source3/libsmb/clireadwrite.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client file read/write routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libsmb/libsmb.h"
  22 #include "../lib/util/tevent_ntstatus.h"
  23 #include "async_smb.h"
  24 #include "trans2.h"
  25 #include "../libcli/smb/smbXcli_base.h"
  26
  27 /****************************************************************************
  28   Calculate the recommended read buffer size
  29 ****************************************************************************/
  30 static size_t cli_read_max_bufsize(struct cli_state *cli)
  31 {
  32         uint8_t wct = 12;
  33         uint32_t min_space;
  34         uint32_t data_offset;
  35         uint32_t useable_space = 0;
  36
  37         data_offset = HDR_VWV;
  38         data_offset += wct * sizeof(uint16_t);
  39         data_offset += sizeof(uint16_t); /* byte count */
  40         data_offset += 1; /* pad */
  41
  42         min_space = cli_state_available_size(cli, data_offset);
  43
  44         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_READ_CAP) {
  45                 useable_space = 0xFFFFFF - data_offset;
  46
  47                 if (smb1cli_conn_signing_is_active(cli->conn)) {
  48                         return min_space;
  49                 }
  50
  51                 if (smb1cli_conn_encryption_on(cli->conn)) {
  52                         return min_space;
  53                 }
  54
  55                 return useable_space;
  56         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_READX) {
  57                 /*
  58                  * Note: CAP_LARGE_READX also works with signing
  59                  */
  60                 useable_space = 0x1FFFF - data_offset;
  61
  62                 useable_space = MIN(useable_space, UINT16_MAX);
  63
  64                 return useable_space;
  65         }
  66
  67         return min_space;
  68 }
  69
  70 /****************************************************************************
  71   Calculate the recommended write buffer size
  72 ****************************************************************************/
  73 static size_t cli_write_max_bufsize(struct cli_state *cli,
  74                                     uint16_t write_mode,
  75                                     uint8_t wct)
  76 {
  77         uint32_t min_space;
  78         uint32_t data_offset;
  79         uint32_t useable_space = 0;
  80
  81         data_offset = HDR_VWV;
  82         data_offset += wct * sizeof(uint16_t);
  83         data_offset += sizeof(uint16_t); /* byte count */
  84         data_offset += 1; /* pad */
  85
  86         min_space = cli_state_available_size(cli, data_offset);
  87
  88         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) {
  89                 useable_space = 0xFFFFFF - data_offset;
  90         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_WRITEX) {
  91                 useable_space = 0x1FFFF - data_offset;
  92         } else {
  93                 return min_space;
  94         }
  95
  96         if (write_mode != 0) {
  97                 return min_space;
  98         }
  99
 100         if (smb1cli_conn_signing_is_active(cli->conn)) {
 101                 return min_space;
 102         }
 103
 104         if (smb1cli_conn_encryption_on(cli->conn)) {
 105                 return min_space;
 106         }
 107
 108         if (strequal(cli->dev, "LPT1:")) {
 109                 return min_space;
 110         }
 111
 112         return useable_space;
 113 }
 114
 115 struct cli_read_andx_state {
 116         size_t size;
 117         uint16_t vwv[12];
 118         NTSTATUS status;
 119         size_t received;
 120         uint8_t *buf;
 121 };
 122
 123 static void cli_read_andx_done(struct tevent_req *subreq);
 124
 125 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
 126                                         struct tevent_context *ev,
 127                                         struct cli_state *cli, uint16_t fnum,
 128                                         off_t offset, size_t size,
 129                                         struct tevent_req **psmbreq)
 130 {
 131         struct tevent_req *req, *subreq;
 132         struct cli_read_andx_state *state;
 133         uint8_t wct = 10;
 134
 135         req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
 136         if (req == NULL) {
 137                 return NULL;
 138         }
 139         state->size = size;
 140
 141         SCVAL(state->vwv + 0, 0, 0xFF);
 142         SCVAL(state->vwv + 0, 1, 0);
 143         SSVAL(state->vwv + 1, 0, 0);
 144         SSVAL(state->vwv + 2, 0, fnum);
 145         SIVAL(state->vwv + 3, 0, offset);
 146         SSVAL(state->vwv + 5, 0, size);
 147         SSVAL(state->vwv + 6, 0, size);
 148         SSVAL(state->vwv + 7, 0, (size >> 16));
 149         SSVAL(state->vwv + 8, 0, 0);
 150         SSVAL(state->vwv + 9, 0, 0);
 151
 152         if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) {
 153                 SIVAL(state->vwv + 10, 0,
 154                       (((uint64_t)offset)>>32) & 0xffffffff);
 155                 wct = 12;
 156         } else {
 157                 if ((((uint64_t)offset) & 0xffffffff00000000LL) != 0) {
 158                         DEBUG(10, ("cli_read_andx_send got large offset where "
 159                                    "the server does not support it\n"));
 160                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 161                         return tevent_req_post(req, ev);
 162                 }
 163         }
 164
 165         subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, wct,
 166                                     state->vwv, 0, NULL);
 167         if (subreq == NULL) {
 168                 TALLOC_FREE(req);
 169                 return NULL;
 170         }
 171         tevent_req_set_callback(subreq, cli_read_andx_done, req);
 172         *psmbreq = subreq;
 173         return req;
 174 }
 175
 176 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
 177                                       struct tevent_context *ev,
 178                                       struct cli_state *cli, uint16_t fnum,
 179                                       off_t offset, size_t size)
 180 {
 181         struct tevent_req *req, *subreq;
 182         NTSTATUS status;
 183
 184         req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
 185                                    &subreq);
 186         if (req == NULL) {
 187                 return NULL;
 188         }
 189
 190         status = smb1cli_req_chain_submit(&subreq, 1);
 191         if (tevent_req_nterror(req, status)) {
 192                 return tevent_req_post(req, ev);
 193         }
 194         return req;
 195 }
 196
 197 static void cli_read_andx_done(struct tevent_req *subreq)
 198 {
 199         struct tevent_req *req = tevent_req_callback_data(
 200                 subreq, struct tevent_req);
 201         struct cli_read_andx_state *state = tevent_req_data(
 202                 req, struct cli_read_andx_state);
 203         uint8_t *inbuf;
 204         uint8_t wct;
 205         uint16_t *vwv;
 206         uint32_t num_bytes;
 207         uint8_t *bytes;
 208
 209         state->status = cli_smb_recv(subreq, state, &inbuf, 12, &wct, &vwv,
 210                                      &num_bytes, &bytes);
 211         TALLOC_FREE(subreq);
 212         if (NT_STATUS_IS_ERR(state->status)) {
 213                 tevent_req_nterror(req, state->status);
 214                 return;
 215         }
 216
 217         /* size is the number of bytes the server returned.
 218          * Might be zero. */
 219         state->received = SVAL(vwv + 5, 0);
 220         state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
 221
 222         if (state->received > state->size) {
 223                 DEBUG(5,("server returned more than we wanted!\n"));
 224                 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
 225                 return;
 226         }
 227
 228         /*
 229          * bcc field must be valid for small reads, for large reads the 16-bit
 230          * bcc field can't be correct.
 231          */
 232
 233         if ((state->received < 0xffff) && (state->received > num_bytes)) {
 234                 DEBUG(5, ("server announced more bytes than sent\n"));
 235                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 236                 return;
 237         }
 238
 239         state->buf = discard_const_p(uint8_t, smb_base(inbuf)) + SVAL(vwv+6, 0);
 240
 241         if (trans_oob(smb_len_tcp(inbuf), SVAL(vwv+6, 0), state->received)
 242             || ((state->received != 0) && (state->buf < bytes))) {
 243                 DEBUG(5, ("server returned invalid read&x data offset\n"));
 244                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 245                 return;
 246         }
 247         tevent_req_done(req);
 248 }
 249
 250 /*
 251  * Pull the data out of a finished async read_and_x request. rcvbuf is
 252  * talloced from the request, so better make sure that you copy it away before
 253  * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
 254  * talloc_move it!
 255  */
 256
 257 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
 258                             uint8_t **rcvbuf)
 259 {
 260         struct cli_read_andx_state *state = tevent_req_data(
 261                 req, struct cli_read_andx_state);
 262         NTSTATUS status;
 263
 264         if (tevent_req_is_nterror(req, &status)) {
 265                 return status;
 266         }
 267         *received = state->received;
 268         *rcvbuf = state->buf;
 269         return NT_STATUS_OK;
 270 }
 271
 272 struct cli_pull_chunk;
 273
 274 struct cli_pull_state {
 275         struct tevent_context *ev;
 276         struct cli_state *cli;
 277         uint16_t fnum;
 278         off_t start_offset;
 279         off_t size;
 280
 281         NTSTATUS (*sink)(char *buf, size_t n, void *priv);
 282         void *priv;
 283
 284         size_t chunk_size;
 285         off_t next_offset;
 286         off_t remaining;
 287
 288         /*
 289          * How many bytes did we push into "sink"?
 290          */
 291         off_t pushed;
 292
 293         /*
 294          * Outstanding requests
 295          *
 296          * The maximum is 256:
 297          * - which would be a window of 256 MByte
 298          *   for SMB2 with multi-credit
 299          *   or smb1 unix extentions.
 300          */
 301         uint16_t max_chunks;
 302         uint16_t num_chunks;
 303         uint16_t num_waiting;
 304         struct cli_pull_chunk *chunks;
 305 };
 306
 307 struct cli_pull_chunk {
 308         struct cli_pull_chunk *prev, *next;
 309         struct tevent_req *req;/* This is the main request! Not the subreq */
 310         struct tevent_req *subreq;
 311         off_t ofs;
 312         uint8_t *buf;
 313         size_t total_size;
 314         size_t tmp_size;
 315         bool done;
 316 };
 317
 318 static void cli_pull_setup_chunks(struct tevent_req *req);
 319 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk);
 320 static void cli_pull_chunk_done(struct tevent_req *subreq);
 321
 322 /*
 323  * Parallel read support.
 324  *
 325  * cli_pull sends as many read&x requests as the server would allow via
 326  * max_mux at a time. When replies flow back in, the data is written into
 327  * the callback function "sink" in the right order.
 328  */
 329
 330 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
 331                                  struct tevent_context *ev,
 332                                  struct cli_state *cli,
 333                                  uint16_t fnum, off_t start_offset,
 334                                  off_t size, size_t window_size,
 335                                  NTSTATUS (*sink)(char *buf, size_t n,
 336                                                   void *priv),
 337                                  void *priv)
 338 {
 339         struct tevent_req *req;
 340         struct cli_pull_state *state;
 341         size_t page_size = 1024;
 342         uint64_t tmp64;
 343
 344         req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
 345         if (req == NULL) {
 346                 return NULL;
 347         }
 348         state->cli = cli;
 349         state->ev = ev;
 350         state->fnum = fnum;
 351         state->start_offset = start_offset;
 352         state->size = size;
 353         state->sink = sink;
 354         state->priv = priv;
 355         state->next_offset = start_offset;
 356         state->remaining = size;
 357
 358         if (size == 0) {
 359                 tevent_req_done(req);
 360                 return tevent_req_post(req, ev);
 361         }
 362
 363         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 364                 state->chunk_size = smb2cli_conn_max_read_size(cli->conn);
 365         } else {
 366                 state->chunk_size = cli_read_max_bufsize(cli);
 367         }
 368         if (state->chunk_size > page_size) {
 369                 state->chunk_size &= ~(page_size - 1);
 370         }
 371
 372         if (window_size == 0) {
 373                 /*
 374                  * We use 16 MByte as default window size.
 375                  */
 376                 window_size = 16 * 1024 * 1024;
 377         }
 378
 379         tmp64 = window_size/state->chunk_size;
 380         if ((window_size % state->chunk_size) > 0) {
 381                 tmp64 += 1;
 382         }
 383         tmp64 = MAX(tmp64, 1);
 384         tmp64 = MIN(tmp64, 256);
 385         state->max_chunks = tmp64;
 386
 387         /*
 388          * We defer the callback because of the complex
 389          * substate/subfunction logic
 390          */
 391         tevent_req_defer_callback(req, ev);
 392
 393         cli_pull_setup_chunks(req);
 394         if (!tevent_req_is_in_progress(req)) {
 395                 return tevent_req_post(req, ev);
 396         }
 397
 398         return req;
 399 }
 400
 401 static void cli_pull_setup_chunks(struct tevent_req *req)
 402 {
 403         struct cli_pull_state *state =
 404                 tevent_req_data(req,
 405                 struct cli_pull_state);
 406         struct cli_pull_chunk *chunk, *next = NULL;
 407         size_t i;
 408
 409         for (chunk = state->chunks; chunk; chunk = next) {
 410                 /*
 411                  * Note that chunk might be removed from this call.
 412                  */
 413                 next = chunk->next;
 414                 cli_pull_chunk_ship(chunk);
 415                 if (!tevent_req_is_in_progress(req)) {
 416                         return;
 417                 }
 418         }
 419
 420         for (i = state->num_chunks; i < state->max_chunks; i++) {
 421
 422                 if (state->num_waiting > 0) {
 423                         return;
 424                 }
 425
 426                 if (state->remaining == 0) {
 427                         break;
 428                 }
 429
 430                 chunk = talloc_zero(state, struct cli_pull_chunk);
 431                 if (tevent_req_nomem(chunk, req)) {
 432                         return;
 433                 }
 434                 chunk->req = req;
 435                 chunk->ofs = state->next_offset;
 436                 chunk->total_size = MIN(state->remaining, state->chunk_size);
 437                 state->next_offset += chunk->total_size;
 438                 state->remaining -= chunk->total_size;
 439
 440                 DLIST_ADD_END(state->chunks, chunk, NULL);
 441                 state->num_chunks++;
 442                 state->num_waiting++;
 443
 444                 cli_pull_chunk_ship(chunk);
 445                 if (!tevent_req_is_in_progress(req)) {
 446                         return;
 447                 }
 448         }
 449
 450         if (state->remaining > 0) {
 451                 return;
 452         }
 453
 454         if (state->num_chunks > 0) {
 455                 return;
 456         }
 457
 458         tevent_req_done(req);
 459 }
 460
 461 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk)
 462 {
 463         struct tevent_req *req = chunk->req;
 464         struct cli_pull_state *state =
 465                 tevent_req_data(req,
 466                 struct cli_pull_state);
 467         bool ok;
 468         off_t ofs;
 469         size_t size;
 470
 471         if (chunk->done) {
 472                 NTSTATUS status;
 473
 474                 if (chunk != state->chunks) {
 475                         /*
 476                          * this chunk is not the
 477                          * first one in the list.
 478                          *
 479                          * which means we should not
 480                          * push it into the sink yet.
 481                          */
 482                         return;
 483                 }
 484
 485                 if (chunk->tmp_size == 0) {
 486                         /*
 487                          * we git a short read, we're done
 488                          */
 489                         tevent_req_done(req);
 490                         return;
 491                 }
 492
 493                 status = state->sink((char *)chunk->buf,
 494                                      chunk->tmp_size,
 495                                      state->priv);
 496                 if (tevent_req_nterror(req, status)) {
 497                         return;
 498                 }
 499                 state->pushed += chunk->tmp_size;
 500
 501                 if (chunk->tmp_size < chunk->total_size) {
 502                         /*
 503                          * we git a short read, we're done
 504                          */
 505                         tevent_req_done(req);
 506                         return;
 507                 }
 508
 509                 DLIST_REMOVE(state->chunks, chunk);
 510                 SMB_ASSERT(state->num_chunks > 0);
 511                 state->num_chunks--;
 512                 TALLOC_FREE(chunk);
 513
 514                 return;
 515         }
 516
 517         if (chunk->subreq != NULL) {
 518                 return;
 519         }
 520
 521         SMB_ASSERT(state->num_waiting > 0);
 522
 523         ofs = chunk->ofs + chunk->tmp_size;
 524         size = chunk->total_size - chunk->tmp_size;
 525
 526         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 527                 uint32_t max_size;
 528
 529                 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
 530                 if (!ok) {
 531                         return;
 532                 }
 533
 534                 /*
 535                  * downgrade depending on the available credits
 536                  */
 537                 size = MIN(max_size, size);
 538
 539                 chunk->subreq = cli_smb2_read_send(chunk,
 540                                                    state->ev,
 541                                                    state->cli,
 542                                                    state->fnum,
 543                                                    ofs,
 544                                                    size);
 545                 if (tevent_req_nomem(chunk->subreq, req)) {
 546                         return;
 547                 }
 548         } else {
 549                 ok = smb1cli_conn_req_possible(state->cli->conn);
 550                 if (!ok) {
 551                         return;
 552                 }
 553
 554                 chunk->subreq = cli_read_andx_send(chunk,
 555                                                    state->ev,
 556                                                    state->cli,
 557                                                    state->fnum,
 558                                                    ofs,
 559                                                    size);
 560                 if (tevent_req_nomem(chunk->subreq, req)) {
 561                         return;
 562                 }
 563         }
 564         tevent_req_set_callback(chunk->subreq,
 565                                 cli_pull_chunk_done,
 566                                 chunk);
 567
 568         state->num_waiting--;
 569         return;
 570 }
 571
 572 static void cli_pull_chunk_done(struct tevent_req *subreq)
 573 {
 574         struct cli_pull_chunk *chunk =
 575                 tevent_req_callback_data(subreq,
 576                 struct cli_pull_chunk);
 577         struct tevent_req *req = chunk->req;
 578         struct cli_pull_state *state =
 579                 tevent_req_data(req,
 580                 struct cli_pull_state);
 581         NTSTATUS status;
 582         size_t expected = chunk->total_size - chunk->tmp_size;
 583         ssize_t received;
 584         uint8_t *buf = NULL;
 585
 586         chunk->subreq = NULL;
 587
 588         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 589                 status = cli_smb2_read_recv(subreq, &received, &buf);
 590         } else {
 591                 status = cli_read_andx_recv(subreq, &received, &buf);
 592         }
 593         if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 594                 received = 0;
 595                 status = NT_STATUS_OK;
 596         }
 597         if (tevent_req_nterror(req, status)) {
 598                 return;
 599         }
 600
 601         if (received > expected) {
 602                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 603                 return;
 604         }
 605
 606         if (received == 0) {
 607                 /*
 608                  * We got EOF we're done
 609                  */
 610                 chunk->done = true;
 611                 cli_pull_setup_chunks(req);
 612                 return;
 613         }
 614
 615         if (received == chunk->total_size) {
 616                 /*
 617                  * We got it in the first run.
 618                  *
 619                  * We don't call TALLOC_FREE(subreq)
 620                  * here and keep the returned buffer.
 621                  */
 622                 chunk->buf = buf;
 623         } else if (chunk->buf == NULL) {
 624                 chunk->buf = talloc_array(chunk, uint8_t, chunk->total_size);
 625                 if (tevent_req_nomem(chunk->buf, req)) {
 626                         return;
 627                 }
 628         }
 629
 630         if (received != chunk->total_size) {
 631                 uint8_t *p = chunk->buf + chunk->tmp_size;
 632                 memcpy(p, buf, received);
 633                 TALLOC_FREE(subreq);
 634         }
 635
 636         chunk->tmp_size += received;
 637
 638         if (chunk->tmp_size == chunk->total_size) {
 639                 chunk->done = true;
 640         } else {
 641                 state->num_waiting++;
 642         }
 643
 644         cli_pull_setup_chunks(req);
 645 }
 646
 647 NTSTATUS cli_pull_recv(struct tevent_req *req, off_t *received)
 648 {
 649         struct cli_pull_state *state = tevent_req_data(
 650                 req, struct cli_pull_state);
 651         NTSTATUS status;
 652
 653         if (tevent_req_is_nterror(req, &status)) {
 654                 tevent_req_received(req);
 655                 return status;
 656         }
 657         *received = state->pushed;
 658         tevent_req_received(req);
 659         return NT_STATUS_OK;
 660 }
 661
 662 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
 663                   off_t start_offset, off_t size, size_t window_size,
 664                   NTSTATUS (*sink)(char *buf, size_t n, void *priv),
 665                   void *priv, off_t *received)
 666 {
 667         TALLOC_CTX *frame = talloc_stackframe();
 668         struct tevent_context *ev;
 669         struct tevent_req *req;
 670         NTSTATUS status = NT_STATUS_OK;
 671
 672         if (smbXcli_conn_has_async_calls(cli->conn)) {
 673                 /*
 674                  * Can't use sync call while an async call is in flight
 675                  */
 676                 status = NT_STATUS_INVALID_PARAMETER;
 677                 goto fail;
 678         }
 679
 680         ev = samba_tevent_context_init(frame);
 681         if (ev == NULL) {
 682                 status = NT_STATUS_NO_MEMORY;
 683                 goto fail;
 684         }
 685
 686         req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
 687                             window_size, sink, priv);
 688         if (req == NULL) {
 689                 status = NT_STATUS_NO_MEMORY;
 690                 goto fail;
 691         }
 692
 693         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 694                 goto fail;
 695         }
 696
 697         status = cli_pull_recv(req, received);
 698  fail:
 699         TALLOC_FREE(frame);
 700         return status;
 701 }
 702
 703 static NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
 704 {
 705         char **pbuf = (char **)priv;
 706         memcpy(*pbuf, buf, n);
 707         *pbuf += n;
 708         return NT_STATUS_OK;
 709 }
 710
 711 NTSTATUS cli_read(struct cli_state *cli, uint16_t fnum,
 712                  char *buf, off_t offset, size_t size,
 713                  size_t *nread)
 714 {
 715         NTSTATUS status;
 716         off_t ret;
 717
 718         status = cli_pull(cli, fnum, offset, size, size,
 719                           cli_read_sink, &buf, &ret);
 720         if (!NT_STATUS_IS_OK(status)) {
 721                 return status;
 722         }
 723
 724         if (nread) {
 725                 *nread = ret;
 726         }
 727
 728         return NT_STATUS_OK;
 729 }
 730
 731 /****************************************************************************
 732   write to a file using a SMBwrite and not bypassing 0 byte writes
 733 ****************************************************************************/
 734
 735 NTSTATUS cli_smbwrite(struct cli_state *cli, uint16_t fnum, char *buf,
 736                       off_t offset, size_t size1, size_t *ptotal)
 737 {
 738         uint8_t *bytes;
 739         ssize_t total = 0;
 740
 741         /*
 742          * 3 bytes prefix
 743          */
 744
 745         bytes = talloc_array(talloc_tos(), uint8_t, 3);
 746         if (bytes == NULL) {
 747                 return NT_STATUS_NO_MEMORY;
 748         }
 749         bytes[0] = 1;
 750
 751         do {
 752                 uint32_t usable_space = cli_state_available_size(cli, 48);
 753                 size_t size = MIN(size1, usable_space);
 754                 struct tevent_req *req;
 755                 uint16_t vwv[5];
 756                 uint16_t *ret_vwv;
 757                 NTSTATUS status;
 758
 759                 SSVAL(vwv+0, 0, fnum);
 760                 SSVAL(vwv+1, 0, size);
 761                 SIVAL(vwv+2, 0, offset);
 762                 SSVAL(vwv+4, 0, 0);
 763
 764                 bytes = talloc_realloc(talloc_tos(), bytes, uint8_t,
 765                                              size+3);
 766                 if (bytes == NULL) {
 767                         return NT_STATUS_NO_MEMORY;
 768                 }
 769                 SSVAL(bytes, 1, size);
 770                 memcpy(bytes + 3, buf + total, size);
 771
 772                 status = cli_smb(talloc_tos(), cli, SMBwrite, 0, 5, vwv,
 773                                  size+3, bytes, &req, 1, NULL, &ret_vwv,
 774                                  NULL, NULL);
 775                 if (!NT_STATUS_IS_OK(status)) {
 776                         TALLOC_FREE(bytes);
 777                         return status;
 778                 }
 779
 780                 size = SVAL(ret_vwv+0, 0);
 781                 TALLOC_FREE(req);
 782                 if (size == 0) {
 783                         break;
 784                 }
 785                 size1 -= size;
 786                 total += size;
 787                 offset += size;
 788
 789         } while (size1);
 790
 791         TALLOC_FREE(bytes);
 792
 793         if (ptotal != NULL) {
 794                 *ptotal = total;
 795         }
 796         return NT_STATUS_OK;
 797 }
 798
 799 /*
 800  * Send a write&x request
 801  */
 802
 803 struct cli_write_andx_state {
 804         size_t size;
 805         uint16_t vwv[14];
 806         size_t written;
 807         uint8_t pad;
 808         struct iovec iov[2];
 809 };
 810
 811 static void cli_write_andx_done(struct tevent_req *subreq);
 812
 813 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
 814                                          struct tevent_context *ev,
 815                                          struct cli_state *cli, uint16_t fnum,
 816                                          uint16_t mode, const uint8_t *buf,
 817                                          off_t offset, size_t size,
 818                                          struct tevent_req **reqs_before,
 819                                          int num_reqs_before,
 820                                          struct tevent_req **psmbreq)
 821 {
 822         struct tevent_req *req, *subreq;
 823         struct cli_write_andx_state *state;
 824         bool bigoffset = ((smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) != 0);
 825         uint8_t wct = bigoffset ? 14 : 12;
 826         size_t max_write = cli_write_max_bufsize(cli, mode, wct);
 827         uint16_t *vwv;
 828
 829         req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
 830         if (req == NULL) {
 831                 return NULL;
 832         }
 833
 834         state->size = MIN(size, max_write);
 835
 836         vwv = state->vwv;
 837
 838         SCVAL(vwv+0, 0, 0xFF);
 839         SCVAL(vwv+0, 1, 0);
 840         SSVAL(vwv+1, 0, 0);
 841         SSVAL(vwv+2, 0, fnum);
 842         SIVAL(vwv+3, 0, offset);
 843         SIVAL(vwv+5, 0, 0);
 844         SSVAL(vwv+7, 0, mode);
 845         SSVAL(vwv+8, 0, 0);
 846         SSVAL(vwv+9, 0, (state->size>>16));
 847         SSVAL(vwv+10, 0, state->size);
 848
 849         SSVAL(vwv+11, 0,
 850               smb1cli_req_wct_ofs(reqs_before, num_reqs_before)
 851               + 1               /* the wct field */
 852               + wct * 2         /* vwv */
 853               + 2               /* num_bytes field */
 854               + 1               /* pad */);
 855
 856         if (bigoffset) {
 857                 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
 858         }
 859
 860         state->pad = 0;
 861         state->iov[0].iov_base = (void *)&state->pad;
 862         state->iov[0].iov_len = 1;
 863         state->iov[1].iov_base = discard_const_p(void, buf);
 864         state->iov[1].iov_len = state->size;
 865
 866         subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
 867                                     2, state->iov);
 868         if (tevent_req_nomem(subreq, req)) {
 869                 return tevent_req_post(req, ev);
 870         }
 871         tevent_req_set_callback(subreq, cli_write_andx_done, req);
 872         *psmbreq = subreq;
 873         return req;
 874 }
 875
 876 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
 877                                        struct tevent_context *ev,
 878                                        struct cli_state *cli, uint16_t fnum,
 879                                        uint16_t mode, const uint8_t *buf,
 880                                        off_t offset, size_t size)
 881 {
 882         struct tevent_req *req, *subreq;
 883         NTSTATUS status;
 884
 885         req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
 886                                     size, NULL, 0, &subreq);
 887         if (req == NULL) {
 888                 return NULL;
 889         }
 890
 891         status = smb1cli_req_chain_submit(&subreq, 1);
 892         if (tevent_req_nterror(req, status)) {
 893                 return tevent_req_post(req, ev);
 894         }
 895         return req;
 896 }
 897
 898 static void cli_write_andx_done(struct tevent_req *subreq)
 899 {
 900         struct tevent_req *req = tevent_req_callback_data(
 901                 subreq, struct tevent_req);
 902         struct cli_write_andx_state *state = tevent_req_data(
 903                 req, struct cli_write_andx_state);
 904         uint8_t wct;
 905         uint16_t *vwv;
 906         NTSTATUS status;
 907
 908         status = cli_smb_recv(subreq, state, NULL, 6, &wct, &vwv,
 909                               NULL, NULL);
 910         TALLOC_FREE(subreq);
 911         if (NT_STATUS_IS_ERR(status)) {
 912                 tevent_req_nterror(req, status);
 913                 return;
 914         }
 915         state->written = SVAL(vwv+2, 0);
 916         if (state->size > UINT16_MAX) {
 917                 /*
 918                  * It is important that we only set the
 919                  * high bits only if we asked for a large write.
 920                  *
 921                  * OS/2 print shares get this wrong and may send
 922                  * invalid values.
 923                  *
 924                  * See bug #5326.
 925                  */
 926                 state->written |= SVAL(vwv+4, 0)<<16;
 927         }
 928         tevent_req_done(req);
 929 }
 930
 931 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
 932 {
 933         struct cli_write_andx_state *state = tevent_req_data(
 934                 req, struct cli_write_andx_state);
 935         NTSTATUS status;
 936
 937         if (tevent_req_is_nterror(req, &status)) {
 938                 return status;
 939         }
 940         if (pwritten != 0) {
 941                 *pwritten = state->written;
 942         }
 943         return NT_STATUS_OK;
 944 }
 945
 946 struct cli_writeall_state {
 947         struct tevent_context *ev;
 948         struct cli_state *cli;
 949         uint16_t fnum;
 950         uint16_t mode;
 951         const uint8_t *buf;
 952         off_t offset;
 953         size_t size;
 954         size_t written;
 955 };
 956
 957 static void cli_writeall_written(struct tevent_req *req);
 958
 959 static struct tevent_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
 960                                             struct tevent_context *ev,
 961                                             struct cli_state *cli,
 962                                             uint16_t fnum,
 963                                             uint16_t mode,
 964                                             const uint8_t *buf,
 965                                             off_t offset, size_t size)
 966 {
 967         struct tevent_req *req, *subreq;
 968         struct cli_writeall_state *state;
 969
 970         req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
 971         if (req == NULL) {
 972                 return NULL;
 973         }
 974         state->ev = ev;
 975         state->cli = cli;
 976         state->fnum = fnum;
 977         state->mode = mode;
 978         state->buf = buf;
 979         state->offset = offset;
 980         state->size = size;
 981         state->written = 0;
 982
 983         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
 984                                      state->mode, state->buf, state->offset,
 985                                      state->size);
 986         if (tevent_req_nomem(subreq, req)) {
 987                 return tevent_req_post(req, ev);
 988         }
 989         tevent_req_set_callback(subreq, cli_writeall_written, req);
 990         return req;
 991 }
 992
 993 static void cli_writeall_written(struct tevent_req *subreq)
 994 {
 995         struct tevent_req *req = tevent_req_callback_data(
 996                 subreq, struct tevent_req);
 997         struct cli_writeall_state *state = tevent_req_data(
 998                 req, struct cli_writeall_state);
 999         NTSTATUS status;
1000         size_t written, to_write;
1001
1002         status = cli_write_andx_recv(subreq, &written);
1003         TALLOC_FREE(subreq);
1004         if (tevent_req_nterror(req, status)) {
1005                 return;
1006         }
1007
1008         state->written += written;
1009
1010         if (state->written > state->size) {
1011                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1012                 return;
1013         }
1014
1015         to_write = state->size - state->written;
1016
1017         if (to_write == 0) {
1018                 tevent_req_done(req);
1019                 return;
1020         }
1021
1022         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1023                                      state->mode,
1024                                      state->buf + state->written,
1025                                      state->offset + state->written, to_write);
1026         if (tevent_req_nomem(subreq, req)) {
1027                 return;
1028         }
1029         tevent_req_set_callback(subreq, cli_writeall_written, req);
1030 }
1031
1032 static NTSTATUS cli_writeall_recv(struct tevent_req *req,
1033                                   size_t *pwritten)
1034 {
1035         struct cli_writeall_state *state = tevent_req_data(
1036                 req, struct cli_writeall_state);
1037         NTSTATUS status;
1038
1039         if (tevent_req_is_nterror(req, &status)) {
1040                 return status;
1041         }
1042         if (pwritten != NULL) {
1043                 *pwritten = state->written;
1044         }
1045         return NT_STATUS_OK;
1046 }
1047
1048 NTSTATUS cli_writeall(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1049                       const uint8_t *buf, off_t offset, size_t size,
1050                       size_t *pwritten)
1051 {
1052         TALLOC_CTX *frame = talloc_stackframe();
1053         struct tevent_context *ev;
1054         struct tevent_req *req;
1055         NTSTATUS status = NT_STATUS_NO_MEMORY;
1056
1057         if (smbXcli_conn_has_async_calls(cli->conn)) {
1058                 /*
1059                  * Can't use sync call while an async call is in flight
1060                  */
1061                 status = NT_STATUS_INVALID_PARAMETER;
1062                 goto fail;
1063         }
1064         ev = samba_tevent_context_init(frame);
1065         if (ev == NULL) {
1066                 goto fail;
1067         }
1068         if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1069                 req = cli_smb2_writeall_send(frame, ev, cli, fnum, mode,
1070                                              buf, offset, size);
1071         } else {
1072                 req = cli_writeall_send(frame, ev, cli, fnum, mode,
1073                                         buf, offset, size);
1074         }
1075         if (req == NULL) {
1076                 goto fail;
1077         }
1078         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1079                 goto fail;
1080         }
1081         if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1082                 status = cli_smb2_writeall_recv(req, pwritten);
1083         } else {
1084                 status = cli_writeall_recv(req, pwritten);
1085         }
1086  fail:
1087         TALLOC_FREE(frame);
1088         return status;
1089 }
1090
1091 struct cli_push_chunk;
1092
1093 struct cli_push_state {
1094         struct tevent_context *ev;
1095         struct cli_state *cli;
1096         uint16_t fnum;
1097         uint16_t mode;
1098         off_t start_offset;
1099
1100         size_t (*source)(uint8_t *buf, size_t n, void *priv);
1101         void *priv;
1102
1103         bool eof;
1104
1105         size_t chunk_size;
1106         off_t next_offset;
1107
1108         /*
1109          * Outstanding requests
1110          *
1111          * The maximum is 256:
1112          * - which would be a window of 256 MByte
1113          *   for SMB2 with multi-credit
1114          *   or smb1 unix extentions.
1115          */
1116         uint16_t max_chunks;
1117         uint16_t num_chunks;
1118         uint16_t num_waiting;
1119         struct cli_push_chunk *chunks;
1120 };
1121
1122 struct cli_push_chunk {
1123         struct cli_push_chunk *prev, *next;
1124         struct tevent_req *req;/* This is the main request! Not the subreq */
1125         struct tevent_req *subreq;
1126         off_t ofs;
1127         uint8_t *buf;
1128         size_t total_size;
1129         size_t tmp_size;
1130         bool done;
1131 };
1132
1133 static void cli_push_setup_chunks(struct tevent_req *req);
1134 static void cli_push_chunk_ship(struct cli_push_chunk *chunk);
1135 static void cli_push_chunk_done(struct tevent_req *subreq);
1136
1137 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
1138                                  struct cli_state *cli,
1139                                  uint16_t fnum, uint16_t mode,
1140                                  off_t start_offset, size_t window_size,
1141                                  size_t (*source)(uint8_t *buf, size_t n,
1142                                                   void *priv),
1143                                  void *priv)
1144 {
1145         struct tevent_req *req;
1146         struct cli_push_state *state;
1147         size_t page_size = 1024;
1148         uint64_t tmp64;
1149
1150         req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1151         if (req == NULL) {
1152                 return NULL;
1153         }
1154         state->cli = cli;
1155         state->ev = ev;
1156         state->fnum = fnum;
1157         state->start_offset = start_offset;
1158         state->mode = mode;
1159         state->source = source;
1160         state->priv = priv;
1161         state->next_offset = start_offset;
1162
1163         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1164                 state->chunk_size = smb2cli_conn_max_write_size(cli->conn);
1165         } else {
1166                 state->chunk_size = cli_write_max_bufsize(cli, mode, 14);
1167         }
1168         if (state->chunk_size > page_size) {
1169                 state->chunk_size &= ~(page_size - 1);
1170         }
1171
1172         if (window_size == 0) {
1173                 /*
1174                  * We use 16 MByte as default window size.
1175                  */
1176                 window_size = 16 * 1024 * 1024;
1177         }
1178
1179         tmp64 = window_size/state->chunk_size;
1180         if ((window_size % state->chunk_size) > 0) {
1181                 tmp64 += 1;
1182         }
1183         tmp64 = MAX(tmp64, 1);
1184         tmp64 = MIN(tmp64, 256);
1185         state->max_chunks = tmp64;
1186
1187         /*
1188          * We defer the callback because of the complex
1189          * substate/subfunction logic
1190          */
1191         tevent_req_defer_callback(req, ev);
1192
1193         cli_push_setup_chunks(req);
1194         if (!tevent_req_is_in_progress(req)) {
1195                 return tevent_req_post(req, ev);
1196         }
1197
1198         return req;
1199 }
1200
1201 static void cli_push_setup_chunks(struct tevent_req *req)
1202 {
1203         struct cli_push_state *state =
1204                 tevent_req_data(req,
1205                 struct cli_push_state);
1206         struct cli_push_chunk *chunk, *next = NULL;
1207         size_t i;
1208
1209         for (chunk = state->chunks; chunk; chunk = next) {
1210                 /*
1211                  * Note that chunk might be removed from this call.
1212                  */
1213                 next = chunk->next;
1214                 cli_push_chunk_ship(chunk);
1215                 if (!tevent_req_is_in_progress(req)) {
1216                         return;
1217                 }
1218         }
1219
1220         for (i = state->num_chunks; i < state->max_chunks; i++) {
1221
1222                 if (state->num_waiting > 0) {
1223                         return;
1224                 }
1225
1226                 if (state->eof) {
1227                         break;
1228                 }
1229
1230                 chunk = talloc_zero(state, struct cli_push_chunk);
1231                 if (tevent_req_nomem(chunk, req)) {
1232                         return;
1233                 }
1234                 chunk->req = req;
1235                 chunk->ofs = state->next_offset;
1236                 chunk->buf = talloc_array(chunk,
1237                                           uint8_t,
1238                                           state->chunk_size);
1239                 if (tevent_req_nomem(chunk->buf, req)) {
1240                         return;
1241                 }
1242                 chunk->total_size = state->source(chunk->buf,
1243                                                   state->chunk_size,
1244                                                   state->priv);
1245                 if (chunk->total_size == 0) {
1246                         /* nothing to send */
1247                         talloc_free(chunk);
1248                         state->eof = true;
1249                         break;
1250                 }
1251                 state->next_offset += chunk->total_size;
1252
1253                 DLIST_ADD_END(state->chunks, chunk, NULL);
1254                 state->num_chunks++;
1255                 state->num_waiting++;
1256
1257                 cli_push_chunk_ship(chunk);
1258                 if (!tevent_req_is_in_progress(req)) {
1259                         return;
1260                 }
1261         }
1262
1263         if (!state->eof) {
1264                 return;
1265         }
1266
1267         if (state->num_chunks > 0) {
1268                 return;
1269         }
1270
1271         tevent_req_done(req);
1272 }
1273
1274 static void cli_push_chunk_ship(struct cli_push_chunk *chunk)
1275 {
1276         struct tevent_req *req = chunk->req;
1277         struct cli_push_state *state =
1278                 tevent_req_data(req,
1279                 struct cli_push_state);
1280         bool ok;
1281         const uint8_t *buf;
1282         off_t ofs;
1283         size_t size;
1284
1285         if (chunk->done) {
1286                 DLIST_REMOVE(state->chunks, chunk);
1287                 SMB_ASSERT(state->num_chunks > 0);
1288                 state->num_chunks--;
1289                 TALLOC_FREE(chunk);
1290
1291                 return;
1292         }
1293
1294         if (chunk->subreq != NULL) {
1295                 return;
1296         }
1297
1298         SMB_ASSERT(state->num_waiting > 0);
1299
1300         buf = chunk->buf + chunk->tmp_size;
1301         ofs = chunk->ofs + chunk->tmp_size;
1302         size = chunk->total_size - chunk->tmp_size;
1303
1304         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1305                 uint32_t max_size;
1306
1307                 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
1308                 if (!ok) {
1309                         return;
1310                 }
1311
1312                 /*
1313                  * downgrade depending on the available credits
1314                  */
1315                 size = MIN(max_size, size);
1316
1317                 chunk->subreq = cli_smb2_write_send(chunk,
1318                                                     state->ev,
1319                                                     state->cli,
1320                                                     state->fnum,
1321                                                     state->mode,
1322                                                     buf,
1323                                                     ofs,
1324                                                     size);
1325                 if (tevent_req_nomem(chunk->subreq, req)) {
1326                         return;
1327                 }
1328         } else {
1329                 ok = smb1cli_conn_req_possible(state->cli->conn);
1330                 if (!ok) {
1331                         return;
1332                 }
1333
1334                 chunk->subreq = cli_write_andx_send(chunk,
1335                                                     state->ev,
1336                                                     state->cli,
1337                                                     state->fnum,
1338                                                     state->mode,
1339                                                     buf,
1340                                                     ofs,
1341                                                     size);
1342                 if (tevent_req_nomem(chunk->subreq, req)) {
1343                         return;
1344                 }
1345         }
1346         tevent_req_set_callback(chunk->subreq,
1347                                 cli_push_chunk_done,
1348                                 chunk);
1349
1350         state->num_waiting--;
1351         return;
1352 }
1353
1354 static void cli_push_chunk_done(struct tevent_req *subreq)
1355 {
1356         struct cli_push_chunk *chunk =
1357                 tevent_req_callback_data(subreq,
1358                 struct cli_push_chunk);
1359         struct tevent_req *req = chunk->req;
1360         struct cli_push_state *state =
1361                 tevent_req_data(req,
1362                 struct cli_push_state);
1363         NTSTATUS status;
1364         size_t expected = chunk->total_size - chunk->tmp_size;
1365         size_t written;
1366
1367         chunk->subreq = NULL;
1368
1369         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1370                 status = cli_smb2_write_recv(subreq, &written);
1371         } else {
1372                 status = cli_write_andx_recv(subreq, &written);
1373         }
1374         TALLOC_FREE(subreq);
1375         if (tevent_req_nterror(req, status)) {
1376                 return;
1377         }
1378
1379         if (written > expected) {
1380                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1381                 return;
1382         }
1383
1384         if (written == 0) {
1385                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1386                 return;
1387         }
1388
1389         chunk->tmp_size += written;
1390
1391         if (chunk->tmp_size == chunk->total_size) {
1392                 chunk->done = true;
1393         } else {
1394                 state->num_waiting++;
1395         }
1396
1397         cli_push_setup_chunks(req);
1398 }
1399
1400 NTSTATUS cli_push_recv(struct tevent_req *req)
1401 {
1402         return tevent_req_simple_recv_ntstatus(req);
1403 }
1404
1405 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1406                   off_t start_offset, size_t window_size,
1407                   size_t (*source)(uint8_t *buf, size_t n, void *priv),
1408                   void *priv)
1409 {
1410         TALLOC_CTX *frame = talloc_stackframe();
1411         struct tevent_context *ev;
1412         struct tevent_req *req;
1413         NTSTATUS status = NT_STATUS_OK;
1414
1415         if (smbXcli_conn_has_async_calls(cli->conn)) {
1416                 /*
1417                  * Can't use sync call while an async call is in flight
1418                  */
1419                 status = NT_STATUS_INVALID_PARAMETER;
1420                 goto fail;
1421         }
1422
1423         ev = samba_tevent_context_init(frame);
1424         if (ev == NULL) {
1425                 status = NT_STATUS_NO_MEMORY;
1426                 goto fail;
1427         }
1428
1429         req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1430                             window_size, source, priv);
1431         if (req == NULL) {
1432                 status = NT_STATUS_NO_MEMORY;
1433                 goto fail;
1434         }
1435
1436         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1437                 goto fail;
1438         }
1439
1440         status = cli_push_recv(req);
1441  fail:
1442         TALLOC_FREE(frame);
1443         return status;
1444 }
1445
1446 #define SPLICE_BLOCK_SIZE 1024 * 1024
1447
1448 static NTSTATUS cli_splice_fallback(TALLOC_CTX *frame,
1449                                     struct cli_state *srccli,
1450                                     struct cli_state *dstcli,
1451                                     uint16_t src_fnum, uint16_t dst_fnum,
1452                                     off_t initial_size,
1453                                     off_t src_offset, off_t dst_offset,
1454                                     off_t *written,
1455                                     int (*splice_cb)(off_t n, void *priv),
1456                                     void *priv)
1457 {
1458         NTSTATUS status;
1459         uint8_t *buf = talloc_size(frame, SPLICE_BLOCK_SIZE);
1460         size_t nread;
1461         off_t remaining = initial_size;
1462
1463         while (remaining) {
1464                 status = cli_read(srccli, src_fnum,
1465                                   (char *)buf, src_offset, SPLICE_BLOCK_SIZE,
1466                                   &nread);
1467                 if (!NT_STATUS_IS_OK(status)) {
1468                         return status;
1469                 }
1470
1471                 status = cli_writeall(dstcli, dst_fnum, 0,
1472                                       buf, dst_offset, nread, NULL);
1473                 if (!NT_STATUS_IS_OK(status)) {
1474                         return status;
1475                 }
1476
1477                 if ((src_offset > INT64_MAX - nread) ||
1478                     (dst_offset > INT64_MAX - nread)) {
1479                         return NT_STATUS_FILE_TOO_LARGE;
1480                 }
1481                 src_offset += nread;
1482                 dst_offset += nread;
1483                 if (remaining < nread) {
1484                         return NT_STATUS_INTERNAL_ERROR;
1485                 }
1486                 remaining -= nread;
1487                 if (!splice_cb(initial_size - remaining, priv)) {
1488                         return NT_STATUS_CANCELLED;
1489                 }
1490         }
1491
1492         return NT_STATUS_OK;
1493 }
1494
1495 NTSTATUS cli_splice(struct cli_state *srccli, struct cli_state *dstcli,
1496                     uint16_t src_fnum, uint16_t dst_fnum,
1497                     off_t size,
1498                     off_t src_offset, off_t dst_offset,
1499                     off_t *written,
1500                     int (*splice_cb)(off_t n, void *priv), void *priv)
1501 {
1502         TALLOC_CTX *frame = talloc_stackframe();
1503         struct tevent_context *ev;
1504         struct tevent_req *req;
1505         NTSTATUS status = NT_STATUS_NO_MEMORY;
1506         bool retry_fallback = false;
1507
1508         if (smbXcli_conn_has_async_calls(srccli->conn) ||
1509             smbXcli_conn_has_async_calls(dstcli->conn))
1510         {
1511                 /*
1512                  * Can't use sync call while an async call is in flight
1513                  */
1514                 status = NT_STATUS_INVALID_PARAMETER;
1515                 goto out;
1516         }
1517
1518         do {
1519                 ev = samba_tevent_context_init(frame);
1520                 if (ev == NULL) {
1521                         goto out;
1522                 }
1523                 if (srccli == dstcli &&
1524                     smbXcli_conn_protocol(srccli->conn) >= PROTOCOL_SMB2_02 &&
1525                     !retry_fallback)
1526                 {
1527                         req = cli_smb2_splice_send(frame, ev,
1528                                                    srccli, src_fnum, dst_fnum,
1529                                                    size, src_offset, dst_offset,
1530                                                    splice_cb, priv);
1531                 } else {
1532                         status = cli_splice_fallback(frame,
1533                                                      srccli, dstcli,
1534                                                      src_fnum, dst_fnum,
1535                                                      size,
1536                                                      src_offset, dst_offset,
1537                                                      written,
1538                                                      splice_cb, priv);
1539                         goto out;
1540                 }
1541                 if (req == NULL) {
1542                         goto out;
1543                 }
1544                 if (!tevent_req_poll(req, ev)) {
1545                         status = map_nt_error_from_unix(errno);
1546                         goto out;
1547                 }
1548                 status = cli_smb2_splice_recv(req, written);
1549
1550                 /*
1551                  * Older versions of Samba don't support
1552                  * FSCTL_SRV_COPYCHUNK_WRITE so use the fallback.
1553                  */
1554                 retry_fallback = NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST);
1555         } while (retry_fallback);
1556
1557  out:
1558         TALLOC_FREE(frame);
1559         return status;
1560 }