2 Unix SMB/CIFS implementation.
3 client transaction calls
4 Copyright (C) Andrew Tridgell 1994-1998
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "libsmb/libsmb.h"
22 #include "../lib/util/tevent_ntstatus.h"
23 #include "async_smb.h"
25 struct trans_recvblob
{
27 uint32_t max
, total
, received
;
30 struct cli_trans_state
{
31 struct cli_state
*cli
;
32 struct event_context
*ev
;
36 const char *pipe_name
;
37 uint8_t *pipe_name_conv
;
38 size_t pipe_name_conv_len
;
43 uint8_t num_setup
, max_setup
;
45 uint32_t num_param
, param_sent
;
47 uint32_t num_data
, data_sent
;
51 struct trans_recvblob rparam
;
52 struct trans_recvblob rdata
;
61 static NTSTATUS
cli_pull_trans(uint8_t *inbuf
,
62 uint8_t wct
, uint16_t *vwv
,
63 uint16_t num_bytes
, uint8_t *bytes
,
64 uint8_t smb_cmd
, bool expect_first_reply
,
65 uint8_t *pnum_setup
, uint16_t **psetup
,
66 uint32_t *ptotal_param
, uint32_t *pnum_param
,
67 uint32_t *pparam_disp
, uint8_t **pparam
,
68 uint32_t *ptotal_data
, uint32_t *pnum_data
,
69 uint32_t *pdata_disp
, uint8_t **pdata
)
71 uint32_t param_ofs
, data_ofs
;
73 if (expect_first_reply
) {
74 if ((wct
!= 0) || (num_bytes
!= 0)) {
75 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
84 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
86 *ptotal_param
= SVAL(vwv
+ 0, 0);
87 *ptotal_data
= SVAL(vwv
+ 1, 0);
88 *pnum_param
= SVAL(vwv
+ 3, 0);
89 param_ofs
= SVAL(vwv
+ 4, 0);
90 *pparam_disp
= SVAL(vwv
+ 5, 0);
91 *pnum_data
= SVAL(vwv
+ 6, 0);
92 data_ofs
= SVAL(vwv
+ 7, 0);
93 *pdata_disp
= SVAL(vwv
+ 8, 0);
94 *pnum_setup
= CVAL(vwv
+ 9, 0);
95 if (wct
< 10 + (*pnum_setup
)) {
96 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
103 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
105 *ptotal_param
= IVAL(vwv
, 3);
106 *ptotal_data
= IVAL(vwv
, 7);
107 *pnum_param
= IVAL(vwv
, 11);
108 param_ofs
= IVAL(vwv
, 15);
109 *pparam_disp
= IVAL(vwv
, 19);
110 *pnum_data
= IVAL(vwv
, 23);
111 data_ofs
= IVAL(vwv
, 27);
112 *pdata_disp
= IVAL(vwv
, 31);
113 *pnum_setup
= CVAL(vwv
, 35);
118 return NT_STATUS_INTERNAL_ERROR
;
122 * Check for buffer overflows. data_ofs needs to be checked against
123 * the incoming buffer length, data_disp against the total
124 * length. Likewise for param_ofs/param_disp.
127 if (trans_oob(smb_len(inbuf
), param_ofs
, *pnum_param
)
128 || trans_oob(*ptotal_param
, *pparam_disp
, *pnum_param
)
129 || trans_oob(smb_len(inbuf
), data_ofs
, *pnum_data
)
130 || trans_oob(*ptotal_data
, *pdata_disp
, *pnum_data
)) {
131 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
134 *pparam
= (uint8_t *)inbuf
+ 4 + param_ofs
;
135 *pdata
= (uint8_t *)inbuf
+ 4 + data_ofs
;
140 static NTSTATUS
cli_trans_pull_blob(TALLOC_CTX
*mem_ctx
,
141 struct trans_recvblob
*blob
,
142 uint32_t total
, uint32_t thistime
,
143 uint8_t *buf
, uint32_t displacement
)
145 if (blob
->data
== NULL
) {
146 if (total
> blob
->max
) {
147 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
150 blob
->data
= talloc_array(mem_ctx
, uint8_t, total
);
151 if (blob
->data
== NULL
) {
152 return NT_STATUS_NO_MEMORY
;
156 if (total
> blob
->total
) {
157 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
161 memcpy(blob
->data
+ displacement
, buf
, thistime
);
162 blob
->received
+= thistime
;
168 static void cli_trans_format(struct cli_trans_state
*state
, uint8_t *pwct
,
172 struct iovec
*iov
= state
->iov
;
173 uint8_t *pad
= state
->pad
;
174 uint16_t *vwv
= state
->vwv
;
175 uint32_t param_offset
;
176 uint32_t this_param
= 0;
178 uint32_t data_offset
;
179 uint32_t this_data
= 0;
181 uint32_t useable_space
;
186 if ((state
->param_sent
!= 0) || (state
->data_sent
!= 0)) {
187 /* The secondary commands are one after the primary ones */
191 param_offset
= smb_size
- 4;
196 iov
[0].iov_base
= (void *)pad
;
198 iov
[1].iov_base
= (void *)state
->pipe_name_conv
;
199 iov
[1].iov_len
= state
->pipe_name_conv_len
;
200 wct
= 14 + state
->num_setup
;
201 param_offset
+= iov
[0].iov_len
+ iov
[1].iov_len
;
206 pad
[1] = 'D'; /* Copy this from "old" 3.0 behaviour */
208 iov
[0].iov_base
= (void *)pad
;
210 wct
= 14 + state
->num_setup
;
221 wct
= 19 + state
->num_setup
;
228 param_offset
+= wct
* sizeof(uint16_t);
229 useable_space
= state
->cli
->max_xmit
- param_offset
;
231 param_pad
= param_offset
% 4;
233 param_pad
= MIN(param_pad
, useable_space
);
234 iov
[0].iov_base
= (void *)state
->zero_pad
;
235 iov
[0].iov_len
= param_pad
;
237 param_offset
+= param_pad
;
239 useable_space
= state
->cli
->max_xmit
- param_offset
;
241 if (state
->param_sent
< state
->num_param
) {
242 this_param
= MIN(state
->num_param
- state
->param_sent
,
244 iov
[0].iov_base
= (void *)(state
->param
+ state
->param_sent
);
245 iov
[0].iov_len
= this_param
;
249 data_offset
= param_offset
+ this_param
;
250 useable_space
= state
->cli
->max_xmit
- data_offset
;
252 data_pad
= data_offset
% 4;
254 data_pad
= MIN(data_pad
, useable_space
);
255 iov
[0].iov_base
= (void *)state
->zero_pad
;
256 iov
[0].iov_len
= data_pad
;
258 data_offset
+= data_pad
;
260 useable_space
= state
->cli
->max_xmit
- data_offset
;
262 if (state
->data_sent
< state
->num_data
) {
263 this_data
= MIN(state
->num_data
- state
->data_sent
,
265 iov
[0].iov_base
= (void *)(state
->data
+ state
->data_sent
);
266 iov
[0].iov_len
= this_data
;
270 DEBUG(10, ("num_setup=%u, max_setup=%u, "
271 "param_total=%u, this_param=%u, max_param=%u, "
272 "data_total=%u, this_data=%u, max_data=%u, "
273 "param_offset=%u, param_pad=%u, param_disp=%u, "
274 "data_offset=%u, data_pad=%u, data_disp=%u\n",
275 (unsigned)state
->num_setup
, (unsigned)state
->max_setup
,
276 (unsigned)state
->num_param
, (unsigned)this_param
,
277 (unsigned)state
->rparam
.max
,
278 (unsigned)state
->num_data
, (unsigned)this_data
,
279 (unsigned)state
->rdata
.max
,
280 (unsigned)param_offset
, (unsigned)param_pad
,
281 (unsigned)state
->param_sent
,
282 (unsigned)data_offset
, (unsigned)data_pad
,
283 (unsigned)state
->data_sent
));
288 SSVAL(vwv
+ 0, 0, state
->num_param
);
289 SSVAL(vwv
+ 1, 0, state
->num_data
);
290 SSVAL(vwv
+ 2, 0, state
->rparam
.max
);
291 SSVAL(vwv
+ 3, 0, state
->rdata
.max
);
292 SCVAL(vwv
+ 4, 0, state
->max_setup
);
293 SCVAL(vwv
+ 4, 1, 0); /* reserved */
294 SSVAL(vwv
+ 5, 0, state
->flags
);
295 SIVAL(vwv
+ 6, 0, 0); /* timeout */
296 SSVAL(vwv
+ 8, 0, 0); /* reserved */
297 SSVAL(vwv
+ 9, 0, this_param
);
298 SSVAL(vwv
+10, 0, param_offset
);
299 SSVAL(vwv
+11, 0, this_data
);
300 SSVAL(vwv
+12, 0, data_offset
);
301 SCVAL(vwv
+13, 0, state
->num_setup
);
302 SCVAL(vwv
+13, 1, 0); /* reserved */
303 memcpy(vwv
+ 14, state
->setup
,
304 sizeof(uint16_t) * state
->num_setup
);
308 SSVAL(vwv
+ 0, 0, state
->num_param
);
309 SSVAL(vwv
+ 1, 0, state
->num_data
);
310 SSVAL(vwv
+ 2, 0, this_param
);
311 SSVAL(vwv
+ 3, 0, param_offset
);
312 SSVAL(vwv
+ 4, 0, state
->param_sent
);
313 SSVAL(vwv
+ 5, 0, this_data
);
314 SSVAL(vwv
+ 6, 0, data_offset
);
315 SSVAL(vwv
+ 7, 0, state
->data_sent
);
316 if (cmd
== SMBtranss2
) {
317 SSVAL(vwv
+ 8, 0, state
->fid
);
321 SCVAL(vwv
+ 0, 0, state
->max_setup
);
322 SSVAL(vwv
+ 0, 1, 0); /* reserved */
323 SIVAL(vwv
+ 1, 1, state
->num_param
);
324 SIVAL(vwv
+ 3, 1, state
->num_data
);
325 SIVAL(vwv
+ 5, 1, state
->rparam
.max
);
326 SIVAL(vwv
+ 7, 1, state
->rdata
.max
);
327 SIVAL(vwv
+ 9, 1, this_param
);
328 SIVAL(vwv
+11, 1, param_offset
);
329 SIVAL(vwv
+13, 1, this_data
);
330 SIVAL(vwv
+15, 1, data_offset
);
331 SCVAL(vwv
+17, 1, state
->num_setup
);
332 SSVAL(vwv
+18, 0, state
->function
);
333 memcpy(vwv
+ 19, state
->setup
,
334 sizeof(uint16_t) * state
->num_setup
);
337 SSVAL(vwv
+ 0, 0, 0); /* reserved */
338 SCVAL(vwv
+ 1, 0, 0); /* reserved */
339 SIVAL(vwv
+ 1, 1, state
->num_param
);
340 SIVAL(vwv
+ 3, 1, state
->num_data
);
341 SIVAL(vwv
+ 5, 1, this_param
);
342 SIVAL(vwv
+ 7, 1, param_offset
);
343 SIVAL(vwv
+ 9, 1, state
->param_sent
);
344 SIVAL(vwv
+11, 1, this_data
);
345 SIVAL(vwv
+13, 1, data_offset
);
346 SIVAL(vwv
+15, 1, state
->data_sent
);
347 SCVAL(vwv
+17, 1, 0); /* reserved */
351 state
->param_sent
+= this_param
;
352 state
->data_sent
+= this_data
;
355 *piov_count
= iov
- state
->iov
;
358 static void cli_trans_done(struct tevent_req
*subreq
);
360 struct tevent_req
*cli_trans_send(
361 TALLOC_CTX
*mem_ctx
, struct event_context
*ev
,
362 struct cli_state
*cli
, uint8_t cmd
,
363 const char *pipe_name
, uint16_t fid
, uint16_t function
, int flags
,
364 uint16_t *setup
, uint8_t num_setup
, uint8_t max_setup
,
365 uint8_t *param
, uint32_t num_param
, uint32_t max_param
,
366 uint8_t *data
, uint32_t num_data
, uint32_t max_data
)
368 struct tevent_req
*req
, *subreq
;
369 struct cli_trans_state
*state
;
374 req
= tevent_req_create(mem_ctx
, &state
, struct cli_trans_state
);
379 if ((cmd
== SMBtrans
) || (cmd
== SMBtrans2
)) {
380 if ((num_param
> 0xffff) || (max_param
> 0xffff)
381 || (num_data
> 0xffff) || (max_data
> 0xffff)) {
382 DEBUG(3, ("Attempt to send invalid trans2 request "
383 "(setup %u, params %u/%u, data %u/%u)\n",
385 (unsigned)num_param
, (unsigned)max_param
,
386 (unsigned)num_data
, (unsigned)max_data
));
387 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
388 return tevent_req_post(req
, ev
);
393 * The largest wct will be for nttrans (19+num_setup). Make sure we
394 * don't overflow state->vwv in cli_trans_format.
397 if ((num_setup
+ 19) > ARRAY_SIZE(state
->vwv
)) {
398 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
399 return tevent_req_post(req
, ev
);
405 state
->flags
= flags
;
406 state
->num_rsetup
= 0;
407 state
->rsetup
= NULL
;
408 ZERO_STRUCT(state
->rparam
);
409 ZERO_STRUCT(state
->rdata
);
411 if ((pipe_name
!= NULL
)
412 && (!convert_string_talloc(state
, CH_UNIX
,
413 cli_ucs2(cli
) ? CH_UTF16LE
: CH_DOS
,
414 pipe_name
, strlen(pipe_name
) + 1,
415 &state
->pipe_name_conv
,
416 &state
->pipe_name_conv_len
))) {
417 tevent_req_nterror(req
, NT_STATUS_NO_MEMORY
);
418 return tevent_req_post(req
, ev
);
420 state
->fid
= fid
; /* trans2 */
421 state
->function
= function
; /* nttrans */
423 state
->setup
= setup
;
424 state
->num_setup
= num_setup
;
425 state
->max_setup
= max_setup
;
427 state
->param
= param
;
428 state
->num_param
= num_param
;
429 state
->param_sent
= 0;
430 state
->rparam
.max
= max_param
;
433 state
->num_data
= num_data
;
434 state
->data_sent
= 0;
435 state
->rdata
.max
= max_data
;
437 cli_trans_format(state
, &wct
, &iov_count
);
439 subreq
= cli_smb_req_create(state
, ev
, cli
, cmd
, 0, wct
, state
->vwv
,
440 iov_count
, state
->iov
);
441 if (tevent_req_nomem(subreq
, req
)) {
442 return tevent_req_post(req
, ev
);
444 status
= cli_smb_req_send(subreq
);
445 if (!NT_STATUS_IS_OK(status
)) {
446 tevent_req_nterror(req
, status
);
447 return tevent_req_post(req
, state
->ev
);
449 tevent_req_set_callback(subreq
, cli_trans_done
, req
);
452 * Now get the MID of the primary request
453 * and mark it as persistent. This means
454 * we will able to send and receive multiple
455 * SMB pdus using this MID in both directions
456 * (including correct SMB signing).
458 state
->mid
= cli_smb_req_mid(subreq
);
459 cli_state_seqnum_persistent(cli
, state
->mid
);
464 static void cli_trans_done(struct tevent_req
*subreq
)
466 struct tevent_req
*req
= tevent_req_callback_data(
467 subreq
, struct tevent_req
);
468 struct cli_trans_state
*state
= tevent_req_data(
469 req
, struct cli_trans_state
);
477 uint8_t num_setup
= 0;
478 uint16_t *setup
= NULL
;
479 uint32_t total_param
= 0;
480 uint32_t num_param
= 0;
481 uint32_t param_disp
= 0;
482 uint32_t total_data
= 0;
483 uint32_t num_data
= 0;
484 uint32_t data_disp
= 0;
485 uint8_t *param
= NULL
;
486 uint8_t *data
= NULL
;
488 status
= cli_smb_recv(subreq
, state
, &inbuf
, 0, &wct
, &vwv
,
491 * Do not TALLOC_FREE(subreq) here, we might receive more than
492 * one response for the same mid.
496 * We can receive something like STATUS_MORE_ENTRIES, so don't use
497 * !NT_STATUS_IS_OK(status) here.
500 if (NT_STATUS_IS_ERR(status
)) {
504 sent_all
= ((state
->param_sent
== state
->num_param
)
505 && (state
->data_sent
== state
->num_data
));
507 status
= cli_pull_trans(
508 inbuf
, wct
, vwv
, num_bytes
, bytes
,
509 state
->cmd
, !sent_all
, &num_setup
, &setup
,
510 &total_param
, &num_param
, ¶m_disp
, ¶m
,
511 &total_data
, &num_data
, &data_disp
, &data
);
513 if (!NT_STATUS_IS_OK(status
)) {
522 cli_trans_format(state
, &wct
, &iov_count
);
524 subreq
= cli_smb_req_create(state
, state
->ev
, state
->cli
,
525 state
->cmd
+ 1, 0, wct
, state
->vwv
,
526 iov_count
, state
->iov
);
527 if (tevent_req_nomem(subreq
, req
)) {
530 cli_smb_req_set_mid(subreq
, state
->mid
);
532 status
= cli_smb_req_send(subreq
);
534 if (!NT_STATUS_IS_OK(status
)) {
537 tevent_req_set_callback(subreq
, cli_trans_done
, req
);
541 status
= cli_trans_pull_blob(
542 state
, &state
->rparam
, total_param
, num_param
, param
,
545 if (!NT_STATUS_IS_OK(status
)) {
546 DEBUG(10, ("Pulling params failed: %s\n", nt_errstr(status
)));
550 status
= cli_trans_pull_blob(
551 state
, &state
->rdata
, total_data
, num_data
, data
,
554 if (!NT_STATUS_IS_OK(status
)) {
555 DEBUG(10, ("Pulling data failed: %s\n", nt_errstr(status
)));
559 if ((state
->rparam
.total
== state
->rparam
.received
)
560 && (state
->rdata
.total
== state
->rdata
.received
)) {
561 state
->recv_flags2
= SVAL(inbuf
, smb_flg2
);
563 cli_state_seqnum_remove(state
->cli
, state
->mid
);
564 tevent_req_done(req
);
570 if (!cli_smb_req_set_pending(subreq
)) {
571 status
= NT_STATUS_NO_MEMORY
;
577 cli_state_seqnum_remove(state
->cli
, state
->mid
);
579 tevent_req_nterror(req
, status
);
582 NTSTATUS
cli_trans_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
583 uint16_t *recv_flags2
,
584 uint16_t **setup
, uint8_t min_setup
,
586 uint8_t **param
, uint32_t min_param
,
588 uint8_t **data
, uint32_t min_data
,
591 struct cli_trans_state
*state
= tevent_req_data(
592 req
, struct cli_trans_state
);
595 if (tevent_req_is_nterror(req
, &status
)) {
599 if ((state
->num_rsetup
< min_setup
)
600 || (state
->rparam
.total
< min_param
)
601 || (state
->rdata
.total
< min_data
)) {
602 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
605 if (recv_flags2
!= NULL
) {
606 *recv_flags2
= state
->recv_flags2
;
610 *setup
= talloc_move(mem_ctx
, &state
->rsetup
);
611 *num_setup
= state
->num_rsetup
;
613 TALLOC_FREE(state
->rsetup
);
617 *param
= talloc_move(mem_ctx
, &state
->rparam
.data
);
618 *num_param
= state
->rparam
.total
;
620 TALLOC_FREE(state
->rparam
.data
);
624 *data
= talloc_move(mem_ctx
, &state
->rdata
.data
);
625 *num_data
= state
->rdata
.total
;
627 TALLOC_FREE(state
->rdata
.data
);
633 NTSTATUS
cli_trans(TALLOC_CTX
*mem_ctx
, struct cli_state
*cli
,
635 const char *pipe_name
, uint16_t fid
, uint16_t function
,
637 uint16_t *setup
, uint8_t num_setup
, uint8_t max_setup
,
638 uint8_t *param
, uint32_t num_param
, uint32_t max_param
,
639 uint8_t *data
, uint32_t num_data
, uint32_t max_data
,
640 uint16_t *recv_flags2
,
641 uint16_t **rsetup
, uint8_t min_rsetup
, uint8_t *num_rsetup
,
642 uint8_t **rparam
, uint32_t min_rparam
, uint32_t *num_rparam
,
643 uint8_t **rdata
, uint32_t min_rdata
, uint32_t *num_rdata
)
645 TALLOC_CTX
*frame
= talloc_stackframe();
646 struct event_context
*ev
;
647 struct tevent_req
*req
;
648 NTSTATUS status
= NT_STATUS_OK
;
650 if (cli_has_async_calls(cli
)) {
652 * Can't use sync call while an async call is in flight
654 status
= NT_STATUS_INVALID_PARAMETER
;
658 ev
= event_context_init(frame
);
660 status
= NT_STATUS_NO_MEMORY
;
664 req
= cli_trans_send(frame
, ev
, cli
, trans_cmd
,
665 pipe_name
, fid
, function
, flags
,
666 setup
, num_setup
, max_setup
,
667 param
, num_param
, max_param
,
668 data
, num_data
, max_data
);
670 status
= NT_STATUS_NO_MEMORY
;
674 if (!tevent_req_poll(req
, ev
)) {
675 status
= map_nt_error_from_unix(errno
);
679 status
= cli_trans_recv(req
, mem_ctx
, recv_flags2
,
680 rsetup
, min_rsetup
, num_rsetup
,
681 rparam
, min_rparam
, num_rparam
,
682 rdata
, min_rdata
, num_rdata
);