?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
CVE-2020-10730: selftest: Add test to confirm VLV interaction with ASQ
[Samba.git] / source3 / libsmb / clireadwrite.c
blob9349b9485e8d2baf1fe2a6d23edb50aba18db9c4
1 /*
2 Unix SMB/CIFS implementation.
3 client file read/write routines
4 Copyright (C) Andrew Tridgell 1994-1998
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "libsmb/libsmb.h"
22 #include "../lib/util/tevent_ntstatus.h"
23 #include "async_smb.h"
24 #include "trans2.h"
25 #include "../libcli/smb/smbXcli_base.h"
26
27 /****************************************************************************
28 Calculate the recommended read buffer size
29 ****************************************************************************/
30 static size_t cli_read_max_bufsize(struct cli_state *cli)
31 {
32 uint8_t wct = 12;
33 uint32_t min_space;
34 uint32_t data_offset;
35 uint32_t useable_space = 0;
36
37 data_offset = HDR_VWV;
38 data_offset += wct * sizeof(uint16_t);
39 data_offset += sizeof(uint16_t); /* byte count */
40 data_offset += 1; /* pad */
41
42 min_space = cli_state_available_size(cli, data_offset);
43
44 if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_READ_CAP) {
45 useable_space = 0xFFFFFF - data_offset;
46
47 if (smb1cli_conn_signing_is_active(cli->conn)) {
48 return min_space;
49 }
50
51 if (smb1cli_conn_encryption_on(cli->conn)) {
52 return min_space;
53 }
54
55 return useable_space;
56 } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_READX) {
57 /*
58 * Note: CAP_LARGE_READX also works with signing
59 */
60 useable_space = 0x1FFFF - data_offset;
61
62 useable_space = MIN(useable_space, UINT16_MAX);
63
64 return useable_space;
65 }
66
67 return min_space;
68 }
69
70 /****************************************************************************
71 Calculate the recommended write buffer size
72 ****************************************************************************/
73 static size_t cli_write_max_bufsize(struct cli_state *cli,
74 uint16_t write_mode,
75 uint8_t wct)
76 {
77 uint32_t min_space;
78 uint32_t data_offset;
79 uint32_t useable_space = 0;
80
81 data_offset = HDR_VWV;
82 data_offset += wct * sizeof(uint16_t);
83 data_offset += sizeof(uint16_t); /* byte count */
84 data_offset += 1; /* pad */
85
86 min_space = cli_state_available_size(cli, data_offset);
87
88 if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) {
89 useable_space = 0xFFFFFF - data_offset;
90 } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_WRITEX) {
91 useable_space = 0x1FFFF - data_offset;
92 } else {
93 return min_space;
94 }
95
96 if (write_mode != 0) {
97 return min_space;
98 }
99
100 if (smb1cli_conn_signing_is_active(cli->conn)) {
101 return min_space;
102 }
103
104 if (smb1cli_conn_encryption_on(cli->conn)) {
105 return min_space;
106 }
107
108 if (strequal(cli->dev, "LPT1:")) {
109 return min_space;
110 }
111
112 return useable_space;
113 }
114
115 struct cli_read_andx_state {
116 size_t size;
117 uint16_t vwv[12];
118 NTSTATUS status;
119 size_t received;
120 uint8_t *buf;
121 };
122
123 static void cli_read_andx_done(struct tevent_req *subreq);
124
125 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
126 struct tevent_context *ev,
127 struct cli_state *cli, uint16_t fnum,
128 off_t offset, size_t size,
129 struct tevent_req **psmbreq)
130 {
131 struct tevent_req *req, *subreq;
132 struct cli_read_andx_state *state;
133 uint8_t wct = 10;
134
135 req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
136 if (req == NULL) {
137 return NULL;
138 }
139 state->size = size;
140
141 SCVAL(state->vwv + 0, 0, 0xFF);
142 SCVAL(state->vwv + 0, 1, 0);
143 SSVAL(state->vwv + 1, 0, 0);
144 SSVAL(state->vwv + 2, 0, fnum);
145 SIVAL(state->vwv + 3, 0, offset);
146 SSVAL(state->vwv + 5, 0, size);
147 SSVAL(state->vwv + 6, 0, size);
148 SSVAL(state->vwv + 7, 0, (size >> 16));
149 SSVAL(state->vwv + 8, 0, 0);
150 SSVAL(state->vwv + 9, 0, 0);
151
152 if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) {
153 SIVAL(state->vwv + 10, 0,
154 (((uint64_t)offset)>>32) & 0xffffffff);
155 wct = 12;
156 } else {
157 if ((((uint64_t)offset) & 0xffffffff00000000LL) != 0) {
158 DEBUG(10, ("cli_read_andx_send got large offset where "
159 "the server does not support it\n"));
160 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
161 return tevent_req_post(req, ev);
162 }
163 }
164
165 subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, 0, wct,
166 state->vwv, 0, NULL);
167 if (subreq == NULL) {
168 TALLOC_FREE(req);
169 return NULL;
170 }
171 tevent_req_set_callback(subreq, cli_read_andx_done, req);
172 *psmbreq = subreq;
173 return req;
174 }
175
176 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
177 struct tevent_context *ev,
178 struct cli_state *cli, uint16_t fnum,
179 off_t offset, size_t size)
180 {
181 struct tevent_req *req, *subreq;
182 NTSTATUS status;
183
184 req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
185 &subreq);
186 if (req == NULL) {
187 return NULL;
188 }
189
190 status = smb1cli_req_chain_submit(&subreq, 1);
191 if (tevent_req_nterror(req, status)) {
192 return tevent_req_post(req, ev);
193 }
194 return req;
195 }
196
197 static void cli_read_andx_done(struct tevent_req *subreq)
198 {
199 struct tevent_req *req = tevent_req_callback_data(
200 subreq, struct tevent_req);
201 struct cli_read_andx_state *state = tevent_req_data(
202 req, struct cli_read_andx_state);
203 uint8_t *inbuf;
204 uint8_t wct;
205 uint16_t *vwv;
206 uint32_t num_bytes;
207 uint8_t *bytes;
208
209 state->status = cli_smb_recv(subreq, state, &inbuf, 12, &wct, &vwv,
210 &num_bytes, &bytes);
211 TALLOC_FREE(subreq);
212 if (NT_STATUS_IS_ERR(state->status)) {
213 tevent_req_nterror(req, state->status);
214 return;
215 }
216
217 /* size is the number of bytes the server returned.
218 * Might be zero. */
219 state->received = SVAL(vwv + 5, 0);
220 state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
221
222 if (state->received > state->size) {
223 DEBUG(5,("server returned more than we wanted!\n"));
224 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
225 return;
226 }
227
228 /*
229 * bcc field must be valid for small reads, for large reads the 16-bit
230 * bcc field can't be correct.
231 */
232
233 if ((state->received < 0xffff) && (state->received > num_bytes)) {
234 DEBUG(5, ("server announced more bytes than sent\n"));
235 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
236 return;
237 }
238
239 state->buf = discard_const_p(uint8_t, smb_base(inbuf)) + SVAL(vwv+6, 0);
240
241 if (trans_oob(smb_len_tcp(inbuf), SVAL(vwv+6, 0), state->received)
242 || ((state->received != 0) && (state->buf < bytes))) {
243 DEBUG(5, ("server returned invalid read&x data offset\n"));
244 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
245 return;
246 }
247 tevent_req_done(req);
248 }
249
250 /*
251 * Pull the data out of a finished async read_and_x request. rcvbuf is
252 * talloced from the request, so better make sure that you copy it away before
253 * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
254 * talloc_move it!
255 */
256
257 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
258 uint8_t **rcvbuf)
259 {
260 struct cli_read_andx_state *state = tevent_req_data(
261 req, struct cli_read_andx_state);
262 NTSTATUS status;
263
264 if (tevent_req_is_nterror(req, &status)) {
265 return status;
266 }
267 *received = state->received;
268 *rcvbuf = state->buf;
269 return NT_STATUS_OK;
270 }
271
272 struct cli_pull_chunk;
273
274 struct cli_pull_state {
275 struct tevent_context *ev;
276 struct cli_state *cli;
277 uint16_t fnum;
278 off_t start_offset;
279 off_t size;
280
281 NTSTATUS (*sink)(char *buf, size_t n, void *priv);
282 void *priv;
283
284 size_t chunk_size;
285 off_t next_offset;
286 off_t remaining;
287
288 /*
289 * How many bytes did we push into "sink"?
290 */
291 off_t pushed;
292
293 /*
294 * Outstanding requests
295 *
296 * The maximum is 256:
297 * - which would be a window of 256 MByte
298 * for SMB2 with multi-credit
299 * or smb1 unix extensions.
300 */
301 uint16_t max_chunks;
302 uint16_t num_chunks;
303 uint16_t num_waiting;
304 struct cli_pull_chunk *chunks;
305 };
306
307 struct cli_pull_chunk {
308 struct cli_pull_chunk *prev, *next;
309 struct tevent_req *req;/* This is the main request! Not the subreq */
310 struct tevent_req *subreq;
311 off_t ofs;
312 uint8_t *buf;
313 size_t total_size;
314 size_t tmp_size;
315 bool done;
316 };
317
318 static void cli_pull_setup_chunks(struct tevent_req *req);
319 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk);
320 static void cli_pull_chunk_done(struct tevent_req *subreq);
321
322 /*
323 * Parallel read support.
324 *
325 * cli_pull sends as many read&x requests as the server would allow via
326 * max_mux at a time. When replies flow back in, the data is written into
327 * the callback function "sink" in the right order.
328 */
329
330 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
331 struct tevent_context *ev,
332 struct cli_state *cli,
333 uint16_t fnum, off_t start_offset,
334 off_t size, size_t window_size,
335 NTSTATUS (*sink)(char *buf, size_t n,
336 void *priv),
337 void *priv)
338 {
339 struct tevent_req *req;
340 struct cli_pull_state *state;
341 size_t page_size = 1024;
342 uint64_t tmp64;
343
344 req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
345 if (req == NULL) {
346 return NULL;
347 }
348 state->cli = cli;
349 state->ev = ev;
350 state->fnum = fnum;
351 state->start_offset = start_offset;
352 state->size = size;
353 state->sink = sink;
354 state->priv = priv;
355 state->next_offset = start_offset;
356 state->remaining = size;
357
358 if (size == 0) {
359 tevent_req_done(req);
360 return tevent_req_post(req, ev);
361 }
362
363 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
364 state->chunk_size = smb2cli_conn_max_read_size(cli->conn);
365 } else {
366 state->chunk_size = cli_read_max_bufsize(cli);
367 }
368 if (state->chunk_size > page_size) {
369 state->chunk_size &= ~(page_size - 1);
370 }
371
372 if (window_size == 0) {
373 /*
374 * We use 16 MByte as default window size.
375 */
376 window_size = 16 * 1024 * 1024;
377 }
378
379 tmp64 = window_size/state->chunk_size;
380 if ((window_size % state->chunk_size) > 0) {
381 tmp64 += 1;
382 }
383 tmp64 = MAX(tmp64, 1);
384 tmp64 = MIN(tmp64, 256);
385 state->max_chunks = tmp64;
386
387 /*
388 * We defer the callback because of the complex
389 * substate/subfunction logic
390 */
391 tevent_req_defer_callback(req, ev);
392
393 cli_pull_setup_chunks(req);
394 if (!tevent_req_is_in_progress(req)) {
395 return tevent_req_post(req, ev);
396 }
397
398 return req;
399 }
400
401 static void cli_pull_setup_chunks(struct tevent_req *req)
402 {
403 struct cli_pull_state *state =
404 tevent_req_data(req,
405 struct cli_pull_state);
406 struct cli_pull_chunk *chunk, *next = NULL;
407 size_t i;
408
409 for (chunk = state->chunks; chunk; chunk = next) {
410 /*
411 * Note that chunk might be removed from this call.
412 */
413 next = chunk->next;
414 cli_pull_chunk_ship(chunk);
415 if (!tevent_req_is_in_progress(req)) {
416 return;
417 }
418 }
419
420 for (i = state->num_chunks; i < state->max_chunks; i++) {
421
422 if (state->num_waiting > 0) {
423 return;
424 }
425
426 if (state->remaining == 0) {
427 break;
428 }
429
430 chunk = talloc_zero(state, struct cli_pull_chunk);
431 if (tevent_req_nomem(chunk, req)) {
432 return;
433 }
434 chunk->req = req;
435 chunk->ofs = state->next_offset;
436 chunk->total_size = MIN(state->remaining, state->chunk_size);
437 state->next_offset += chunk->total_size;
438 state->remaining -= chunk->total_size;
439
440 DLIST_ADD_END(state->chunks, chunk);
441 state->num_chunks++;
442 state->num_waiting++;
443
444 cli_pull_chunk_ship(chunk);
445 if (!tevent_req_is_in_progress(req)) {
446 return;
447 }
448 }
449
450 if (state->remaining > 0) {
451 return;
452 }
453
454 if (state->num_chunks > 0) {
455 return;
456 }
457
458 tevent_req_done(req);
459 }
460
461 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk)
462 {
463 struct tevent_req *req = chunk->req;
464 struct cli_pull_state *state =
465 tevent_req_data(req,
466 struct cli_pull_state);
467 bool ok;
468 off_t ofs;
469 size_t size;
470
471 if (chunk->done) {
472 NTSTATUS status;
473
474 if (chunk != state->chunks) {
475 /*
476 * this chunk is not the
477 * first one in the list.
478 *
479 * which means we should not
480 * push it into the sink yet.
481 */
482 return;
483 }
484
485 if (chunk->tmp_size == 0) {
486 /*
487 * we got a short read, we're done
488 */
489 tevent_req_done(req);
490 return;
491 }
492
493 status = state->sink((char *)chunk->buf,
494 chunk->tmp_size,
495 state->priv);
496 if (tevent_req_nterror(req, status)) {
497 return;
498 }
499 state->pushed += chunk->tmp_size;
500
501 if (chunk->tmp_size < chunk->total_size) {
502 /*
503 * we got a short read, we're done
504 */
505 tevent_req_done(req);
506 return;
507 }
508
509 DLIST_REMOVE(state->chunks, chunk);
510 SMB_ASSERT(state->num_chunks > 0);
511 state->num_chunks--;
512 TALLOC_FREE(chunk);
513
514 return;
515 }
516
517 if (chunk->subreq != NULL) {
518 return;
519 }
520
521 SMB_ASSERT(state->num_waiting > 0);
522
523 ofs = chunk->ofs + chunk->tmp_size;
524 size = chunk->total_size - chunk->tmp_size;
525
526 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
527 uint32_t max_size;
528
529 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
530 if (!ok) {
531 return;
532 }
533
534 /*
535 * downgrade depending on the available credits
536 */
537 size = MIN(max_size, size);
538
539 chunk->subreq = cli_smb2_read_send(chunk,
540 state->ev,
541 state->cli,
542 state->fnum,
543 ofs,
544 size);
545 if (tevent_req_nomem(chunk->subreq, req)) {
546 return;
547 }
548 } else {
549 ok = smb1cli_conn_req_possible(state->cli->conn);
550 if (!ok) {
551 return;
552 }
553
554 chunk->subreq = cli_read_andx_send(chunk,
555 state->ev,
556 state->cli,
557 state->fnum,
558 ofs,
559 size);
560 if (tevent_req_nomem(chunk->subreq, req)) {
561 return;
562 }
563 }
564 tevent_req_set_callback(chunk->subreq,
565 cli_pull_chunk_done,
566 chunk);
567
568 state->num_waiting--;
569 return;
570 }
571
572 static void cli_pull_chunk_done(struct tevent_req *subreq)
573 {
574 struct cli_pull_chunk *chunk =
575 tevent_req_callback_data(subreq,
576 struct cli_pull_chunk);
577 struct tevent_req *req = chunk->req;
578 struct cli_pull_state *state =
579 tevent_req_data(req,
580 struct cli_pull_state);
581 NTSTATUS status;
582 size_t expected = chunk->total_size - chunk->tmp_size;
583 ssize_t received = 0;
584 uint8_t *buf = NULL;
585
586 chunk->subreq = NULL;
587
588 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
589 status = cli_smb2_read_recv(subreq, &received, &buf);
590 } else {
591 status = cli_read_andx_recv(subreq, &received, &buf);
592 }
593 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
594 received = 0;
595 status = NT_STATUS_OK;
596 }
597 if (tevent_req_nterror(req, status)) {
598 return;
599 }
600
601 if (received > expected) {
602 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
603 return;
604 }
605
606 if (received == 0) {
607 /*
608 * We got EOF we're done
609 */
610 chunk->done = true;
611 cli_pull_setup_chunks(req);
612 return;
613 }
614
615 if (received == chunk->total_size) {
616 /*
617 * We got it in the first run.
618 *
619 * We don't call TALLOC_FREE(subreq)
620 * here and keep the returned buffer.
621 */
622 chunk->buf = buf;
623 } else if (chunk->buf == NULL) {
624 chunk->buf = talloc_array(chunk, uint8_t, chunk->total_size);
625 if (tevent_req_nomem(chunk->buf, req)) {
626 return;
627 }
628 }
629
630 if (received != chunk->total_size) {
631 uint8_t *p = chunk->buf + chunk->tmp_size;
632 memcpy(p, buf, received);
633 TALLOC_FREE(subreq);
634 }
635
636 chunk->tmp_size += received;
637
638 if (chunk->tmp_size == chunk->total_size) {
639 chunk->done = true;
640 } else {
641 state->num_waiting++;
642 }
643
644 cli_pull_setup_chunks(req);
645 }
646
647 NTSTATUS cli_pull_recv(struct tevent_req *req, off_t *received)
648 {
649 struct cli_pull_state *state = tevent_req_data(
650 req, struct cli_pull_state);
651 NTSTATUS status;
652
653 if (tevent_req_is_nterror(req, &status)) {
654 tevent_req_received(req);
655 return status;
656 }
657 *received = state->pushed;
658 tevent_req_received(req);
659 return NT_STATUS_OK;
660 }
661
662 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
663 off_t start_offset, off_t size, size_t window_size,
664 NTSTATUS (*sink)(char *buf, size_t n, void *priv),
665 void *priv, off_t *received)
666 {
667 TALLOC_CTX *frame = talloc_stackframe();
668 struct tevent_context *ev;
669 struct tevent_req *req;
670 NTSTATUS status = NT_STATUS_OK;
671
672 if (smbXcli_conn_has_async_calls(cli->conn)) {
673 /*
674 * Can't use sync call while an async call is in flight
675 */
676 status = NT_STATUS_INVALID_PARAMETER;
677 goto fail;
678 }
679
680 ev = samba_tevent_context_init(frame);
681 if (ev == NULL) {
682 status = NT_STATUS_NO_MEMORY;
683 goto fail;
684 }
685
686 req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
687 window_size, sink, priv);
688 if (req == NULL) {
689 status = NT_STATUS_NO_MEMORY;
690 goto fail;
691 }
692
693 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
694 goto fail;
695 }
696
697 status = cli_pull_recv(req, received);
698 fail:
699 TALLOC_FREE(frame);
700 return status;
701 }
702
703 struct cli_read_state {
704 struct cli_state *cli;
705 char *buf;
706 size_t buflen;
707 size_t received;
708 };
709
710 static void cli_read_done(struct tevent_req *subreq);
711
712 struct tevent_req *cli_read_send(
713 TALLOC_CTX *mem_ctx,
714 struct tevent_context *ev,
715 struct cli_state *cli,
716 uint16_t fnum,
717 char *buf,
718 off_t offset,
719 size_t size)
720 {
721 struct tevent_req *req, *subreq;
722 struct cli_read_state *state;
723
724 req = tevent_req_create(mem_ctx, &state, struct cli_read_state);
725 if (req == NULL) {
726 return NULL;
727 }
728 state->cli = cli;
729 state->buf = buf;
730 state->buflen = size;
731
732 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
733 uint32_t max_size;
734 bool ok;
735
736 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
737 if (!ok) {
738 tevent_req_nterror(
739 req,
740 NT_STATUS_INSUFFICIENT_RESOURCES);
741 return tevent_req_post(req, ev);
742 }
743
744 /*
745 * downgrade depending on the available credits
746 */
747 size = MIN(max_size, size);
748
749 subreq = cli_smb2_read_send(
750 state, ev, cli, fnum, offset, size);
751 if (tevent_req_nomem(subreq, req)) {
752 return tevent_req_post(req, ev);
753 }
754 } else {
755 bool ok;
756 ok = smb1cli_conn_req_possible(state->cli->conn);
757 if (!ok) {
758 tevent_req_nterror(
759 req,
760 NT_STATUS_INSUFFICIENT_RESOURCES);
761 return tevent_req_post(req, ev);
762 }
763
764 subreq = cli_read_andx_send(
765 state, ev, cli, fnum, offset, size);
766 if (tevent_req_nomem(subreq, req)) {
767 return tevent_req_post(req, ev);
768 }
769 }
770
771 tevent_req_set_callback(subreq, cli_read_done, req);
772
773 return req;
774 }
775
776 static void cli_read_done(struct tevent_req *subreq)
777 {
778 struct tevent_req *req = tevent_req_callback_data(
779 subreq, struct tevent_req);
780 struct cli_read_state *state = tevent_req_data(
781 req, struct cli_read_state);
782 NTSTATUS status;
783 ssize_t received;
784 uint8_t *buf = NULL;
785
786 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
787 status = cli_smb2_read_recv(subreq, &received, &buf);
788 } else {
789 status = cli_read_andx_recv(subreq, &received, &buf);
790 }
791
792 if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
793 received = 0;
794 status = NT_STATUS_OK;
795 }
796 if (tevent_req_nterror(req, status)) {
797 return;
798 }
799 if ((buf == NULL) || (received < 0) || (received > state->buflen)) {
800 state->received = 0;
801 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
802 return;
803 }
804
805 memcpy(state->buf, buf, received);
806 state->received = received;
807 tevent_req_done(req);
808 }
809
810 NTSTATUS cli_read_recv(struct tevent_req *req, size_t *received)
811 {
812 struct cli_read_state *state = tevent_req_data(
813 req, struct cli_read_state);
814 NTSTATUS status;
815
816 if (tevent_req_is_nterror(req, &status)) {
817 return status;
818 }
819 if (received != NULL) {
820 *received = state->received;
821 }
822 return NT_STATUS_OK;
823 }
824
825 /*
826 * Helper function for cli_pull(). This takes a chunk of data (buf) read from
827 * a remote file and copies it into the return buffer (priv).
828 */
829 NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
830 {
831 char **pbuf = (char **)priv;
832 memcpy(*pbuf, buf, n);
833 *pbuf += n;
834 return NT_STATUS_OK;
835 }
836
837 NTSTATUS cli_read(struct cli_state *cli, uint16_t fnum,
838 char *buf, off_t offset, size_t size,
839 size_t *nread)
840 {
841 NTSTATUS status;
842 off_t ret = 0;
843
844 status = cli_pull(cli, fnum, offset, size, size,
845 cli_read_sink, &buf, &ret);
846 if (!NT_STATUS_IS_OK(status)) {
847 return status;
848 }
849
850 if (nread) {
851 *nread = ret;
852 }
853
854 return NT_STATUS_OK;
855 }
856
857 /****************************************************************************
858 write to a file using a SMBwrite and not bypassing 0 byte writes
859 ****************************************************************************/
860
861 NTSTATUS cli_smbwrite(struct cli_state *cli, uint16_t fnum, char *buf,
862 off_t offset, size_t size1, size_t *ptotal)
863 {
864 uint8_t *bytes;
865 ssize_t total = 0;
866
867 /*
868 * 3 bytes prefix
869 */
870
871 bytes = talloc_array(talloc_tos(), uint8_t, 3);
872 if (bytes == NULL) {
873 return NT_STATUS_NO_MEMORY;
874 }
875 bytes[0] = 1;
876
877 do {
878 uint32_t usable_space = cli_state_available_size(cli, 48);
879 size_t size = MIN(size1, usable_space);
880 struct tevent_req *req;
881 uint16_t vwv[5];
882 uint16_t *ret_vwv;
883 NTSTATUS status;
884
885 SSVAL(vwv+0, 0, fnum);
886 SSVAL(vwv+1, 0, size);
887 SIVAL(vwv+2, 0, offset);
888 SSVAL(vwv+4, 0, 0);
889
890 bytes = talloc_realloc(talloc_tos(), bytes, uint8_t,
891 size+3);
892 if (bytes == NULL) {
893 return NT_STATUS_NO_MEMORY;
894 }
895 SSVAL(bytes, 1, size);
896 memcpy(bytes + 3, buf + total, size);
897
898 status = cli_smb(talloc_tos(), cli, SMBwrite, 0, 5, vwv,
899 size+3, bytes, &req, 1, NULL, &ret_vwv,
900 NULL, NULL);
901 if (!NT_STATUS_IS_OK(status)) {
902 TALLOC_FREE(bytes);
903 return status;
904 }
905
906 size = SVAL(ret_vwv+0, 0);
907 TALLOC_FREE(req);
908 if (size == 0) {
909 break;
910 }
911 size1 -= size;
912 total += size;
913 offset += size;
914
915 } while (size1);
916
917 TALLOC_FREE(bytes);
918
919 if (ptotal != NULL) {
920 *ptotal = total;
921 }
922 return NT_STATUS_OK;
923 }
924
925 /*
926 * Send a write&x request
927 */
928
929 struct cli_write_andx_state {
930 size_t size;
931 uint16_t vwv[14];
932 size_t written;
933 uint8_t pad;
934 struct iovec iov[2];
935 };
936
937 static void cli_write_andx_done(struct tevent_req *subreq);
938
939 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
940 struct tevent_context *ev,
941 struct cli_state *cli, uint16_t fnum,
942 uint16_t mode, const uint8_t *buf,
943 off_t offset, size_t size,
944 struct tevent_req **reqs_before,
945 int num_reqs_before,
946 struct tevent_req **psmbreq)
947 {
948 struct tevent_req *req, *subreq;
949 struct cli_write_andx_state *state;
950 bool bigoffset = ((smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) != 0);
951 uint8_t wct = bigoffset ? 14 : 12;
952 size_t max_write = cli_write_max_bufsize(cli, mode, wct);
953 uint16_t *vwv;
954
955 req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
956 if (req == NULL) {
957 return NULL;
958 }
959
960 state->size = MIN(size, max_write);
961
962 vwv = state->vwv;
963
964 SCVAL(vwv+0, 0, 0xFF);
965 SCVAL(vwv+0, 1, 0);
966 SSVAL(vwv+1, 0, 0);
967 SSVAL(vwv+2, 0, fnum);
968 SIVAL(vwv+3, 0, offset);
969 SIVAL(vwv+5, 0, 0);
970 SSVAL(vwv+7, 0, mode);
971 SSVAL(vwv+8, 0, 0);
972 SSVAL(vwv+9, 0, (state->size>>16));
973 SSVAL(vwv+10, 0, state->size);
974
975 SSVAL(vwv+11, 0,
976 smb1cli_req_wct_ofs(reqs_before, num_reqs_before)
977 + 1 /* the wct field */
978 + wct * 2 /* vwv */
979 + 2 /* num_bytes field */
980 + 1 /* pad */);
981
982 if (bigoffset) {
983 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
984 }
985
986 state->pad = 0;
987 state->iov[0].iov_base = (void *)&state->pad;
988 state->iov[0].iov_len = 1;
989 state->iov[1].iov_base = discard_const_p(void, buf);
990 state->iov[1].iov_len = state->size;
991
992 subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, 0, wct, vwv,
993 2, state->iov);
994 if (tevent_req_nomem(subreq, req)) {
995 return tevent_req_post(req, ev);
996 }
997 tevent_req_set_callback(subreq, cli_write_andx_done, req);
998 *psmbreq = subreq;
999 return req;
1000 }
1001
1002 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
1003 struct tevent_context *ev,
1004 struct cli_state *cli, uint16_t fnum,
1005 uint16_t mode, const uint8_t *buf,
1006 off_t offset, size_t size)
1007 {
1008 struct tevent_req *req, *subreq;
1009 NTSTATUS status;
1010
1011 req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
1012 size, NULL, 0, &subreq);
1013 if (req == NULL) {
1014 return NULL;
1015 }
1016
1017 status = smb1cli_req_chain_submit(&subreq, 1);
1018 if (tevent_req_nterror(req, status)) {
1019 return tevent_req_post(req, ev);
1020 }
1021 return req;
1022 }
1023
1024 static void cli_write_andx_done(struct tevent_req *subreq)
1025 {
1026 struct tevent_req *req = tevent_req_callback_data(
1027 subreq, struct tevent_req);
1028 struct cli_write_andx_state *state = tevent_req_data(
1029 req, struct cli_write_andx_state);
1030 uint8_t wct;
1031 uint16_t *vwv;
1032 NTSTATUS status;
1033
1034 status = cli_smb_recv(subreq, state, NULL, 6, &wct, &vwv,
1035 NULL, NULL);
1036 TALLOC_FREE(subreq);
1037 if (NT_STATUS_IS_ERR(status)) {
1038 tevent_req_nterror(req, status);
1039 return;
1040 }
1041 state->written = SVAL(vwv+2, 0);
1042 if (state->size > UINT16_MAX) {
1043 /*
1044 * It is important that we only set the
1045 * high bits only if we asked for a large write.
1046 *
1047 * OS/2 print shares get this wrong and may send
1048 * invalid values.
1049 *
1050 * See bug #5326.
1051 */
1052 state->written |= SVAL(vwv+4, 0)<<16;
1053 }
1054 tevent_req_done(req);
1055 }
1056
1057 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
1058 {
1059 struct cli_write_andx_state *state = tevent_req_data(
1060 req, struct cli_write_andx_state);
1061 NTSTATUS status;
1062
1063 if (tevent_req_is_nterror(req, &status)) {
1064 return status;
1065 }
1066 if (pwritten != 0) {
1067 *pwritten = state->written;
1068 }
1069 return NT_STATUS_OK;
1070 }
1071
1072 struct cli_write_state {
1073 struct cli_state *cli;
1074 size_t written;
1075 };
1076
1077 static void cli_write_done(struct tevent_req *subreq);
1078
1079 /*
1080 * Used to write to a file remotely.
1081 * This is similar in functionality to cli_push_send(), except this is a more
1082 * finer-grain API. For example, if the data we want to write exceeds the max
1083 * write size of the underlying connection, then it's the caller's
1084 * responsibility to handle this.
1085 * For writing a small amount of data to file, this is a simpler API to use.
1086 */
1087 struct tevent_req *cli_write_send(TALLOC_CTX *mem_ctx,
1088 struct tevent_context *ev,
1089 struct cli_state *cli, uint16_t fnum,
1090 uint16_t mode, const uint8_t *buf,
1091 off_t offset, size_t size)
1092 {
1093 struct tevent_req *req = NULL;
1094 struct cli_write_state *state = NULL;
1095 struct tevent_req *subreq = NULL;
1096
1097 req = tevent_req_create(mem_ctx, &state, struct cli_write_state);
1098 if (req == NULL) {
1099 return NULL;
1100 }
1101 state->cli = cli;
1102
1103 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1104 uint32_t max_size;
1105 bool ok;
1106
1107 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
1108 if (!ok) {
1109 tevent_req_nterror(
1110 req,
1111 NT_STATUS_INSUFFICIENT_RESOURCES);
1112 return tevent_req_post(req, ev);
1113 }
1114
1115 /*
1116 * downgrade depending on the available credits
1117 */
1118 size = MIN(max_size, size);
1119
1120 subreq = cli_smb2_write_send(state,
1121 ev,
1122 cli,
1123 fnum,
1124 mode,
1125 buf,
1126 offset,
1127 size);
1128 } else {
1129 bool ok;
1130
1131 ok = smb1cli_conn_req_possible(state->cli->conn);
1132 if (!ok) {
1133 tevent_req_nterror(
1134 req,
1135 NT_STATUS_INSUFFICIENT_RESOURCES);
1136 return tevent_req_post(req, ev);
1137 }
1138
1139 subreq = cli_write_andx_send(state,
1140 ev,
1141 cli,
1142 fnum,
1143 mode,
1144 buf,
1145 offset,
1146 size);
1147 }
1148 if (tevent_req_nomem(subreq, req)) {
1149 return tevent_req_post(req, ev);
1150 }
1151 tevent_req_set_callback(subreq, cli_write_done, req);
1152
1153 return req;
1154 }
1155
1156 static void cli_write_done(struct tevent_req *subreq)
1157 {
1158 struct tevent_req *req =
1159 tevent_req_callback_data(subreq,
1160 struct tevent_req);
1161 struct cli_write_state *state =
1162 tevent_req_data(req,
1163 struct cli_write_state);
1164 NTSTATUS status;
1165
1166 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1167 status = cli_smb2_write_recv(subreq, &state->written);
1168 } else {
1169 status = cli_write_andx_recv(subreq, &state->written);
1170 }
1171 TALLOC_FREE(subreq);
1172 if (tevent_req_nterror(req, status)) {
1173 return;
1174 }
1175 tevent_req_done(req);
1176 }
1177
1178 NTSTATUS cli_write_recv(struct tevent_req *req, size_t *pwritten)
1179 {
1180 struct cli_write_state *state =
1181 tevent_req_data(req,
1182 struct cli_write_state);
1183 NTSTATUS status;
1184
1185 if (tevent_req_is_nterror(req, &status)) {
1186 tevent_req_received(req);
1187 return status;
1188 }
1189 if (pwritten != NULL) {
1190 *pwritten = state->written;
1191 }
1192 tevent_req_received(req);
1193 return NT_STATUS_OK;
1194 }
1195
1196 struct cli_smb1_writeall_state {
1197 struct tevent_context *ev;
1198 struct cli_state *cli;
1199 uint16_t fnum;
1200 uint16_t mode;
1201 const uint8_t *buf;
1202 off_t offset;
1203 size_t size;
1204 size_t written;
1205 };
1206
1207 static void cli_smb1_writeall_written(struct tevent_req *req);
1208
1209 static struct tevent_req *cli_smb1_writeall_send(TALLOC_CTX *mem_ctx,
1210 struct tevent_context *ev,
1211 struct cli_state *cli,
1212 uint16_t fnum,
1213 uint16_t mode,
1214 const uint8_t *buf,
1215 off_t offset, size_t size)
1216 {
1217 struct tevent_req *req, *subreq;
1218 struct cli_smb1_writeall_state *state;
1219
1220 req = tevent_req_create(mem_ctx, &state,
1221 struct cli_smb1_writeall_state);
1222 if (req == NULL) {
1223 return NULL;
1224 }
1225 state->ev = ev;
1226 state->cli = cli;
1227 state->fnum = fnum;
1228 state->mode = mode;
1229 state->buf = buf;
1230 state->offset = offset;
1231 state->size = size;
1232 state->written = 0;
1233
1234 subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1235 state->mode, state->buf, state->offset,
1236 state->size);
1237 if (tevent_req_nomem(subreq, req)) {
1238 return tevent_req_post(req, ev);
1239 }
1240 tevent_req_set_callback(subreq, cli_smb1_writeall_written, req);
1241 return req;
1242 }
1243
1244 static void cli_smb1_writeall_written(struct tevent_req *subreq)
1245 {
1246 struct tevent_req *req = tevent_req_callback_data(
1247 subreq, struct tevent_req);
1248 struct cli_smb1_writeall_state *state = tevent_req_data(
1249 req, struct cli_smb1_writeall_state);
1250 NTSTATUS status;
1251 size_t written = 0, to_write;
1252
1253 status = cli_write_andx_recv(subreq, &written);
1254 TALLOC_FREE(subreq);
1255 if (tevent_req_nterror(req, status)) {
1256 return;
1257 }
1258
1259 state->written += written;
1260
1261 if (state->written > state->size) {
1262 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1263 return;
1264 }
1265
1266 to_write = state->size - state->written;
1267
1268 if (to_write == 0) {
1269 tevent_req_done(req);
1270 return;
1271 }
1272
1273 subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1274 state->mode,
1275 state->buf + state->written,
1276 state->offset + state->written, to_write);
1277 if (tevent_req_nomem(subreq, req)) {
1278 return;
1279 }
1280 tevent_req_set_callback(subreq, cli_smb1_writeall_written, req);
1281 }
1282
1283 static NTSTATUS cli_smb1_writeall_recv(struct tevent_req *req,
1284 size_t *pwritten)
1285 {
1286 struct cli_smb1_writeall_state *state = tevent_req_data(
1287 req, struct cli_smb1_writeall_state);
1288 NTSTATUS status;
1289
1290 if (tevent_req_is_nterror(req, &status)) {
1291 return status;
1292 }
1293 if (pwritten != NULL) {
1294 *pwritten = state->written;
1295 }
1296 return NT_STATUS_OK;
1297 }
1298
1299 struct cli_writeall_state {
1300 struct cli_state *cli;
1301 size_t written;
1302 };
1303
1304 static void cli_writeall_done(struct tevent_req *subreq);
1305
1306 struct tevent_req *cli_writeall_send(
1307 TALLOC_CTX *mem_ctx,
1308 struct tevent_context *ev,
1309 struct cli_state *cli,
1310 uint16_t fnum,
1311 uint16_t mode,
1312 const uint8_t *buf,
1313 off_t offset,
1314 size_t size)
1315 {
1316 struct tevent_req *req, *subreq;
1317 struct cli_writeall_state *state;
1318
1319 req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
1320 if (req == NULL) {
1321 return NULL;
1322 }
1323 state->cli = cli;
1324
1325 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
1326 subreq = cli_smb2_writeall_send(
1327 state,
1328 ev,
1329 cli,
1330 fnum,
1331 mode,
1332 buf,
1333 offset,
1334 size);
1335 } else {
1336 subreq = cli_smb1_writeall_send(
1337 state,
1338 ev,
1339 cli,
1340 fnum,
1341 mode,
1342 buf,
1343 offset,
1344 size);
1345 }
1346
1347 if (tevent_req_nomem(subreq, req)) {
1348 return tevent_req_post(req, ev);
1349 }
1350 tevent_req_set_callback(subreq, cli_writeall_done, req);
1351
1352 return req;
1353 }
1354
1355 static void cli_writeall_done(struct tevent_req *subreq)
1356 {
1357 struct tevent_req *req = tevent_req_callback_data(
1358 subreq, struct tevent_req);
1359 struct cli_writeall_state *state = tevent_req_data(
1360 req, struct cli_writeall_state);
1361 NTSTATUS status;
1362
1363 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1364 status = cli_smb2_writeall_recv(subreq, &state->written);
1365 } else {
1366 status = cli_smb1_writeall_recv(subreq, &state->written);
1367 }
1368 TALLOC_FREE(subreq);
1369 if (tevent_req_nterror(req, status)) {
1370 return;
1371 }
1372 tevent_req_done(req);
1373 }
1374
1375 NTSTATUS cli_writeall_recv(struct tevent_req *req, size_t *pwritten)
1376 {
1377 struct cli_writeall_state *state = tevent_req_data(
1378 req, struct cli_writeall_state);
1379 NTSTATUS status;
1380
1381 if (tevent_req_is_nterror(req, &status)) {
1382 return status;
1383 }
1384 if (pwritten != NULL) {
1385 *pwritten = state->written;
1386 }
1387 return NT_STATUS_OK;
1388 }
1389
1390
1391 NTSTATUS cli_writeall(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1392 const uint8_t *buf, off_t offset, size_t size,
1393 size_t *pwritten)
1394 {
1395 TALLOC_CTX *frame = talloc_stackframe();
1396 struct tevent_context *ev;
1397 struct tevent_req *req;
1398 NTSTATUS status = NT_STATUS_NO_MEMORY;
1399
1400 if (smbXcli_conn_has_async_calls(cli->conn)) {
1401 /*
1402 * Can't use sync call while an async call is in flight
1403 */
1404 status = NT_STATUS_INVALID_PARAMETER;
1405 goto fail;
1406 }
1407 ev = samba_tevent_context_init(frame);
1408 if (ev == NULL) {
1409 goto fail;
1410 }
1411 req = cli_writeall_send(frame, ev, cli, fnum, mode, buf, offset, size);
1412 if (req == NULL) {
1413 goto fail;
1414 }
1415 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1416 goto fail;
1417 }
1418 status = cli_writeall_recv(req, pwritten);
1419 fail:
1420 TALLOC_FREE(frame);
1421 return status;
1422 }
1423
1424 struct cli_push_chunk;
1425
1426 struct cli_push_state {
1427 struct tevent_context *ev;
1428 struct cli_state *cli;
1429 uint16_t fnum;
1430 uint16_t mode;
1431 off_t start_offset;
1432
1433 size_t (*source)(uint8_t *buf, size_t n, void *priv);
1434 void *priv;
1435
1436 bool eof;
1437
1438 size_t chunk_size;
1439 off_t next_offset;
1440
1441 /*
1442 * Outstanding requests
1443 *
1444 * The maximum is 256:
1445 * - which would be a window of 256 MByte
1446 * for SMB2 with multi-credit
1447 * or smb1 unix extensions.
1448 */
1449 uint16_t max_chunks;
1450 uint16_t num_chunks;
1451 uint16_t num_waiting;
1452 struct cli_push_chunk *chunks;
1453 };
1454
1455 struct cli_push_chunk {
1456 struct cli_push_chunk *prev, *next;
1457 struct tevent_req *req;/* This is the main request! Not the subreq */
1458 struct tevent_req *subreq;
1459 off_t ofs;
1460 uint8_t *buf;
1461 size_t total_size;
1462 size_t tmp_size;
1463 bool done;
1464 };
1465
1466 static void cli_push_setup_chunks(struct tevent_req *req);
1467 static void cli_push_chunk_ship(struct cli_push_chunk *chunk);
1468 static void cli_push_chunk_done(struct tevent_req *subreq);
1469
1470 /*
1471 * Used to write to a file remotely.
1472 * This is similar in functionality to cli_write_send(), except this API
1473 * handles writing a large file by breaking the data into chunks (so we don't
1474 * exceed the max write size of the underlying connection). To do this, the
1475 * (*source) callback handles copying the underlying file data into a message
1476 * buffer, one chunk at a time.
1477 * This API is recommended when writing a potentially large amount of data,
1478 * e.g. when copying a file (or doing a 'put').
1479 */
1480 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
1481 struct cli_state *cli,
1482 uint16_t fnum, uint16_t mode,
1483 off_t start_offset, size_t window_size,
1484 size_t (*source)(uint8_t *buf, size_t n,
1485 void *priv),
1486 void *priv)
1487 {
1488 struct tevent_req *req;
1489 struct cli_push_state *state;
1490 size_t page_size = 1024;
1491 uint64_t tmp64;
1492
1493 req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1494 if (req == NULL) {
1495 return NULL;
1496 }
1497 state->cli = cli;
1498 state->ev = ev;
1499 state->fnum = fnum;
1500 state->start_offset = start_offset;
1501 state->mode = mode;
1502 state->source = source;
1503 state->priv = priv;
1504 state->next_offset = start_offset;
1505
1506 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1507 state->chunk_size = smb2cli_conn_max_write_size(cli->conn);
1508 } else {
1509 state->chunk_size = cli_write_max_bufsize(cli, mode, 14);
1510 }
1511 if (state->chunk_size > page_size) {
1512 state->chunk_size &= ~(page_size - 1);
1513 }
1514
1515 if (window_size == 0) {
1516 /*
1517 * We use 16 MByte as default window size.
1518 */
1519 window_size = 16 * 1024 * 1024;
1520 }
1521
1522 tmp64 = window_size/state->chunk_size;
1523 if ((window_size % state->chunk_size) > 0) {
1524 tmp64 += 1;
1525 }
1526 tmp64 = MAX(tmp64, 1);
1527 tmp64 = MIN(tmp64, 256);
1528 state->max_chunks = tmp64;
1529
1530 /*
1531 * We defer the callback because of the complex
1532 * substate/subfunction logic
1533 */
1534 tevent_req_defer_callback(req, ev);
1535
1536 cli_push_setup_chunks(req);
1537 if (!tevent_req_is_in_progress(req)) {
1538 return tevent_req_post(req, ev);
1539 }
1540
1541 return req;
1542 }
1543
1544 static void cli_push_setup_chunks(struct tevent_req *req)
1545 {
1546 struct cli_push_state *state =
1547 tevent_req_data(req,
1548 struct cli_push_state);
1549 struct cli_push_chunk *chunk, *next = NULL;
1550 size_t i;
1551
1552 for (chunk = state->chunks; chunk; chunk = next) {
1553 /*
1554 * Note that chunk might be removed from this call.
1555 */
1556 next = chunk->next;
1557 cli_push_chunk_ship(chunk);
1558 if (!tevent_req_is_in_progress(req)) {
1559 return;
1560 }
1561 }
1562
1563 for (i = state->num_chunks; i < state->max_chunks; i++) {
1564
1565 if (state->num_waiting > 0) {
1566 return;
1567 }
1568
1569 if (state->eof) {
1570 break;
1571 }
1572
1573 chunk = talloc_zero(state, struct cli_push_chunk);
1574 if (tevent_req_nomem(chunk, req)) {
1575 return;
1576 }
1577 chunk->req = req;
1578 chunk->ofs = state->next_offset;
1579 chunk->buf = talloc_array(chunk,
1580 uint8_t,
1581 state->chunk_size);
1582 if (tevent_req_nomem(chunk->buf, req)) {
1583 return;
1584 }
1585 chunk->total_size = state->source(chunk->buf,
1586 state->chunk_size,
1587 state->priv);
1588 if (chunk->total_size == 0) {
1589 /* nothing to send */
1590 talloc_free(chunk);
1591 state->eof = true;
1592 break;
1593 }
1594 state->next_offset += chunk->total_size;
1595
1596 DLIST_ADD_END(state->chunks, chunk);
1597 state->num_chunks++;
1598 state->num_waiting++;
1599
1600 cli_push_chunk_ship(chunk);
1601 if (!tevent_req_is_in_progress(req)) {
1602 return;
1603 }
1604 }
1605
1606 if (!state->eof) {
1607 return;
1608 }
1609
1610 if (state->num_chunks > 0) {
1611 return;
1612 }
1613
1614 tevent_req_done(req);
1615 }
1616
1617 static void cli_push_chunk_ship(struct cli_push_chunk *chunk)
1618 {
1619 struct tevent_req *req = chunk->req;
1620 struct cli_push_state *state =
1621 tevent_req_data(req,
1622 struct cli_push_state);
1623 bool ok;
1624 const uint8_t *buf;
1625 off_t ofs;
1626 size_t size;
1627
1628 if (chunk->done) {
1629 DLIST_REMOVE(state->chunks, chunk);
1630 SMB_ASSERT(state->num_chunks > 0);
1631 state->num_chunks--;
1632 TALLOC_FREE(chunk);
1633
1634 return;
1635 }
1636
1637 if (chunk->subreq != NULL) {
1638 return;
1639 }
1640
1641 SMB_ASSERT(state->num_waiting > 0);
1642
1643 buf = chunk->buf + chunk->tmp_size;
1644 ofs = chunk->ofs + chunk->tmp_size;
1645 size = chunk->total_size - chunk->tmp_size;
1646
1647 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1648 uint32_t max_size;
1649
1650 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
1651 if (!ok) {
1652 return;
1653 }
1654
1655 /*
1656 * downgrade depending on the available credits
1657 */
1658 size = MIN(max_size, size);
1659
1660 chunk->subreq = cli_smb2_write_send(chunk,
1661 state->ev,
1662 state->cli,
1663 state->fnum,
1664 state->mode,
1665 buf,
1666 ofs,
1667 size);
1668 if (tevent_req_nomem(chunk->subreq, req)) {
1669 return;
1670 }
1671 } else {
1672 ok = smb1cli_conn_req_possible(state->cli->conn);
1673 if (!ok) {
1674 return;
1675 }
1676
1677 chunk->subreq = cli_write_andx_send(chunk,
1678 state->ev,
1679 state->cli,
1680 state->fnum,
1681 state->mode,
1682 buf,
1683 ofs,
1684 size);
1685 if (tevent_req_nomem(chunk->subreq, req)) {
1686 return;
1687 }
1688 }
1689 tevent_req_set_callback(chunk->subreq,
1690 cli_push_chunk_done,
1691 chunk);
1692
1693 state->num_waiting--;
1694 return;
1695 }
1696
1697 static void cli_push_chunk_done(struct tevent_req *subreq)
1698 {
1699 struct cli_push_chunk *chunk =
1700 tevent_req_callback_data(subreq,
1701 struct cli_push_chunk);
1702 struct tevent_req *req = chunk->req;
1703 struct cli_push_state *state =
1704 tevent_req_data(req,
1705 struct cli_push_state);
1706 NTSTATUS status;
1707 size_t expected = chunk->total_size - chunk->tmp_size;
1708 size_t written;
1709
1710 chunk->subreq = NULL;
1711
1712 if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1713 status = cli_smb2_write_recv(subreq, &written);
1714 } else {
1715 status = cli_write_andx_recv(subreq, &written);
1716 }
1717 TALLOC_FREE(subreq);
1718 if (tevent_req_nterror(req, status)) {
1719 return;
1720 }
1721
1722 if (written > expected) {
1723 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1724 return;
1725 }
1726
1727 if (written == 0) {
1728 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1729 return;
1730 }
1731
1732 chunk->tmp_size += written;
1733
1734 if (chunk->tmp_size == chunk->total_size) {
1735 chunk->done = true;
1736 } else {
1737 state->num_waiting++;
1738 }
1739
1740 cli_push_setup_chunks(req);
1741 }
1742
1743 NTSTATUS cli_push_recv(struct tevent_req *req)
1744 {
1745 return tevent_req_simple_recv_ntstatus(req);
1746 }
1747
1748 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1749 off_t start_offset, size_t window_size,
1750 size_t (*source)(uint8_t *buf, size_t n, void *priv),
1751 void *priv)
1752 {
1753 TALLOC_CTX *frame = talloc_stackframe();
1754 struct tevent_context *ev;
1755 struct tevent_req *req;
1756 NTSTATUS status = NT_STATUS_OK;
1757
1758 if (smbXcli_conn_has_async_calls(cli->conn)) {
1759 /*
1760 * Can't use sync call while an async call is in flight
1761 */
1762 status = NT_STATUS_INVALID_PARAMETER;
1763 goto fail;
1764 }
1765
1766 ev = samba_tevent_context_init(frame);
1767 if (ev == NULL) {
1768 status = NT_STATUS_NO_MEMORY;
1769 goto fail;
1770 }
1771
1772 req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1773 window_size, source, priv);
1774 if (req == NULL) {
1775 status = NT_STATUS_NO_MEMORY;
1776 goto fail;
1777 }
1778
1779 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1780 goto fail;
1781 }
1782
1783 status = cli_push_recv(req);
1784 fail:
1785 TALLOC_FREE(frame);
1786 return status;
1787 }
1788
1789 #define SPLICE_BLOCK_SIZE 1024 * 1024
1790
1791 static NTSTATUS cli_splice_fallback(TALLOC_CTX *frame,
1792 struct cli_state *srccli,
1793 struct cli_state *dstcli,
1794 uint16_t src_fnum, uint16_t dst_fnum,
1795 off_t initial_size,
1796 off_t src_offset, off_t dst_offset,
1797 off_t *written,
1798 int (*splice_cb)(off_t n, void *priv),
1799 void *priv)
1800 {
1801 NTSTATUS status;
1802 uint8_t *buf = talloc_size(frame, SPLICE_BLOCK_SIZE);
1803 size_t nread;
1804 off_t remaining = initial_size;
1805 *written = 0;
1806
1807 while (remaining) {
1808 size_t to_read = MIN(remaining, SPLICE_BLOCK_SIZE);
1809
1810 status = cli_read(srccli, src_fnum,
1811 (char *)buf, src_offset, to_read,
1812 &nread);
1813 if (!NT_STATUS_IS_OK(status)) {
1814 return status;
1815 }
1816
1817 status = cli_writeall(dstcli, dst_fnum, 0,
1818 buf, dst_offset, nread, NULL);
1819 if (!NT_STATUS_IS_OK(status)) {
1820 return status;
1821 }
1822
1823 if ((src_offset > INT64_MAX - nread) ||
1824 (dst_offset > INT64_MAX - nread)) {
1825 return NT_STATUS_FILE_TOO_LARGE;
1826 }
1827 src_offset += nread;
1828 dst_offset += nread;
1829 *written += nread;
1830 if (remaining < nread) {
1831 return NT_STATUS_INTERNAL_ERROR;
1832 }
1833 remaining -= nread;
1834 if (!splice_cb(initial_size - remaining, priv)) {
1835 return NT_STATUS_CANCELLED;
1836 }
1837 }
1838
1839 return NT_STATUS_OK;
1840 }
1841
1842 NTSTATUS cli_splice(struct cli_state *srccli, struct cli_state *dstcli,
1843 uint16_t src_fnum, uint16_t dst_fnum,
1844 off_t size,
1845 off_t src_offset, off_t dst_offset,
1846 off_t *written,
1847 int (*splice_cb)(off_t n, void *priv), void *priv)
1848 {
1849 TALLOC_CTX *frame = talloc_stackframe();
1850 struct tevent_context *ev;
1851 struct tevent_req *req;
1852 NTSTATUS status = NT_STATUS_NO_MEMORY;
1853 bool retry_fallback = false;
1854
1855 if (smbXcli_conn_has_async_calls(srccli->conn) ||
1856 smbXcli_conn_has_async_calls(dstcli->conn))
1857 {
1858 /*
1859 * Can't use sync call while an async call is in flight
1860 */
1861 status = NT_STATUS_INVALID_PARAMETER;
1862 goto out;
1863 }
1864
1865 do {
1866 ev = samba_tevent_context_init(frame);
1867 if (ev == NULL) {
1868 goto out;
1869 }
1870 if (srccli == dstcli &&
1871 smbXcli_conn_protocol(srccli->conn) >= PROTOCOL_SMB2_02 &&
1872 !retry_fallback)
1873 {
1874 req = cli_smb2_splice_send(frame, ev,
1875 srccli, src_fnum, dst_fnum,
1876 size, src_offset, dst_offset,
1877 splice_cb, priv);
1878 } else {
1879 status = cli_splice_fallback(frame,
1880 srccli, dstcli,
1881 src_fnum, dst_fnum,
1882 size,
1883 src_offset, dst_offset,
1884 written,
1885 splice_cb, priv);
1886 goto out;
1887 }
1888 if (req == NULL) {
1889 goto out;
1890 }
1891 if (!tevent_req_poll(req, ev)) {
1892 status = map_nt_error_from_unix(errno);
1893 goto out;
1894 }
1895 status = cli_smb2_splice_recv(req, written);
1896
1897 /*
1898 * Older versions of Samba don't support
1899 * FSCTL_SRV_COPYCHUNK_WRITE so use the fallback.
1900 */
1901 retry_fallback = NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST);
1902 } while (retry_fallback);
1903
1904 out:
1905 TALLOC_FREE(frame);
1906 return status;
1907 }
Samba GIT mirror