	}

	/* ucs2 strings must be at least 2 bytes long */
	if (src_len2 < 2) {
		*dest = NULL;
		return 0;
	}

	ret = convert_string_talloc(mem_ctx, CH_UCS2, CH_UNIX, src, src_len2, (const void **)dest);
	if (ret == -1) {
		*dest = NULL;
		return 0;
	}

	return src_len2 + alignment;
}

/*
  pull a ascii string from a request packet, returning a talloced string

  the string length is limited by the 3 things:
   - the data size in the request (end of packet)
   - the passed 'byte_len' if it is not -1
   - the end of string (null termination)

  Note that 'byte_len' is the number of bytes in the packet

  on failure zero is returned and *dest is set to NULL, otherwise the number
  of bytes consumed in the packet is returned
*/
size_t cli_req_pull_ascii(struct cli_request *req, TALLOC_CTX *mem_ctx,
			  char **dest, const char *src, int byte_len, unsigned flags)
{
	int src_len, src_len2;
	ssize_t ret;

	src_len = req->in.data_size - PTR_DIFF(src, req->in.data);
	if (src_len < 0) {
		*dest = NULL;
		return 0;
	}
	if (byte_len != -1 && src_len > byte_len) {
		src_len = byte_len;
	}
	src_len2 = strnlen(src, src_len);
	if (src_len2 < src_len - 1) {
		/* include the termination if we didn't reach the end of the packet */
		src_len2++;
	}

	ret = convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, src, src_len2, (const void **)dest);

	if (ret == -1) {
		*dest = NULL;
		return 0;
	}

	return ret;
}

/*
  pull a string from a request packet, returning a talloced string

  the string length is limited by the 3 things:
   - the data size in the request (end of packet)
   - the passed 'byte_len' if it is not -1
   - the end of string (null termination)

  Note that 'byte_len' is the number of bytes in the packet

  on failure zero is returned and *dest is set to NULL, otherwise the number
  of bytes consumed in the packet is returned
*/
size_t cli_req_pull_string(struct cli_request *req, TALLOC_CTX *mem_ctx, 
			   char **dest, const char *src, int byte_len, unsigned flags)
{
	if (!(flags & STR_ASCII) && 
	    ((flags & STR_UNICODE || (req->flags2 & FLAGS2_UNICODE_STRINGS)))) {
		return cli_req_pull_ucs2(req, mem_ctx, dest, src, byte_len, flags);
	}

	return cli_req_pull_ascii(req, mem_ctx, dest, src, byte_len, flags);
}


/*
  pull a DATA_BLOB from a reply packet, returning a talloced blob
  make sure we don't go past end of packet

  if byte_len is -1 then limit the blob only by packet size
*/
DATA_BLOB cli_req_pull_blob(struct cli_request *req, TALLOC_CTX *mem_ctx, const char *src, int byte_len)
{
	int src_len;

	src_len = req->in.data_size - PTR_DIFF(src, req->in.data);

	if (src_len < 0) {
		return data_blob(NULL, 0);
	}

	if (byte_len != -1 && src_len > byte_len) {
		src_len = byte_len;
	}

	return data_blob_talloc(mem_ctx, src, src_len);
}

/* check that a lump of data in a request is within the bounds of the data section of
   the packet */
static BOOL cli_req_data_oob(struct cli_request *req, const char *ptr, uint32 count)
{
	/* be careful with wraparound! */
	if (ptr < req->in.data ||
	    ptr >= req->in.data + req->in.data_size ||
	    count > req->in.data_size ||
	    ptr + count > req->in.data + req->in.data_size) {
		return True;
	}
	return False;
}

/*
  pull a lump of data from a request packet

  return False if any part is outside the data portion of the packet
*/
BOOL cli_raw_pull_data(struct cli_request *req, const char *src, int len, char *dest)
{
	if (len == 0) return True;

	if (cli_req_data_oob(req, src, len)) {
		return False;
	}

	memcpy(dest, src, len);
	return True;
}


/*
  put a NTTIME into a packet
*/

void cli_push_nttime(void *base, uint16 offset, NTTIME *t)
{
	SIVAL(base, offset,   t->low);
	SIVAL(base, offset+4, t->high);
}

/*
  pull a NTTIME from a packet
*/
NTTIME cli_pull_nttime(void *base, uint16 offset)
{
	NTTIME ret;
	ret.low = IVAL(base, offset);
	ret.high = IVAL(base, offset+4);
	return ret;
}

/*
  pull a UCS2 string from a blob, returning a talloced unix string

  the string length is limited by the 3 things:
   - the data size in the blob
   - the passed 'byte_len' if it is not -1
   - the end of string (null termination)

  Note that 'byte_len' is the number of bytes in the packet

  on failure zero is returned and *dest is set to NULL, otherwise the number
  of bytes consumed in the blob is returned
*/
static size_t cli_blob_pull_ucs2(TALLOC_CTX* mem_ctx,
				 DATA_BLOB *blob, const char **dest, 
				 const char *src, int byte_len, unsigned flags)
{
	int src_len, src_len2, alignment=0;
	ssize_t ret;

	if (src < (const char *)blob->data ||
	    src >= (const char *)(blob->data + blob->length)) {
		*dest = NULL;
		return 0;
	}

	src_len = blob->length - PTR_DIFF(src, blob->data);

	if (byte_len != -1 && src_len > byte_len) {
		src_len = byte_len;
	}

	if (!(flags & STR_NOALIGN) && ucs2_align(blob->data, src, flags)) {
		src++;
		alignment=1;
		src_len--;
	}

	if (src_len < 2) {
		*dest = NULL;
		return 0;
	}

	src_len2 = strnlen_w((const smb_ucs2_t *)src, src_len/2) * 2;

	if (src_len2 < src_len - 2) {
		/* include the termination if we didn't reach the end of the packet */
		src_len2 += 2;
	}

	ret = convert_string_talloc(mem_ctx, CH_UCS2, CH_UNIX, src, src_len2, (const void **)dest);
	if (ret == -1) {
		*dest = NULL;
		return 0;
	}

	return src_len2 + alignment;
}

/*
  pull a ascii string from a blob, returning a talloced string

  the string length is limited by the 3 things:
   - the data size in the blob
   - the passed 'byte_len' if it is not -1
   - the end of string (null termination)

  Note that 'byte_len' is the number of bytes in the blob

  on failure zero is returned and *dest is set to NULL, otherwise the number
  of bytes consumed in the blob is returned
*/
static size_t cli_blob_pull_ascii(TALLOC_CTX *mem_ctx,
				  DATA_BLOB *blob, const char **dest, 
				  const char *src, int byte_len, unsigned flags)
{
	int src_len, src_len2;
	ssize_t ret;

	src_len = blob->length - PTR_DIFF(src, blob->data);
	if (src_len < 0) {
		*dest = NULL;
		return 0;
	}
	if (byte_len != -1 && src_len > byte_len) {
		src_len = byte_len;
	}
	src_len2 = strnlen(src, src_len);

	if (src_len2 < src_len - 1) {
		/* include the termination if we didn't reach the end of the packet */
		src_len2++;
	}

	ret = convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX, src, src_len2, (const void **)dest);

	if (ret == -1) {
		*dest = NULL;
		return 0;
	}

	return ret;
}

/*
  pull a string from a blob, returning a talloced WIRE_STRING

  the string length is limited by the 3 things:
   - the data size in the blob
   - length field on the wire
   - the end of string (null termination)

   if STR_LEN8BIT is set in the flags then assume the length field is
   8 bits, instead of 32

  on failure zero is returned and dest->s is set to NULL, otherwise the number
  of bytes consumed in the blob is returned
*/
size_t cli_blob_pull_string(struct cli_session *session,
			    TALLOC_CTX *mem_ctx,
			    DATA_BLOB *blob, 
			    WIRE_STRING *dest, 
			    uint16 len_offset, uint16 str_offset, 
			    unsigned flags)
{
	dest->s = NULL;

	if (len_offset > blob->length-4) {
		return 0;
	}
	if (flags & STR_LEN8BIT) {
		dest->private_length = CVAL(blob->data, len_offset);
	} else {
		dest->private_length = IVAL(blob->data, len_offset);
	}
	dest->s = NULL;
	if (!(flags & STR_ASCII) && 
	    ((flags & STR_UNICODE) || 
	     (session->transport->negotiate.capabilities & CAP_UNICODE))) {
		if ((str_offset&1) && !(flags & STR_NOALIGN)) {
			str_offset++;
		}
		return cli_blob_pull_ucs2(mem_ctx, blob, &dest->s, 
					  blob->data+str_offset, dest->private_length, flags);
	}

	return cli_blob_pull_ascii(mem_ctx, blob, &dest->s, 
				   blob->data+str_offset, dest->private_length, flags);
}

/*
  append a string into a blob
*/
size_t cli_blob_append_string(struct cli_session *session,
			      TALLOC_CTX *mem_ctx, DATA_BLOB *blob, 
			      const char *str, unsigned flags)
{
	size_t max_len;
	int len;

	if (!str) return 0;

	/* determine string type to use */
	if (!(flags & (STR_ASCII|STR_UNICODE))) {
		flags |= (session->transport->negotiate.capabilities & CAP_UNICODE) ? STR_UNICODE : STR_ASCII;
	}

	max_len = (strlen(str)+2) * MAX_BYTES_PER_CHAR;		

	blob->data = talloc_realloc(mem_ctx, blob->data, blob->length + max_len);
	if (!blob->data) {
		return 0;
	}

	len = push_string(NULL, blob->data + blob->length, str, max_len, flags);

	blob->length += len;

	return len;
}