2 Unix SMB/CIFS implementation.
3 Infrastructure for async SMB client requests
4 Copyright (C) Volker Lendecke 2008
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "../lib/async_req/async_sock.h"
22 #include "async_smb.h"
23 #include "smb_crypt.h"
26 * Read an smb packet asynchronously, discard keepalives
29 struct read_smb_state
{
30 struct tevent_context
*ev
;
35 static ssize_t
read_smb_more(uint8_t *buf
, size_t buflen
, void *private_data
);
36 static void read_smb_done(struct tevent_req
*subreq
);
38 static struct tevent_req
*read_smb_send(TALLOC_CTX
*mem_ctx
,
39 struct tevent_context
*ev
,
42 struct tevent_req
*result
, *subreq
;
43 struct read_smb_state
*state
;
45 result
= tevent_req_create(mem_ctx
, &state
, struct read_smb_state
);
52 subreq
= read_packet_send(state
, ev
, fd
, 4, read_smb_more
, NULL
);
56 tevent_req_set_callback(subreq
, read_smb_done
, result
);
63 static ssize_t
read_smb_more(uint8_t *buf
, size_t buflen
, void *private_data
)
66 return 0; /* We've been here, we're done */
68 return smb_len_large(buf
);
71 static void read_smb_done(struct tevent_req
*subreq
)
73 struct tevent_req
*req
= tevent_req_callback_data(
74 subreq
, struct tevent_req
);
75 struct read_smb_state
*state
= tevent_req_data(
76 req
, struct read_smb_state
);
80 len
= read_packet_recv(subreq
, state
, &state
->buf
, &err
);
83 tevent_req_error(req
, err
);
87 if (CVAL(state
->buf
, 0) == SMBkeepalive
) {
88 subreq
= read_packet_send(state
, state
->ev
, state
->fd
, 4,
90 if (tevent_req_nomem(subreq
, req
)) {
93 tevent_req_set_callback(subreq
, read_smb_done
, req
);
99 static ssize_t
read_smb_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
100 uint8_t **pbuf
, int *perrno
)
102 struct read_smb_state
*state
= tevent_req_data(
103 req
, struct read_smb_state
);
105 if (tevent_req_is_unix_error(req
, perrno
)) {
108 *pbuf
= talloc_move(mem_ctx
, &state
->buf
);
109 return talloc_get_size(*pbuf
);
113 * Fetch an error out of a NBT packet
114 * @param[in] buf The SMB packet
115 * @retval The error, converted to NTSTATUS
118 NTSTATUS
cli_pull_error(char *buf
)
120 uint32_t flags2
= SVAL(buf
, smb_flg2
);
122 if (flags2
& FLAGS2_32_BIT_ERROR_CODES
) {
123 return NT_STATUS(IVAL(buf
, smb_rcls
));
126 return dos_to_ntstatus(CVAL(buf
, smb_rcls
), SVAL(buf
,smb_err
));
130 * Compatibility helper for the sync APIs: Fake NTSTATUS in cli->inbuf
131 * @param[in] cli The client connection that just received an error
132 * @param[in] status The error to set on "cli"
135 void cli_set_error(struct cli_state
*cli
, NTSTATUS status
)
137 uint32_t flags2
= SVAL(cli
->inbuf
, smb_flg2
);
139 if (NT_STATUS_IS_DOS(status
)) {
140 SSVAL(cli
->inbuf
, smb_flg2
,
141 flags2
& ~FLAGS2_32_BIT_ERROR_CODES
);
142 SCVAL(cli
->inbuf
, smb_rcls
, NT_STATUS_DOS_CLASS(status
));
143 SSVAL(cli
->inbuf
, smb_err
, NT_STATUS_DOS_CODE(status
));
147 SSVAL(cli
->inbuf
, smb_flg2
, flags2
| FLAGS2_32_BIT_ERROR_CODES
);
148 SIVAL(cli
->inbuf
, smb_rcls
, NT_STATUS_V(status
));
153 * Figure out if there is an andx command behind the current one
154 * @param[in] buf The smb buffer to look at
155 * @param[in] ofs The offset to the wct field that is followed by the cmd
156 * @retval Is there a command following?
159 static bool have_andx_command(const char *buf
, uint16_t ofs
)
162 size_t buflen
= talloc_get_size(buf
);
164 if ((ofs
== buflen
-1) || (ofs
== buflen
)) {
168 wct
= CVAL(buf
, ofs
);
171 * Not enough space for the command and a following pointer
175 return (CVAL(buf
, ofs
+1) != 0xff);
178 #define MAX_SMB_IOV 5
180 struct cli_smb_state
{
181 struct tevent_context
*ev
;
182 struct cli_state
*cli
;
183 uint8_t header
[smb_wct
+1]; /* Space for the header including the wct */
186 * For normal requests, cli_smb_req_send chooses a mid. Secondary
187 * trans requests need to use the mid of the primary request, so we
188 * need a place to store it. Assume it's set if != 0.
193 uint8_t bytecount_buf
[2];
195 struct iovec iov
[MAX_SMB_IOV
+3];
202 struct tevent_req
**chained_requests
;
205 static uint16_t cli_alloc_mid(struct cli_state
*cli
)
207 int num_pending
= talloc_array_length(cli
->pending
);
214 if ((result
== 0) || (result
== 0xffff)) {
218 for (i
=0; i
<num_pending
; i
++) {
219 if (result
== cli_smb_req_mid(cli
->pending
[i
])) {
224 if (i
== num_pending
) {
230 void cli_smb_req_unset_pending(struct tevent_req
*req
)
232 struct cli_smb_state
*state
= tevent_req_data(
233 req
, struct cli_smb_state
);
234 struct cli_state
*cli
= state
->cli
;
235 int num_pending
= talloc_array_length(cli
->pending
);
238 if (num_pending
== 1) {
240 * The pending read_smb tevent_req is a child of
241 * cli->pending. So if nothing is pending anymore, we need to
242 * delete the socket read fde.
244 TALLOC_FREE(cli
->pending
);
248 for (i
=0; i
<num_pending
; i
++) {
249 if (req
== cli
->pending
[i
]) {
253 if (i
== num_pending
) {
255 * Something's seriously broken. Just returning here is the
256 * right thing nevertheless, the point of this routine is to
257 * remove ourselves from cli->pending.
263 * Remove ourselves from the cli->pending array
265 if (num_pending
> 1) {
266 cli
->pending
[i
] = cli
->pending
[num_pending
-1];
270 * No NULL check here, we're shrinking by sizeof(void *), and
271 * talloc_realloc just adjusts the size for this.
273 cli
->pending
= talloc_realloc(NULL
, cli
->pending
, struct tevent_req
*,
278 static int cli_smb_req_destructor(struct tevent_req
*req
)
280 cli_smb_req_unset_pending(req
);
284 static void cli_smb_received(struct tevent_req
*subreq
);
286 bool cli_smb_req_set_pending(struct tevent_req
*req
)
288 struct cli_smb_state
*state
= tevent_req_data(
289 req
, struct cli_smb_state
);
290 struct cli_state
*cli
;
291 struct tevent_req
**pending
;
293 struct tevent_req
*subreq
;
296 num_pending
= talloc_array_length(cli
->pending
);
298 pending
= talloc_realloc(cli
, cli
->pending
, struct tevent_req
*,
300 if (pending
== NULL
) {
303 pending
[num_pending
] = req
;
304 cli
->pending
= pending
;
305 talloc_set_destructor(req
, cli_smb_req_destructor
);
307 if (num_pending
> 0) {
312 * We're the first ones, add the read_smb request that waits for the
313 * answer from the server
315 subreq
= read_smb_send(cli
->pending
, state
->ev
, cli
->fd
);
316 if (subreq
== NULL
) {
317 cli_smb_req_unset_pending(req
);
320 tevent_req_set_callback(subreq
, cli_smb_received
, cli
);
325 * Fetch a smb request's mid. Only valid after the request has been sent by
326 * cli_smb_req_send().
328 uint16_t cli_smb_req_mid(struct tevent_req
*req
)
330 struct cli_smb_state
*state
= tevent_req_data(
331 req
, struct cli_smb_state
);
332 return SVAL(state
->header
, smb_mid
);
335 void cli_smb_req_set_mid(struct tevent_req
*req
, uint16_t mid
)
337 struct cli_smb_state
*state
= tevent_req_data(
338 req
, struct cli_smb_state
);
342 static size_t iov_len(const struct iovec
*iov
, int count
)
346 for (i
=0; i
<count
; i
++) {
347 result
+= iov
[i
].iov_len
;
352 static uint8_t *iov_concat(TALLOC_CTX
*mem_ctx
, const struct iovec
*iov
,
355 size_t len
= iov_len(iov
, count
);
360 buf
= talloc_array(mem_ctx
, uint8_t, len
);
365 for (i
=0; i
<count
; i
++) {
366 memcpy(buf
+copied
, iov
[i
].iov_base
, iov
[i
].iov_len
);
367 copied
+= iov
[i
].iov_len
;
372 struct tevent_req
*cli_smb_req_create(TALLOC_CTX
*mem_ctx
,
373 struct event_context
*ev
,
374 struct cli_state
*cli
,
376 uint8_t additional_flags
,
377 uint8_t wct
, uint16_t *vwv
,
379 struct iovec
*bytes_iov
)
381 struct tevent_req
*result
;
382 struct cli_smb_state
*state
;
383 struct timeval endtime
;
385 if (iov_count
> MAX_SMB_IOV
) {
387 * Should not happen :-)
392 result
= tevent_req_create(mem_ctx
, &state
, struct cli_smb_state
);
393 if (result
== NULL
) {
398 state
->mid
= 0; /* Set to auto-choose in cli_smb_req_send */
399 state
->chain_num
= 0;
400 state
->chained_requests
= NULL
;
402 cli_setup_packet_buf(cli
, (char *)state
->header
);
403 SCVAL(state
->header
, smb_com
, smb_command
);
404 SSVAL(state
->header
, smb_tid
, cli
->cnum
);
405 SCVAL(state
->header
, smb_wct
, wct
);
409 SSVAL(state
->bytecount_buf
, 0, iov_len(bytes_iov
, iov_count
));
411 state
->iov
[0].iov_base
= (void *)state
->header
;
412 state
->iov
[0].iov_len
= sizeof(state
->header
);
413 state
->iov
[1].iov_base
= (void *)state
->vwv
;
414 state
->iov
[1].iov_len
= wct
* sizeof(uint16_t);
415 state
->iov
[2].iov_base
= (void *)state
->bytecount_buf
;
416 state
->iov
[2].iov_len
= sizeof(uint16_t);
418 if (iov_count
!= 0) {
419 memcpy(&state
->iov
[3], bytes_iov
,
420 iov_count
* sizeof(*bytes_iov
));
422 state
->iov_count
= iov_count
+ 3;
425 endtime
= timeval_current_ofs(0, cli
->timeout
* 1000);
426 if (!tevent_req_set_endtime(result
, ev
, endtime
)) {
427 tevent_req_nomem(NULL
, result
);
433 static NTSTATUS
cli_signv(struct cli_state
*cli
, struct iovec
*iov
, int count
,
439 * Obvious optimization: Make cli_calculate_sign_mac work with struct
440 * iovec directly. MD5Update would do that just fine.
443 if ((count
<= 0) || (iov
[0].iov_len
< smb_wct
)) {
444 return NT_STATUS_INVALID_PARAMETER
;
447 buf
= iov_concat(talloc_tos(), iov
, count
);
449 return NT_STATUS_NO_MEMORY
;
452 cli_calculate_sign_mac(cli
, (char *)buf
, seqnum
);
453 memcpy(iov
[0].iov_base
, buf
, iov
[0].iov_len
);
459 static void cli_smb_sent(struct tevent_req
*subreq
);
461 static NTSTATUS
cli_smb_req_iov_send(struct tevent_req
*req
,
462 struct cli_smb_state
*state
,
463 struct iovec
*iov
, int iov_count
)
465 struct tevent_req
*subreq
;
468 if (state
->cli
->fd
== -1) {
469 return NT_STATUS_CONNECTION_INVALID
;
472 if (iov
[0].iov_len
< smb_wct
) {
473 return NT_STATUS_INVALID_PARAMETER
;
476 if (state
->mid
!= 0) {
477 SSVAL(iov
[0].iov_base
, smb_mid
, state
->mid
);
479 uint16_t mid
= cli_alloc_mid(state
->cli
);
480 SSVAL(iov
[0].iov_base
, smb_mid
, mid
);
483 smb_setlen((char *)iov
[0].iov_base
, iov_len(iov
, iov_count
) - 4);
485 status
= cli_signv(state
->cli
, iov
, iov_count
, &state
->seqnum
);
487 if (!NT_STATUS_IS_OK(status
)) {
491 if (cli_encryption_on(state
->cli
)) {
494 buf
= (char *)iov_concat(talloc_tos(), iov
, iov_count
);
496 return NT_STATUS_NO_MEMORY
;
498 status
= cli_encrypt_message(state
->cli
, (char *)buf
,
501 if (!NT_STATUS_IS_OK(status
)) {
502 DEBUG(0, ("Error in encrypting client message: %s\n",
506 buf
= (char *)talloc_memdup(state
, enc_buf
,
510 return NT_STATUS_NO_MEMORY
;
512 iov
[0].iov_base
= (void *)buf
;
513 iov
[0].iov_len
= talloc_get_size(buf
);
516 subreq
= writev_send(state
, state
->ev
, state
->cli
->outgoing
,
517 state
->cli
->fd
, false, iov
, iov_count
);
518 if (subreq
== NULL
) {
519 return NT_STATUS_NO_MEMORY
;
521 tevent_req_set_callback(subreq
, cli_smb_sent
, req
);
525 NTSTATUS
cli_smb_req_send(struct tevent_req
*req
)
527 struct cli_smb_state
*state
= tevent_req_data(
528 req
, struct cli_smb_state
);
530 return cli_smb_req_iov_send(req
, state
, state
->iov
, state
->iov_count
);
533 struct tevent_req
*cli_smb_send(TALLOC_CTX
*mem_ctx
,
534 struct event_context
*ev
,
535 struct cli_state
*cli
,
537 uint8_t additional_flags
,
538 uint8_t wct
, uint16_t *vwv
,
540 const uint8_t *bytes
)
542 struct tevent_req
*req
;
546 iov
.iov_base
= CONST_DISCARD(void *, bytes
);
547 iov
.iov_len
= num_bytes
;
549 req
= cli_smb_req_create(mem_ctx
, ev
, cli
, smb_command
,
550 additional_flags
, wct
, vwv
, 1, &iov
);
555 status
= cli_smb_req_send(req
);
556 if (!NT_STATUS_IS_OK(status
)) {
557 tevent_req_nterror(req
, status
);
558 return tevent_req_post(req
, ev
);
563 static void cli_smb_sent(struct tevent_req
*subreq
)
565 struct tevent_req
*req
= tevent_req_callback_data(
566 subreq
, struct tevent_req
);
567 struct cli_smb_state
*state
= tevent_req_data(
568 req
, struct cli_smb_state
);
572 nwritten
= writev_recv(subreq
, &err
);
574 if (nwritten
== -1) {
575 if (state
->cli
->fd
!= -1) {
576 close(state
->cli
->fd
);
579 tevent_req_nterror(req
, map_nt_error_from_unix(err
));
583 switch (CVAL(state
->header
, smb_com
)) {
589 tevent_req_done(req
);
592 if ((CVAL(state
->header
, smb_wct
) == 8) &&
593 (CVAL(state
->vwv
+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE
)) {
595 tevent_req_done(req
);
600 if (!cli_smb_req_set_pending(req
)) {
601 tevent_req_nterror(req
, NT_STATUS_NO_MEMORY
);
606 static void cli_smb_received(struct tevent_req
*subreq
)
608 struct cli_state
*cli
= tevent_req_callback_data(
609 subreq
, struct cli_state
);
610 struct tevent_req
*req
;
611 struct cli_smb_state
*state
;
620 received
= read_smb_recv(subreq
, talloc_tos(), &inbuf
, &err
);
622 if (received
== -1) {
627 status
= map_nt_error_from_unix(err
);
631 if ((IVAL(inbuf
, 4) != 0x424d53ff) /* 0xFF"SMB" */
632 && (SVAL(inbuf
, 4) != 0x45ff)) /* 0xFF"E" */ {
633 DEBUG(10, ("Got non-SMB PDU\n"));
634 status
= NT_STATUS_INVALID_NETWORK_RESPONSE
;
638 if (cli_encryption_on(cli
) && (CVAL(inbuf
, 0) == 0)) {
639 uint16_t enc_ctx_num
;
641 status
= get_enc_ctx_num(inbuf
, &enc_ctx_num
);
642 if (!NT_STATUS_IS_OK(status
)) {
643 DEBUG(10, ("get_enc_ctx_num returned %s\n",
648 if (enc_ctx_num
!= cli
->trans_enc_state
->enc_ctx_num
) {
649 DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
651 cli
->trans_enc_state
->enc_ctx_num
));
652 status
= NT_STATUS_INVALID_HANDLE
;
656 status
= common_decrypt_buffer(cli
->trans_enc_state
,
658 if (!NT_STATUS_IS_OK(status
)) {
659 DEBUG(10, ("common_decrypt_buffer returned %s\n",
665 mid
= SVAL(inbuf
, smb_mid
);
666 num_pending
= talloc_array_length(cli
->pending
);
668 for (i
=0; i
<num_pending
; i
++) {
669 if (mid
== cli_smb_req_mid(cli
->pending
[i
])) {
673 if (i
== num_pending
) {
674 /* Dump unexpected reply */
679 oplock_break
= false;
683 * Paranoia checks that this is really an oplock break request.
685 oplock_break
= (smb_len(inbuf
) == 51); /* hdr + 8 words */
686 oplock_break
&= ((CVAL(inbuf
, smb_flg
) & FLAG_REPLY
) == 0);
687 oplock_break
&= (CVAL(inbuf
, smb_com
) == SMBlockingX
);
688 oplock_break
&= (SVAL(inbuf
, smb_vwv6
) == 0);
689 oplock_break
&= (SVAL(inbuf
, smb_vwv7
) == 0);
692 /* Dump unexpected reply */
698 req
= cli
->pending
[i
];
699 state
= tevent_req_data(req
, struct cli_smb_state
);
701 if (!oplock_break
/* oplock breaks are not signed */
702 && !cli_check_sign_mac(cli
, (char *)inbuf
, state
->seqnum
+1)) {
703 DEBUG(10, ("cli_check_sign_mac failed\n"));
705 status
= NT_STATUS_ACCESS_DENIED
;
711 if (state
->chained_requests
== NULL
) {
712 state
->inbuf
= talloc_move(state
, &inbuf
);
713 talloc_set_destructor(req
, NULL
);
714 cli_smb_req_destructor(req
);
715 state
->chain_num
= 0;
716 state
->chain_length
= 1;
717 tevent_req_done(req
);
719 struct tevent_req
**chain
= talloc_move(
720 talloc_tos(), &state
->chained_requests
);
721 int num_chained
= talloc_array_length(chain
);
723 for (i
=0; i
<num_chained
; i
++) {
724 state
= tevent_req_data(chain
[i
], struct
726 state
->inbuf
= inbuf
;
727 state
->chain_num
= i
;
728 state
->chain_length
= num_chained
;
729 tevent_req_done(chain
[i
]);
735 if (talloc_array_length(cli
->pending
) > 0) {
737 * Set up another read request for the other pending cli_smb
740 state
= tevent_req_data(cli
->pending
[0], struct cli_smb_state
);
741 subreq
= read_smb_send(cli
->pending
, state
->ev
, cli
->fd
);
742 if (subreq
== NULL
) {
743 status
= NT_STATUS_NO_MEMORY
;
746 tevent_req_set_callback(subreq
, cli_smb_received
, cli
);
751 * Cancel all pending requests. We don't do a for-loop walking
752 * cli->pending because that array changes in
753 * cli_smb_req_destructor().
755 while (talloc_array_length(cli
->pending
) > 0) {
756 req
= cli
->pending
[0];
757 talloc_set_destructor(req
, NULL
);
758 cli_smb_req_destructor(req
);
759 tevent_req_nterror(req
, status
);
763 NTSTATUS
cli_smb_recv(struct tevent_req
*req
,
764 TALLOC_CTX
*mem_ctx
, uint8_t **pinbuf
,
765 uint8_t min_wct
, uint8_t *pwct
, uint16_t **pvwv
,
766 uint32_t *pnum_bytes
, uint8_t **pbytes
)
768 struct cli_smb_state
*state
= tevent_req_data(
769 req
, struct cli_smb_state
);
770 NTSTATUS status
= NT_STATUS_OK
;
773 size_t wct_ofs
, bytes_offset
;
776 if (tevent_req_is_nterror(req
, &status
)) {
780 if (state
->inbuf
== NULL
) {
781 /* This was a request without a reply */
786 cmd
= CVAL(state
->inbuf
, smb_com
);
788 for (i
=0; i
<state
->chain_num
; i
++) {
789 if (i
< state
->chain_num
-1) {
791 return NT_STATUS_REQUEST_ABORTED
;
793 if (!is_andx_req(cmd
)) {
794 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
798 if (!have_andx_command((char *)state
->inbuf
, wct_ofs
)) {
800 * This request was not completed because a previous
801 * request in the chain had received an error.
803 return NT_STATUS_REQUEST_ABORTED
;
806 wct_ofs
= SVAL(state
->inbuf
, wct_ofs
+ 3);
809 * Skip the all-present length field. No overflow, we've just
810 * put a 16-bit value into a size_t.
814 if (wct_ofs
+2 > talloc_get_size(state
->inbuf
)) {
815 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
818 cmd
= CVAL(state
->inbuf
, wct_ofs
+ 1);
821 status
= cli_pull_error((char *)state
->inbuf
);
823 if (!have_andx_command((char *)state
->inbuf
, wct_ofs
)) {
825 if ((cmd
== SMBsesssetupX
)
827 status
, NT_STATUS_MORE_PROCESSING_REQUIRED
)) {
829 * NT_STATUS_MORE_PROCESSING_REQUIRED is a
830 * valid return code for session setup
835 if (NT_STATUS_IS_ERR(status
)) {
837 * The last command takes the error code. All
838 * further commands down the requested chain
839 * will get a NT_STATUS_REQUEST_ABORTED.
847 wct
= CVAL(state
->inbuf
, wct_ofs
);
848 bytes_offset
= wct_ofs
+ 1 + wct
* sizeof(uint16_t);
849 num_bytes
= SVAL(state
->inbuf
, bytes_offset
);
852 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
856 * wct_ofs is a 16-bit value plus 4, wct is a 8-bit value, num_bytes
857 * is a 16-bit value. So bytes_offset being size_t should be far from
860 if ((bytes_offset
+ 2 > talloc_get_size(state
->inbuf
))
861 || (bytes_offset
> 0xffff)) {
862 return NT_STATUS_INVALID_NETWORK_RESPONSE
;
869 *pvwv
= (uint16_t *)(state
->inbuf
+ wct_ofs
+ 1);
871 if (pnum_bytes
!= NULL
) {
872 *pnum_bytes
= num_bytes
;
874 if (pbytes
!= NULL
) {
875 *pbytes
= (uint8_t *)state
->inbuf
+ bytes_offset
+ 2;
877 if ((mem_ctx
!= NULL
) && (pinbuf
!= NULL
)) {
878 if (state
->chain_num
== state
->chain_length
-1) {
879 *pinbuf
= talloc_move(mem_ctx
, &state
->inbuf
);
881 *pinbuf
= state
->inbuf
;
888 size_t cli_smb_wct_ofs(struct tevent_req
**reqs
, int num_reqs
)
893 wct_ofs
= smb_wct
- 4;
895 for (i
=0; i
<num_reqs
; i
++) {
896 struct cli_smb_state
*state
;
897 state
= tevent_req_data(reqs
[i
], struct cli_smb_state
);
898 wct_ofs
+= iov_len(state
->iov
+1, state
->iov_count
-1);
899 wct_ofs
= (wct_ofs
+ 3) & ~3;
904 NTSTATUS
cli_smb_chain_send(struct tevent_req
**reqs
, int num_reqs
)
906 struct cli_smb_state
*first_state
= tevent_req_data(
907 reqs
[0], struct cli_smb_state
);
908 struct cli_smb_state
*last_state
= tevent_req_data(
909 reqs
[num_reqs
-1], struct cli_smb_state
);
910 struct cli_smb_state
*state
;
912 size_t chain_padding
= 0;
914 struct iovec
*iov
= NULL
;
915 struct iovec
*this_iov
;
919 for (i
=0; i
<num_reqs
; i
++) {
920 state
= tevent_req_data(reqs
[i
], struct cli_smb_state
);
921 iovlen
+= state
->iov_count
;
924 iov
= talloc_array(last_state
, struct iovec
, iovlen
);
926 return NT_STATUS_NO_MEMORY
;
929 first_state
->chained_requests
= (struct tevent_req
**)talloc_memdup(
930 last_state
, reqs
, sizeof(*reqs
) * num_reqs
);
931 if (first_state
->chained_requests
== NULL
) {
933 return NT_STATUS_NO_MEMORY
;
936 wct_offset
= smb_wct
- 4;
939 for (i
=0; i
<num_reqs
; i
++) {
940 size_t next_padding
= 0;
943 state
= tevent_req_data(reqs
[i
], struct cli_smb_state
);
945 if (i
< num_reqs
-1) {
946 if (!is_andx_req(CVAL(state
->header
, smb_com
))
947 || CVAL(state
->header
, smb_wct
) < 2) {
949 TALLOC_FREE(first_state
->chained_requests
);
950 return NT_STATUS_INVALID_PARAMETER
;
954 wct_offset
+= iov_len(state
->iov
+1, state
->iov_count
-1) + 1;
955 if ((wct_offset
% 4) != 0) {
956 next_padding
= 4 - (wct_offset
% 4);
958 wct_offset
+= next_padding
;
961 if (i
< num_reqs
-1) {
962 struct cli_smb_state
*next_state
= tevent_req_data(
963 reqs
[i
+1], struct cli_smb_state
);
964 SCVAL(vwv
+0, 0, CVAL(next_state
->header
, smb_com
));
966 SSVAL(vwv
+1, 0, wct_offset
);
967 } else if (is_andx_req(CVAL(state
->header
, smb_com
))) {
968 /* properly end the chain */
969 SCVAL(vwv
+0, 0, 0xff);
970 SCVAL(vwv
+0, 1, 0xff);
975 this_iov
[0] = state
->iov
[0];
978 * This one is a bit subtle. We have to add
979 * chain_padding bytes between the requests, and we
980 * have to also include the wct field of the
981 * subsequent requests. We use the subsequent header
982 * for the padding, it contains the wct field in its
985 this_iov
[0].iov_len
= chain_padding
+1;
986 this_iov
[0].iov_base
= (void *)&state
->header
[
987 sizeof(state
->header
) - this_iov
[0].iov_len
];
988 memset(this_iov
[0].iov_base
, 0, this_iov
[0].iov_len
-1);
990 memcpy(this_iov
+1, state
->iov
+1,
991 sizeof(struct iovec
) * (state
->iov_count
-1));
992 this_iov
+= state
->iov_count
;
993 chain_padding
= next_padding
;
996 status
= cli_smb_req_iov_send(reqs
[0], last_state
, iov
, iovlen
);
997 if (!NT_STATUS_IS_OK(status
)) {
999 TALLOC_FREE(first_state
->chained_requests
);
1003 return NT_STATUS_OK
;
1006 uint8_t *cli_smb_inbuf(struct tevent_req
*req
)
1008 struct cli_smb_state
*state
= tevent_req_data(
1009 req
, struct cli_smb_state
);
1010 return state
->inbuf
;
1013 bool cli_has_async_calls(struct cli_state
*cli
)
1015 return ((tevent_queue_length(cli
->outgoing
) != 0)
1016 || (talloc_array_length(cli
->pending
) != 0));
1019 struct cli_smb_oplock_break_waiter_state
{
1024 static void cli_smb_oplock_break_waiter_done(struct tevent_req
*subreq
);
1026 struct tevent_req
*cli_smb_oplock_break_waiter_send(TALLOC_CTX
*mem_ctx
,
1027 struct event_context
*ev
,
1028 struct cli_state
*cli
)
1030 struct tevent_req
*req
, *subreq
;
1031 struct cli_smb_oplock_break_waiter_state
*state
;
1032 struct cli_smb_state
*smb_state
;
1034 req
= tevent_req_create(mem_ctx
, &state
,
1035 struct cli_smb_oplock_break_waiter_state
);
1041 * Create a fake SMB request that we will never send out. This is only
1042 * used to be set into the pending queue with the right mid.
1044 subreq
= cli_smb_req_create(mem_ctx
, ev
, cli
, 0, 0, 0, NULL
, 0, NULL
);
1045 if (tevent_req_nomem(subreq
, req
)) {
1046 return tevent_req_post(req
, ev
);
1048 smb_state
= tevent_req_data(subreq
, struct cli_smb_state
);
1049 SSVAL(smb_state
->header
, smb_mid
, 0xffff);
1051 if (!cli_smb_req_set_pending(subreq
)) {
1052 tevent_req_nterror(req
, NT_STATUS_NO_MEMORY
);
1053 return tevent_req_post(req
, ev
);
1055 tevent_req_set_callback(subreq
, cli_smb_oplock_break_waiter_done
, req
);
1059 static void cli_smb_oplock_break_waiter_done(struct tevent_req
*subreq
)
1061 struct tevent_req
*req
= tevent_req_callback_data(
1062 subreq
, struct tevent_req
);
1063 struct cli_smb_oplock_break_waiter_state
*state
= tevent_req_data(
1064 req
, struct cli_smb_oplock_break_waiter_state
);
1072 status
= cli_smb_recv(subreq
, state
, &inbuf
, 8, &wct
, &vwv
,
1073 &num_bytes
, &bytes
);
1074 TALLOC_FREE(subreq
);
1075 if (!NT_STATUS_IS_OK(status
)) {
1076 tevent_req_nterror(req
, status
);
1079 state
->fnum
= SVAL(vwv
+2, 0);
1080 state
->level
= CVAL(vwv
+3, 1);
1081 tevent_req_done(req
);
1084 NTSTATUS
cli_smb_oplock_break_waiter_recv(struct tevent_req
*req
,
1088 struct cli_smb_oplock_break_waiter_state
*state
= tevent_req_data(
1089 req
, struct cli_smb_oplock_break_waiter_state
);
1092 if (tevent_req_is_nterror(req
, &status
)) {
1095 *pfnum
= state
->fnum
;
1096 *plevel
= state
->level
;
1097 return NT_STATUS_OK
;
1101 struct cli_session_request_state
{
1102 struct tevent_context
*ev
;
1105 struct iovec iov
[3];
1106 uint8_t nb_session_response
;
1109 static void cli_session_request_sent(struct tevent_req
*subreq
);
1110 static void cli_session_request_recvd(struct tevent_req
*subreq
);
1112 struct tevent_req
*cli_session_request_send(TALLOC_CTX
*mem_ctx
,
1113 struct tevent_context
*ev
,
1115 const struct nmb_name
*called
,
1116 const struct nmb_name
*calling
)
1118 struct tevent_req
*req
, *subreq
;
1119 struct cli_session_request_state
*state
;
1121 req
= tevent_req_create(mem_ctx
, &state
,
1122 struct cli_session_request_state
);
1129 state
->iov
[1].iov_base
= name_mangle(
1130 state
, called
->name
, called
->name_type
);
1131 if (tevent_req_nomem(state
->iov
[1].iov_base
, req
)) {
1132 return tevent_req_post(req
, ev
);
1134 state
->iov
[1].iov_len
= name_len(
1135 (unsigned char *)state
->iov
[1].iov_base
,
1136 talloc_get_size(state
->iov
[1].iov_base
));
1138 state
->iov
[2].iov_base
= name_mangle(
1139 state
, calling
->name
, calling
->name_type
);
1140 if (tevent_req_nomem(state
->iov
[2].iov_base
, req
)) {
1141 return tevent_req_post(req
, ev
);
1143 state
->iov
[2].iov_len
= name_len(
1144 (unsigned char *)state
->iov
[2].iov_base
,
1145 talloc_get_size(state
->iov
[2].iov_base
));
1147 _smb_setlen(((char *)&state
->len_hdr
),
1148 state
->iov
[1].iov_len
+ state
->iov
[2].iov_len
);
1149 SCVAL((char *)&state
->len_hdr
, 0, 0x81);
1151 state
->iov
[0].iov_base
= &state
->len_hdr
;
1152 state
->iov
[0].iov_len
= sizeof(state
->len_hdr
);
1154 subreq
= writev_send(state
, ev
, NULL
, sock
, true, state
->iov
, 3);
1155 if (tevent_req_nomem(subreq
, req
)) {
1156 return tevent_req_post(req
, ev
);
1158 tevent_req_set_callback(subreq
, cli_session_request_sent
, req
);
1162 static void cli_session_request_sent(struct tevent_req
*subreq
)
1164 struct tevent_req
*req
= tevent_req_callback_data(
1165 subreq
, struct tevent_req
);
1166 struct cli_session_request_state
*state
= tevent_req_data(
1167 req
, struct cli_session_request_state
);
1171 ret
= writev_recv(subreq
, &err
);
1172 TALLOC_FREE(subreq
);
1174 tevent_req_error(req
, err
);
1177 subreq
= read_smb_send(state
, state
->ev
, state
->sock
);
1178 if (tevent_req_nomem(subreq
, req
)) {
1181 tevent_req_set_callback(subreq
, cli_session_request_recvd
, req
);
1184 static void cli_session_request_recvd(struct tevent_req
*subreq
)
1186 struct tevent_req
*req
= tevent_req_callback_data(
1187 subreq
, struct tevent_req
);
1188 struct cli_session_request_state
*state
= tevent_req_data(
1189 req
, struct cli_session_request_state
);
1194 ret
= read_smb_recv(subreq
, talloc_tos(), &buf
, &err
);
1195 TALLOC_FREE(subreq
);
1202 tevent_req_error(req
, err
);
1206 * In case of an error there is more information in the data
1207 * portion according to RFC1002. We're not subtle enough to
1208 * respond to the different error conditions, so drop the
1211 state
->nb_session_response
= CVAL(buf
, 0);
1212 tevent_req_done(req
);
1215 bool cli_session_request_recv(struct tevent_req
*req
, int *err
, uint8_t *resp
)
1217 struct cli_session_request_state
*state
= tevent_req_data(
1218 req
, struct cli_session_request_state
);
1220 if (tevent_req_is_unix_error(req
, err
)) {
1223 *resp
= state
->nb_session_response
;