source3/libsmb/clireadwrite.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client file read/write routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libsmb/libsmb.h"
  22 #include "../lib/util/tevent_ntstatus.h"
  23 #include "async_smb.h"
  24 #include "trans2.h"
  25 #include "../libcli/smb/smbXcli_base.h"
  26
  27 /****************************************************************************
  28   Calculate the recommended read buffer size
  29 ****************************************************************************/
  30 static size_t cli_read_max_bufsize(struct cli_state *cli)
  31 {
  32         uint8_t wct = 12;
  33         uint32_t min_space;
  34         uint32_t data_offset;
  35         uint32_t useable_space = 0;
  36
  37         data_offset = HDR_VWV;
  38         data_offset += wct * sizeof(uint16_t);
  39         data_offset += sizeof(uint16_t); /* byte count */
  40         data_offset += 1; /* pad */
  41
  42         min_space = cli_state_available_size(cli, data_offset);
  43
  44         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_READ_CAP) {
  45                 useable_space = 0xFFFFFF - data_offset;
  46
  47                 if (smb1cli_conn_signing_is_active(cli->conn)) {
  48                         return min_space;
  49                 }
  50
  51                 if (smb1cli_conn_encryption_on(cli->conn)) {
  52                         return min_space;
  53                 }
  54
  55                 return useable_space;
  56         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_READX) {
  57                 /*
  58                  * Note: CAP_LARGE_READX also works with signing
  59                  */
  60                 useable_space = 0x1FFFF - data_offset;
  61
  62                 useable_space = MIN(useable_space, UINT16_MAX);
  63
  64                 return useable_space;
  65         }
  66
  67         return min_space;
  68 }
  69
  70 /****************************************************************************
  71   Calculate the recommended write buffer size
  72 ****************************************************************************/
  73 static size_t cli_write_max_bufsize(struct cli_state *cli,
  74                                     uint16_t write_mode,
  75                                     uint8_t wct)
  76 {
  77         uint32_t min_space;
  78         uint32_t data_offset;
  79         uint32_t useable_space = 0;
  80
  81         data_offset = HDR_VWV;
  82         data_offset += wct * sizeof(uint16_t);
  83         data_offset += sizeof(uint16_t); /* byte count */
  84         data_offset += 1; /* pad */
  85
  86         min_space = cli_state_available_size(cli, data_offset);
  87
  88         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) {
  89                 useable_space = 0xFFFFFF - data_offset;
  90         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_WRITEX) {
  91                 useable_space = 0x1FFFF - data_offset;
  92         } else {
  93                 return min_space;
  94         }
  95
  96         if (write_mode != 0) {
  97                 return min_space;
  98         }
  99
 100         if (smb1cli_conn_signing_is_active(cli->conn)) {
 101                 return min_space;
 102         }
 103
 104         if (smb1cli_conn_encryption_on(cli->conn)) {
 105                 return min_space;
 106         }
 107
 108         if (strequal(cli->dev, "LPT1:")) {
 109                 return min_space;
 110         }
 111
 112         return useable_space;
 113 }
 114
 115 struct cli_read_andx_state {
 116         size_t size;
 117         uint16_t vwv[12];
 118         NTSTATUS status;
 119         size_t received;
 120         uint8_t *buf;
 121 };
 122
 123 static void cli_read_andx_done(struct tevent_req *subreq);
 124
 125 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
 126                                         struct tevent_context *ev,
 127                                         struct cli_state *cli, uint16_t fnum,
 128                                         off_t offset, size_t size,
 129                                         struct tevent_req **psmbreq)
 130 {
 131         struct tevent_req *req, *subreq;
 132         struct cli_read_andx_state *state;
 133         uint8_t wct = 10;
 134
 135         req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
 136         if (req == NULL) {
 137                 return NULL;
 138         }
 139         state->size = size;
 140
 141         SCVAL(state->vwv + 0, 0, 0xFF);
 142         SCVAL(state->vwv + 0, 1, 0);
 143         SSVAL(state->vwv + 1, 0, 0);
 144         SSVAL(state->vwv + 2, 0, fnum);
 145         SIVAL(state->vwv + 3, 0, offset);
 146         SSVAL(state->vwv + 5, 0, size);
 147         SSVAL(state->vwv + 6, 0, size);
 148         SSVAL(state->vwv + 7, 0, (size >> 16));
 149         SSVAL(state->vwv + 8, 0, 0);
 150         SSVAL(state->vwv + 9, 0, 0);
 151
 152         if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) {
 153                 SIVAL(state->vwv + 10, 0,
 154                       (((uint64_t)offset)>>32) & 0xffffffff);
 155                 wct = 12;
 156         } else {
 157                 if ((((uint64_t)offset) & 0xffffffff00000000LL) != 0) {
 158                         DEBUG(10, ("cli_read_andx_send got large offset where "
 159                                    "the server does not support it\n"));
 160                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 161                         return tevent_req_post(req, ev);
 162                 }
 163         }
 164
 165         subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, wct,
 166                                     state->vwv, 0, NULL);
 167         if (subreq == NULL) {
 168                 TALLOC_FREE(req);
 169                 return NULL;
 170         }
 171         tevent_req_set_callback(subreq, cli_read_andx_done, req);
 172         *psmbreq = subreq;
 173         return req;
 174 }
 175
 176 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
 177                                       struct tevent_context *ev,
 178                                       struct cli_state *cli, uint16_t fnum,
 179                                       off_t offset, size_t size)
 180 {
 181         struct tevent_req *req, *subreq;
 182         NTSTATUS status;
 183
 184         req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
 185                                    &subreq);
 186         if (req == NULL) {
 187                 return NULL;
 188         }
 189
 190         status = smb1cli_req_chain_submit(&subreq, 1);
 191         if (tevent_req_nterror(req, status)) {
 192                 return tevent_req_post(req, ev);
 193         }
 194         return req;
 195 }
 196
 197 static void cli_read_andx_done(struct tevent_req *subreq)
 198 {
 199         struct tevent_req *req = tevent_req_callback_data(
 200                 subreq, struct tevent_req);
 201         struct cli_read_andx_state *state = tevent_req_data(
 202                 req, struct cli_read_andx_state);
 203         uint8_t *inbuf;
 204         uint8_t wct;
 205         uint16_t *vwv;
 206         uint32_t num_bytes;
 207         uint8_t *bytes;
 208
 209         state->status = cli_smb_recv(subreq, state, &inbuf, 12, &wct, &vwv,
 210                                      &num_bytes, &bytes);
 211         TALLOC_FREE(subreq);
 212         if (NT_STATUS_IS_ERR(state->status)) {
 213                 tevent_req_nterror(req, state->status);
 214                 return;
 215         }
 216
 217         /* size is the number of bytes the server returned.
 218          * Might be zero. */
 219         state->received = SVAL(vwv + 5, 0);
 220         state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
 221
 222         if (state->received > state->size) {
 223                 DEBUG(5,("server returned more than we wanted!\n"));
 224                 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
 225                 return;
 226         }
 227
 228         /*
 229          * bcc field must be valid for small reads, for large reads the 16-bit
 230          * bcc field can't be correct.
 231          */
 232
 233         if ((state->received < 0xffff) && (state->received > num_bytes)) {
 234                 DEBUG(5, ("server announced more bytes than sent\n"));
 235                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 236                 return;
 237         }
 238
 239         state->buf = discard_const_p(uint8_t, smb_base(inbuf)) + SVAL(vwv+6, 0);
 240
 241         if (trans_oob(smb_len_tcp(inbuf), SVAL(vwv+6, 0), state->received)
 242             || ((state->received != 0) && (state->buf < bytes))) {
 243                 DEBUG(5, ("server returned invalid read&x data offset\n"));
 244                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 245                 return;
 246         }
 247         tevent_req_done(req);
 248 }
 249
 250 /*
 251  * Pull the data out of a finished async read_and_x request. rcvbuf is
 252  * talloced from the request, so better make sure that you copy it away before
 253  * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
 254  * talloc_move it!
 255  */
 256
 257 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
 258                             uint8_t **rcvbuf)
 259 {
 260         struct cli_read_andx_state *state = tevent_req_data(
 261                 req, struct cli_read_andx_state);
 262         NTSTATUS status;
 263
 264         if (tevent_req_is_nterror(req, &status)) {
 265                 return status;
 266         }
 267         *received = state->received;
 268         *rcvbuf = state->buf;
 269         return NT_STATUS_OK;
 270 }
 271
 272 struct cli_pull_chunk;
 273
 274 struct cli_pull_state {
 275         struct tevent_context *ev;
 276         struct cli_state *cli;
 277         uint16_t fnum;
 278         off_t start_offset;
 279         off_t size;
 280
 281         NTSTATUS (*sink)(char *buf, size_t n, void *priv);
 282         void *priv;
 283
 284         size_t chunk_size;
 285         off_t next_offset;
 286         off_t remaining;
 287
 288         /*
 289          * How many bytes did we push into "sink"?
 290          */
 291         off_t pushed;
 292
 293         /*
 294          * Outstanding requests
 295          *
 296          * The maximum is 256:
 297          * - which would be a window of 256 MByte
 298          *   for SMB2 with multi-credit
 299          *   or smb1 unix extentions.
 300          */
 301         uint16_t max_chunks;
 302         uint16_t num_chunks;
 303         uint16_t num_waiting;
 304         struct cli_pull_chunk *chunks;
 305 };
 306
 307 struct cli_pull_chunk {
 308         struct cli_pull_chunk *prev, *next;
 309         struct tevent_req *req;/* This is the main request! Not the subreq */
 310         struct tevent_req *subreq;
 311         off_t ofs;
 312         uint8_t *buf;
 313         size_t total_size;
 314         size_t tmp_size;
 315         bool done;
 316 };
 317
 318 static void cli_pull_setup_chunks(struct tevent_req *req);
 319 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk);
 320 static void cli_pull_chunk_done(struct tevent_req *subreq);
 321
 322 /*
 323  * Parallel read support.
 324  *
 325  * cli_pull sends as many read&x requests as the server would allow via
 326  * max_mux at a time. When replies flow back in, the data is written into
 327  * the callback function "sink" in the right order.
 328  */
 329
 330 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
 331                                  struct tevent_context *ev,
 332                                  struct cli_state *cli,
 333                                  uint16_t fnum, off_t start_offset,
 334                                  off_t size, size_t window_size,
 335                                  NTSTATUS (*sink)(char *buf, size_t n,
 336                                                   void *priv),
 337                                  void *priv)
 338 {
 339         struct tevent_req *req;
 340         struct cli_pull_state *state;
 341         size_t page_size = 1024;
 342         uint64_t tmp64;
 343
 344         req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
 345         if (req == NULL) {
 346                 return NULL;
 347         }
 348         state->cli = cli;
 349         state->ev = ev;
 350         state->fnum = fnum;
 351         state->start_offset = start_offset;
 352         state->size = size;
 353         state->sink = sink;
 354         state->priv = priv;
 355         state->next_offset = start_offset;
 356         state->remaining = size;
 357
 358         if (size == 0) {
 359                 tevent_req_done(req);
 360                 return tevent_req_post(req, ev);
 361         }
 362
 363         state->chunk_size = cli_read_max_bufsize(cli);
 364         if (state->chunk_size > page_size) {
 365                 state->chunk_size &= ~(page_size - 1);
 366         }
 367
 368         if (window_size == 0) {
 369                 /*
 370                  * We use 16 MByte as default window size.
 371                  */
 372                 window_size = 16 * 1024 * 1024;
 373         }
 374
 375         tmp64 = window_size/state->chunk_size;
 376         if ((window_size % state->chunk_size) > 0) {
 377                 tmp64 += 1;
 378         }
 379         tmp64 = MAX(tmp64, 1);
 380         tmp64 = MIN(tmp64, 256);
 381         state->max_chunks = tmp64;
 382
 383         /*
 384          * We defer the callback because of the complex
 385          * substate/subfunction logic
 386          */
 387         tevent_req_defer_callback(req, ev);
 388
 389         cli_pull_setup_chunks(req);
 390         if (!tevent_req_is_in_progress(req)) {
 391                 return tevent_req_post(req, ev);
 392         }
 393
 394         return req;
 395 }
 396
 397 static void cli_pull_setup_chunks(struct tevent_req *req)
 398 {
 399         struct cli_pull_state *state =
 400                 tevent_req_data(req,
 401                 struct cli_pull_state);
 402         struct cli_pull_chunk *chunk, *next = NULL;
 403         size_t i;
 404
 405         for (chunk = state->chunks; chunk; chunk = next) {
 406                 /*
 407                  * Note that chunk might be removed from this call.
 408                  */
 409                 next = chunk->next;
 410                 cli_pull_chunk_ship(chunk);
 411                 if (!tevent_req_is_in_progress(req)) {
 412                         return;
 413                 }
 414         }
 415
 416         for (i = state->num_chunks; i < state->max_chunks; i++) {
 417
 418                 if (state->num_waiting > 0) {
 419                         return;
 420                 }
 421
 422                 if (state->remaining == 0) {
 423                         break;
 424                 }
 425
 426                 chunk = talloc_zero(state, struct cli_pull_chunk);
 427                 if (tevent_req_nomem(chunk, req)) {
 428                         return;
 429                 }
 430                 chunk->req = req;
 431                 chunk->ofs = state->next_offset;
 432                 chunk->total_size = MIN(state->remaining, state->chunk_size);
 433                 state->next_offset += chunk->total_size;
 434                 state->remaining -= chunk->total_size;
 435
 436                 DLIST_ADD_END(state->chunks, chunk, NULL);
 437                 state->num_chunks++;
 438                 state->num_waiting++;
 439
 440                 cli_pull_chunk_ship(chunk);
 441                 if (!tevent_req_is_in_progress(req)) {
 442                         return;
 443                 }
 444         }
 445
 446         if (state->remaining > 0) {
 447                 return;
 448         }
 449
 450         if (state->num_chunks > 0) {
 451                 return;
 452         }
 453
 454         tevent_req_done(req);
 455 }
 456
 457 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk)
 458 {
 459         struct tevent_req *req = chunk->req;
 460         struct cli_pull_state *state =
 461                 tevent_req_data(req,
 462                 struct cli_pull_state);
 463         bool ok;
 464         off_t ofs;
 465         size_t size;
 466
 467         if (chunk->done) {
 468                 NTSTATUS status;
 469
 470                 if (chunk != state->chunks) {
 471                         /*
 472                          * this chunk is not the
 473                          * first one in the list.
 474                          *
 475                          * which means we should not
 476                          * push it into the sink yet.
 477                          */
 478                         return;
 479                 }
 480
 481                 if (chunk->tmp_size == 0) {
 482                         /*
 483                          * we git a short read, we're done
 484                          */
 485                         tevent_req_done(req);
 486                         return;
 487                 }
 488
 489                 status = state->sink((char *)chunk->buf,
 490                                      chunk->tmp_size,
 491                                      state->priv);
 492                 if (tevent_req_nterror(req, status)) {
 493                         return;
 494                 }
 495                 state->pushed += chunk->tmp_size;
 496
 497                 if (chunk->tmp_size < chunk->total_size) {
 498                         /*
 499                          * we git a short read, we're done
 500                          */
 501                         tevent_req_done(req);
 502                         return;
 503                 }
 504
 505                 DLIST_REMOVE(state->chunks, chunk);
 506                 SMB_ASSERT(state->num_chunks > 0);
 507                 state->num_chunks--;
 508                 TALLOC_FREE(chunk);
 509
 510                 return;
 511         }
 512
 513         if (chunk->subreq != NULL) {
 514                 return;
 515         }
 516
 517         SMB_ASSERT(state->num_waiting > 0);
 518
 519         ofs = chunk->ofs + chunk->tmp_size;
 520         size = chunk->total_size - chunk->tmp_size;
 521
 522         ok = smb1cli_conn_req_possible(state->cli->conn);
 523         if (!ok) {
 524                 return;
 525         }
 526
 527         chunk->subreq = cli_read_andx_send(chunk,
 528                                            state->ev,
 529                                            state->cli,
 530                                            state->fnum,
 531                                            ofs,
 532                                            size);
 533         if (tevent_req_nomem(chunk->subreq, req)) {
 534                 return;
 535         }
 536         tevent_req_set_callback(chunk->subreq,
 537                                 cli_pull_chunk_done,
 538                                 chunk);
 539
 540         state->num_waiting--;
 541         return;
 542 }
 543
 544 static void cli_pull_chunk_done(struct tevent_req *subreq)
 545 {
 546         struct cli_pull_chunk *chunk =
 547                 tevent_req_callback_data(subreq,
 548                 struct cli_pull_chunk);
 549         struct tevent_req *req = chunk->req;
 550         struct cli_pull_state *state =
 551                 tevent_req_data(req,
 552                 struct cli_pull_state);
 553         NTSTATUS status;
 554         size_t expected = chunk->total_size - chunk->tmp_size;
 555         ssize_t received;
 556         uint8_t *buf = NULL;
 557
 558         chunk->subreq = NULL;
 559
 560         status = cli_read_andx_recv(subreq, &received, &buf);
 561         if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 562                 received = 0;
 563                 status = NT_STATUS_OK;
 564         }
 565         if (tevent_req_nterror(req, status)) {
 566                 return;
 567         }
 568
 569         if (received > expected) {
 570                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 571                 return;
 572         }
 573
 574         if (received == 0) {
 575                 /*
 576                  * We got EOF we're done
 577                  */
 578                 chunk->done = true;
 579                 cli_pull_setup_chunks(req);
 580                 return;
 581         }
 582
 583         if (received == chunk->total_size) {
 584                 /*
 585                  * We got it in the first run.
 586                  *
 587                  * We don't call TALLOC_FREE(subreq)
 588                  * here and keep the returned buffer.
 589                  */
 590                 chunk->buf = buf;
 591         } else if (chunk->buf == NULL) {
 592                 chunk->buf = talloc_array(chunk, uint8_t, chunk->total_size);
 593                 if (tevent_req_nomem(chunk->buf, req)) {
 594                         return;
 595                 }
 596         }
 597
 598         if (received != chunk->total_size) {
 599                 uint8_t *p = chunk->buf + chunk->tmp_size;
 600                 memcpy(p, buf, received);
 601                 TALLOC_FREE(subreq);
 602         }
 603
 604         chunk->tmp_size += received;
 605
 606         if (chunk->tmp_size == chunk->total_size) {
 607                 chunk->done = true;
 608         } else {
 609                 state->num_waiting++;
 610         }
 611
 612         cli_pull_setup_chunks(req);
 613 }
 614
 615 NTSTATUS cli_pull_recv(struct tevent_req *req, off_t *received)
 616 {
 617         struct cli_pull_state *state = tevent_req_data(
 618                 req, struct cli_pull_state);
 619         NTSTATUS status;
 620
 621         if (tevent_req_is_nterror(req, &status)) {
 622                 tevent_req_received(req);
 623                 return status;
 624         }
 625         *received = state->pushed;
 626         tevent_req_received(req);
 627         return NT_STATUS_OK;
 628 }
 629
 630 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
 631                   off_t start_offset, off_t size, size_t window_size,
 632                   NTSTATUS (*sink)(char *buf, size_t n, void *priv),
 633                   void *priv, off_t *received)
 634 {
 635         TALLOC_CTX *frame = talloc_stackframe();
 636         struct tevent_context *ev;
 637         struct tevent_req *req;
 638         NTSTATUS status = NT_STATUS_OK;
 639
 640         if (smbXcli_conn_has_async_calls(cli->conn)) {
 641                 /*
 642                  * Can't use sync call while an async call is in flight
 643                  */
 644                 status = NT_STATUS_INVALID_PARAMETER;
 645                 goto fail;
 646         }
 647
 648         ev = samba_tevent_context_init(frame);
 649         if (ev == NULL) {
 650                 status = NT_STATUS_NO_MEMORY;
 651                 goto fail;
 652         }
 653
 654         req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
 655                             window_size, sink, priv);
 656         if (req == NULL) {
 657                 status = NT_STATUS_NO_MEMORY;
 658                 goto fail;
 659         }
 660
 661         if (!tevent_req_poll(req, ev)) {
 662                 status = map_nt_error_from_unix(errno);
 663                 goto fail;
 664         }
 665
 666         status = cli_pull_recv(req, received);
 667  fail:
 668         TALLOC_FREE(frame);
 669         return status;
 670 }
 671
 672 static NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
 673 {
 674         char **pbuf = (char **)priv;
 675         memcpy(*pbuf, buf, n);
 676         *pbuf += n;
 677         return NT_STATUS_OK;
 678 }
 679
 680 NTSTATUS cli_read(struct cli_state *cli, uint16_t fnum,
 681                  char *buf, off_t offset, size_t size,
 682                  size_t *nread)
 683 {
 684         NTSTATUS status;
 685         off_t ret;
 686
 687         status = cli_pull(cli, fnum, offset, size, size,
 688                           cli_read_sink, &buf, &ret);
 689         if (!NT_STATUS_IS_OK(status)) {
 690                 return status;
 691         }
 692
 693         if (nread) {
 694                 *nread = ret;
 695         }
 696
 697         return NT_STATUS_OK;
 698 }
 699
 700 /****************************************************************************
 701   write to a file using a SMBwrite and not bypassing 0 byte writes
 702 ****************************************************************************/
 703
 704 NTSTATUS cli_smbwrite(struct cli_state *cli, uint16_t fnum, char *buf,
 705                       off_t offset, size_t size1, size_t *ptotal)
 706 {
 707         uint8_t *bytes;
 708         ssize_t total = 0;
 709
 710         /*
 711          * 3 bytes prefix
 712          */
 713
 714         bytes = talloc_array(talloc_tos(), uint8_t, 3);
 715         if (bytes == NULL) {
 716                 return NT_STATUS_NO_MEMORY;
 717         }
 718         bytes[0] = 1;
 719
 720         do {
 721                 uint32_t usable_space = cli_state_available_size(cli, 48);
 722                 size_t size = MIN(size1, usable_space);
 723                 struct tevent_req *req;
 724                 uint16_t vwv[5];
 725                 uint16_t *ret_vwv;
 726                 NTSTATUS status;
 727
 728                 SSVAL(vwv+0, 0, fnum);
 729                 SSVAL(vwv+1, 0, size);
 730                 SIVAL(vwv+2, 0, offset);
 731                 SSVAL(vwv+4, 0, 0);
 732
 733                 bytes = talloc_realloc(talloc_tos(), bytes, uint8_t,
 734                                              size+3);
 735                 if (bytes == NULL) {
 736                         return NT_STATUS_NO_MEMORY;
 737                 }
 738                 SSVAL(bytes, 1, size);
 739                 memcpy(bytes + 3, buf + total, size);
 740
 741                 status = cli_smb(talloc_tos(), cli, SMBwrite, 0, 5, vwv,
 742                                  size+3, bytes, &req, 1, NULL, &ret_vwv,
 743                                  NULL, NULL);
 744                 if (!NT_STATUS_IS_OK(status)) {
 745                         TALLOC_FREE(bytes);
 746                         return status;
 747                 }
 748
 749                 size = SVAL(ret_vwv+0, 0);
 750                 TALLOC_FREE(req);
 751                 if (size == 0) {
 752                         break;
 753                 }
 754                 size1 -= size;
 755                 total += size;
 756                 offset += size;
 757
 758         } while (size1);
 759
 760         TALLOC_FREE(bytes);
 761
 762         if (ptotal != NULL) {
 763                 *ptotal = total;
 764         }
 765         return NT_STATUS_OK;
 766 }
 767
 768 /*
 769  * Send a write&x request
 770  */
 771
 772 struct cli_write_andx_state {
 773         size_t size;
 774         uint16_t vwv[14];
 775         size_t written;
 776         uint8_t pad;
 777         struct iovec iov[2];
 778 };
 779
 780 static void cli_write_andx_done(struct tevent_req *subreq);
 781
 782 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
 783                                          struct tevent_context *ev,
 784                                          struct cli_state *cli, uint16_t fnum,
 785                                          uint16_t mode, const uint8_t *buf,
 786                                          off_t offset, size_t size,
 787                                          struct tevent_req **reqs_before,
 788                                          int num_reqs_before,
 789                                          struct tevent_req **psmbreq)
 790 {
 791         struct tevent_req *req, *subreq;
 792         struct cli_write_andx_state *state;
 793         bool bigoffset = ((smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) != 0);
 794         uint8_t wct = bigoffset ? 14 : 12;
 795         size_t max_write = cli_write_max_bufsize(cli, mode, wct);
 796         uint16_t *vwv;
 797
 798         req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
 799         if (req == NULL) {
 800                 return NULL;
 801         }
 802
 803         state->size = MIN(size, max_write);
 804
 805         vwv = state->vwv;
 806
 807         SCVAL(vwv+0, 0, 0xFF);
 808         SCVAL(vwv+0, 1, 0);
 809         SSVAL(vwv+1, 0, 0);
 810         SSVAL(vwv+2, 0, fnum);
 811         SIVAL(vwv+3, 0, offset);
 812         SIVAL(vwv+5, 0, 0);
 813         SSVAL(vwv+7, 0, mode);
 814         SSVAL(vwv+8, 0, 0);
 815         SSVAL(vwv+9, 0, (state->size>>16));
 816         SSVAL(vwv+10, 0, state->size);
 817
 818         SSVAL(vwv+11, 0,
 819               smb1cli_req_wct_ofs(reqs_before, num_reqs_before)
 820               + 1               /* the wct field */
 821               + wct * 2         /* vwv */
 822               + 2               /* num_bytes field */
 823               + 1               /* pad */);
 824
 825         if (bigoffset) {
 826                 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
 827         }
 828
 829         state->pad = 0;
 830         state->iov[0].iov_base = (void *)&state->pad;
 831         state->iov[0].iov_len = 1;
 832         state->iov[1].iov_base = discard_const_p(void, buf);
 833         state->iov[1].iov_len = state->size;
 834
 835         subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
 836                                     2, state->iov);
 837         if (tevent_req_nomem(subreq, req)) {
 838                 return tevent_req_post(req, ev);
 839         }
 840         tevent_req_set_callback(subreq, cli_write_andx_done, req);
 841         *psmbreq = subreq;
 842         return req;
 843 }
 844
 845 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
 846                                        struct tevent_context *ev,
 847                                        struct cli_state *cli, uint16_t fnum,
 848                                        uint16_t mode, const uint8_t *buf,
 849                                        off_t offset, size_t size)
 850 {
 851         struct tevent_req *req, *subreq;
 852         NTSTATUS status;
 853
 854         req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
 855                                     size, NULL, 0, &subreq);
 856         if (req == NULL) {
 857                 return NULL;
 858         }
 859
 860         status = smb1cli_req_chain_submit(&subreq, 1);
 861         if (tevent_req_nterror(req, status)) {
 862                 return tevent_req_post(req, ev);
 863         }
 864         return req;
 865 }
 866
 867 static void cli_write_andx_done(struct tevent_req *subreq)
 868 {
 869         struct tevent_req *req = tevent_req_callback_data(
 870                 subreq, struct tevent_req);
 871         struct cli_write_andx_state *state = tevent_req_data(
 872                 req, struct cli_write_andx_state);
 873         uint8_t wct;
 874         uint16_t *vwv;
 875         NTSTATUS status;
 876
 877         status = cli_smb_recv(subreq, state, NULL, 6, &wct, &vwv,
 878                               NULL, NULL);
 879         TALLOC_FREE(subreq);
 880         if (NT_STATUS_IS_ERR(status)) {
 881                 tevent_req_nterror(req, status);
 882                 return;
 883         }
 884         state->written = SVAL(vwv+2, 0);
 885         if (state->size > UINT16_MAX) {
 886                 /*
 887                  * It is important that we only set the
 888                  * high bits only if we asked for a large write.
 889                  *
 890                  * OS/2 print shares get this wrong and may send
 891                  * invalid values.
 892                  *
 893                  * See bug #5326.
 894                  */
 895                 state->written |= SVAL(vwv+4, 0)<<16;
 896         }
 897         tevent_req_done(req);
 898 }
 899
 900 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
 901 {
 902         struct cli_write_andx_state *state = tevent_req_data(
 903                 req, struct cli_write_andx_state);
 904         NTSTATUS status;
 905
 906         if (tevent_req_is_nterror(req, &status)) {
 907                 return status;
 908         }
 909         if (pwritten != 0) {
 910                 *pwritten = state->written;
 911         }
 912         return NT_STATUS_OK;
 913 }
 914
 915 struct cli_writeall_state {
 916         struct tevent_context *ev;
 917         struct cli_state *cli;
 918         uint16_t fnum;
 919         uint16_t mode;
 920         const uint8_t *buf;
 921         off_t offset;
 922         size_t size;
 923         size_t written;
 924 };
 925
 926 static void cli_writeall_written(struct tevent_req *req);
 927
 928 static struct tevent_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
 929                                             struct tevent_context *ev,
 930                                             struct cli_state *cli,
 931                                             uint16_t fnum,
 932                                             uint16_t mode,
 933                                             const uint8_t *buf,
 934                                             off_t offset, size_t size)
 935 {
 936         struct tevent_req *req, *subreq;
 937         struct cli_writeall_state *state;
 938
 939         req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
 940         if (req == NULL) {
 941                 return NULL;
 942         }
 943         state->ev = ev;
 944         state->cli = cli;
 945         state->fnum = fnum;
 946         state->mode = mode;
 947         state->buf = buf;
 948         state->offset = offset;
 949         state->size = size;
 950         state->written = 0;
 951
 952         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
 953                                      state->mode, state->buf, state->offset,
 954                                      state->size);
 955         if (tevent_req_nomem(subreq, req)) {
 956                 return tevent_req_post(req, ev);
 957         }
 958         tevent_req_set_callback(subreq, cli_writeall_written, req);
 959         return req;
 960 }
 961
 962 static void cli_writeall_written(struct tevent_req *subreq)
 963 {
 964         struct tevent_req *req = tevent_req_callback_data(
 965                 subreq, struct tevent_req);
 966         struct cli_writeall_state *state = tevent_req_data(
 967                 req, struct cli_writeall_state);
 968         NTSTATUS status;
 969         size_t written, to_write;
 970
 971         status = cli_write_andx_recv(subreq, &written);
 972         TALLOC_FREE(subreq);
 973         if (tevent_req_nterror(req, status)) {
 974                 return;
 975         }
 976
 977         state->written += written;
 978
 979         if (state->written > state->size) {
 980                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 981                 return;
 982         }
 983
 984         to_write = state->size - state->written;
 985
 986         if (to_write == 0) {
 987                 tevent_req_done(req);
 988                 return;
 989         }
 990
 991         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
 992                                      state->mode,
 993                                      state->buf + state->written,
 994                                      state->offset + state->written, to_write);
 995         if (tevent_req_nomem(subreq, req)) {
 996                 return;
 997         }
 998         tevent_req_set_callback(subreq, cli_writeall_written, req);
 999 }
1000
1001 static NTSTATUS cli_writeall_recv(struct tevent_req *req,
1002                                   size_t *pwritten)
1003 {
1004         struct cli_writeall_state *state = tevent_req_data(
1005                 req, struct cli_writeall_state);
1006         NTSTATUS status;
1007
1008         if (tevent_req_is_nterror(req, &status)) {
1009                 return status;
1010         }
1011         if (pwritten != NULL) {
1012                 *pwritten = state->written;
1013         }
1014         return NT_STATUS_OK;
1015 }
1016
1017 NTSTATUS cli_writeall(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1018                       const uint8_t *buf, off_t offset, size_t size,
1019                       size_t *pwritten)
1020 {
1021         TALLOC_CTX *frame = talloc_stackframe();
1022         struct tevent_context *ev;
1023         struct tevent_req *req;
1024         NTSTATUS status = NT_STATUS_NO_MEMORY;
1025
1026         if (smbXcli_conn_has_async_calls(cli->conn)) {
1027                 /*
1028                  * Can't use sync call while an async call is in flight
1029                  */
1030                 status = NT_STATUS_INVALID_PARAMETER;
1031                 goto fail;
1032         }
1033         ev = samba_tevent_context_init(frame);
1034         if (ev == NULL) {
1035                 goto fail;
1036         }
1037         req = cli_writeall_send(frame, ev, cli, fnum, mode, buf, offset, size);
1038         if (req == NULL) {
1039                 goto fail;
1040         }
1041         if (!tevent_req_poll(req, ev)) {
1042                 status = map_nt_error_from_unix(errno);
1043                 goto fail;
1044         }
1045         status = cli_writeall_recv(req, pwritten);
1046  fail:
1047         TALLOC_FREE(frame);
1048         return status;
1049 }
1050
1051 struct cli_push_chunk;
1052
1053 struct cli_push_state {
1054         struct tevent_context *ev;
1055         struct cli_state *cli;
1056         uint16_t fnum;
1057         uint16_t mode;
1058         off_t start_offset;
1059
1060         size_t (*source)(uint8_t *buf, size_t n, void *priv);
1061         void *priv;
1062
1063         bool eof;
1064
1065         size_t chunk_size;
1066         off_t next_offset;
1067
1068         /*
1069          * Outstanding requests
1070          *
1071          * The maximum is 256:
1072          * - which would be a window of 256 MByte
1073          *   for SMB2 with multi-credit
1074          *   or smb1 unix extentions.
1075          */
1076         uint16_t max_chunks;
1077         uint16_t num_chunks;
1078         uint16_t num_waiting;
1079         struct cli_push_chunk *chunks;
1080 };
1081
1082 struct cli_push_chunk {
1083         struct cli_push_chunk *prev, *next;
1084         struct tevent_req *req;/* This is the main request! Not the subreq */
1085         struct tevent_req *subreq;
1086         off_t ofs;
1087         uint8_t *buf;
1088         size_t total_size;
1089         size_t tmp_size;
1090         bool done;
1091 };
1092
1093 static void cli_push_setup_chunks(struct tevent_req *req);
1094 static void cli_push_chunk_ship(struct cli_push_chunk *chunk);
1095 static void cli_push_chunk_done(struct tevent_req *subreq);
1096
1097 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
1098                                  struct cli_state *cli,
1099                                  uint16_t fnum, uint16_t mode,
1100                                  off_t start_offset, size_t window_size,
1101                                  size_t (*source)(uint8_t *buf, size_t n,
1102                                                   void *priv),
1103                                  void *priv)
1104 {
1105         struct tevent_req *req;
1106         struct cli_push_state *state;
1107         size_t page_size = 1024;
1108         uint64_t tmp64;
1109
1110         req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1111         if (req == NULL) {
1112                 return NULL;
1113         }
1114         state->cli = cli;
1115         state->ev = ev;
1116         state->fnum = fnum;
1117         state->start_offset = start_offset;
1118         state->mode = mode;
1119         state->source = source;
1120         state->priv = priv;
1121         state->next_offset = start_offset;
1122
1123         state->chunk_size = cli_write_max_bufsize(cli, mode, 14);
1124         if (state->chunk_size > page_size) {
1125                 state->chunk_size &= ~(page_size - 1);
1126         }
1127
1128         if (window_size == 0) {
1129                 /*
1130                  * We use 16 MByte as default window size.
1131                  */
1132                 window_size = 16 * 1024 * 1024;
1133         }
1134
1135         tmp64 = window_size/state->chunk_size;
1136         if ((window_size % state->chunk_size) > 0) {
1137                 tmp64 += 1;
1138         }
1139         tmp64 = MAX(tmp64, 1);
1140         tmp64 = MIN(tmp64, 256);
1141         state->max_chunks = tmp64;
1142
1143         /*
1144          * We defer the callback because of the complex
1145          * substate/subfunction logic
1146          */
1147         tevent_req_defer_callback(req, ev);
1148
1149         cli_push_setup_chunks(req);
1150         if (!tevent_req_is_in_progress(req)) {
1151                 return tevent_req_post(req, ev);
1152         }
1153
1154         return req;
1155 }
1156
1157 static void cli_push_setup_chunks(struct tevent_req *req)
1158 {
1159         struct cli_push_state *state =
1160                 tevent_req_data(req,
1161                 struct cli_push_state);
1162         struct cli_push_chunk *chunk, *next = NULL;
1163         size_t i;
1164
1165         for (chunk = state->chunks; chunk; chunk = next) {
1166                 /*
1167                  * Note that chunk might be removed from this call.
1168                  */
1169                 next = chunk->next;
1170                 cli_push_chunk_ship(chunk);
1171                 if (!tevent_req_is_in_progress(req)) {
1172                         return;
1173                 }
1174         }
1175
1176         for (i = state->num_chunks; i < state->max_chunks; i++) {
1177
1178                 if (state->num_waiting > 0) {
1179                         return;
1180                 }
1181
1182                 if (state->eof) {
1183                         break;
1184                 }
1185
1186                 chunk = talloc_zero(state, struct cli_push_chunk);
1187                 if (tevent_req_nomem(chunk, req)) {
1188                         return;
1189                 }
1190                 chunk->req = req;
1191                 chunk->ofs = state->next_offset;
1192                 chunk->buf = talloc_array(chunk,
1193                                           uint8_t,
1194                                           state->chunk_size);
1195                 if (tevent_req_nomem(chunk->buf, req)) {
1196                         return;
1197                 }
1198                 chunk->total_size = state->source(chunk->buf,
1199                                                   state->chunk_size,
1200                                                   state->priv);
1201                 if (chunk->total_size == 0) {
1202                         /* nothing to send */
1203                         talloc_free(chunk);
1204                         state->eof = true;
1205                         break;
1206                 }
1207                 state->next_offset += chunk->total_size;
1208
1209                 DLIST_ADD_END(state->chunks, chunk, NULL);
1210                 state->num_chunks++;
1211                 state->num_waiting++;
1212
1213                 cli_push_chunk_ship(chunk);
1214                 if (!tevent_req_is_in_progress(req)) {
1215                         return;
1216                 }
1217         }
1218
1219         if (!state->eof) {
1220                 return;
1221         }
1222
1223         if (state->num_chunks > 0) {
1224                 return;
1225         }
1226
1227         tevent_req_done(req);
1228 }
1229
1230 static void cli_push_chunk_ship(struct cli_push_chunk *chunk)
1231 {
1232         struct tevent_req *req = chunk->req;
1233         struct cli_push_state *state =
1234                 tevent_req_data(req,
1235                 struct cli_push_state);
1236         bool ok;
1237         const uint8_t *buf;
1238         off_t ofs;
1239         size_t size;
1240
1241         if (chunk->done) {
1242                 DLIST_REMOVE(state->chunks, chunk);
1243                 SMB_ASSERT(state->num_chunks > 0);
1244                 state->num_chunks--;
1245                 TALLOC_FREE(chunk);
1246
1247                 return;
1248         }
1249
1250         if (chunk->subreq != NULL) {
1251                 return;
1252         }
1253
1254         SMB_ASSERT(state->num_waiting > 0);
1255
1256         buf = chunk->buf + chunk->tmp_size;
1257         ofs = chunk->ofs + chunk->tmp_size;
1258         size = chunk->total_size - chunk->tmp_size;
1259
1260         ok = smb1cli_conn_req_possible(state->cli->conn);
1261         if (!ok) {
1262                 return;
1263         }
1264
1265         chunk->subreq = cli_write_andx_send(chunk,
1266                                             state->ev,
1267                                             state->cli,
1268                                             state->fnum,
1269                                             state->mode,
1270                                             buf,
1271                                             ofs,
1272                                             size);
1273         if (tevent_req_nomem(chunk->subreq, req)) {
1274                 return;
1275         }
1276         tevent_req_set_callback(chunk->subreq,
1277                                 cli_push_chunk_done,
1278                                 chunk);
1279
1280         state->num_waiting--;
1281         return;
1282 }
1283
1284 static void cli_push_chunk_done(struct tevent_req *subreq)
1285 {
1286         struct cli_push_chunk *chunk =
1287                 tevent_req_callback_data(subreq,
1288                 struct cli_push_chunk);
1289         struct tevent_req *req = chunk->req;
1290         struct cli_push_state *state =
1291                 tevent_req_data(req,
1292                 struct cli_push_state);
1293         NTSTATUS status;
1294         size_t expected = chunk->total_size - chunk->tmp_size;
1295         size_t written;
1296
1297         chunk->subreq = NULL;
1298
1299         status = cli_write_andx_recv(subreq, &written);
1300         TALLOC_FREE(subreq);
1301         if (tevent_req_nterror(req, status)) {
1302                 return;
1303         }
1304
1305         if (written > expected) {
1306                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1307                 return;
1308         }
1309
1310         if (written == 0) {
1311                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1312                 return;
1313         }
1314
1315         chunk->tmp_size += written;
1316
1317         if (chunk->tmp_size == chunk->total_size) {
1318                 chunk->done = true;
1319         } else {
1320                 state->num_waiting++;
1321         }
1322
1323         cli_push_setup_chunks(req);
1324 }
1325
1326 NTSTATUS cli_push_recv(struct tevent_req *req)
1327 {
1328         return tevent_req_simple_recv_ntstatus(req);
1329 }
1330
1331 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1332                   off_t start_offset, size_t window_size,
1333                   size_t (*source)(uint8_t *buf, size_t n, void *priv),
1334                   void *priv)
1335 {
1336         TALLOC_CTX *frame = talloc_stackframe();
1337         struct tevent_context *ev;
1338         struct tevent_req *req;
1339         NTSTATUS status = NT_STATUS_OK;
1340
1341         if (smbXcli_conn_has_async_calls(cli->conn)) {
1342                 /*
1343                  * Can't use sync call while an async call is in flight
1344                  */
1345                 status = NT_STATUS_INVALID_PARAMETER;
1346                 goto fail;
1347         }
1348
1349         ev = samba_tevent_context_init(frame);
1350         if (ev == NULL) {
1351                 status = NT_STATUS_NO_MEMORY;
1352                 goto fail;
1353         }
1354
1355         req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1356                             window_size, source, priv);
1357         if (req == NULL) {
1358                 status = NT_STATUS_NO_MEMORY;
1359                 goto fail;
1360         }
1361
1362         if (!tevent_req_poll(req, ev)) {
1363                 status = map_nt_error_from_unix(errno);
1364                 goto fail;
1365         }
1366
1367         status = cli_push_recv(req);
1368  fail:
1369         TALLOC_FREE(frame);
1370         return status;
1371 }