Context Navigation

source: vendor/3.6.0/source3/smbd/ipc.c

Visit:

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago
Samba Server: update vendor to 3.6.0
File size: 24.7 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3	Inter-process communication and named pipe handling
4	Copyright (C) Andrew Tridgell 1992-1998
5
6	SMB Version handling
7	Copyright (C) John H Terpstra 1995-1998
8
9	This program is free software; you can redistribute it and/or modify
10	it under the terms of the GNU General Public License as published by
11	the Free Software Foundation; either version 3 of the License, or
12	(at your option) any later version.
13
14	This program is distributed in the hope that it will be useful,
15	but WITHOUT ANY WARRANTY; without even the implied warranty of
16	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	GNU General Public License for more details.
18
19	You should have received a copy of the GNU General Public License
20	along with this program. If not, see <http://www.gnu.org/licenses/>.
21	*/
22	/*
23	This file handles the named pipe and mailslot calls
24	in the SMBtrans protocol
25	*/
26
27	#include "includes.h"
28	#include "smbd/smbd.h"
29	#include "smbd/globals.h"
30	#include "smbprofile.h"
31	#include "rpc_server/srv_pipe_hnd.h"
32
33	#define NERR_notsupported 50
34
35	static void api_no_reply(connection_struct conn, struct smb_request req);
36
37	/*******************************************************************
38	copies parameters and data, as needed, into the smb buffer
39
40	both the data and params sections should be aligned. this
41	is fudged in the rpc pipes by
42	at present, only the data section is. this may be a possible
43	cause of some of the ipc problems being experienced. lkcl26dec97
44
45	******************************************************************/
46
47	static void copy_trans_params_and_data(char *outbuf, int align,
48	char *rparam, int param_offset, int param_len,
49	char *rdata, int data_offset, int data_len)
50	{
51	char *copy_into = smb_buf(outbuf);
52
53	if(param_len < 0)
54	param_len = 0;
55
56	if(data_len < 0)
57	data_len = 0;
58
59	DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d] (align %d)\n",
60	param_offset, param_offset + param_len,
61	data_offset , data_offset + data_len,
62	align));
63
64	*copy_into = '\0';
65
66	copy_into += 1;
67
68	if (param_len)
69	memcpy(copy_into, &rparam[param_offset], param_len);
70
71	copy_into += param_len;
72	if (align) {
73	memset(copy_into, '\0', align);
74	}
75
76	copy_into += align;
77
78	if (data_len )
79	memcpy(copy_into, &rdata[data_offset], data_len);
80	}
81
82	/****************************************************************************
83	Send a trans reply.
84	****************************************************************************/
85
86	void send_trans_reply(connection_struct *conn,
87	struct smb_request *req,
88	char *rparam, int rparam_len,
89	char *rdata, int rdata_len,
90	bool buffer_too_large)
91	{
92	int this_ldata,this_lparam;
93	int tot_data_sent = 0;
94	int tot_param_sent = 0;
95	int align;
96
97	int ldata = rdata ? rdata_len : 0;
98	int lparam = rparam ? rparam_len : 0;
99	struct smbd_server_connection *sconn = req->sconn;
100	int max_send = sconn->smb1.sessions.max_send;
101
102	if (buffer_too_large)
103	DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
104
105	this_lparam = MIN(lparam,max_send - 500); /* hack */
106	this_ldata = MIN(ldata,max_send - (500+this_lparam));
107
108	align = ((this_lparam)%4);
109
110	reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
111
112	/*
113	* We might have SMBtranss in req which was transferred to the outbuf,
114	* fix that.
115	*/
116	SCVAL(req->outbuf, smb_com, SMBtrans);
117
118	copy_trans_params_and_data((char *)req->outbuf, align,
119	rparam, tot_param_sent, this_lparam,
120	rdata, tot_data_sent, this_ldata);
121
122	SSVAL(req->outbuf,smb_vwv0,lparam);
123	SSVAL(req->outbuf,smb_vwv1,ldata);
124	SSVAL(req->outbuf,smb_vwv3,this_lparam);
125	SSVAL(req->outbuf,smb_vwv4,
126	smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
127	SSVAL(req->outbuf,smb_vwv5,0);
128	SSVAL(req->outbuf,smb_vwv6,this_ldata);
129	SSVAL(req->outbuf,smb_vwv7,
130	smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
131	req->outbuf));
132	SSVAL(req->outbuf,smb_vwv8,0);
133	SSVAL(req->outbuf,smb_vwv9,0);
134
135	if (buffer_too_large) {
136	error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
137	STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
138	}
139
140	show_msg((char *)req->outbuf);
141	if (!srv_send_smb(sconn, (char *)req->outbuf,
142	true, req->seqnum+1,
143	IS_CONN_ENCRYPTED(conn), &req->pcd)) {
144	exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
145	}
146
147	TALLOC_FREE(req->outbuf);
148
149	tot_data_sent = this_ldata;
150	tot_param_sent = this_lparam;
151
152	while (tot_data_sent < ldata \|\| tot_param_sent < lparam)
153	{
154	this_lparam = MIN(lparam-tot_param_sent,
155	max_send - 500); /* hack */
156	this_ldata = MIN(ldata -tot_data_sent,
157	max_send - (500+this_lparam));
158
159	if(this_lparam < 0)
160	this_lparam = 0;
161
162	if(this_ldata < 0)
163	this_ldata = 0;
164
165	align = (this_lparam%4);
166
167	reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
168
169	/*
170	* We might have SMBtranss in req which was transferred to the
171	* outbuf, fix that.
172	*/
173	SCVAL(req->outbuf, smb_com, SMBtrans);
174
175	copy_trans_params_and_data((char *)req->outbuf, align,
176	rparam, tot_param_sent, this_lparam,
177	rdata, tot_data_sent, this_ldata);
178
179	SSVAL(req->outbuf,smb_vwv0,lparam);
180	SSVAL(req->outbuf,smb_vwv1,ldata);
181
182	SSVAL(req->outbuf,smb_vwv3,this_lparam);
183	SSVAL(req->outbuf,smb_vwv4,
184	smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
185	SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
186	SSVAL(req->outbuf,smb_vwv6,this_ldata);
187	SSVAL(req->outbuf,smb_vwv7,
188	smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
189	req->outbuf));
190	SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
191	SSVAL(req->outbuf,smb_vwv9,0);
192
193	if (buffer_too_large) {
194	error_packet_set((char *)req->outbuf,
195	ERRDOS, ERRmoredata,
196	STATUS_BUFFER_OVERFLOW,
197	__LINE__, __FILE__);
198	}
199
200	show_msg((char *)req->outbuf);
201	if (!srv_send_smb(sconn, (char *)req->outbuf,
202	true, req->seqnum+1,
203	IS_CONN_ENCRYPTED(conn), &req->pcd))
204	exit_server_cleanly("send_trans_reply: srv_send_smb "
205	"failed.");
206
207	tot_data_sent += this_ldata;
208	tot_param_sent += this_lparam;
209	TALLOC_FREE(req->outbuf);
210	}
211	}
212
213	/****************************************************************************
214	Start the first part of an RPC reply which began with an SMBtrans request.
215	****************************************************************************/
216
217	struct dcerpc_cmd_state {
218	struct fake_file_handle *handle;
219	uint8_t *data;
220	size_t num_data;
221	size_t max_read;
222	};
223
224	static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
225	static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
226
227	static void api_dcerpc_cmd(connection_struct conn, struct smb_request req,
228	files_struct fsp, uint8_t data, size_t length,
229	size_t max_read)
230	{
231	struct tevent_req *subreq;
232	struct dcerpc_cmd_state *state;
233	bool busy;
234
235	if (!fsp_is_np(fsp)) {
236	api_no_reply(conn, req);
237	return;
238	}
239
240	/*
241	* Trans requests are only allowed
242	* if no other Trans or Read is active
243	*/
244	busy = np_read_in_progress(fsp->fake_file_handle);
245	if (busy) {
246	reply_nterror(req, NT_STATUS_PIPE_BUSY);
247	return;
248	}
249
250	state = talloc(req, struct dcerpc_cmd_state);
251	if (state == NULL) {
252	reply_nterror(req, NT_STATUS_NO_MEMORY);
253	return;
254	}
255	req->async_priv = state;
256
257	state->handle = fsp->fake_file_handle;
258
259	/*
260	* This memdup severely sucks. But doing it properly essentially means
261	* to rewrite lanman.c, something which I don't really want to do now.
262	*/
263	state->data = (uint8_t *)talloc_memdup(state, data, length);
264	if (state->data == NULL) {
265	reply_nterror(req, NT_STATUS_NO_MEMORY);
266	return;
267	}
268	state->num_data = length;
269	state->max_read = max_read;
270
271	subreq = np_write_send(state, smbd_event_context(), state->handle,
272	state->data, length);
273	if (subreq == NULL) {
274	TALLOC_FREE(state);
275	reply_nterror(req, NT_STATUS_NO_MEMORY);
276	return;
277	}
278	tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
279	talloc_move(conn, &req));
280	}
281
282	static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
283	{
284	struct smb_request *req = tevent_req_callback_data(
285	subreq, struct smb_request);
286	struct dcerpc_cmd_state *state = talloc_get_type_abort(
287	req->async_priv, struct dcerpc_cmd_state);
288	NTSTATUS status;
289	ssize_t nwritten = -1;
290
291	status = np_write_recv(subreq, &nwritten);
292	TALLOC_FREE(subreq);
293	if (!NT_STATUS_IS_OK(status) \|\| (nwritten != state->num_data)) {
294	DEBUG(10, ("Could not write to pipe: %s (%d/%d)\n",
295	nt_errstr(status), (int)state->num_data,
296	(int)nwritten));
297	reply_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
298	goto send;
299	}
300
301	state->data = TALLOC_REALLOC_ARRAY(state, state->data, uint8_t,
302	state->max_read);
303	if (state->data == NULL) {
304	reply_nterror(req, NT_STATUS_NO_MEMORY);
305	goto send;
306	}
307
308	subreq = np_read_send(req->conn, smbd_event_context(),
309	state->handle, state->data, state->max_read);
310	if (subreq == NULL) {
311	reply_nterror(req, NT_STATUS_NO_MEMORY);
312	goto send;
313	}
314	tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
315	return;
316
317	send:
318	if (!srv_send_smb(
319	req->sconn, (char *)req->outbuf,
320	true, req->seqnum+1,
321	IS_CONN_ENCRYPTED(req->conn) \|\| req->encrypted,
322	&req->pcd)) {
323	exit_server_cleanly("api_dcerpc_cmd_write_done: "
324	"srv_send_smb failed.");
325	}
326	TALLOC_FREE(req);
327	}
328
329	static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
330	{
331	struct smb_request *req = tevent_req_callback_data(
332	subreq, struct smb_request);
333	struct dcerpc_cmd_state *state = talloc_get_type_abort(
334	req->async_priv, struct dcerpc_cmd_state);
335	NTSTATUS status;
336	ssize_t nread;
337	bool is_data_outstanding;
338
339	status = np_read_recv(subreq, &nread, &is_data_outstanding);
340	TALLOC_FREE(subreq);
341
342	if (!NT_STATUS_IS_OK(status)) {
343	DEBUG(10, ("Could not read from to pipe: %s\n",
344	nt_errstr(status)));
345	reply_nterror(req, status);
346
347	if (!srv_send_smb(req->sconn, (char *)req->outbuf,
348	true, req->seqnum+1,
349	IS_CONN_ENCRYPTED(req->conn)
350	\|\|req->encrypted, &req->pcd)) {
351	exit_server_cleanly("api_dcerpc_cmd_read_done: "
352	"srv_send_smb failed.");
353	}
354	TALLOC_FREE(req);
355	return;
356	}
357
358	send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
359	is_data_outstanding);
360	TALLOC_FREE(req);
361	}
362
363	/****************************************************************************
364	WaitNamedPipeHandleState
365	****************************************************************************/
366
367	static void api_WNPHS(connection_struct conn, struct smb_request req,
368	struct files_struct fsp, char param, int param_len)
369	{
370	if (!param \|\| param_len < 2) {
371	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
372	return;
373	}
374
375	DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
376	(int)SVAL(param,0)));
377
378	send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
379	}
380
381
382	/****************************************************************************
383	SetNamedPipeHandleState
384	****************************************************************************/
385
386	static void api_SNPHS(connection_struct conn, struct smb_request req,
387	struct files_struct fsp, char param, int param_len)
388	{
389	if (!param \|\| param_len < 2) {
390	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
391	return;
392	}
393
394	DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
395
396	send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
397	}
398
399
400	/****************************************************************************
401	When no reply is generated, indicate unsupported.
402	****************************************************************************/
403
404	static void api_no_reply(connection_struct conn, struct smb_request req)
405	{
406	char rparam[4];
407
408	/* unsupported */
409	SSVAL(rparam,0,NERR_notsupported);
410	SSVAL(rparam,2,0); /* converter word */
411
412	DEBUG(3,("Unsupported API fd command\n"));
413
414	/* now send the reply */
415	send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
416
417	return;
418	}
419
420	/****************************************************************************
421	Handle remote api calls delivered to a named pipe already opened.
422	****************************************************************************/
423
424	static void api_fd_reply(connection_struct *conn, uint16 vuid,
425	struct smb_request *req,
426	uint16 setup, uint8_t data, char *params,
427	int suwcnt, int tdscnt, int tpscnt,
428	int mdrcnt, int mprcnt)
429	{
430	struct files_struct *fsp;
431	int pnum;
432	int subcommand;
433
434	DEBUG(5,("api_fd_reply\n"));
435
436	/* First find out the name of this file. */
437	if (suwcnt != 2) {
438	DEBUG(0,("Unexpected named pipe transaction.\n"));
439	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
440	return;
441	}
442
443	/* Get the file handle and hence the file name. */
444	/*
445	* NB. The setup array has already been transformed
446	* via SVAL and so is in host byte order.
447	*/
448	pnum = ((int)setup[1]) & 0xFFFF;
449	subcommand = ((int)setup[0]) & 0xFFFF;
450
451	fsp = file_fsp(req, pnum);
452
453	if (!fsp_is_np(fsp)) {
454	if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
455	/* Win9x does this call with a unicode pipe name, not a pnum. */
456	/* Just return success for now... */
457	DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
458	send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
459	return;
460	}
461
462	DEBUG(1,("api_fd_reply: INVALID PIPE HANDLE: %x\n", pnum));
463	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
464	return;
465	}
466
467	if (vuid != fsp->vuid) {
468	DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %d, "
469	"expected %d\n", pnum, vuid, fsp->vuid));
470	reply_nterror(req, NT_STATUS_INVALID_HANDLE);
471	return;
472	}
473
474	DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
475	subcommand, fsp_str_dbg(fsp), pnum));
476
477	DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
478
479	switch (subcommand) {
480	case TRANSACT_DCERPCCMD: {
481	/* dce/rpc command */
482	api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
483	mdrcnt);
484	break;
485	}
486	case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
487	/* Wait Named Pipe Handle state */
488	api_WNPHS(conn, req, fsp, params, tpscnt);
489	break;
490	case TRANSACT_SETNAMEDPIPEHANDLESTATE:
491	/* Set Named Pipe Handle state */
492	api_SNPHS(conn, req, fsp, params, tpscnt);
493	break;
494	default:
495	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
496	return;
497	}
498	}
499
500	/****************************************************************************
501	Handle named pipe commands.
502	****************************************************************************/
503
504	static void named_pipe(connection_struct *conn, uint16 vuid,
505	struct smb_request *req,
506	const char name, uint16 setup,
507	char data, char params,
508	int suwcnt, int tdscnt,int tpscnt,
509	int msrcnt, int mdrcnt, int mprcnt)
510	{
511	DEBUG(3,("named pipe command on <%s> name\n", name));
512
513	if (strequal(name,"LANMAN")) {
514	api_reply(conn, vuid, req,
515	data, params,
516	tdscnt, tpscnt,
517	mdrcnt, mprcnt);
518	return;
519	}
520
521	if (strequal(name,"WKSSVC") \|\|
522	strequal(name,"SRVSVC") \|\|
523	strequal(name,"WINREG") \|\|
524	strequal(name,"SAMR") \|\|
525	strequal(name,"LSARPC")) {
526
527	DEBUG(4,("named pipe command from Win95 (wow!)\n"));
528
529	api_fd_reply(conn, vuid, req,
530	setup, (uint8_t *)data, params,
531	suwcnt, tdscnt, tpscnt,
532	mdrcnt, mprcnt);
533	return;
534	}
535
536	if (strlen(name) < 1) {
537	api_fd_reply(conn, vuid, req,
538	setup, (uint8_t *)data,
539	params, suwcnt, tdscnt,
540	tpscnt, mdrcnt, mprcnt);
541	return;
542	}
543
544	if (setup)
545	DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n",
546	(int)setup[0],(int)setup[1]));
547
548	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
549	return;
550	}
551
552	static void handle_trans(connection_struct conn, struct smb_request req,
553	struct trans_state *state)
554	{
555	char *local_machine_name;
556	int name_offset = 0;
557
558	DEBUG(3,("trans <%s> data=%u params=%u setup=%u\n",
559	state->name,(unsigned int)state->total_data,(unsigned int)state->total_param,
560	(unsigned int)state->setup_count));
561
562	/*
563	* WinCE wierdness....
564	*/
565
566	local_machine_name = talloc_asprintf(state, "\\%s\\",
567	get_local_machine_name());
568
569	if (local_machine_name == NULL) {
570	reply_nterror(req, NT_STATUS_NO_MEMORY);
571	return;
572	}
573
574	if (strnequal(state->name, local_machine_name,
575	strlen(local_machine_name))) {
576	name_offset = strlen(local_machine_name)-1;
577	}
578
579	if (!strnequal(&state->name[name_offset], "\\PIPE",
580	strlen("\\PIPE"))) {
581	reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
582	return;
583	}
584
585	name_offset += strlen("\\PIPE");
586
587	/* Win9x weirdness. When talking to a unicode server Win9x
588	only sends \PIPE instead of \PIPE\ */
589
590	if (state->name[name_offset] == '\\')
591	name_offset++;
592
593	DEBUG(5,("calling named_pipe\n"));
594	named_pipe(conn, state->vuid, req,
595	state->name+name_offset,
596	state->setup,state->data,
597	state->param,
598	state->setup_count,state->total_data,
599	state->total_param,
600	state->max_setup_return,
601	state->max_data_return,
602	state->max_param_return);
603
604	if (state->close_on_completion) {
605	close_cnum(conn,state->vuid);
606	req->conn = NULL;
607	}
608
609	return;
610	}
611
612	/****************************************************************************
613	Reply to a SMBtrans.
614	****************************************************************************/
615
616	void reply_trans(struct smb_request *req)
617	{
618	connection_struct *conn = req->conn;
619	unsigned int dsoff;
620	unsigned int dscnt;
621	unsigned int psoff;
622	unsigned int pscnt;
623	struct trans_state *state;
624	NTSTATUS result;
625
626	START_PROFILE(SMBtrans);
627
628	if (req->wct < 14) {
629	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
630	END_PROFILE(SMBtrans);
631	return;
632	}
633
634	dsoff = SVAL(req->vwv+12, 0);
635	dscnt = SVAL(req->vwv+11, 0);
636	psoff = SVAL(req->vwv+10, 0);
637	pscnt = SVAL(req->vwv+9, 0);
638
639	result = allow_new_trans(conn->pending_trans, req->mid);
640	if (!NT_STATUS_IS_OK(result)) {
641	DEBUG(2, ("Got invalid trans request: %s\n",
642	nt_errstr(result)));
643	reply_nterror(req, result);
644	END_PROFILE(SMBtrans);
645	return;
646	}
647
648	if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
649	DEBUG(0, ("talloc failed\n"));
650	reply_nterror(req, NT_STATUS_NO_MEMORY);
651	END_PROFILE(SMBtrans);
652	return;
653	}
654
655	state->cmd = SMBtrans;
656
657	state->mid = req->mid;
658	state->vuid = req->vuid;
659	state->setup_count = CVAL(req->vwv+13, 0);
660	state->setup = NULL;
661	state->total_param = SVAL(req->vwv+0, 0);
662	state->param = NULL;
663	state->total_data = SVAL(req->vwv+1, 0);
664	state->data = NULL;
665	state->max_param_return = SVAL(req->vwv+2, 0);
666	state->max_data_return = SVAL(req->vwv+3, 0);
667	state->max_setup_return = CVAL(req->vwv+4, 0);
668	state->close_on_completion = BITSETW(req->vwv+5, 0);
669	state->one_way = BITSETW(req->vwv+5, 1);
670
671	srvstr_pull_req_talloc(state, req, &state->name, req->buf,
672	STR_TERMINATE);
673
674	if ((dscnt > state->total_data) \|\| (pscnt > state->total_param) \|\|
675	!state->name)
676	goto bad_param;
677
678	if (state->total_data) {
679
680	if (trans_oob(state->total_data, 0, dscnt)
681	\|\| trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
682	goto bad_param;
683	}
684
685	/* Can't use talloc here, the core routines do realloc on the
686	* params and data. Out of paranoia, 100 bytes too many. */
687	state->data = (char *)SMB_MALLOC(state->total_data+100);
688	if (state->data == NULL) {
689	DEBUG(0,("reply_trans: data malloc fail for %u "
690	"bytes !\n", (unsigned int)state->total_data));
691	TALLOC_FREE(state);
692	reply_nterror(req, NT_STATUS_NO_MEMORY);
693	END_PROFILE(SMBtrans);
694	return;
695	}
696	/* null-terminate the slack space */
697	memset(&state->data[state->total_data], 0, 100);
698
699	memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
700	}
701
702	if (state->total_param) {
703
704	if (trans_oob(state->total_param, 0, pscnt)
705	\|\| trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
706	goto bad_param;
707	}
708
709	/* Can't use talloc here, the core routines do realloc on the
710	* params and data. Out of paranoia, 100 bytes too many */
711	state->param = (char *)SMB_MALLOC(state->total_param+100);
712	if (state->param == NULL) {
713	DEBUG(0,("reply_trans: param malloc fail for %u "
714	"bytes !\n", (unsigned int)state->total_param));
715	SAFE_FREE(state->data);
716	TALLOC_FREE(state);
717	reply_nterror(req, NT_STATUS_NO_MEMORY);
718	END_PROFILE(SMBtrans);
719	return;
720	}
721	/* null-terminate the slack space */
722	memset(&state->param[state->total_param], 0, 100);
723
724	memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
725	}
726
727	state->received_data = dscnt;
728	state->received_param = pscnt;
729
730	if (state->setup_count) {
731	unsigned int i;
732
733	/*
734	* No overflow possible here, state->setup_count is an
735	* unsigned int, being filled by a single byte from
736	* CVAL(req->vwv+13, 0) above. The cast in the comparison
737	* below is not necessary, it's here to clarify things. The
738	* validity of req->vwv and req->wct has been checked in
739	* init_smb_request already.
740	*/
741	if (state->setup_count + 14 > (unsigned int)req->wct) {
742	goto bad_param;
743	}
744
745	if((state->setup = TALLOC_ARRAY(
746	state, uint16, state->setup_count)) == NULL) {
747	DEBUG(0,("reply_trans: setup malloc fail for %u "
748	"bytes !\n", (unsigned int)
749	(state->setup_count * sizeof(uint16))));
750	SAFE_FREE(state->data);
751	SAFE_FREE(state->param);
752	TALLOC_FREE(state);
753	reply_nterror(req, NT_STATUS_NO_MEMORY);
754	END_PROFILE(SMBtrans);
755	return;
756	}
757
758	for (i=0;i<state->setup_count;i++) {
759	state->setup[i] = SVAL(req->vwv + 14 + i, 0);
760	}
761	}
762
763	state->received_param = pscnt;
764
765	if ((state->received_param != state->total_param) \|\|
766	(state->received_data != state->total_data)) {
767	DLIST_ADD(conn->pending_trans, state);
768
769	/* We need to send an interim response then receive the rest
770	of the parameter/data bytes */
771	reply_outbuf(req, 0, 0);
772	show_msg((char *)req->outbuf);
773	END_PROFILE(SMBtrans);
774	return;
775	}
776
777	talloc_steal(talloc_tos(), state);
778
779	handle_trans(conn, req, state);
780
781	SAFE_FREE(state->data);
782	SAFE_FREE(state->param);
783	TALLOC_FREE(state);
784
785	END_PROFILE(SMBtrans);
786	return;
787
788	bad_param:
789
790	DEBUG(0,("reply_trans: invalid trans parameters\n"));
791	SAFE_FREE(state->data);
792	SAFE_FREE(state->param);
793	TALLOC_FREE(state);
794	END_PROFILE(SMBtrans);
795	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
796	return;
797	}
798
799	/****************************************************************************
800	Reply to a secondary SMBtrans.
801	****************************************************************************/
802
803	void reply_transs(struct smb_request *req)
804	{
805	connection_struct *conn = req->conn;
806	unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
807	struct trans_state *state;
808
809	START_PROFILE(SMBtranss);
810
811	show_msg((char *)req->inbuf);
812
813	if (req->wct < 8) {
814	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
815	END_PROFILE(SMBtranss);
816	return;
817	}
818
819	for (state = conn->pending_trans; state != NULL;
820	state = state->next) {
821	if (state->mid == req->mid) {
822	break;
823	}
824	}
825
826	if ((state == NULL) \|\| (state->cmd != SMBtrans)) {
827	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
828	END_PROFILE(SMBtranss);
829	return;
830	}
831
832	/* Revise total_params and total_data in case they have changed
833	* downwards */
834
835	if (SVAL(req->vwv+0, 0) < state->total_param)
836	state->total_param = SVAL(req->vwv+0, 0);
837	if (SVAL(req->vwv+1, 0) < state->total_data)
838	state->total_data = SVAL(req->vwv+1, 0);
839
840	pcnt = SVAL(req->vwv+2, 0);
841	poff = SVAL(req->vwv+3, 0);
842	pdisp = SVAL(req->vwv+4, 0);
843
844	dcnt = SVAL(req->vwv+5, 0);
845	doff = SVAL(req->vwv+6, 0);
846	ddisp = SVAL(req->vwv+7, 0);
847
848	state->received_param += pcnt;
849	state->received_data += dcnt;
850
851	if ((state->received_data > state->total_data) \|\|
852	(state->received_param > state->total_param))
853	goto bad_param;
854
855	if (pcnt) {
856	if (trans_oob(state->total_param, pdisp, pcnt)
857	\|\| trans_oob(smb_len(req->inbuf), poff, pcnt)) {
858	goto bad_param;
859	}
860	memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
861	}
862
863	if (dcnt) {
864	if (trans_oob(state->total_data, ddisp, dcnt)
865	\|\| trans_oob(smb_len(req->inbuf), doff, dcnt)) {
866	goto bad_param;
867	}
868	memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
869	}
870
871	if ((state->received_param < state->total_param) \|\|
872	(state->received_data < state->total_data)) {
873	END_PROFILE(SMBtranss);
874	return;
875	}
876
877	talloc_steal(talloc_tos(), state);
878
879	handle_trans(conn, req, state);
880
881	DLIST_REMOVE(conn->pending_trans, state);
882	SAFE_FREE(state->data);
883	SAFE_FREE(state->param);
884	TALLOC_FREE(state);
885
886	END_PROFILE(SMBtranss);
887	return;
888
889	bad_param:
890
891	DEBUG(0,("reply_transs: invalid trans parameters\n"));
892	DLIST_REMOVE(conn->pending_trans, state);
893	SAFE_FREE(state->data);
894	SAFE_FREE(state->param);
895	TALLOC_FREE(state);
896	reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
897	END_PROFILE(SMBtranss);
898	return;
899	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: