?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
socket_wrapper: fix compiler warnings
[Samba/gbeck.git] / source3 / smbd / ipc.c
blob5dd0e5627e2bffd3db3e5616c1722e1524fe5430
1 /*
2 Unix SMB/CIFS implementation.
3 Inter-process communication and named pipe handling
4 Copyright (C) Andrew Tridgell 1992-1998
5
6 SMB Version handling
7 Copyright (C) John H Terpstra 1995-1998
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23 This file handles the named pipe and mailslot calls
24 in the SMBtrans protocol
25 */
26
27 #include "includes.h"
28 #include "smbd/globals.h"
29
30 #define NERR_notsupported 50
31
32 static void api_no_reply(connection_struct *conn, struct smb_request *req);
33
34 /*******************************************************************
35 copies parameters and data, as needed, into the smb buffer
36
37 *both* the data and params sections should be aligned. this
38 is fudged in the rpc pipes by
39 at present, only the data section is. this may be a possible
40 cause of some of the ipc problems being experienced. lkcl26dec97
41
42 ******************************************************************/
43
44 static void copy_trans_params_and_data(char *outbuf, int align,
45 char *rparam, int param_offset, int param_len,
46 char *rdata, int data_offset, int data_len)
47 {
48 char *copy_into = smb_buf(outbuf);
49
50 if(param_len < 0)
51 param_len = 0;
52
53 if(data_len < 0)
54 data_len = 0;
55
56 DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d] (align %d)\n",
57 param_offset, param_offset + param_len,
58 data_offset , data_offset + data_len,
59 align));
60
61 *copy_into = '\0';
62
63 copy_into += 1;
64
65 if (param_len)
66 memcpy(copy_into, &rparam[param_offset], param_len);
67
68 copy_into += param_len;
69 if (align) {
70 memset(copy_into, '\0', align);
71 }
72
73 copy_into += align;
74
75 if (data_len )
76 memcpy(copy_into, &rdata[data_offset], data_len);
77 }
78
79 /****************************************************************************
80 Send a trans reply.
81 ****************************************************************************/
82
83 void send_trans_reply(connection_struct *conn,
84 struct smb_request *req,
85 char *rparam, int rparam_len,
86 char *rdata, int rdata_len,
87 bool buffer_too_large)
88 {
89 int this_ldata,this_lparam;
90 int tot_data_sent = 0;
91 int tot_param_sent = 0;
92 int align;
93
94 int ldata = rdata ? rdata_len : 0;
95 int lparam = rparam ? rparam_len : 0;
96 struct smbd_server_connection *sconn = req->sconn;
97 int max_send = sconn->smb1.sessions.max_send;
98
99 if (buffer_too_large)
100 DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
101
102 this_lparam = MIN(lparam,max_send - 500); /* hack */
103 this_ldata = MIN(ldata,max_send - (500+this_lparam));
104
105 align = ((this_lparam)%4);
106
107 reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
108
109 /*
110 * We might have SMBtranss in req which was transferred to the outbuf,
111 * fix that.
112 */
113 SCVAL(req->outbuf, smb_com, SMBtrans);
114
115 copy_trans_params_and_data((char *)req->outbuf, align,
116 rparam, tot_param_sent, this_lparam,
117 rdata, tot_data_sent, this_ldata);
118
119 SSVAL(req->outbuf,smb_vwv0,lparam);
120 SSVAL(req->outbuf,smb_vwv1,ldata);
121 SSVAL(req->outbuf,smb_vwv3,this_lparam);
122 SSVAL(req->outbuf,smb_vwv4,
123 smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
124 SSVAL(req->outbuf,smb_vwv5,0);
125 SSVAL(req->outbuf,smb_vwv6,this_ldata);
126 SSVAL(req->outbuf,smb_vwv7,
127 smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
128 req->outbuf));
129 SSVAL(req->outbuf,smb_vwv8,0);
130 SSVAL(req->outbuf,smb_vwv9,0);
131
132 if (buffer_too_large) {
133 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
134 STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
135 }
136
137 show_msg((char *)req->outbuf);
138 if (!srv_send_smb(sconn, (char *)req->outbuf,
139 true, req->seqnum+1,
140 IS_CONN_ENCRYPTED(conn), &req->pcd)) {
141 exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
142 }
143
144 TALLOC_FREE(req->outbuf);
145
146 tot_data_sent = this_ldata;
147 tot_param_sent = this_lparam;
148
149 while (tot_data_sent < ldata || tot_param_sent < lparam)
150 {
151 this_lparam = MIN(lparam-tot_param_sent,
152 max_send - 500); /* hack */
153 this_ldata = MIN(ldata -tot_data_sent,
154 max_send - (500+this_lparam));
155
156 if(this_lparam < 0)
157 this_lparam = 0;
158
159 if(this_ldata < 0)
160 this_ldata = 0;
161
162 align = (this_lparam%4);
163
164 reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
165
166 /*
167 * We might have SMBtranss in req which was transferred to the
168 * outbuf, fix that.
169 */
170 SCVAL(req->outbuf, smb_com, SMBtrans);
171
172 copy_trans_params_and_data((char *)req->outbuf, align,
173 rparam, tot_param_sent, this_lparam,
174 rdata, tot_data_sent, this_ldata);
175
176 SSVAL(req->outbuf,smb_vwv0,lparam);
177 SSVAL(req->outbuf,smb_vwv1,ldata);
178
179 SSVAL(req->outbuf,smb_vwv3,this_lparam);
180 SSVAL(req->outbuf,smb_vwv4,
181 smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
182 SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
183 SSVAL(req->outbuf,smb_vwv6,this_ldata);
184 SSVAL(req->outbuf,smb_vwv7,
185 smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
186 req->outbuf));
187 SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
188 SSVAL(req->outbuf,smb_vwv9,0);
189
190 if (buffer_too_large) {
191 error_packet_set((char *)req->outbuf,
192 ERRDOS, ERRmoredata,
193 STATUS_BUFFER_OVERFLOW,
194 __LINE__, __FILE__);
195 }
196
197 show_msg((char *)req->outbuf);
198 if (!srv_send_smb(sconn, (char *)req->outbuf,
199 true, req->seqnum+1,
200 IS_CONN_ENCRYPTED(conn), &req->pcd))
201 exit_server_cleanly("send_trans_reply: srv_send_smb "
202 "failed.");
203
204 tot_data_sent += this_ldata;
205 tot_param_sent += this_lparam;
206 TALLOC_FREE(req->outbuf);
207 }
208 }
209
210 /****************************************************************************
211 Start the first part of an RPC reply which began with an SMBtrans request.
212 ****************************************************************************/
213
214 struct dcerpc_cmd_state {
215 struct fake_file_handle *handle;
216 uint8_t *data;
217 size_t num_data;
218 size_t max_read;
219 };
220
221 static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
222 static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
223
224 static void api_dcerpc_cmd(connection_struct *conn, struct smb_request *req,
225 files_struct *fsp, uint8_t *data, size_t length,
226 size_t max_read)
227 {
228 struct tevent_req *subreq;
229 struct dcerpc_cmd_state *state;
230 bool busy;
231
232 if (!fsp_is_np(fsp)) {
233 api_no_reply(conn, req);
234 return;
235 }
236
237 /*
238 * Trans requests are only allowed
239 * if no other Trans or Read is active
240 */
241 busy = np_read_in_progress(fsp->fake_file_handle);
242 if (busy) {
243 reply_nterror(req, NT_STATUS_PIPE_BUSY);
244 return;
245 }
246
247 state = talloc(req, struct dcerpc_cmd_state);
248 if (state == NULL) {
249 reply_nterror(req, NT_STATUS_NO_MEMORY);
250 return;
251 }
252 req->async_priv = state;
253
254 state->handle = fsp->fake_file_handle;
255
256 /*
257 * This memdup severely sucks. But doing it properly essentially means
258 * to rewrite lanman.c, something which I don't really want to do now.
259 */
260 state->data = (uint8_t *)talloc_memdup(state, data, length);
261 if (state->data == NULL) {
262 reply_nterror(req, NT_STATUS_NO_MEMORY);
263 return;
264 }
265 state->num_data = length;
266 state->max_read = max_read;
267
268 subreq = np_write_send(state, smbd_event_context(), state->handle,
269 state->data, length);
270 if (subreq == NULL) {
271 TALLOC_FREE(state);
272 reply_nterror(req, NT_STATUS_NO_MEMORY);
273 return;
274 }
275 tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
276 talloc_move(conn, &req));
277 }
278
279 static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
280 {
281 struct smb_request *req = tevent_req_callback_data(
282 subreq, struct smb_request);
283 struct dcerpc_cmd_state *state = talloc_get_type_abort(
284 req->async_priv, struct dcerpc_cmd_state);
285 NTSTATUS status;
286 ssize_t nwritten = -1;
287
288 status = np_write_recv(subreq, &nwritten);
289 TALLOC_FREE(subreq);
290 if (!NT_STATUS_IS_OK(status) || (nwritten != state->num_data)) {
291 DEBUG(10, ("Could not write to pipe: %s (%d/%d)\n",
292 nt_errstr(status), (int)state->num_data,
293 (int)nwritten));
294 reply_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
295 goto send;
296 }
297
298 state->data = TALLOC_REALLOC_ARRAY(state, state->data, uint8_t,
299 state->max_read);
300 if (state->data == NULL) {
301 reply_nterror(req, NT_STATUS_NO_MEMORY);
302 goto send;
303 }
304
305 subreq = np_read_send(req->conn, smbd_event_context(),
306 state->handle, state->data, state->max_read);
307 if (subreq == NULL) {
308 reply_nterror(req, NT_STATUS_NO_MEMORY);
309 goto send;
310 }
311 tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
312 return;
313
314 send:
315 if (!srv_send_smb(
316 req->sconn, (char *)req->outbuf,
317 true, req->seqnum+1,
318 IS_CONN_ENCRYPTED(req->conn) || req->encrypted,
319 &req->pcd)) {
320 exit_server_cleanly("api_dcerpc_cmd_write_done: "
321 "srv_send_smb failed.");
322 }
323 TALLOC_FREE(req);
324 }
325
326 static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
327 {
328 struct smb_request *req = tevent_req_callback_data(
329 subreq, struct smb_request);
330 struct dcerpc_cmd_state *state = talloc_get_type_abort(
331 req->async_priv, struct dcerpc_cmd_state);
332 NTSTATUS status;
333 ssize_t nread;
334 bool is_data_outstanding;
335
336 status = np_read_recv(subreq, &nread, &is_data_outstanding);
337 TALLOC_FREE(subreq);
338
339 if (!NT_STATUS_IS_OK(status)) {
340 DEBUG(10, ("Could not read from to pipe: %s\n",
341 nt_errstr(status)));
342 reply_nterror(req, status);
343
344 if (!srv_send_smb(req->sconn, (char *)req->outbuf,
345 true, req->seqnum+1,
346 IS_CONN_ENCRYPTED(req->conn)
347 ||req->encrypted, &req->pcd)) {
348 exit_server_cleanly("api_dcerpc_cmd_read_done: "
349 "srv_send_smb failed.");
350 }
351 TALLOC_FREE(req);
352 return;
353 }
354
355 send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
356 is_data_outstanding);
357 TALLOC_FREE(req);
358 }
359
360 /****************************************************************************
361 WaitNamedPipeHandleState
362 ****************************************************************************/
363
364 static void api_WNPHS(connection_struct *conn, struct smb_request *req,
365 struct files_struct *fsp, char *param, int param_len)
366 {
367 if (!param || param_len < 2) {
368 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
369 return;
370 }
371
372 DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
373 (int)SVAL(param,0)));
374
375 send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
376 }
377
378
379 /****************************************************************************
380 SetNamedPipeHandleState
381 ****************************************************************************/
382
383 static void api_SNPHS(connection_struct *conn, struct smb_request *req,
384 struct files_struct *fsp, char *param, int param_len)
385 {
386 if (!param || param_len < 2) {
387 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
388 return;
389 }
390
391 DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
392
393 send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
394 }
395
396
397 /****************************************************************************
398 When no reply is generated, indicate unsupported.
399 ****************************************************************************/
400
401 static void api_no_reply(connection_struct *conn, struct smb_request *req)
402 {
403 char rparam[4];
404
405 /* unsupported */
406 SSVAL(rparam,0,NERR_notsupported);
407 SSVAL(rparam,2,0); /* converter word */
408
409 DEBUG(3,("Unsupported API fd command\n"));
410
411 /* now send the reply */
412 send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
413
414 return;
415 }
416
417 /****************************************************************************
418 Handle remote api calls delivered to a named pipe already opened.
419 ****************************************************************************/
420
421 static void api_fd_reply(connection_struct *conn, uint16 vuid,
422 struct smb_request *req,
423 uint16 *setup, uint8_t *data, char *params,
424 int suwcnt, int tdscnt, int tpscnt,
425 int mdrcnt, int mprcnt)
426 {
427 struct files_struct *fsp;
428 int pnum;
429 int subcommand;
430
431 DEBUG(5,("api_fd_reply\n"));
432
433 /* First find out the name of this file. */
434 if (suwcnt != 2) {
435 DEBUG(0,("Unexpected named pipe transaction.\n"));
436 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
437 return;
438 }
439
440 /* Get the file handle and hence the file name. */
441 /*
442 * NB. The setup array has already been transformed
443 * via SVAL and so is in host byte order.
444 */
445 pnum = ((int)setup[1]) & 0xFFFF;
446 subcommand = ((int)setup[0]) & 0xFFFF;
447
448 fsp = file_fsp(req, pnum);
449
450 if (!fsp_is_np(fsp)) {
451 if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
452 /* Win9x does this call with a unicode pipe name, not a pnum. */
453 /* Just return success for now... */
454 DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
455 send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
456 return;
457 }
458
459 DEBUG(1,("api_fd_reply: INVALID PIPE HANDLE: %x\n", pnum));
460 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
461 return;
462 }
463
464 if (vuid != fsp->vuid) {
465 DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %d, "
466 "expected %d\n", pnum, vuid, fsp->vuid));
467 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
468 return;
469 }
470
471 DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
472 subcommand, fsp_str_dbg(fsp), pnum));
473
474 DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
475
476 switch (subcommand) {
477 case TRANSACT_DCERPCCMD: {
478 /* dce/rpc command */
479 api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
480 mdrcnt);
481 break;
482 }
483 case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
484 /* Wait Named Pipe Handle state */
485 api_WNPHS(conn, req, fsp, params, tpscnt);
486 break;
487 case TRANSACT_SETNAMEDPIPEHANDLESTATE:
488 /* Set Named Pipe Handle state */
489 api_SNPHS(conn, req, fsp, params, tpscnt);
490 break;
491 default:
492 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
493 return;
494 }
495 }
496
497 /****************************************************************************
498 Handle named pipe commands.
499 ****************************************************************************/
500
501 static void named_pipe(connection_struct *conn, uint16 vuid,
502 struct smb_request *req,
503 const char *name, uint16 *setup,
504 char *data, char *params,
505 int suwcnt, int tdscnt,int tpscnt,
506 int msrcnt, int mdrcnt, int mprcnt)
507 {
508 DEBUG(3,("named pipe command on <%s> name\n", name));
509
510 if (strequal(name,"LANMAN")) {
511 api_reply(conn, vuid, req,
512 data, params,
513 tdscnt, tpscnt,
514 mdrcnt, mprcnt);
515 return;
516 }
517
518 if (strequal(name,"WKSSVC") ||
519 strequal(name,"SRVSVC") ||
520 strequal(name,"WINREG") ||
521 strequal(name,"SAMR") ||
522 strequal(name,"LSARPC")) {
523
524 DEBUG(4,("named pipe command from Win95 (wow!)\n"));
525
526 api_fd_reply(conn, vuid, req,
527 setup, (uint8_t *)data, params,
528 suwcnt, tdscnt, tpscnt,
529 mdrcnt, mprcnt);
530 return;
531 }
532
533 if (strlen(name) < 1) {
534 api_fd_reply(conn, vuid, req,
535 setup, (uint8_t *)data,
536 params, suwcnt, tdscnt,
537 tpscnt, mdrcnt, mprcnt);
538 return;
539 }
540
541 if (setup)
542 DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n",
543 (int)setup[0],(int)setup[1]));
544
545 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
546 return;
547 }
548
549 static void handle_trans(connection_struct *conn, struct smb_request *req,
550 struct trans_state *state)
551 {
552 char *local_machine_name;
553 int name_offset = 0;
554
555 DEBUG(3,("trans <%s> data=%u params=%u setup=%u\n",
556 state->name,(unsigned int)state->total_data,(unsigned int)state->total_param,
557 (unsigned int)state->setup_count));
558
559 /*
560 * WinCE wierdness....
561 */
562
563 local_machine_name = talloc_asprintf(state, "\\%s\\",
564 get_local_machine_name());
565
566 if (local_machine_name == NULL) {
567 reply_nterror(req, NT_STATUS_NO_MEMORY);
568 return;
569 }
570
571 if (strnequal(state->name, local_machine_name,
572 strlen(local_machine_name))) {
573 name_offset = strlen(local_machine_name)-1;
574 }
575
576 if (!strnequal(&state->name[name_offset], "\\PIPE",
577 strlen("\\PIPE"))) {
578 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
579 return;
580 }
581
582 name_offset += strlen("\\PIPE");
583
584 /* Win9x weirdness. When talking to a unicode server Win9x
585 only sends \PIPE instead of \PIPE\ */
586
587 if (state->name[name_offset] == '\\')
588 name_offset++;
589
590 DEBUG(5,("calling named_pipe\n"));
591 named_pipe(conn, state->vuid, req,
592 state->name+name_offset,
593 state->setup,state->data,
594 state->param,
595 state->setup_count,state->total_data,
596 state->total_param,
597 state->max_setup_return,
598 state->max_data_return,
599 state->max_param_return);
600
601 if (state->close_on_completion) {
602 close_cnum(conn,state->vuid);
603 req->conn = NULL;
604 }
605
606 return;
607 }
608
609 /****************************************************************************
610 Reply to a SMBtrans.
611 ****************************************************************************/
612
613 void reply_trans(struct smb_request *req)
614 {
615 connection_struct *conn = req->conn;
616 unsigned int dsoff;
617 unsigned int dscnt;
618 unsigned int psoff;
619 unsigned int pscnt;
620 struct trans_state *state;
621 NTSTATUS result;
622
623 START_PROFILE(SMBtrans);
624
625 if (req->wct < 14) {
626 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
627 END_PROFILE(SMBtrans);
628 return;
629 }
630
631 dsoff = SVAL(req->vwv+12, 0);
632 dscnt = SVAL(req->vwv+11, 0);
633 psoff = SVAL(req->vwv+10, 0);
634 pscnt = SVAL(req->vwv+9, 0);
635
636 result = allow_new_trans(conn->pending_trans, req->mid);
637 if (!NT_STATUS_IS_OK(result)) {
638 DEBUG(2, ("Got invalid trans request: %s\n",
639 nt_errstr(result)));
640 reply_nterror(req, result);
641 END_PROFILE(SMBtrans);
642 return;
643 }
644
645 if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
646 DEBUG(0, ("talloc failed\n"));
647 reply_nterror(req, NT_STATUS_NO_MEMORY);
648 END_PROFILE(SMBtrans);
649 return;
650 }
651
652 state->cmd = SMBtrans;
653
654 state->mid = req->mid;
655 state->vuid = req->vuid;
656 state->setup_count = CVAL(req->vwv+13, 0);
657 state->setup = NULL;
658 state->total_param = SVAL(req->vwv+0, 0);
659 state->param = NULL;
660 state->total_data = SVAL(req->vwv+1, 0);
661 state->data = NULL;
662 state->max_param_return = SVAL(req->vwv+2, 0);
663 state->max_data_return = SVAL(req->vwv+3, 0);
664 state->max_setup_return = CVAL(req->vwv+4, 0);
665 state->close_on_completion = BITSETW(req->vwv+5, 0);
666 state->one_way = BITSETW(req->vwv+5, 1);
667
668 srvstr_pull_req_talloc(state, req, &state->name, req->buf,
669 STR_TERMINATE);
670
671 if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
672 !state->name)
673 goto bad_param;
674
675 if (state->total_data) {
676
677 if (trans_oob(state->total_data, 0, dscnt)
678 || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
679 goto bad_param;
680 }
681
682 /* Can't use talloc here, the core routines do realloc on the
683 * params and data. Out of paranoia, 100 bytes too many. */
684 state->data = (char *)SMB_MALLOC(state->total_data+100);
685 if (state->data == NULL) {
686 DEBUG(0,("reply_trans: data malloc fail for %u "
687 "bytes !\n", (unsigned int)state->total_data));
688 TALLOC_FREE(state);
689 reply_nterror(req, NT_STATUS_NO_MEMORY);
690 END_PROFILE(SMBtrans);
691 return;
692 }
693 /* null-terminate the slack space */
694 memset(&state->data[state->total_data], 0, 100);
695
696 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
697 }
698
699 if (state->total_param) {
700
701 if (trans_oob(state->total_param, 0, pscnt)
702 || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
703 goto bad_param;
704 }
705
706 /* Can't use talloc here, the core routines do realloc on the
707 * params and data. Out of paranoia, 100 bytes too many */
708 state->param = (char *)SMB_MALLOC(state->total_param+100);
709 if (state->param == NULL) {
710 DEBUG(0,("reply_trans: param malloc fail for %u "
711 "bytes !\n", (unsigned int)state->total_param));
712 SAFE_FREE(state->data);
713 TALLOC_FREE(state);
714 reply_nterror(req, NT_STATUS_NO_MEMORY);
715 END_PROFILE(SMBtrans);
716 return;
717 }
718 /* null-terminate the slack space */
719 memset(&state->param[state->total_param], 0, 100);
720
721 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
722 }
723
724 state->received_data = dscnt;
725 state->received_param = pscnt;
726
727 if (state->setup_count) {
728 unsigned int i;
729
730 /*
731 * No overflow possible here, state->setup_count is an
732 * unsigned int, being filled by a single byte from
733 * CVAL(req->vwv+13, 0) above. The cast in the comparison
734 * below is not necessary, it's here to clarify things. The
735 * validity of req->vwv and req->wct has been checked in
736 * init_smb_request already.
737 */
738 if (state->setup_count + 14 > (unsigned int)req->wct) {
739 goto bad_param;
740 }
741
742 if((state->setup = TALLOC_ARRAY(
743 state, uint16, state->setup_count)) == NULL) {
744 DEBUG(0,("reply_trans: setup malloc fail for %u "
745 "bytes !\n", (unsigned int)
746 (state->setup_count * sizeof(uint16))));
747 SAFE_FREE(state->data);
748 SAFE_FREE(state->param);
749 TALLOC_FREE(state);
750 reply_nterror(req, NT_STATUS_NO_MEMORY);
751 END_PROFILE(SMBtrans);
752 return;
753 }
754
755 for (i=0;i<state->setup_count;i++) {
756 state->setup[i] = SVAL(req->vwv + 14 + i, 0);
757 }
758 }
759
760 state->received_param = pscnt;
761
762 if ((state->received_param != state->total_param) ||
763 (state->received_data != state->total_data)) {
764 DLIST_ADD(conn->pending_trans, state);
765
766 /* We need to send an interim response then receive the rest
767 of the parameter/data bytes */
768 reply_outbuf(req, 0, 0);
769 show_msg((char *)req->outbuf);
770 END_PROFILE(SMBtrans);
771 return;
772 }
773
774 talloc_steal(talloc_tos(), state);
775
776 handle_trans(conn, req, state);
777
778 SAFE_FREE(state->data);
779 SAFE_FREE(state->param);
780 TALLOC_FREE(state);
781
782 END_PROFILE(SMBtrans);
783 return;
784
785 bad_param:
786
787 DEBUG(0,("reply_trans: invalid trans parameters\n"));
788 SAFE_FREE(state->data);
789 SAFE_FREE(state->param);
790 TALLOC_FREE(state);
791 END_PROFILE(SMBtrans);
792 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
793 return;
794 }
795
796 /****************************************************************************
797 Reply to a secondary SMBtrans.
798 ****************************************************************************/
799
800 void reply_transs(struct smb_request *req)
801 {
802 connection_struct *conn = req->conn;
803 unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
804 struct trans_state *state;
805
806 START_PROFILE(SMBtranss);
807
808 show_msg((char *)req->inbuf);
809
810 if (req->wct < 8) {
811 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
812 END_PROFILE(SMBtranss);
813 return;
814 }
815
816 for (state = conn->pending_trans; state != NULL;
817 state = state->next) {
818 if (state->mid == req->mid) {
819 break;
820 }
821 }
822
823 if ((state == NULL) || (state->cmd != SMBtrans)) {
824 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
825 END_PROFILE(SMBtranss);
826 return;
827 }
828
829 /* Revise total_params and total_data in case they have changed
830 * downwards */
831
832 if (SVAL(req->vwv+0, 0) < state->total_param)
833 state->total_param = SVAL(req->vwv+0, 0);
834 if (SVAL(req->vwv+1, 0) < state->total_data)
835 state->total_data = SVAL(req->vwv+1, 0);
836
837 pcnt = SVAL(req->vwv+2, 0);
838 poff = SVAL(req->vwv+3, 0);
839 pdisp = SVAL(req->vwv+4, 0);
840
841 dcnt = SVAL(req->vwv+5, 0);
842 doff = SVAL(req->vwv+6, 0);
843 ddisp = SVAL(req->vwv+7, 0);
844
845 state->received_param += pcnt;
846 state->received_data += dcnt;
847
848 if ((state->received_data > state->total_data) ||
849 (state->received_param > state->total_param))
850 goto bad_param;
851
852 if (pcnt) {
853 if (trans_oob(state->total_param, pdisp, pcnt)
854 || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
855 goto bad_param;
856 }
857 memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
858 }
859
860 if (dcnt) {
861 if (trans_oob(state->total_data, ddisp, dcnt)
862 || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
863 goto bad_param;
864 }
865 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
866 }
867
868 if ((state->received_param < state->total_param) ||
869 (state->received_data < state->total_data)) {
870 END_PROFILE(SMBtranss);
871 return;
872 }
873
874 talloc_steal(talloc_tos(), state);
875
876 handle_trans(conn, req, state);
877
878 DLIST_REMOVE(conn->pending_trans, state);
879 SAFE_FREE(state->data);
880 SAFE_FREE(state->param);
881 TALLOC_FREE(state);
882
883 END_PROFILE(SMBtranss);
884 return;
885
886 bad_param:
887
888 DEBUG(0,("reply_transs: invalid trans parameters\n"));
889 DLIST_REMOVE(conn->pending_trans, state);
890 SAFE_FREE(state->data);
891 SAFE_FREE(state->param);
892 TALLOC_FREE(state);
893 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
894 END_PROFILE(SMBtranss);
895 return;
896 }
WIP