1 | /*
|
---|
2 | Unix SMB/CIFS implementation.
|
---|
3 | client transaction calls
|
---|
4 | Copyright (C) Andrew Tridgell 1994-1998
|
---|
5 |
|
---|
6 | This program is free software; you can redistribute it and/or modify
|
---|
7 | it under the terms of the GNU General Public License as published by
|
---|
8 | the Free Software Foundation; either version 3 of the License, or
|
---|
9 | (at your option) any later version.
|
---|
10 |
|
---|
11 | This program is distributed in the hope that it will be useful,
|
---|
12 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
13 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
14 | GNU General Public License for more details.
|
---|
15 |
|
---|
16 | You should have received a copy of the GNU General Public License
|
---|
17 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
18 | */
|
---|
19 |
|
---|
20 | #include "includes.h"
|
---|
21 | #include "libsmb/libsmb.h"
|
---|
22 | #include "../lib/util/tevent_ntstatus.h"
|
---|
23 | #include "async_smb.h"
|
---|
24 |
|
---|
25 | struct trans_recvblob {
|
---|
26 | uint8_t *data;
|
---|
27 | uint32_t max, total, received;
|
---|
28 | };
|
---|
29 |
|
---|
30 | struct cli_trans_state {
|
---|
31 | struct cli_state *cli;
|
---|
32 | struct event_context *ev;
|
---|
33 | uint8_t cmd;
|
---|
34 | uint16_t mid;
|
---|
35 | const char *pipe_name;
|
---|
36 | uint8_t *pipe_name_conv;
|
---|
37 | size_t pipe_name_conv_len;
|
---|
38 | uint16_t fid;
|
---|
39 | uint16_t function;
|
---|
40 | int flags;
|
---|
41 | uint16_t *setup;
|
---|
42 | uint8_t num_setup, max_setup;
|
---|
43 | uint8_t *param;
|
---|
44 | uint32_t num_param, param_sent;
|
---|
45 | uint8_t *data;
|
---|
46 | uint32_t num_data, data_sent;
|
---|
47 |
|
---|
48 | uint8_t num_rsetup;
|
---|
49 | uint16_t *rsetup;
|
---|
50 | struct trans_recvblob rparam;
|
---|
51 | struct trans_recvblob rdata;
|
---|
52 | uint16_t recv_flags2;
|
---|
53 |
|
---|
54 | struct iovec iov[6];
|
---|
55 | uint8_t pad[4];
|
---|
56 | uint8_t zero_pad[4];
|
---|
57 | uint16_t vwv[32];
|
---|
58 |
|
---|
59 | struct tevent_req *primary_subreq;
|
---|
60 | };
|
---|
61 |
|
---|
62 | static void cli_trans_cleanup_primary(struct cli_trans_state *state)
|
---|
63 | {
|
---|
64 | if (state->primary_subreq) {
|
---|
65 | cli_smb_req_set_mid(state->primary_subreq, 0);
|
---|
66 | cli_smb_req_unset_pending(state->primary_subreq);
|
---|
67 | TALLOC_FREE(state->primary_subreq);
|
---|
68 | }
|
---|
69 | }
|
---|
70 |
|
---|
71 | static int cli_trans_state_destructor(struct cli_trans_state *state)
|
---|
72 | {
|
---|
73 | cli_trans_cleanup_primary(state);
|
---|
74 | return 0;
|
---|
75 | }
|
---|
76 |
|
---|
77 | static NTSTATUS cli_pull_trans(uint8_t *inbuf,
|
---|
78 | uint8_t wct, uint16_t *vwv,
|
---|
79 | uint16_t num_bytes, uint8_t *bytes,
|
---|
80 | uint8_t smb_cmd, bool expect_first_reply,
|
---|
81 | uint8_t *pnum_setup, uint16_t **psetup,
|
---|
82 | uint32_t *ptotal_param, uint32_t *pnum_param,
|
---|
83 | uint32_t *pparam_disp, uint8_t **pparam,
|
---|
84 | uint32_t *ptotal_data, uint32_t *pnum_data,
|
---|
85 | uint32_t *pdata_disp, uint8_t **pdata)
|
---|
86 | {
|
---|
87 | uint32_t param_ofs, data_ofs;
|
---|
88 |
|
---|
89 | if (expect_first_reply) {
|
---|
90 | if ((wct != 0) || (num_bytes != 0)) {
|
---|
91 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
92 | }
|
---|
93 | return NT_STATUS_OK;
|
---|
94 | }
|
---|
95 |
|
---|
96 | switch (smb_cmd) {
|
---|
97 | case SMBtrans:
|
---|
98 | case SMBtrans2:
|
---|
99 | if (wct < 10) {
|
---|
100 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
101 | }
|
---|
102 | *ptotal_param = SVAL(vwv + 0, 0);
|
---|
103 | *ptotal_data = SVAL(vwv + 1, 0);
|
---|
104 | *pnum_param = SVAL(vwv + 3, 0);
|
---|
105 | param_ofs = SVAL(vwv + 4, 0);
|
---|
106 | *pparam_disp = SVAL(vwv + 5, 0);
|
---|
107 | *pnum_data = SVAL(vwv + 6, 0);
|
---|
108 | data_ofs = SVAL(vwv + 7, 0);
|
---|
109 | *pdata_disp = SVAL(vwv + 8, 0);
|
---|
110 | *pnum_setup = CVAL(vwv + 9, 0);
|
---|
111 | if (wct < 10 + (*pnum_setup)) {
|
---|
112 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
113 | }
|
---|
114 | *psetup = vwv + 10;
|
---|
115 |
|
---|
116 | break;
|
---|
117 | case SMBnttrans:
|
---|
118 | if (wct < 18) {
|
---|
119 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
120 | }
|
---|
121 | *ptotal_param = IVAL(vwv, 3);
|
---|
122 | *ptotal_data = IVAL(vwv, 7);
|
---|
123 | *pnum_param = IVAL(vwv, 11);
|
---|
124 | param_ofs = IVAL(vwv, 15);
|
---|
125 | *pparam_disp = IVAL(vwv, 19);
|
---|
126 | *pnum_data = IVAL(vwv, 23);
|
---|
127 | data_ofs = IVAL(vwv, 27);
|
---|
128 | *pdata_disp = IVAL(vwv, 31);
|
---|
129 | *pnum_setup = CVAL(vwv, 35);
|
---|
130 | *psetup = vwv + 18;
|
---|
131 | break;
|
---|
132 |
|
---|
133 | default:
|
---|
134 | return NT_STATUS_INTERNAL_ERROR;
|
---|
135 | }
|
---|
136 |
|
---|
137 | /*
|
---|
138 | * Check for buffer overflows. data_ofs needs to be checked against
|
---|
139 | * the incoming buffer length, data_disp against the total
|
---|
140 | * length. Likewise for param_ofs/param_disp.
|
---|
141 | */
|
---|
142 |
|
---|
143 | if (trans_oob(smb_len(inbuf), param_ofs, *pnum_param)
|
---|
144 | || trans_oob(*ptotal_param, *pparam_disp, *pnum_param)
|
---|
145 | || trans_oob(smb_len(inbuf), data_ofs, *pnum_data)
|
---|
146 | || trans_oob(*ptotal_data, *pdata_disp, *pnum_data)) {
|
---|
147 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
148 | }
|
---|
149 |
|
---|
150 | *pparam = (uint8_t *)inbuf + 4 + param_ofs;
|
---|
151 | *pdata = (uint8_t *)inbuf + 4 + data_ofs;
|
---|
152 |
|
---|
153 | return NT_STATUS_OK;
|
---|
154 | }
|
---|
155 |
|
---|
156 | static NTSTATUS cli_trans_pull_blob(TALLOC_CTX *mem_ctx,
|
---|
157 | struct trans_recvblob *blob,
|
---|
158 | uint32_t total, uint32_t thistime,
|
---|
159 | uint8_t *buf, uint32_t displacement)
|
---|
160 | {
|
---|
161 | if (blob->data == NULL) {
|
---|
162 | if (total > blob->max) {
|
---|
163 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
164 | }
|
---|
165 | blob->total = total;
|
---|
166 | blob->data = TALLOC_ARRAY(mem_ctx, uint8_t, total);
|
---|
167 | if (blob->data == NULL) {
|
---|
168 | return NT_STATUS_NO_MEMORY;
|
---|
169 | }
|
---|
170 | }
|
---|
171 |
|
---|
172 | if (total > blob->total) {
|
---|
173 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
174 | }
|
---|
175 |
|
---|
176 | if (thistime) {
|
---|
177 | memcpy(blob->data + displacement, buf, thistime);
|
---|
178 | blob->received += thistime;
|
---|
179 | }
|
---|
180 |
|
---|
181 | return NT_STATUS_OK;
|
---|
182 | }
|
---|
183 |
|
---|
184 | static void cli_trans_format(struct cli_trans_state *state, uint8_t *pwct,
|
---|
185 | int *piov_count)
|
---|
186 | {
|
---|
187 | uint8_t wct = 0;
|
---|
188 | struct iovec *iov = state->iov;
|
---|
189 | uint8_t *pad = state->pad;
|
---|
190 | uint16_t *vwv = state->vwv;
|
---|
191 | uint32_t param_offset;
|
---|
192 | uint32_t this_param = 0;
|
---|
193 | uint32_t param_pad;
|
---|
194 | uint32_t data_offset;
|
---|
195 | uint32_t this_data = 0;
|
---|
196 | uint32_t data_pad;
|
---|
197 | uint32_t useable_space;
|
---|
198 | uint8_t cmd;
|
---|
199 |
|
---|
200 | cmd = state->cmd;
|
---|
201 |
|
---|
202 | if ((state->param_sent != 0) || (state->data_sent != 0)) {
|
---|
203 | /* The secondary commands are one after the primary ones */
|
---|
204 | cmd += 1;
|
---|
205 | }
|
---|
206 |
|
---|
207 | param_offset = smb_size - 4;
|
---|
208 |
|
---|
209 | switch (cmd) {
|
---|
210 | case SMBtrans:
|
---|
211 | if (cli_ucs2(state->cli)) {
|
---|
212 | pad[0] = 0;
|
---|
213 | iov[0].iov_base = (void *)pad;
|
---|
214 | iov[0].iov_len = 1;
|
---|
215 | param_offset += 1;
|
---|
216 | iov += 1;
|
---|
217 | }
|
---|
218 | iov[0].iov_base = (void *)state->pipe_name_conv;
|
---|
219 | iov[0].iov_len = state->pipe_name_conv_len;
|
---|
220 | wct = 14 + state->num_setup;
|
---|
221 | param_offset += iov[0].iov_len;
|
---|
222 | iov += 1;
|
---|
223 | break;
|
---|
224 | case SMBtrans2:
|
---|
225 | pad[0] = 0;
|
---|
226 | pad[1] = 'D'; /* Copy this from "old" 3.0 behaviour */
|
---|
227 | pad[2] = ' ';
|
---|
228 | iov[0].iov_base = (void *)pad;
|
---|
229 | iov[0].iov_len = 3;
|
---|
230 | wct = 14 + state->num_setup;
|
---|
231 | param_offset += 3;
|
---|
232 | iov += 1;
|
---|
233 | break;
|
---|
234 | case SMBtranss:
|
---|
235 | wct = 8;
|
---|
236 | break;
|
---|
237 | case SMBtranss2:
|
---|
238 | wct = 9;
|
---|
239 | break;
|
---|
240 | case SMBnttrans:
|
---|
241 | wct = 19 + state->num_setup;
|
---|
242 | break;
|
---|
243 | case SMBnttranss:
|
---|
244 | wct = 18;
|
---|
245 | break;
|
---|
246 | }
|
---|
247 |
|
---|
248 | param_offset += wct * sizeof(uint16_t);
|
---|
249 | useable_space = state->cli->max_xmit - param_offset;
|
---|
250 |
|
---|
251 | param_pad = param_offset % 4;
|
---|
252 | if (param_pad > 0) {
|
---|
253 | param_pad = MIN(param_pad, useable_space);
|
---|
254 | iov[0].iov_base = (void *)state->zero_pad;
|
---|
255 | iov[0].iov_len = param_pad;
|
---|
256 | iov += 1;
|
---|
257 | param_offset += param_pad;
|
---|
258 | }
|
---|
259 | useable_space = state->cli->max_xmit - param_offset;
|
---|
260 |
|
---|
261 | if (state->param_sent < state->num_param) {
|
---|
262 | this_param = MIN(state->num_param - state->param_sent,
|
---|
263 | useable_space);
|
---|
264 | iov[0].iov_base = (void *)(state->param + state->param_sent);
|
---|
265 | iov[0].iov_len = this_param;
|
---|
266 | iov += 1;
|
---|
267 | }
|
---|
268 |
|
---|
269 | data_offset = param_offset + this_param;
|
---|
270 | useable_space = state->cli->max_xmit - data_offset;
|
---|
271 |
|
---|
272 | data_pad = data_offset % 4;
|
---|
273 | if (data_pad > 0) {
|
---|
274 | data_pad = MIN(data_pad, useable_space);
|
---|
275 | iov[0].iov_base = (void *)state->zero_pad;
|
---|
276 | iov[0].iov_len = data_pad;
|
---|
277 | iov += 1;
|
---|
278 | data_offset += data_pad;
|
---|
279 | }
|
---|
280 | useable_space = state->cli->max_xmit - data_offset;
|
---|
281 |
|
---|
282 | if (state->data_sent < state->num_data) {
|
---|
283 | this_data = MIN(state->num_data - state->data_sent,
|
---|
284 | useable_space);
|
---|
285 | iov[0].iov_base = (void *)(state->data + state->data_sent);
|
---|
286 | iov[0].iov_len = this_data;
|
---|
287 | iov += 1;
|
---|
288 | }
|
---|
289 |
|
---|
290 | DEBUG(10, ("num_setup=%u, max_setup=%u, "
|
---|
291 | "param_total=%u, this_param=%u, max_param=%u, "
|
---|
292 | "data_total=%u, this_data=%u, max_data=%u, "
|
---|
293 | "param_offset=%u, param_pad=%u, param_disp=%u, "
|
---|
294 | "data_offset=%u, data_pad=%u, data_disp=%u\n",
|
---|
295 | (unsigned)state->num_setup, (unsigned)state->max_setup,
|
---|
296 | (unsigned)state->num_param, (unsigned)this_param,
|
---|
297 | (unsigned)state->rparam.max,
|
---|
298 | (unsigned)state->num_data, (unsigned)this_data,
|
---|
299 | (unsigned)state->rdata.max,
|
---|
300 | (unsigned)param_offset, (unsigned)param_pad,
|
---|
301 | (unsigned)state->param_sent,
|
---|
302 | (unsigned)data_offset, (unsigned)data_pad,
|
---|
303 | (unsigned)state->data_sent));
|
---|
304 |
|
---|
305 | switch (cmd) {
|
---|
306 | case SMBtrans:
|
---|
307 | case SMBtrans2:
|
---|
308 | SSVAL(vwv + 0, 0, state->num_param);
|
---|
309 | SSVAL(vwv + 1, 0, state->num_data);
|
---|
310 | SSVAL(vwv + 2, 0, state->rparam.max);
|
---|
311 | SSVAL(vwv + 3, 0, state->rdata.max);
|
---|
312 | SCVAL(vwv + 4, 0, state->max_setup);
|
---|
313 | SCVAL(vwv + 4, 1, 0); /* reserved */
|
---|
314 | SSVAL(vwv + 5, 0, state->flags);
|
---|
315 | SIVAL(vwv + 6, 0, 0); /* timeout */
|
---|
316 | SSVAL(vwv + 8, 0, 0); /* reserved */
|
---|
317 | SSVAL(vwv + 9, 0, this_param);
|
---|
318 | SSVAL(vwv +10, 0, param_offset);
|
---|
319 | SSVAL(vwv +11, 0, this_data);
|
---|
320 | SSVAL(vwv +12, 0, data_offset);
|
---|
321 | SCVAL(vwv +13, 0, state->num_setup);
|
---|
322 | SCVAL(vwv +13, 1, 0); /* reserved */
|
---|
323 | memcpy(vwv + 14, state->setup,
|
---|
324 | sizeof(uint16_t) * state->num_setup);
|
---|
325 | break;
|
---|
326 | case SMBtranss:
|
---|
327 | case SMBtranss2:
|
---|
328 | SSVAL(vwv + 0, 0, state->num_param);
|
---|
329 | SSVAL(vwv + 1, 0, state->num_data);
|
---|
330 | SSVAL(vwv + 2, 0, this_param);
|
---|
331 | SSVAL(vwv + 3, 0, param_offset);
|
---|
332 | SSVAL(vwv + 4, 0, state->param_sent);
|
---|
333 | SSVAL(vwv + 5, 0, this_data);
|
---|
334 | SSVAL(vwv + 6, 0, data_offset);
|
---|
335 | SSVAL(vwv + 7, 0, state->data_sent);
|
---|
336 | if (cmd == SMBtranss2) {
|
---|
337 | SSVAL(vwv + 8, 0, state->fid);
|
---|
338 | }
|
---|
339 | break;
|
---|
340 | case SMBnttrans:
|
---|
341 | SCVAL(vwv + 0, 0, state->max_setup);
|
---|
342 | SSVAL(vwv + 0, 1, 0); /* reserved */
|
---|
343 | SIVAL(vwv + 1, 1, state->num_param);
|
---|
344 | SIVAL(vwv + 3, 1, state->num_data);
|
---|
345 | SIVAL(vwv + 5, 1, state->rparam.max);
|
---|
346 | SIVAL(vwv + 7, 1, state->rdata.max);
|
---|
347 | SIVAL(vwv + 9, 1, this_param);
|
---|
348 | SIVAL(vwv +11, 1, param_offset);
|
---|
349 | SIVAL(vwv +13, 1, this_data);
|
---|
350 | SIVAL(vwv +15, 1, data_offset);
|
---|
351 | SCVAL(vwv +17, 1, state->num_setup);
|
---|
352 | SSVAL(vwv +18, 0, state->function);
|
---|
353 | memcpy(vwv + 19, state->setup,
|
---|
354 | sizeof(uint16_t) * state->num_setup);
|
---|
355 | break;
|
---|
356 | case SMBnttranss:
|
---|
357 | SSVAL(vwv + 0, 0, 0); /* reserved */
|
---|
358 | SCVAL(vwv + 1, 0, 0); /* reserved */
|
---|
359 | SIVAL(vwv + 1, 1, state->num_param);
|
---|
360 | SIVAL(vwv + 3, 1, state->num_data);
|
---|
361 | SIVAL(vwv + 5, 1, this_param);
|
---|
362 | SIVAL(vwv + 7, 1, param_offset);
|
---|
363 | SIVAL(vwv + 9, 1, state->param_sent);
|
---|
364 | SIVAL(vwv +11, 1, this_data);
|
---|
365 | SIVAL(vwv +13, 1, data_offset);
|
---|
366 | SIVAL(vwv +15, 1, state->data_sent);
|
---|
367 | SCVAL(vwv +17, 1, 0); /* reserved */
|
---|
368 | break;
|
---|
369 | }
|
---|
370 |
|
---|
371 | state->param_sent += this_param;
|
---|
372 | state->data_sent += this_data;
|
---|
373 |
|
---|
374 | *pwct = wct;
|
---|
375 | *piov_count = iov - state->iov;
|
---|
376 | }
|
---|
377 |
|
---|
378 | static void cli_trans_done(struct tevent_req *subreq);
|
---|
379 |
|
---|
380 | struct tevent_req *cli_trans_send(
|
---|
381 | TALLOC_CTX *mem_ctx, struct event_context *ev,
|
---|
382 | struct cli_state *cli, uint8_t cmd,
|
---|
383 | const char *pipe_name, uint16_t fid, uint16_t function, int flags,
|
---|
384 | uint16_t *setup, uint8_t num_setup, uint8_t max_setup,
|
---|
385 | uint8_t *param, uint32_t num_param, uint32_t max_param,
|
---|
386 | uint8_t *data, uint32_t num_data, uint32_t max_data)
|
---|
387 | {
|
---|
388 | struct tevent_req *req, *subreq;
|
---|
389 | struct cli_trans_state *state;
|
---|
390 | int iov_count;
|
---|
391 | uint8_t wct;
|
---|
392 | NTSTATUS status;
|
---|
393 |
|
---|
394 | req = tevent_req_create(mem_ctx, &state, struct cli_trans_state);
|
---|
395 | if (req == NULL) {
|
---|
396 | return NULL;
|
---|
397 | }
|
---|
398 |
|
---|
399 | if ((cmd == SMBtrans) || (cmd == SMBtrans2)) {
|
---|
400 | if ((num_param > 0xffff) || (max_param > 0xffff)
|
---|
401 | || (num_data > 0xffff) || (max_data > 0xffff)) {
|
---|
402 | DEBUG(3, ("Attempt to send invalid trans2 request "
|
---|
403 | "(setup %u, params %u/%u, data %u/%u)\n",
|
---|
404 | (unsigned)num_setup,
|
---|
405 | (unsigned)num_param, (unsigned)max_param,
|
---|
406 | (unsigned)num_data, (unsigned)max_data));
|
---|
407 | tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
---|
408 | return tevent_req_post(req, ev);
|
---|
409 | }
|
---|
410 | }
|
---|
411 |
|
---|
412 | /*
|
---|
413 | * The largest wct will be for nttrans (19+num_setup). Make sure we
|
---|
414 | * don't overflow state->vwv in cli_trans_format.
|
---|
415 | */
|
---|
416 |
|
---|
417 | if ((num_setup + 19) > ARRAY_SIZE(state->vwv)) {
|
---|
418 | tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
|
---|
419 | return tevent_req_post(req, ev);
|
---|
420 | }
|
---|
421 |
|
---|
422 | state->cli = cli;
|
---|
423 | state->ev = ev;
|
---|
424 | state->cmd = cmd;
|
---|
425 | state->flags = flags;
|
---|
426 | state->num_rsetup = 0;
|
---|
427 | state->rsetup = NULL;
|
---|
428 | ZERO_STRUCT(state->rparam);
|
---|
429 | ZERO_STRUCT(state->rdata);
|
---|
430 |
|
---|
431 | if ((pipe_name != NULL)
|
---|
432 | && (!convert_string_talloc(state, CH_UNIX,
|
---|
433 | cli_ucs2(cli) ? CH_UTF16LE : CH_DOS,
|
---|
434 | pipe_name, strlen(pipe_name) + 1,
|
---|
435 | &state->pipe_name_conv,
|
---|
436 | &state->pipe_name_conv_len, true))) {
|
---|
437 | tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
|
---|
438 | return tevent_req_post(req, ev);
|
---|
439 | }
|
---|
440 | state->fid = fid; /* trans2 */
|
---|
441 | state->function = function; /* nttrans */
|
---|
442 |
|
---|
443 | state->setup = setup;
|
---|
444 | state->num_setup = num_setup;
|
---|
445 | state->max_setup = max_setup;
|
---|
446 |
|
---|
447 | state->param = param;
|
---|
448 | state->num_param = num_param;
|
---|
449 | state->param_sent = 0;
|
---|
450 | state->rparam.max = max_param;
|
---|
451 |
|
---|
452 | state->data = data;
|
---|
453 | state->num_data = num_data;
|
---|
454 | state->data_sent = 0;
|
---|
455 | state->rdata.max = max_data;
|
---|
456 |
|
---|
457 | cli_trans_format(state, &wct, &iov_count);
|
---|
458 |
|
---|
459 | subreq = cli_smb_req_create(state, ev, cli, cmd, 0, wct, state->vwv,
|
---|
460 | iov_count, state->iov);
|
---|
461 | if (tevent_req_nomem(subreq, req)) {
|
---|
462 | return tevent_req_post(req, ev);
|
---|
463 | }
|
---|
464 | status = cli_smb_req_send(subreq);
|
---|
465 | if (!NT_STATUS_IS_OK(status)) {
|
---|
466 | tevent_req_nterror(req, status);
|
---|
467 | return tevent_req_post(req, state->ev);
|
---|
468 | }
|
---|
469 | tevent_req_set_callback(subreq, cli_trans_done, req);
|
---|
470 |
|
---|
471 | /*
|
---|
472 | * Now get the MID of the primary request
|
---|
473 | * and mark it as persistent. This means
|
---|
474 | * we will able to send and receive multiple
|
---|
475 | * SMB pdus using this MID in both directions
|
---|
476 | * (including correct SMB signing).
|
---|
477 | */
|
---|
478 | state->mid = cli_smb_req_mid(subreq);
|
---|
479 | cli_smb_req_set_mid(subreq, state->mid);
|
---|
480 | state->primary_subreq = subreq;
|
---|
481 | talloc_set_destructor(state, cli_trans_state_destructor);
|
---|
482 |
|
---|
483 | return req;
|
---|
484 | }
|
---|
485 |
|
---|
486 | static void cli_trans_done2(struct tevent_req *subreq);
|
---|
487 |
|
---|
488 | static void cli_trans_done(struct tevent_req *subreq)
|
---|
489 | {
|
---|
490 | struct tevent_req *req = tevent_req_callback_data(
|
---|
491 | subreq, struct tevent_req);
|
---|
492 | struct cli_trans_state *state = tevent_req_data(
|
---|
493 | req, struct cli_trans_state);
|
---|
494 | NTSTATUS status;
|
---|
495 | bool sent_all;
|
---|
496 | uint8_t wct;
|
---|
497 | uint16_t *vwv;
|
---|
498 | uint32_t num_bytes;
|
---|
499 | uint8_t *bytes;
|
---|
500 | uint8_t *inbuf;
|
---|
501 | uint8_t num_setup = 0;
|
---|
502 | uint16_t *setup = NULL;
|
---|
503 | uint32_t total_param = 0;
|
---|
504 | uint32_t num_param = 0;
|
---|
505 | uint32_t param_disp = 0;
|
---|
506 | uint32_t total_data = 0;
|
---|
507 | uint32_t num_data = 0;
|
---|
508 | uint32_t data_disp = 0;
|
---|
509 | uint8_t *param = NULL;
|
---|
510 | uint8_t *data = NULL;
|
---|
511 |
|
---|
512 | status = cli_smb_recv(subreq, state, &inbuf, 0, &wct, &vwv,
|
---|
513 | &num_bytes, &bytes);
|
---|
514 | /*
|
---|
515 | * Do not TALLOC_FREE(subreq) here, we might receive more than
|
---|
516 | * one response for the same mid.
|
---|
517 | */
|
---|
518 |
|
---|
519 | /*
|
---|
520 | * We can receive something like STATUS_MORE_ENTRIES, so don't use
|
---|
521 | * !NT_STATUS_IS_OK(status) here.
|
---|
522 | */
|
---|
523 |
|
---|
524 | if (NT_STATUS_IS_ERR(status)) {
|
---|
525 | goto fail;
|
---|
526 | }
|
---|
527 |
|
---|
528 | sent_all = ((state->param_sent == state->num_param)
|
---|
529 | && (state->data_sent == state->num_data));
|
---|
530 |
|
---|
531 | status = cli_pull_trans(
|
---|
532 | inbuf, wct, vwv, num_bytes, bytes,
|
---|
533 | state->cmd, !sent_all, &num_setup, &setup,
|
---|
534 | &total_param, &num_param, ¶m_disp, ¶m,
|
---|
535 | &total_data, &num_data, &data_disp, &data);
|
---|
536 |
|
---|
537 | if (!NT_STATUS_IS_OK(status)) {
|
---|
538 | goto fail;
|
---|
539 | }
|
---|
540 |
|
---|
541 | if (!sent_all) {
|
---|
542 | int iov_count;
|
---|
543 | struct tevent_req *subreq2;
|
---|
544 |
|
---|
545 | cli_trans_format(state, &wct, &iov_count);
|
---|
546 |
|
---|
547 | subreq2 = cli_smb_req_create(state, state->ev, state->cli,
|
---|
548 | state->cmd + 1, 0, wct, state->vwv,
|
---|
549 | iov_count, state->iov);
|
---|
550 | if (tevent_req_nomem(subreq2, req)) {
|
---|
551 | return;
|
---|
552 | }
|
---|
553 | cli_smb_req_set_mid(subreq2, state->mid);
|
---|
554 |
|
---|
555 | status = cli_smb_req_send(subreq2);
|
---|
556 |
|
---|
557 | if (!NT_STATUS_IS_OK(status)) {
|
---|
558 | goto fail;
|
---|
559 | }
|
---|
560 | tevent_req_set_callback(subreq2, cli_trans_done2, req);
|
---|
561 |
|
---|
562 | return;
|
---|
563 | }
|
---|
564 |
|
---|
565 | status = cli_trans_pull_blob(
|
---|
566 | state, &state->rparam, total_param, num_param, param,
|
---|
567 | param_disp);
|
---|
568 |
|
---|
569 | if (!NT_STATUS_IS_OK(status)) {
|
---|
570 | DEBUG(10, ("Pulling params failed: %s\n", nt_errstr(status)));
|
---|
571 | goto fail;
|
---|
572 | }
|
---|
573 |
|
---|
574 | status = cli_trans_pull_blob(
|
---|
575 | state, &state->rdata, total_data, num_data, data,
|
---|
576 | data_disp);
|
---|
577 |
|
---|
578 | if (!NT_STATUS_IS_OK(status)) {
|
---|
579 | DEBUG(10, ("Pulling data failed: %s\n", nt_errstr(status)));
|
---|
580 | goto fail;
|
---|
581 | }
|
---|
582 |
|
---|
583 | if ((state->rparam.total == state->rparam.received)
|
---|
584 | && (state->rdata.total == state->rdata.received)) {
|
---|
585 | state->recv_flags2 = SVAL(inbuf, smb_flg2);
|
---|
586 | cli_trans_cleanup_primary(state);
|
---|
587 | tevent_req_done(req);
|
---|
588 | return;
|
---|
589 | }
|
---|
590 |
|
---|
591 | TALLOC_FREE(inbuf);
|
---|
592 |
|
---|
593 | return;
|
---|
594 |
|
---|
595 | fail:
|
---|
596 | cli_trans_cleanup_primary(state);
|
---|
597 | tevent_req_nterror(req, status);
|
---|
598 | }
|
---|
599 |
|
---|
600 | static void cli_trans_done2(struct tevent_req *subreq2)
|
---|
601 | {
|
---|
602 | struct tevent_req *req = tevent_req_callback_data(
|
---|
603 | subreq2, struct tevent_req);
|
---|
604 | struct cli_trans_state *state = tevent_req_data(
|
---|
605 | req, struct cli_trans_state);
|
---|
606 | NTSTATUS status;
|
---|
607 | bool sent_all;
|
---|
608 | uint8_t wct;
|
---|
609 | uint32_t seqnum;
|
---|
610 |
|
---|
611 | /*
|
---|
612 | * First backup the seqnum of the secondary request
|
---|
613 | * and attach it to the primary request.
|
---|
614 | */
|
---|
615 | seqnum = cli_smb_req_seqnum(subreq2);
|
---|
616 | cli_smb_req_set_seqnum(state->primary_subreq, seqnum);
|
---|
617 |
|
---|
618 | status = cli_smb_recv(subreq2, state, NULL, 0, &wct, NULL,
|
---|
619 | NULL, NULL);
|
---|
620 | TALLOC_FREE(subreq2);
|
---|
621 |
|
---|
622 | if (!NT_STATUS_IS_OK(status)) {
|
---|
623 | goto fail;
|
---|
624 | }
|
---|
625 |
|
---|
626 | if (wct != 0) {
|
---|
627 | status = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
628 | goto fail;
|
---|
629 | }
|
---|
630 |
|
---|
631 | sent_all = ((state->param_sent == state->num_param)
|
---|
632 | && (state->data_sent == state->num_data));
|
---|
633 |
|
---|
634 | if (!sent_all) {
|
---|
635 | int iov_count;
|
---|
636 |
|
---|
637 | cli_trans_format(state, &wct, &iov_count);
|
---|
638 |
|
---|
639 | subreq2 = cli_smb_req_create(state, state->ev, state->cli,
|
---|
640 | state->cmd + 1, 0, wct, state->vwv,
|
---|
641 | iov_count, state->iov);
|
---|
642 | if (tevent_req_nomem(subreq2, req)) {
|
---|
643 | return;
|
---|
644 | }
|
---|
645 | cli_smb_req_set_mid(subreq2, state->mid);
|
---|
646 |
|
---|
647 | status = cli_smb_req_send(subreq2);
|
---|
648 |
|
---|
649 | if (!NT_STATUS_IS_OK(status)) {
|
---|
650 | goto fail;
|
---|
651 | }
|
---|
652 | tevent_req_set_callback(subreq2, cli_trans_done2, req);
|
---|
653 | return;
|
---|
654 | }
|
---|
655 |
|
---|
656 | return;
|
---|
657 |
|
---|
658 | fail:
|
---|
659 | cli_trans_cleanup_primary(state);
|
---|
660 | tevent_req_nterror(req, status);
|
---|
661 | }
|
---|
662 |
|
---|
663 | NTSTATUS cli_trans_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
|
---|
664 | uint16_t *recv_flags2,
|
---|
665 | uint16_t **setup, uint8_t min_setup,
|
---|
666 | uint8_t *num_setup,
|
---|
667 | uint8_t **param, uint32_t min_param,
|
---|
668 | uint32_t *num_param,
|
---|
669 | uint8_t **data, uint32_t min_data,
|
---|
670 | uint32_t *num_data)
|
---|
671 | {
|
---|
672 | struct cli_trans_state *state = tevent_req_data(
|
---|
673 | req, struct cli_trans_state);
|
---|
674 | NTSTATUS status;
|
---|
675 |
|
---|
676 | cli_trans_cleanup_primary(state);
|
---|
677 |
|
---|
678 | if (tevent_req_is_nterror(req, &status)) {
|
---|
679 | return status;
|
---|
680 | }
|
---|
681 |
|
---|
682 | if ((state->num_rsetup < min_setup)
|
---|
683 | || (state->rparam.total < min_param)
|
---|
684 | || (state->rdata.total < min_data)) {
|
---|
685 | return NT_STATUS_INVALID_NETWORK_RESPONSE;
|
---|
686 | }
|
---|
687 |
|
---|
688 | if (recv_flags2 != NULL) {
|
---|
689 | *recv_flags2 = state->recv_flags2;
|
---|
690 | }
|
---|
691 |
|
---|
692 | if (setup != NULL) {
|
---|
693 | *setup = talloc_move(mem_ctx, &state->rsetup);
|
---|
694 | *num_setup = state->num_rsetup;
|
---|
695 | } else {
|
---|
696 | TALLOC_FREE(state->rsetup);
|
---|
697 | }
|
---|
698 |
|
---|
699 | if (param != NULL) {
|
---|
700 | *param = talloc_move(mem_ctx, &state->rparam.data);
|
---|
701 | *num_param = state->rparam.total;
|
---|
702 | } else {
|
---|
703 | TALLOC_FREE(state->rparam.data);
|
---|
704 | }
|
---|
705 |
|
---|
706 | if (data != NULL) {
|
---|
707 | *data = talloc_move(mem_ctx, &state->rdata.data);
|
---|
708 | *num_data = state->rdata.total;
|
---|
709 | } else {
|
---|
710 | TALLOC_FREE(state->rdata.data);
|
---|
711 | }
|
---|
712 |
|
---|
713 | return NT_STATUS_OK;
|
---|
714 | }
|
---|
715 |
|
---|
716 | NTSTATUS cli_trans(TALLOC_CTX *mem_ctx, struct cli_state *cli,
|
---|
717 | uint8_t trans_cmd,
|
---|
718 | const char *pipe_name, uint16_t fid, uint16_t function,
|
---|
719 | int flags,
|
---|
720 | uint16_t *setup, uint8_t num_setup, uint8_t max_setup,
|
---|
721 | uint8_t *param, uint32_t num_param, uint32_t max_param,
|
---|
722 | uint8_t *data, uint32_t num_data, uint32_t max_data,
|
---|
723 | uint16_t *recv_flags2,
|
---|
724 | uint16_t **rsetup, uint8_t min_rsetup, uint8_t *num_rsetup,
|
---|
725 | uint8_t **rparam, uint32_t min_rparam, uint32_t *num_rparam,
|
---|
726 | uint8_t **rdata, uint32_t min_rdata, uint32_t *num_rdata)
|
---|
727 | {
|
---|
728 | TALLOC_CTX *frame = talloc_stackframe();
|
---|
729 | struct event_context *ev;
|
---|
730 | struct tevent_req *req;
|
---|
731 | NTSTATUS status = NT_STATUS_OK;
|
---|
732 |
|
---|
733 | if (cli_has_async_calls(cli)) {
|
---|
734 | /*
|
---|
735 | * Can't use sync call while an async call is in flight
|
---|
736 | */
|
---|
737 | status = NT_STATUS_INVALID_PARAMETER;
|
---|
738 | goto fail;
|
---|
739 | }
|
---|
740 |
|
---|
741 | ev = event_context_init(frame);
|
---|
742 | if (ev == NULL) {
|
---|
743 | status = NT_STATUS_NO_MEMORY;
|
---|
744 | goto fail;
|
---|
745 | }
|
---|
746 |
|
---|
747 | req = cli_trans_send(frame, ev, cli, trans_cmd,
|
---|
748 | pipe_name, fid, function, flags,
|
---|
749 | setup, num_setup, max_setup,
|
---|
750 | param, num_param, max_param,
|
---|
751 | data, num_data, max_data);
|
---|
752 | if (req == NULL) {
|
---|
753 | status = NT_STATUS_NO_MEMORY;
|
---|
754 | goto fail;
|
---|
755 | }
|
---|
756 |
|
---|
757 | if (!tevent_req_poll(req, ev)) {
|
---|
758 | status = map_nt_error_from_unix(errno);
|
---|
759 | goto fail;
|
---|
760 | }
|
---|
761 |
|
---|
762 | status = cli_trans_recv(req, mem_ctx, recv_flags2,
|
---|
763 | rsetup, min_rsetup, num_rsetup,
|
---|
764 | rparam, min_rparam, num_rparam,
|
---|
765 | rdata, min_rdata, num_rdata);
|
---|
766 | fail:
|
---|
767 | TALLOC_FREE(frame);
|
---|
768 | return status;
|
---|
769 | }
|
---|