mirror of
https://github.com/samba-team/samba.git
synced 2025-01-08 21:18:16 +03:00
b4726d48e5
metze
(This used to be commit 5bf136e233
)
682 lines
18 KiB
C
682 lines
18 KiB
C
/*
|
|
Unix SMB/CIFS implementation.
|
|
raw trans/trans2/nttrans operations
|
|
|
|
Copyright (C) James Myers 2003 <myersjj@samba.org>
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License as published by
|
|
the Free Software Foundation; either version 3 of the License, or
|
|
(at your option) any later version.
|
|
|
|
This program is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License for more details.
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include "lib/util/dlinklist.h"
|
|
#include "libcli/raw/libcliraw.h"
|
|
#include "libcli/raw/raw_proto.h"
|
|
|
|
#define TORTURE_TRANS_DATA 0
|
|
|
|
/*
|
|
check out of bounds for incoming data
|
|
*/
|
|
static bool raw_trans_oob(struct smbcli_request *req,
|
|
uint_t offset, uint_t count)
|
|
{
|
|
uint8_t *ptr;
|
|
|
|
if (count == 0) {
|
|
return false;
|
|
}
|
|
|
|
ptr = req->in.hdr + offset;
|
|
|
|
/* be careful with wraparound! */
|
|
if ((uintptr_t)ptr < (uintptr_t)req->in.data ||
|
|
(uintptr_t)ptr >= (uintptr_t)req->in.data + req->in.data_size ||
|
|
count > req->in.data_size ||
|
|
(uintptr_t)ptr + count > (uintptr_t)req->in.data + req->in.data_size) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/****************************************************************************
|
|
receive a SMB trans or trans2 response allocating the necessary memory
|
|
****************************************************************************/
|
|
NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
int total_data=0;
|
|
int total_param=0;
|
|
uint8_t *tdata;
|
|
uint8_t *tparam;
|
|
|
|
parms->out.data.length = 0;
|
|
parms->out.data.data = NULL;
|
|
parms->out.params.length = 0;
|
|
parms->out.params.data = NULL;
|
|
|
|
if (!smbcli_request_receive(req)) {
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
/*
|
|
* An NT RPC pipe call can return ERRDOS, ERRmoredata
|
|
* to a trans call. This is not an error and should not
|
|
* be treated as such.
|
|
*/
|
|
if (NT_STATUS_IS_ERR(req->status)) {
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
SMBCLI_CHECK_MIN_WCT(req, 10);
|
|
|
|
/* parse out the lengths */
|
|
total_data = SVAL(req->in.vwv, VWV(1));
|
|
total_param = SVAL(req->in.vwv, VWV(0));
|
|
|
|
/* allocate it */
|
|
if (total_data != 0) {
|
|
tdata = talloc_array(mem_ctx, uint8_t, total_data);
|
|
if (!tdata) {
|
|
DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
|
|
req->status = NT_STATUS_NO_MEMORY;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
parms->out.data.data = tdata;
|
|
}
|
|
|
|
if (total_param != 0) {
|
|
tparam = talloc_array(mem_ctx, uint8_t, total_param);
|
|
if (!tparam) {
|
|
DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
|
|
req->status = NT_STATUS_NO_MEMORY;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
parms->out.params.data = tparam;
|
|
}
|
|
|
|
parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
|
|
SMBCLI_CHECK_WCT(req, 10 + parms->out.setup_count);
|
|
|
|
if (parms->out.setup_count > 0) {
|
|
int i;
|
|
parms->out.setup = talloc_array(mem_ctx, uint16_t, parms->out.setup_count);
|
|
if (!parms->out.setup) {
|
|
req->status = NT_STATUS_NO_MEMORY;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
for (i=0;i<parms->out.setup_count;i++) {
|
|
parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
|
|
}
|
|
}
|
|
|
|
while (1) {
|
|
uint16_t param_count, param_ofs, param_disp;
|
|
uint16_t data_count, data_ofs, data_disp;
|
|
uint16_t total_data2, total_param2;
|
|
|
|
/* parse out the total lengths again - they can shrink! */
|
|
total_data2 = SVAL(req->in.vwv, VWV(1));
|
|
total_param2 = SVAL(req->in.vwv, VWV(0));
|
|
|
|
if (total_data2 > total_data ||
|
|
total_param2 > total_param) {
|
|
/* they must *only* shrink */
|
|
DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
total_data = total_data2;
|
|
total_param = total_param2;
|
|
|
|
/* parse params for this lump */
|
|
param_count = SVAL(req->in.vwv, VWV(3));
|
|
param_ofs = SVAL(req->in.vwv, VWV(4));
|
|
param_disp = SVAL(req->in.vwv, VWV(5));
|
|
|
|
data_count = SVAL(req->in.vwv, VWV(6));
|
|
data_ofs = SVAL(req->in.vwv, VWV(7));
|
|
data_disp = SVAL(req->in.vwv, VWV(8));
|
|
|
|
if (data_count + data_disp > total_data ||
|
|
param_count + param_disp > total_param) {
|
|
DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
/* check the server isn't being nasty */
|
|
if (raw_trans_oob(req, param_ofs, param_count) ||
|
|
raw_trans_oob(req, data_ofs, data_count)) {
|
|
DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
if (data_count) {
|
|
memcpy(parms->out.data.data + data_disp,
|
|
req->in.hdr + data_ofs,
|
|
data_count);
|
|
}
|
|
|
|
if (param_count) {
|
|
memcpy(parms->out.params.data + param_disp,
|
|
req->in.hdr + param_ofs,
|
|
param_count);
|
|
}
|
|
|
|
parms->out.data.length += data_count;
|
|
parms->out.params.length += param_count;
|
|
|
|
if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
|
|
break;
|
|
|
|
if (!smbcli_request_receive_more(req)) {
|
|
req->status = NT_STATUS_UNSUCCESSFUL;
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
}
|
|
|
|
failed:
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
_PUBLIC_ NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
return smb_raw_trans2_recv(req, mem_ctx, parms);
|
|
}
|
|
|
|
|
|
/*
|
|
trans/trans2 raw async interface - only BLOBs used in this interface.
|
|
*/
|
|
struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
|
|
struct smb_trans2 *parms,
|
|
uint8_t command)
|
|
{
|
|
int wct = 14 + parms->in.setup_count;
|
|
struct smbcli_request *req, *req2;
|
|
uint8_t *outdata,*outparam;
|
|
int i;
|
|
int padding;
|
|
size_t namelen = 0;
|
|
uint16_t data_disp, data_length, max_data;
|
|
|
|
if (parms->in.params.length > UINT16_MAX ||
|
|
parms->in.data.length > UINT16_MAX) {
|
|
DEBUG(3,("Attempt to send invalid trans2 request (params %u, data %u)\n",
|
|
(unsigned)parms->in.params.length, (unsigned)parms->in.data.length));
|
|
return NULL;
|
|
}
|
|
|
|
|
|
if (command == SMBtrans)
|
|
padding = 1;
|
|
else
|
|
padding = 3;
|
|
|
|
req = smbcli_request_setup(tree, command, wct, padding);
|
|
if (!req) {
|
|
return NULL;
|
|
}
|
|
|
|
/* Watch out, this changes the req->out.* pointers */
|
|
if (command == SMBtrans && parms->in.trans_name) {
|
|
namelen = smbcli_req_append_string(req, parms->in.trans_name,
|
|
STR_TERMINATE);
|
|
}
|
|
|
|
/* fill in SMB parameters */
|
|
outparam = req->out.data + padding;
|
|
outdata = outparam + parms->in.params.length;
|
|
|
|
/* make sure we don't leak data via the padding */
|
|
memset(req->out.data, 0, padding);
|
|
|
|
data_length = parms->in.data.length;
|
|
|
|
max_data = smb_raw_max_trans_data(tree, parms->in.params.length);
|
|
if (max_data < data_length) {
|
|
data_length = max_data;
|
|
}
|
|
|
|
#if TORTURE_TRANS_DATA
|
|
if (data_length > 1) {
|
|
data_length /= 2;
|
|
}
|
|
#endif
|
|
|
|
/* primary request */
|
|
SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
|
|
SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
|
|
SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
|
|
SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
|
|
SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
|
|
SSVAL(req->out.vwv,VWV(5),parms->in.flags);
|
|
SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
|
|
SSVAL(req->out.vwv,VWV(8),0); /* reserved */
|
|
SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
|
|
SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr)+namelen);
|
|
SSVAL(req->out.vwv,VWV(11),data_length);
|
|
SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr)+namelen);
|
|
SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
|
|
for (i=0;i<parms->in.setup_count;i++) {
|
|
SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
|
|
}
|
|
if (parms->in.params.data) {
|
|
smbcli_req_append_blob(req, &parms->in.params);
|
|
}
|
|
if (parms->in.data.data) {
|
|
DATA_BLOB data;
|
|
data.data = parms->in.data.data;
|
|
data.length = data_length;
|
|
smbcli_req_append_blob(req, &data);
|
|
}
|
|
|
|
if (!smbcli_request_send(req)) {
|
|
smbcli_request_destroy(req);
|
|
return NULL;
|
|
}
|
|
|
|
data_disp = data_length;
|
|
|
|
|
|
if (data_disp != parms->in.data.length) {
|
|
/* TODO: this should be done asynchronously .... */
|
|
if (!smbcli_request_receive(req) ||
|
|
!NT_STATUS_IS_OK(req->status)) {
|
|
return req;
|
|
}
|
|
|
|
req->state = SMBCLI_REQUEST_RECV;
|
|
DLIST_ADD(req->transport->pending_recv, req);
|
|
}
|
|
|
|
|
|
while (data_disp != parms->in.data.length) {
|
|
data_length = parms->in.data.length - data_disp;
|
|
|
|
max_data = smb_raw_max_trans_data(tree, 0);
|
|
if (max_data < data_length) {
|
|
data_length = max_data;
|
|
}
|
|
|
|
#if TORTURE_TRANS_DATA
|
|
if (data_length > 1) {
|
|
data_length /= 2;
|
|
}
|
|
#endif
|
|
|
|
req2 = smbcli_request_setup(tree, command+1, 9, data_length);
|
|
if (!req2) {
|
|
return NULL;
|
|
}
|
|
req2->mid = req->mid;
|
|
SSVAL(req2->out.hdr, HDR_MID, req2->mid);
|
|
|
|
outdata = req2->out.data;
|
|
|
|
SSVAL(req2->out.vwv,VWV(0), parms->in.params.length);
|
|
SSVAL(req2->out.vwv,VWV(1), parms->in.data.length);
|
|
SSVAL(req2->out.vwv,VWV(2), 0);
|
|
SSVAL(req2->out.vwv,VWV(3), 0);
|
|
SSVAL(req2->out.vwv,VWV(4), 0);
|
|
SSVAL(req2->out.vwv,VWV(5), data_length);
|
|
SSVAL(req2->out.vwv,VWV(6), PTR_DIFF(outdata,req2->out.hdr));
|
|
SSVAL(req2->out.vwv,VWV(7), data_disp);
|
|
SSVAL(req2->out.vwv,VWV(8), 0xFFFF);
|
|
|
|
if (data_length != 0) {
|
|
memcpy(req2->out.data, parms->in.data.data + data_disp,
|
|
data_length);
|
|
}
|
|
|
|
data_disp += data_length;
|
|
|
|
req2->one_way_request = 1;
|
|
|
|
if (!smbcli_request_send(req2)) {
|
|
smbcli_request_destroy(req2);
|
|
return NULL;
|
|
}
|
|
|
|
req->seq_num = req2->seq_num;
|
|
}
|
|
|
|
|
|
return req;
|
|
}
|
|
|
|
|
|
/*
|
|
trans/trans2 raw async interface - only BLOBs used in this interface.
|
|
note that this doesn't yet support multi-part requests
|
|
*/
|
|
_PUBLIC_ struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
return smb_raw_trans_send_backend(tree, parms, SMBtrans);
|
|
}
|
|
|
|
struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
|
|
}
|
|
|
|
/*
|
|
trans2 synchronous blob interface
|
|
*/
|
|
NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
struct smbcli_request *req;
|
|
req = smb_raw_trans2_send(tree, parms);
|
|
if (!req) return NT_STATUS_UNSUCCESSFUL;
|
|
return smb_raw_trans2_recv(req, mem_ctx, parms);
|
|
}
|
|
|
|
|
|
/*
|
|
trans synchronous blob interface
|
|
*/
|
|
_PUBLIC_ NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_trans2 *parms)
|
|
{
|
|
struct smbcli_request *req;
|
|
req = smb_raw_trans_send(tree, parms);
|
|
if (!req) return NT_STATUS_UNSUCCESSFUL;
|
|
return smb_raw_trans_recv(req, mem_ctx, parms);
|
|
}
|
|
|
|
struct smb_raw_nttrans_recv_state {
|
|
bool got_first;
|
|
uint32_t recvd_data;
|
|
uint32_t recvd_param;
|
|
struct smb_nttrans io;
|
|
};
|
|
|
|
NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_nttrans *parms)
|
|
{
|
|
struct smb_raw_nttrans_recv_state *state;
|
|
|
|
if (!smbcli_request_receive(req) ||
|
|
smbcli_request_is_error(req)) {
|
|
goto failed;
|
|
}
|
|
|
|
state = talloc_get_type(req->recv_helper.private_data,
|
|
struct smb_raw_nttrans_recv_state);
|
|
|
|
parms->out = state->io.out;
|
|
talloc_steal(mem_ctx, parms->out.setup);
|
|
talloc_steal(mem_ctx, parms->out.params.data);
|
|
talloc_steal(mem_ctx, parms->out.data.data);
|
|
talloc_free(state);
|
|
|
|
ZERO_STRUCT(req->recv_helper);
|
|
|
|
failed:
|
|
return smbcli_request_destroy(req);
|
|
}
|
|
|
|
/*
|
|
* This helper returns SMBCLI_REQUEST_RECV until all data has arrived
|
|
*/
|
|
static enum smbcli_request_state smb_raw_nttrans_recv_helper(struct smbcli_request *req)
|
|
{
|
|
struct smb_raw_nttrans_recv_state *state = talloc_get_type(req->recv_helper.private_data,
|
|
struct smb_raw_nttrans_recv_state);
|
|
uint32_t param_count, param_ofs, param_disp;
|
|
uint32_t data_count, data_ofs, data_disp;
|
|
uint32_t total_data, total_param;
|
|
uint8_t setup_count;
|
|
|
|
/*
|
|
* An NT RPC pipe call can return ERRDOS, ERRmoredata
|
|
* to a trans call. This is not an error and should not
|
|
* be treated as such.
|
|
*/
|
|
if (smbcli_request_is_error(req)) {
|
|
goto failed;
|
|
}
|
|
|
|
/* sanity check */
|
|
if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
|
|
DEBUG(0,("smb_raw_nttrans_recv_helper: Expected %s response, got command 0x%02x\n",
|
|
"SMBnttrans",
|
|
CVAL(req->in.hdr,HDR_COM)));
|
|
req->status = NT_STATUS_INVALID_NETWORK_RESPONSE;
|
|
goto failed;
|
|
}
|
|
|
|
/* this is the first packet of the response */
|
|
SMBCLI_CHECK_MIN_WCT(req, 18);
|
|
|
|
total_param = IVAL(req->in.vwv, 3);
|
|
total_data = IVAL(req->in.vwv, 7);
|
|
setup_count = CVAL(req->in.vwv, 35);
|
|
|
|
param_count = IVAL(req->in.vwv, 11);
|
|
param_ofs = IVAL(req->in.vwv, 15);
|
|
param_disp = IVAL(req->in.vwv, 19);
|
|
|
|
data_count = IVAL(req->in.vwv, 23);
|
|
data_ofs = IVAL(req->in.vwv, 27);
|
|
data_disp = IVAL(req->in.vwv, 31);
|
|
|
|
if (!state->got_first) {
|
|
if (total_param > 0) {
|
|
state->io.out.params = data_blob_talloc(state, NULL, total_param);
|
|
if (!state->io.out.params.data) {
|
|
goto nomem;
|
|
}
|
|
}
|
|
|
|
if (total_data > 0) {
|
|
state->io.out.data = data_blob_talloc(state, NULL, total_data);
|
|
if (!state->io.out.data.data) {
|
|
goto nomem;
|
|
}
|
|
}
|
|
|
|
if (setup_count > 0) {
|
|
SMBCLI_CHECK_WCT(req, 18 + setup_count);
|
|
|
|
state->io.out.setup_count = setup_count;
|
|
state->io.out.setup = talloc_array(state, uint8_t,
|
|
setup_count * VWV(1));
|
|
if (!state->io.out.setup) {
|
|
goto nomem;
|
|
}
|
|
memcpy(state->io.out.setup, (uint8_t *)req->out.vwv + VWV(18),
|
|
setup_count * VWV(1));
|
|
}
|
|
|
|
state->got_first = true;
|
|
}
|
|
|
|
if (total_data > state->io.out.data.length ||
|
|
total_param > state->io.out.params.length) {
|
|
/* they must *only* shrink */
|
|
DEBUG(1,("smb_raw_nttrans_recv_helper: data/params expanded!\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
goto failed;
|
|
}
|
|
|
|
state->io.out.data.length = total_data;
|
|
state->io.out.params.length = total_param;
|
|
|
|
if (data_count + data_disp > total_data ||
|
|
param_count + param_disp > total_param) {
|
|
DEBUG(1,("smb_raw_nttrans_recv_helper: Buffer overflow\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
goto failed;
|
|
}
|
|
|
|
/* check the server isn't being nasty */
|
|
if (raw_trans_oob(req, param_ofs, param_count) ||
|
|
raw_trans_oob(req, data_ofs, data_count)) {
|
|
DEBUG(1,("smb_raw_nttrans_recv_helper: out of bounds parameters!\n"));
|
|
req->status = NT_STATUS_BUFFER_TOO_SMALL;
|
|
goto failed;
|
|
}
|
|
|
|
if (data_count) {
|
|
memcpy(state->io.out.data.data + data_disp,
|
|
req->in.hdr + data_ofs,
|
|
data_count);
|
|
}
|
|
|
|
if (param_count) {
|
|
memcpy(state->io.out.params.data + param_disp,
|
|
req->in.hdr + param_ofs,
|
|
param_count);
|
|
}
|
|
|
|
state->recvd_param += param_count;
|
|
state->recvd_data += data_count;
|
|
|
|
if (state->recvd_data < total_data ||
|
|
state->recvd_param < total_param) {
|
|
|
|
/* we don't need the in buffer any more */
|
|
talloc_free(req->in.buffer);
|
|
ZERO_STRUCT(req->in);
|
|
|
|
/* we still wait for more data */
|
|
DEBUG(10,("smb_raw_nttrans_recv_helper: more data needed\n"));
|
|
return SMBCLI_REQUEST_RECV;
|
|
}
|
|
|
|
DEBUG(10,("smb_raw_nttrans_recv_helper: done\n"));
|
|
return SMBCLI_REQUEST_DONE;
|
|
|
|
nomem:
|
|
req->status = NT_STATUS_NO_MEMORY;
|
|
failed:
|
|
return SMBCLI_REQUEST_ERROR;
|
|
}
|
|
|
|
/****************************************************************************
|
|
nttrans raw - only BLOBs used in this interface.
|
|
at the moment we only handle a single primary request
|
|
****************************************************************************/
|
|
struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
|
|
struct smb_nttrans *parms)
|
|
{
|
|
struct smbcli_request *req;
|
|
struct smb_raw_nttrans_recv_state *state;
|
|
uint8_t *outdata, *outparam;
|
|
int align = 0;
|
|
|
|
/* only align if there are parameters or data */
|
|
if (parms->in.params.length || parms->in.data.length) {
|
|
align = 3;
|
|
}
|
|
|
|
req = smbcli_request_setup(tree, SMBnttrans,
|
|
19 + parms->in.setup_count,
|
|
align +
|
|
parms->in.params.length +
|
|
parms->in.data.length);
|
|
if (!req) {
|
|
return NULL;
|
|
}
|
|
|
|
state = talloc_zero(req, struct smb_raw_nttrans_recv_state);
|
|
if (!state) {
|
|
talloc_free(req);
|
|
return NULL;
|
|
}
|
|
|
|
/* fill in SMB parameters */
|
|
outparam = req->out.data + align;
|
|
outdata = outparam + parms->in.params.length;
|
|
|
|
if (align != 0) {
|
|
memset(req->out.data, 0, align);
|
|
}
|
|
|
|
SCVAL(req->out.vwv, 0, parms->in.max_setup);
|
|
SSVAL(req->out.vwv, 1, 0); /* reserved */
|
|
SIVAL(req->out.vwv, 3, parms->in.params.length);
|
|
SIVAL(req->out.vwv, 7, parms->in.data.length);
|
|
SIVAL(req->out.vwv, 11, parms->in.max_param);
|
|
SIVAL(req->out.vwv, 15, parms->in.max_data);
|
|
SIVAL(req->out.vwv, 19, parms->in.params.length);
|
|
SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
|
|
SIVAL(req->out.vwv, 27, parms->in.data.length);
|
|
SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
|
|
SCVAL(req->out.vwv, 35, parms->in.setup_count);
|
|
SSVAL(req->out.vwv, 36, parms->in.function);
|
|
memcpy(req->out.vwv + VWV(19), parms->in.setup,
|
|
sizeof(uint16_t) * parms->in.setup_count);
|
|
if (parms->in.params.length) {
|
|
memcpy(outparam, parms->in.params.data, parms->in.params.length);
|
|
}
|
|
if (parms->in.data.length) {
|
|
memcpy(outdata, parms->in.data.data, parms->in.data.length);
|
|
}
|
|
|
|
/* add the helper which will check that all multi-part replies are
|
|
in before an async client callack will be issued */
|
|
req->recv_helper.fn = smb_raw_nttrans_recv_helper;
|
|
req->recv_helper.private_data = state;
|
|
|
|
if (!smbcli_request_send(req)) {
|
|
smbcli_request_destroy(req);
|
|
return NULL;
|
|
}
|
|
|
|
return req;
|
|
}
|
|
|
|
|
|
/****************************************************************************
|
|
receive a SMB nttrans response allocating the necessary memory
|
|
****************************************************************************/
|
|
NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
|
|
TALLOC_CTX *mem_ctx,
|
|
struct smb_nttrans *parms)
|
|
{
|
|
struct smbcli_request *req;
|
|
|
|
req = smb_raw_nttrans_send(tree, parms);
|
|
if (!req) {
|
|
return NT_STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
return smb_raw_nttrans_recv(req, mem_ctx, parms);
|
|
}
|
|
|
|
/*
|
|
work out the maximum data size for a trans request while avoiding
|
|
multi-part replies
|
|
|
|
TODO: we only need to avoid multi-part replies because the
|
|
multi-part trans receive code is broken.
|
|
*/
|
|
_PUBLIC_ size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
|
|
{
|
|
return tree->session->transport->negotiate.max_xmit - (70 + param_size);
|
|
}
|