source3/libsmb/clireadwrite.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client file read/write routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "async_smb.h"
  22 #include "trans2.h"
  23
  24 /****************************************************************************
  25   Calculate the recommended read buffer size
  26 ****************************************************************************/
  27 static size_t cli_read_max_bufsize(struct cli_state *cli)
  28 {
  29         if (!client_is_signing_on(cli) && !cli_encryption_on(cli)
  30             && (cli->server_posix_capabilities & CIFS_UNIX_LARGE_READ_CAP)) {
  31                 return CLI_SAMBA_MAX_POSIX_LARGE_READX_SIZE;
  32         }
  33         if (cli->capabilities & CAP_LARGE_READX) {
  34                 return cli->is_samba
  35                         ? CLI_SAMBA_MAX_LARGE_READX_SIZE
  36                         : CLI_WINDOWS_MAX_LARGE_READX_SIZE;
  37         }
  38         return (cli->max_xmit - (smb_size+32)) & ~1023;
  39 }
  40
  41 /****************************************************************************
  42   Calculate the recommended write buffer size
  43 ****************************************************************************/
  44 static size_t cli_write_max_bufsize(struct cli_state *cli, uint16_t write_mode)
  45 {
  46         if (write_mode == 0 &&
  47             !client_is_signing_on(cli) &&
  48             !cli_encryption_on(cli) &&
  49             (cli->server_posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) &&
  50             (cli->capabilities & CAP_LARGE_FILES)) {
  51                 /* Only do massive writes if we can do them direct
  52                  * with no signing or encrypting - not on a pipe. */
  53                 return CLI_SAMBA_MAX_POSIX_LARGE_WRITEX_SIZE;
  54         }
  55
  56         if (cli->is_samba) {
  57                 return CLI_SAMBA_MAX_LARGE_WRITEX_SIZE;
  58         }
  59
  60         if (((cli->capabilities & CAP_LARGE_WRITEX) == 0)
  61             || client_is_signing_on(cli)
  62             || strequal(cli->dev, "LPT1:")) {
  63
  64                 /*
  65                  * Printer devices are restricted to max_xmit writesize in
  66                  * Vista and XPSP3 as are signing connections.
  67                  */
  68
  69                 return (cli->max_xmit - (smb_size+32)) & ~1023;
  70         }
  71
  72         return CLI_WINDOWS_MAX_LARGE_WRITEX_SIZE;
  73 }
  74
  75 struct cli_read_andx_state {
  76         size_t size;
  77         uint16_t vwv[12];
  78         NTSTATUS status;
  79         size_t received;
  80         uint8_t *buf;
  81 };
  82
  83 static void cli_read_andx_done(struct tevent_req *subreq);
  84
  85 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
  86                                         struct event_context *ev,
  87                                         struct cli_state *cli, uint16_t fnum,
  88                                         off_t offset, size_t size,
  89                                         struct tevent_req **psmbreq)
  90 {
  91         struct tevent_req *req, *subreq;
  92         struct cli_read_andx_state *state;
  93         uint8_t wct = 10;
  94
  95         if (size > cli_read_max_bufsize(cli)) {
  96                 DEBUG(0, ("cli_read_andx_send got size=%d, can only handle "
  97                           "size=%d\n", (int)size,
  98                           (int)cli_read_max_bufsize(cli)));
  99                 return NULL;
 100         }
 101
 102         req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
 103         if (req == NULL) {
 104                 return NULL;
 105         }
 106         state->size = size;
 107
 108         SCVAL(state->vwv + 0, 0, 0xFF);
 109         SCVAL(state->vwv + 0, 1, 0);
 110         SSVAL(state->vwv + 1, 0, 0);
 111         SSVAL(state->vwv + 2, 0, fnum);
 112         SIVAL(state->vwv + 3, 0, offset);
 113         SSVAL(state->vwv + 5, 0, size);
 114         SSVAL(state->vwv + 6, 0, size);
 115         SSVAL(state->vwv + 7, 0, (size >> 16));
 116         SSVAL(state->vwv + 8, 0, 0);
 117         SSVAL(state->vwv + 9, 0, 0);
 118
 119         if ((uint64_t)offset >> 32) {
 120                 SIVAL(state->vwv + 10, 0,
 121                       (((uint64_t)offset)>>32) & 0xffffffff);
 122                 wct += 2;
 123         }
 124
 125         subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, wct,
 126                                     state->vwv, 0, NULL);
 127         if (subreq == NULL) {
 128                 TALLOC_FREE(req);
 129                 return NULL;
 130         }
 131         tevent_req_set_callback(subreq, cli_read_andx_done, req);
 132         *psmbreq = subreq;
 133         return req;
 134 }
 135
 136 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
 137                                       struct event_context *ev,
 138                                       struct cli_state *cli, uint16_t fnum,
 139                                       off_t offset, size_t size)
 140 {
 141         struct tevent_req *req, *subreq;
 142         NTSTATUS status;
 143
 144         req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
 145                                    &subreq);
 146         if (req == NULL) {
 147                 return NULL;
 148         }
 149
 150         status = cli_smb_req_send(subreq);
 151         if (tevent_req_nterror(req, status)) {
 152                 return tevent_req_post(req, ev);
 153         }
 154         return req;
 155 }
 156
 157 static void cli_read_andx_done(struct tevent_req *subreq)
 158 {
 159         struct tevent_req *req = tevent_req_callback_data(
 160                 subreq, struct tevent_req);
 161         struct cli_read_andx_state *state = tevent_req_data(
 162                 req, struct cli_read_andx_state);
 163         uint8_t *inbuf;
 164         uint8_t wct;
 165         uint16_t *vwv;
 166         uint32_t num_bytes;
 167         uint8_t *bytes;
 168
 169         state->status = cli_smb_recv(subreq, state, &inbuf, 12, &wct, &vwv,
 170                                      &num_bytes, &bytes);
 171         TALLOC_FREE(subreq);
 172         if (NT_STATUS_IS_ERR(state->status)) {
 173                 tevent_req_nterror(req, state->status);
 174                 return;
 175         }
 176
 177         /* size is the number of bytes the server returned.
 178          * Might be zero. */
 179         state->received = SVAL(vwv + 5, 0);
 180         state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
 181
 182         if (state->received > state->size) {
 183                 DEBUG(5,("server returned more than we wanted!\n"));
 184                 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
 185                 return;
 186         }
 187
 188         /*
 189          * bcc field must be valid for small reads, for large reads the 16-bit
 190          * bcc field can't be correct.
 191          */
 192
 193         if ((state->received < 0xffff) && (state->received > num_bytes)) {
 194                 DEBUG(5, ("server announced more bytes than sent\n"));
 195                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 196                 return;
 197         }
 198
 199         state->buf = (uint8_t *)smb_base(inbuf) + SVAL(vwv+6, 0);
 200
 201         if (trans_oob(smb_len(inbuf), SVAL(vwv+6, 0), state->received)
 202             || ((state->received != 0) && (state->buf < bytes))) {
 203                 DEBUG(5, ("server returned invalid read&x data offset\n"));
 204                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 205                 return;
 206         }
 207         tevent_req_done(req);
 208 }
 209
 210 /*
 211  * Pull the data out of a finished async read_and_x request. rcvbuf is
 212  * talloced from the request, so better make sure that you copy it away before
 213  * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
 214  * talloc_move it!
 215  */
 216
 217 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
 218                             uint8_t **rcvbuf)
 219 {
 220         struct cli_read_andx_state *state = tevent_req_data(
 221                 req, struct cli_read_andx_state);
 222         NTSTATUS status;
 223
 224         if (tevent_req_is_nterror(req, &status)) {
 225                 return status;
 226         }
 227         *received = state->received;
 228         *rcvbuf = state->buf;
 229         return NT_STATUS_OK;
 230 }
 231
 232 struct cli_readall_state {
 233         struct tevent_context *ev;
 234         struct cli_state *cli;
 235         uint16_t fnum;
 236         off_t start_offset;
 237         size_t size;
 238         size_t received;
 239         uint8_t *buf;
 240 };
 241
 242 static void cli_readall_done(struct tevent_req *subreq);
 243
 244 static struct tevent_req *cli_readall_send(TALLOC_CTX *mem_ctx,
 245                                            struct event_context *ev,
 246                                            struct cli_state *cli,
 247                                            uint16_t fnum,
 248                                            off_t offset, size_t size)
 249 {
 250         struct tevent_req *req, *subreq;
 251         struct cli_readall_state *state;
 252
 253         req = tevent_req_create(mem_ctx, &state, struct cli_readall_state);
 254         if (req == NULL) {
 255                 return NULL;
 256         }
 257         state->ev = ev;
 258         state->cli = cli;
 259         state->fnum = fnum;
 260         state->start_offset = offset;
 261         state->size = size;
 262         state->received = 0;
 263         state->buf = NULL;
 264
 265         subreq = cli_read_andx_send(state, ev, cli, fnum, offset, size);
 266         if (tevent_req_nomem(subreq, req)) {
 267                 return tevent_req_post(req, ev);
 268         }
 269         tevent_req_set_callback(subreq, cli_readall_done, req);
 270         return req;
 271 }
 272
 273 static void cli_readall_done(struct tevent_req *subreq)
 274 {
 275         struct tevent_req *req = tevent_req_callback_data(
 276                 subreq, struct tevent_req);
 277         struct cli_readall_state *state = tevent_req_data(
 278                 req, struct cli_readall_state);
 279         ssize_t received;
 280         uint8_t *buf;
 281         NTSTATUS status;
 282
 283         status = cli_read_andx_recv(subreq, &received, &buf);
 284         if (tevent_req_nterror(req, status)) {
 285                 return;
 286         }
 287
 288         if (received == 0) {
 289                 /* EOF */
 290                 tevent_req_done(req);
 291                 return;
 292         }
 293
 294         if ((state->received == 0) && (received == state->size)) {
 295                 /* Ideal case: Got it all in one run */
 296                 state->buf = buf;
 297                 state->received += received;
 298                 tevent_req_done(req);
 299                 return;
 300         }
 301
 302         /*
 303          * We got a short read, issue a read for the
 304          * rest. Unfortunately we have to allocate the buffer
 305          * ourselves now, as our caller expects to receive a single
 306          * buffer. cli_read_andx does it from the buffer received from
 307          * the net, but with a short read we have to put it together
 308          * from several reads.
 309          */
 310
 311         if (state->buf == NULL) {
 312                 state->buf = talloc_array(state, uint8_t, state->size);
 313                 if (tevent_req_nomem(state->buf, req)) {
 314                         return;
 315                 }
 316         }
 317         memcpy(state->buf + state->received, buf, received);
 318         state->received += received;
 319
 320         TALLOC_FREE(subreq);
 321
 322         if (state->received >= state->size) {
 323                 tevent_req_done(req);
 324                 return;
 325         }
 326
 327         subreq = cli_read_andx_send(state, state->ev, state->cli, state->fnum,
 328                                     state->start_offset + state->received,
 329                                     state->size - state->received);
 330         if (tevent_req_nomem(subreq, req)) {
 331                 return;
 332         }
 333         tevent_req_set_callback(subreq, cli_readall_done, req);
 334 }
 335
 336 static NTSTATUS cli_readall_recv(struct tevent_req *req, ssize_t *received,
 337                                  uint8_t **rcvbuf)
 338 {
 339         struct cli_readall_state *state = tevent_req_data(
 340                 req, struct cli_readall_state);
 341         NTSTATUS status;
 342
 343         if (tevent_req_is_nterror(req, &status)) {
 344                 return status;
 345         }
 346         *received = state->received;
 347         *rcvbuf = state->buf;
 348         return NT_STATUS_OK;
 349 }
 350
 351 struct cli_pull_subreq {
 352         struct tevent_req *req;
 353         ssize_t received;
 354         uint8_t *buf;
 355 };
 356
 357 /*
 358  * Parallel read support.
 359  *
 360  * cli_pull sends as many read&x requests as the server would allow via
 361  * max_mux at a time. When replies flow back in, the data is written into
 362  * the callback function "sink" in the right order.
 363  */
 364
 365 struct cli_pull_state {
 366         struct tevent_req *req;
 367
 368         struct event_context *ev;
 369         struct cli_state *cli;
 370         uint16_t fnum;
 371         off_t start_offset;
 372         SMB_OFF_T size;
 373
 374         NTSTATUS (*sink)(char *buf, size_t n, void *priv);
 375         void *priv;
 376
 377         size_t chunk_size;
 378
 379         /*
 380          * Outstanding requests
 381          */
 382         int num_reqs;
 383         struct cli_pull_subreq *reqs;
 384
 385         /*
 386          * For how many bytes did we send requests already?
 387          */
 388         SMB_OFF_T requested;
 389
 390         /*
 391          * Next request index to push into "sink". This walks around the "req"
 392          * array, taking care that the requests are pushed to "sink" in the
 393          * right order. If necessary (i.e. replies don't come in in the right
 394          * order), replies are held back in "reqs".
 395          */
 396         int top_req;
 397
 398         /*
 399          * How many bytes did we push into "sink"?
 400          */
 401
 402         SMB_OFF_T pushed;
 403 };
 404
 405 static char *cli_pull_print(struct tevent_req *req, TALLOC_CTX *mem_ctx)
 406 {
 407         struct cli_pull_state *state = tevent_req_data(
 408                 req, struct cli_pull_state);
 409         char *result;
 410
 411         result = tevent_req_default_print(req, mem_ctx);
 412         if (result == NULL) {
 413                 return NULL;
 414         }
 415
 416         return talloc_asprintf_append_buffer(
 417                 result, "num_reqs=%d, top_req=%d",
 418                 state->num_reqs, state->top_req);
 419 }
 420
 421 static void cli_pull_read_done(struct tevent_req *read_req);
 422
 423 /*
 424  * Prepare an async pull request
 425  */
 426
 427 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
 428                                  struct event_context *ev,
 429                                  struct cli_state *cli,
 430                                  uint16_t fnum, off_t start_offset,
 431                                  SMB_OFF_T size, size_t window_size,
 432                                  NTSTATUS (*sink)(char *buf, size_t n,
 433                                                   void *priv),
 434                                  void *priv)
 435 {
 436         struct tevent_req *req;
 437         struct cli_pull_state *state;
 438         int i;
 439
 440         req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
 441         if (req == NULL) {
 442                 return NULL;
 443         }
 444         tevent_req_set_print_fn(req, cli_pull_print);
 445         state->req = req;
 446
 447         state->cli = cli;
 448         state->ev = ev;
 449         state->fnum = fnum;
 450         state->start_offset = start_offset;
 451         state->size = size;
 452         state->sink = sink;
 453         state->priv = priv;
 454
 455         state->pushed = 0;
 456         state->top_req = 0;
 457
 458         if (size == 0) {
 459                 tevent_req_done(req);
 460                 return tevent_req_post(req, ev);
 461         }
 462
 463         state->chunk_size = cli_read_max_bufsize(cli);
 464
 465         state->num_reqs = MAX(window_size/state->chunk_size, 1);
 466         state->num_reqs = MIN(state->num_reqs, cli->max_mux);
 467
 468         state->reqs = TALLOC_ZERO_ARRAY(state, struct cli_pull_subreq,
 469                                         state->num_reqs);
 470         if (state->reqs == NULL) {
 471                 goto failed;
 472         }
 473
 474         state->requested = 0;
 475
 476         for (i=0; i<state->num_reqs; i++) {
 477                 struct cli_pull_subreq *subreq = &state->reqs[i];
 478                 SMB_OFF_T size_left;
 479                 size_t request_thistime;
 480
 481                 if (state->requested >= size) {
 482                         state->num_reqs = i;
 483                         break;
 484                 }
 485
 486                 size_left = size - state->requested;
 487                 request_thistime = MIN(size_left, state->chunk_size);
 488
 489                 subreq->req = cli_readall_send(
 490                         state->reqs, ev, cli, fnum,
 491                         state->start_offset + state->requested,
 492                         request_thistime);
 493
 494                 if (subreq->req == NULL) {
 495                         goto failed;
 496                 }
 497                 tevent_req_set_callback(subreq->req, cli_pull_read_done, req);
 498                 state->requested += request_thistime;
 499         }
 500         return req;
 501
 502 failed:
 503         TALLOC_FREE(req);
 504         return NULL;
 505 }
 506
 507 /*
 508  * Handle incoming read replies, push the data into sink and send out new
 509  * requests if necessary.
 510  */
 511
 512 static void cli_pull_read_done(struct tevent_req *subreq)
 513 {
 514         struct tevent_req *req = tevent_req_callback_data(
 515                 subreq, struct tevent_req);
 516         struct cli_pull_state *state = tevent_req_data(
 517                 req, struct cli_pull_state);
 518         struct cli_pull_subreq *pull_subreq = NULL;
 519         NTSTATUS status;
 520         int i;
 521
 522         for (i = 0; i < state->num_reqs; i++) {
 523                 pull_subreq = &state->reqs[i];
 524                 if (subreq == pull_subreq->req) {
 525                         break;
 526                 }
 527         }
 528         if (i == state->num_reqs) {
 529                 /* Huh -- received something we did not send?? */
 530                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 531                 return;
 532         }
 533
 534         status = cli_readall_recv(subreq, &pull_subreq->received,
 535                                   &pull_subreq->buf);
 536         if (!NT_STATUS_IS_OK(status)) {
 537                 tevent_req_nterror(state->req, status);
 538                 return;
 539         }
 540
 541         /*
 542          * This loop is the one to take care of out-of-order replies. All
 543          * pending requests are in state->reqs, state->reqs[top_req] is the
 544          * one that is to be pushed next. If however a request later than
 545          * top_req is replied to, then we can't push yet. If top_req is
 546          * replied to at a later point then, we need to push all the finished
 547          * requests.
 548          */
 549
 550         while (state->reqs[state->top_req].req != NULL) {
 551                 struct cli_pull_subreq *top_subreq;
 552
 553                 DEBUG(11, ("cli_pull_read_done: top_req = %d\n",
 554                            state->top_req));
 555
 556                 top_subreq = &state->reqs[state->top_req];
 557
 558                 if (tevent_req_is_in_progress(top_subreq->req)) {
 559                         DEBUG(11, ("cli_pull_read_done: top request not yet "
 560                                    "done\n"));
 561                         return;
 562                 }
 563
 564                 DEBUG(10, ("cli_pull_read_done: Pushing %d bytes, %d already "
 565                            "pushed\n", (int)top_subreq->received,
 566                            (int)state->pushed));
 567
 568                 status = state->sink((char *)top_subreq->buf,
 569                                      top_subreq->received, state->priv);
 570                 if (tevent_req_nterror(state->req, status)) {
 571                         return;
 572                 }
 573                 state->pushed += top_subreq->received;
 574
 575                 TALLOC_FREE(state->reqs[state->top_req].req);
 576
 577                 if (state->requested < state->size) {
 578                         struct tevent_req *new_req;
 579                         SMB_OFF_T size_left;
 580                         size_t request_thistime;
 581
 582                         size_left = state->size - state->requested;
 583                         request_thistime = MIN(size_left, state->chunk_size);
 584
 585                         DEBUG(10, ("cli_pull_read_done: Requesting %d bytes "
 586                                    "at %d, position %d\n",
 587                                    (int)request_thistime,
 588                                    (int)(state->start_offset
 589                                          + state->requested),
 590                                    state->top_req));
 591
 592                         new_req = cli_readall_send(
 593                                 state->reqs, state->ev, state->cli,
 594                                 state->fnum,
 595                                 state->start_offset + state->requested,
 596                                 request_thistime);
 597
 598                         if (tevent_req_nomem(new_req, state->req)) {
 599                                 return;
 600                         }
 601                         tevent_req_set_callback(new_req, cli_pull_read_done,
 602                                                 req);
 603
 604                         state->reqs[state->top_req].req = new_req;
 605                         state->requested += request_thistime;
 606                 }
 607
 608                 state->top_req = (state->top_req+1) % state->num_reqs;
 609         }
 610
 611         tevent_req_done(req);
 612 }
 613
 614 NTSTATUS cli_pull_recv(struct tevent_req *req, SMB_OFF_T *received)
 615 {
 616         struct cli_pull_state *state = tevent_req_data(
 617                 req, struct cli_pull_state);
 618         NTSTATUS status;
 619
 620         if (tevent_req_is_nterror(req, &status)) {
 621                 return status;
 622         }
 623         *received = state->pushed;
 624         return NT_STATUS_OK;
 625 }
 626
 627 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
 628                   off_t start_offset, SMB_OFF_T size, size_t window_size,
 629                   NTSTATUS (*sink)(char *buf, size_t n, void *priv),
 630                   void *priv, SMB_OFF_T *received)
 631 {
 632         TALLOC_CTX *frame = talloc_stackframe();
 633         struct event_context *ev;
 634         struct tevent_req *req;
 635         NTSTATUS status = NT_STATUS_OK;
 636
 637         if (cli_has_async_calls(cli)) {
 638                 /*
 639                  * Can't use sync call while an async call is in flight
 640                  */
 641                 status = NT_STATUS_INVALID_PARAMETER;
 642                 goto fail;
 643         }
 644
 645         ev = event_context_init(frame);
 646         if (ev == NULL) {
 647                 status = NT_STATUS_NO_MEMORY;
 648                 goto fail;
 649         }
 650
 651         req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
 652                             window_size, sink, priv);
 653         if (req == NULL) {
 654                 status = NT_STATUS_NO_MEMORY;
 655                 goto fail;
 656         }
 657
 658         if (!tevent_req_poll(req, ev)) {
 659                 status = map_nt_error_from_unix(errno);
 660                 goto fail;
 661         }
 662
 663         status = cli_pull_recv(req, received);
 664  fail:
 665         TALLOC_FREE(frame);
 666         if (!NT_STATUS_IS_OK(status)) {
 667                 cli_set_error(cli, status);
 668         }
 669         return status;
 670 }
 671
 672 static NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
 673 {
 674         char **pbuf = (char **)priv;
 675         memcpy(*pbuf, buf, n);
 676         *pbuf += n;
 677         return NT_STATUS_OK;
 678 }
 679
 680 ssize_t cli_read(struct cli_state *cli, uint16_t fnum, char *buf,
 681                  off_t offset, size_t size)
 682 {
 683         NTSTATUS status;
 684         SMB_OFF_T ret;
 685
 686         status = cli_pull(cli, fnum, offset, size, size,
 687                           cli_read_sink, &buf, &ret);
 688         if (!NT_STATUS_IS_OK(status)) {
 689                 cli_set_error(cli, status);
 690                 return -1;
 691         }
 692         return ret;
 693 }
 694
 695 /****************************************************************************
 696  Issue a single SMBwrite and don't wait for a reply.
 697 ****************************************************************************/
 698
 699 static bool cli_issue_write(struct cli_state *cli,
 700                                 uint16_t fnum,
 701                                 off_t offset,
 702                                 uint16 mode,
 703                                 const char *buf,
 704                                 size_t size)
 705 {
 706         char *p;
 707         bool large_writex = false;
 708         /* We can only do direct writes if not signing and not encrypting. */
 709         bool direct_writes = !client_is_signing_on(cli) && !cli_encryption_on(cli);
 710
 711         if (!direct_writes && size + 1 > cli->bufsize) {
 712                 cli->outbuf = (char *)SMB_REALLOC(cli->outbuf, size + 1024);
 713                 if (!cli->outbuf) {
 714                         return False;
 715                 }
 716                 cli->inbuf = (char *)SMB_REALLOC(cli->inbuf, size + 1024);
 717                 if (cli->inbuf == NULL) {
 718                         SAFE_FREE(cli->outbuf);
 719                         return False;
 720                 }
 721                 cli->bufsize = size + 1024;
 722         }
 723
 724         memset(cli->outbuf,'\0',smb_size);
 725         memset(cli->inbuf,'\0',smb_size);
 726
 727         if (cli->capabilities & CAP_LARGE_FILES) {
 728                 large_writex = True;
 729         }
 730
 731         if (large_writex) {
 732                 cli_set_message(cli->outbuf,14,0,True);
 733         } else {
 734                 cli_set_message(cli->outbuf,12,0,True);
 735         }
 736
 737         SCVAL(cli->outbuf,smb_com,SMBwriteX);
 738         SSVAL(cli->outbuf,smb_tid,cli->cnum);
 739         cli_setup_packet(cli);
 740
 741         SCVAL(cli->outbuf,smb_vwv0,0xFF);
 742         SSVAL(cli->outbuf,smb_vwv2,fnum);
 743
 744         SIVAL(cli->outbuf,smb_vwv3,offset);
 745         SIVAL(cli->outbuf,smb_vwv5,0);
 746         SSVAL(cli->outbuf,smb_vwv7,mode);
 747
 748         SSVAL(cli->outbuf,smb_vwv8,(mode & 0x0008) ? size : 0);
 749         /*
 750          * According to CIFS-TR-1p00, this following field should only
 751          * be set if CAP_LARGE_WRITEX is set. We should check this
 752          * locally. However, this check might already have been
 753          * done by our callers.
 754          */
 755         SSVAL(cli->outbuf,smb_vwv9,(size>>16));
 756         SSVAL(cli->outbuf,smb_vwv10,size);
 757         /* +1 is pad byte. */
 758         SSVAL(cli->outbuf,smb_vwv11,
 759               smb_buf(cli->outbuf) - smb_base(cli->outbuf) + 1);
 760
 761         if (large_writex) {
 762                 SIVAL(cli->outbuf,smb_vwv12,(((uint64_t)offset)>>32) & 0xffffffff);
 763         }
 764
 765         p = smb_base(cli->outbuf) + SVAL(cli->outbuf,smb_vwv11) -1;
 766         *p++ = '\0'; /* pad byte. */
 767         if (!direct_writes) {
 768                 memcpy(p, buf, size);
 769         }
 770         if (size > 0x1FFFF) {
 771                 /* This is a POSIX 14 word large write. */
 772                 set_message_bcc(cli->outbuf, 0); /* Set bcc to zero. */
 773                 _smb_setlen_large(cli->outbuf,smb_size + 28 + 1 /* pad */ + size - 4);
 774         } else {
 775                 cli_setup_bcc(cli, p+size);
 776         }
 777
 778         show_msg(cli->outbuf);
 779         if (direct_writes) {
 780                 /* For direct writes we now need to write the data
 781                  * directly out of buf. */
 782                 return cli_send_smb_direct_writeX(cli, buf, size);
 783         } else {
 784                 return cli_send_smb(cli);
 785         }
 786 }
 787
 788 /****************************************************************************
 789   write to a file
 790   write_mode: 0x0001 disallow write cacheing
 791               0x0002 return bytes remaining
 792               0x0004 use raw named pipe protocol
 793               0x0008 start of message mode named pipe protocol
 794 ****************************************************************************/
 795
 796 ssize_t cli_write(struct cli_state *cli,
 797                  uint16_t fnum, uint16 write_mode,
 798                  const char *buf, off_t offset, size_t size)
 799 {
 800         ssize_t bwritten = 0;
 801         unsigned int issued = 0;
 802         unsigned int received = 0;
 803         int mpx = 1;
 804         size_t writesize;
 805         int blocks;
 806
 807         if(cli->max_mux > 1) {
 808                 mpx = cli->max_mux-1;
 809         } else {
 810                 mpx = 1;
 811         }
 812
 813         writesize = cli_write_max_bufsize(cli, write_mode);
 814
 815         blocks = (size + (writesize-1)) / writesize;
 816
 817         while (received < blocks) {
 818
 819                 while ((issued - received < mpx) && (issued < blocks)) {
 820                         ssize_t bsent = issued * writesize;
 821                         ssize_t size1 = MIN(writesize, size - bsent);
 822
 823                         if (!cli_issue_write(cli, fnum, offset + bsent,
 824                                         write_mode,
 825                                         buf + bsent,
 826                                         size1))
 827                                 return -1;
 828                         issued++;
 829                 }
 830
 831                 if (!cli_receive_smb(cli)) {
 832                         return bwritten;
 833                 }
 834
 835                 received++;
 836
 837                 if (cli_is_error(cli))
 838                         break;
 839
 840                 bwritten += SVAL(cli->inbuf, smb_vwv2);
 841                 if (writesize > 0xFFFF) {
 842                         bwritten += (((int)(SVAL(cli->inbuf, smb_vwv4)))<<16);
 843                 }
 844         }
 845
 846         while (received < issued && cli_receive_smb(cli)) {
 847                 received++;
 848         }
 849
 850         return bwritten;
 851 }
 852
 853 /****************************************************************************
 854   write to a file using a SMBwrite and not bypassing 0 byte writes
 855 ****************************************************************************/
 856
 857 NTSTATUS cli_smbwrite(struct cli_state *cli, uint16_t fnum, char *buf,
 858                       off_t offset, size_t size1, size_t *ptotal)
 859 {
 860         uint8_t *bytes;
 861         ssize_t total = 0;
 862
 863         /*
 864          * 3 bytes prefix
 865          */
 866
 867         bytes = TALLOC_ARRAY(talloc_tos(), uint8_t, 3);
 868         if (bytes == NULL) {
 869                 return NT_STATUS_NO_MEMORY;
 870         }
 871         bytes[0] = 1;
 872
 873         do {
 874                 size_t size = MIN(size1, cli->max_xmit - 48);
 875                 struct tevent_req *req;
 876                 uint16_t vwv[5];
 877                 uint16_t *ret_vwv;
 878                 NTSTATUS status;
 879
 880                 SSVAL(vwv+0, 0, fnum);
 881                 SSVAL(vwv+1, 0, size);
 882                 SIVAL(vwv+2, 0, offset);
 883                 SSVAL(vwv+4, 0, 0);
 884
 885                 bytes = TALLOC_REALLOC_ARRAY(talloc_tos(), bytes, uint8_t,
 886                                              size+3);
 887                 if (bytes == NULL) {
 888                         return NT_STATUS_NO_MEMORY;
 889                 }
 890                 SSVAL(bytes, 1, size);
 891                 memcpy(bytes + 3, buf + total, size);
 892
 893                 status = cli_smb(talloc_tos(), cli, SMBwrite, 0, 5, vwv,
 894                                  size+3, bytes, &req, 1, NULL, &ret_vwv,
 895                                  NULL, NULL);
 896                 if (!NT_STATUS_IS_OK(status)) {
 897                         TALLOC_FREE(bytes);
 898                         return status;
 899                 }
 900
 901                 size = SVAL(ret_vwv+0, 0);
 902                 TALLOC_FREE(req);
 903                 if (size == 0) {
 904                         break;
 905                 }
 906                 size1 -= size;
 907                 total += size;
 908                 offset += size;
 909
 910         } while (size1);
 911
 912         TALLOC_FREE(bytes);
 913
 914         if (ptotal != NULL) {
 915                 *ptotal = total;
 916         }
 917         return NT_STATUS_OK;
 918 }
 919
 920 /*
 921  * Send a write&x request
 922  */
 923
 924 struct cli_write_andx_state {
 925         size_t size;
 926         uint16_t vwv[14];
 927         size_t written;
 928         uint8_t pad;
 929         struct iovec iov[2];
 930 };
 931
 932 static void cli_write_andx_done(struct tevent_req *subreq);
 933
 934 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
 935                                          struct event_context *ev,
 936                                          struct cli_state *cli, uint16_t fnum,
 937                                          uint16_t mode, const uint8_t *buf,
 938                                          off_t offset, size_t size,
 939                                          struct tevent_req **reqs_before,
 940                                          int num_reqs_before,
 941                                          struct tevent_req **psmbreq)
 942 {
 943         struct tevent_req *req, *subreq;
 944         struct cli_write_andx_state *state;
 945         bool bigoffset = ((cli->capabilities & CAP_LARGE_FILES) != 0);
 946         uint8_t wct = bigoffset ? 14 : 12;
 947         size_t max_write = cli_write_max_bufsize(cli, mode);
 948         uint16_t *vwv;
 949
 950         req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
 951         if (req == NULL) {
 952                 return NULL;
 953         }
 954
 955         size = MIN(size, max_write);
 956
 957         vwv = state->vwv;
 958
 959         SCVAL(vwv+0, 0, 0xFF);
 960         SCVAL(vwv+0, 1, 0);
 961         SSVAL(vwv+1, 0, 0);
 962         SSVAL(vwv+2, 0, fnum);
 963         SIVAL(vwv+3, 0, offset);
 964         SIVAL(vwv+5, 0, 0);
 965         SSVAL(vwv+7, 0, mode);
 966         SSVAL(vwv+8, 0, 0);
 967         SSVAL(vwv+9, 0, (size>>16));
 968         SSVAL(vwv+10, 0, size);
 969
 970         SSVAL(vwv+11, 0,
 971               cli_smb_wct_ofs(reqs_before, num_reqs_before)
 972               + 1               /* the wct field */
 973               + wct * 2         /* vwv */
 974               + 2               /* num_bytes field */
 975               + 1               /* pad */);
 976
 977         if (bigoffset) {
 978                 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
 979         }
 980
 981         state->pad = 0;
 982         state->iov[0].iov_base = (void *)&state->pad;
 983         state->iov[0].iov_len = 1;
 984         state->iov[1].iov_base = CONST_DISCARD(void *, buf);
 985         state->iov[1].iov_len = size;
 986
 987         subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
 988                                     2, state->iov);
 989         if (tevent_req_nomem(subreq, req)) {
 990                 return tevent_req_post(req, ev);
 991         }
 992         tevent_req_set_callback(subreq, cli_write_andx_done, req);
 993         *psmbreq = subreq;
 994         return req;
 995 }
 996
 997 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
 998                                        struct event_context *ev,
 999                                        struct cli_state *cli, uint16_t fnum,
1000                                        uint16_t mode, const uint8_t *buf,
1001                                        off_t offset, size_t size)
1002 {
1003         struct tevent_req *req, *subreq;
1004         NTSTATUS status;
1005
1006         req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
1007                                     size, NULL, 0, &subreq);
1008         if (req == NULL) {
1009                 return NULL;
1010         }
1011
1012         status = cli_smb_req_send(subreq);
1013         if (tevent_req_nterror(req, status)) {
1014                 return tevent_req_post(req, ev);
1015         }
1016         return req;
1017 }
1018
1019 static void cli_write_andx_done(struct tevent_req *subreq)
1020 {
1021         struct tevent_req *req = tevent_req_callback_data(
1022                 subreq, struct tevent_req);
1023         struct cli_write_andx_state *state = tevent_req_data(
1024                 req, struct cli_write_andx_state);
1025         uint8_t wct;
1026         uint16_t *vwv;
1027         uint8_t *inbuf;
1028         NTSTATUS status;
1029
1030         status = cli_smb_recv(subreq, state, &inbuf, 6, &wct, &vwv,
1031                               NULL, NULL);
1032         TALLOC_FREE(subreq);
1033         if (NT_STATUS_IS_ERR(status)) {
1034                 tevent_req_nterror(req, status);
1035                 return;
1036         }
1037         state->written = SVAL(vwv+2, 0);
1038         state->written |= SVAL(vwv+4, 0)<<16;
1039         tevent_req_done(req);
1040 }
1041
1042 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
1043 {
1044         struct cli_write_andx_state *state = tevent_req_data(
1045                 req, struct cli_write_andx_state);
1046         NTSTATUS status;
1047
1048         if (tevent_req_is_nterror(req, &status)) {
1049                 return status;
1050         }
1051         *pwritten = state->written;
1052         return NT_STATUS_OK;
1053 }
1054
1055 struct cli_writeall_state {
1056         struct event_context *ev;
1057         struct cli_state *cli;
1058         uint16_t fnum;
1059         uint16_t mode;
1060         const uint8_t *buf;
1061         off_t offset;
1062         size_t size;
1063         size_t written;
1064 };
1065
1066 static void cli_writeall_written(struct tevent_req *req);
1067
1068 static struct tevent_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
1069                                             struct event_context *ev,
1070                                             struct cli_state *cli,
1071                                             uint16_t fnum,
1072                                             uint16_t mode,
1073                                             const uint8_t *buf,
1074                                             off_t offset, size_t size)
1075 {
1076         struct tevent_req *req, *subreq;
1077         struct cli_writeall_state *state;
1078
1079         req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
1080         if (req == NULL) {
1081                 return NULL;
1082         }
1083         state->ev = ev;
1084         state->cli = cli;
1085         state->fnum = fnum;
1086         state->mode = mode;
1087         state->buf = buf;
1088         state->offset = offset;
1089         state->size = size;
1090         state->written = 0;
1091
1092         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1093                                      state->mode, state->buf, state->offset,
1094                                      state->size);
1095         if (tevent_req_nomem(subreq, req)) {
1096                 return tevent_req_post(req, ev);
1097         }
1098         tevent_req_set_callback(subreq, cli_writeall_written, req);
1099         return req;
1100 }
1101
1102 static void cli_writeall_written(struct tevent_req *subreq)
1103 {
1104         struct tevent_req *req = tevent_req_callback_data(
1105                 subreq, struct tevent_req);
1106         struct cli_writeall_state *state = tevent_req_data(
1107                 req, struct cli_writeall_state);
1108         NTSTATUS status;
1109         size_t written, to_write;
1110
1111         status = cli_write_andx_recv(subreq, &written);
1112         TALLOC_FREE(subreq);
1113         if (tevent_req_nterror(req, status)) {
1114                 return;
1115         }
1116
1117         state->written += written;
1118
1119         if (state->written > state->size) {
1120                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1121                 return;
1122         }
1123
1124         to_write = state->size - state->written;
1125
1126         if (to_write == 0) {
1127                 tevent_req_done(req);
1128                 return;
1129         }
1130
1131         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1132                                      state->mode,
1133                                      state->buf + state->written,
1134                                      state->offset + state->written, to_write);
1135         if (tevent_req_nomem(subreq, req)) {
1136                 return;
1137         }
1138         tevent_req_set_callback(subreq, cli_writeall_written, req);
1139 }
1140
1141 static NTSTATUS cli_writeall_recv(struct tevent_req *req,
1142                                   size_t *pwritten)
1143 {
1144         struct cli_writeall_state *state = tevent_req_data(
1145                 req, struct cli_writeall_state);
1146         NTSTATUS status;
1147
1148         if (tevent_req_is_nterror(req, &status)) {
1149                 return status;
1150         }
1151         if (pwritten != NULL) {
1152                 *pwritten = state->written;
1153         }
1154         return NT_STATUS_OK;
1155 }
1156
1157 NTSTATUS cli_writeall(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1158                       const uint8_t *buf, off_t offset, size_t size,
1159                       size_t *pwritten)
1160 {
1161         TALLOC_CTX *frame = talloc_stackframe();
1162         struct event_context *ev;
1163         struct tevent_req *req;
1164         NTSTATUS status = NT_STATUS_NO_MEMORY;
1165
1166         if (cli_has_async_calls(cli)) {
1167                 /*
1168                  * Can't use sync call while an async call is in flight
1169                  */
1170                 status = NT_STATUS_INVALID_PARAMETER;
1171                 goto fail;
1172         }
1173         ev = event_context_init(frame);
1174         if (ev == NULL) {
1175                 goto fail;
1176         }
1177         req = cli_writeall_send(frame, ev, cli, fnum, mode, buf, offset, size);
1178         if (req == NULL) {
1179                 goto fail;
1180         }
1181         if (!tevent_req_poll(req, ev)) {
1182                 status = map_nt_error_from_unix(errno);
1183                 goto fail;
1184         }
1185         status = cli_writeall_recv(req, pwritten);
1186  fail:
1187         TALLOC_FREE(frame);
1188         if (!NT_STATUS_IS_OK(status)) {
1189                 cli_set_error(cli, status);
1190         }
1191         return status;
1192 }
1193
1194 struct cli_push_write_state {
1195         struct tevent_req *req;/* This is the main request! Not the subreq */
1196         uint32_t idx;
1197         off_t ofs;
1198         uint8_t *buf;
1199         size_t size;
1200 };
1201
1202 struct cli_push_state {
1203         struct event_context *ev;
1204         struct cli_state *cli;
1205         uint16_t fnum;
1206         uint16_t mode;
1207         off_t start_offset;
1208         size_t window_size;
1209
1210         size_t (*source)(uint8_t *buf, size_t n, void *priv);
1211         void *priv;
1212
1213         bool eof;
1214
1215         size_t chunk_size;
1216         off_t next_offset;
1217
1218         /*
1219          * Outstanding requests
1220          */
1221         uint32_t pending;
1222         uint32_t num_reqs;
1223         struct cli_push_write_state **reqs;
1224 };
1225
1226 static void cli_push_written(struct tevent_req *req);
1227
1228 static bool cli_push_write_setup(struct tevent_req *req,
1229                                  struct cli_push_state *state,
1230                                  uint32_t idx)
1231 {
1232         struct cli_push_write_state *substate;
1233         struct tevent_req *subreq;
1234
1235         substate = talloc(state->reqs, struct cli_push_write_state);
1236         if (!substate) {
1237                 return false;
1238         }
1239         substate->req = req;
1240         substate->idx = idx;
1241         substate->ofs = state->next_offset;
1242         substate->buf = talloc_array(substate, uint8_t, state->chunk_size);
1243         if (!substate->buf) {
1244                 talloc_free(substate);
1245                 return false;
1246         }
1247         substate->size = state->source(substate->buf,
1248                                        state->chunk_size,
1249                                        state->priv);
1250         if (substate->size == 0) {
1251                 state->eof = true;
1252                 /* nothing to send */
1253                 talloc_free(substate);
1254                 return true;
1255         }
1256
1257         subreq = cli_writeall_send(substate,
1258                                    state->ev, state->cli,
1259                                    state->fnum, state->mode,
1260                                    substate->buf,
1261                                    substate->ofs,
1262                                    substate->size);
1263         if (!subreq) {
1264                 talloc_free(substate);
1265                 return false;
1266         }
1267         tevent_req_set_callback(subreq, cli_push_written, substate);
1268
1269         state->reqs[idx] = substate;
1270         state->pending += 1;
1271         state->next_offset += substate->size;
1272
1273         return true;
1274 }
1275
1276 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
1277                                  struct cli_state *cli,
1278                                  uint16_t fnum, uint16_t mode,
1279                                  off_t start_offset, size_t window_size,
1280                                  size_t (*source)(uint8_t *buf, size_t n,
1281                                                   void *priv),
1282                                  void *priv)
1283 {
1284         struct tevent_req *req;
1285         struct cli_push_state *state;
1286         uint32_t i;
1287
1288         req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1289         if (req == NULL) {
1290                 return NULL;
1291         }
1292         state->cli = cli;
1293         state->ev = ev;
1294         state->fnum = fnum;
1295         state->start_offset = start_offset;
1296         state->mode = mode;
1297         state->source = source;
1298         state->priv = priv;
1299         state->eof = false;
1300         state->pending = 0;
1301         state->next_offset = start_offset;
1302
1303         state->chunk_size = cli_write_max_bufsize(cli, mode);
1304
1305         if (window_size == 0) {
1306                 window_size = cli->max_mux * state->chunk_size;
1307         }
1308         state->num_reqs = window_size/state->chunk_size;
1309         if ((window_size % state->chunk_size) > 0) {
1310                 state->num_reqs += 1;
1311         }
1312         state->num_reqs = MIN(state->num_reqs, cli->max_mux);
1313         state->num_reqs = MAX(state->num_reqs, 1);
1314
1315         state->reqs = TALLOC_ZERO_ARRAY(state, struct cli_push_write_state *,
1316                                         state->num_reqs);
1317         if (state->reqs == NULL) {
1318                 goto failed;
1319         }
1320
1321         for (i=0; i<state->num_reqs; i++) {
1322                 if (!cli_push_write_setup(req, state, i)) {
1323                         goto failed;
1324                 }
1325
1326                 if (state->eof) {
1327                         break;
1328                 }
1329         }
1330
1331         if (state->pending == 0) {
1332                 tevent_req_done(req);
1333                 return tevent_req_post(req, ev);
1334         }
1335
1336         return req;
1337
1338  failed:
1339         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1340         return tevent_req_post(req, ev);
1341 }
1342
1343 static void cli_push_written(struct tevent_req *subreq)
1344 {
1345         struct cli_push_write_state *substate = tevent_req_callback_data(
1346                 subreq, struct cli_push_write_state);
1347         struct tevent_req *req = substate->req;
1348         struct cli_push_state *state = tevent_req_data(
1349                 req, struct cli_push_state);
1350         NTSTATUS status;
1351         uint32_t idx = substate->idx;
1352
1353         state->reqs[idx] = NULL;
1354         state->pending -= 1;
1355
1356         status = cli_writeall_recv(subreq, NULL);
1357         TALLOC_FREE(subreq);
1358         TALLOC_FREE(substate);
1359         if (tevent_req_nterror(req, status)) {
1360                 return;
1361         }
1362
1363         if (!state->eof) {
1364                 if (!cli_push_write_setup(req, state, idx)) {
1365                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1366                         return;
1367                 }
1368         }
1369
1370         if (state->pending == 0) {
1371                 tevent_req_done(req);
1372                 return;
1373         }
1374 }
1375
1376 NTSTATUS cli_push_recv(struct tevent_req *req)
1377 {
1378         return tevent_req_simple_recv_ntstatus(req);
1379 }
1380
1381 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1382                   off_t start_offset, size_t window_size,
1383                   size_t (*source)(uint8_t *buf, size_t n, void *priv),
1384                   void *priv)
1385 {
1386         TALLOC_CTX *frame = talloc_stackframe();
1387         struct event_context *ev;
1388         struct tevent_req *req;
1389         NTSTATUS status = NT_STATUS_OK;
1390
1391         if (cli_has_async_calls(cli)) {
1392                 /*
1393                  * Can't use sync call while an async call is in flight
1394                  */
1395                 status = NT_STATUS_INVALID_PARAMETER;
1396                 goto fail;
1397         }
1398
1399         ev = event_context_init(frame);
1400         if (ev == NULL) {
1401                 status = NT_STATUS_NO_MEMORY;
1402                 goto fail;
1403         }
1404
1405         req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1406                             window_size, source, priv);
1407         if (req == NULL) {
1408                 status = NT_STATUS_NO_MEMORY;
1409                 goto fail;
1410         }
1411
1412         if (!tevent_req_poll(req, ev)) {
1413                 status = map_nt_error_from_unix(errno);
1414                 goto fail;
1415         }
1416
1417         status = cli_push_recv(req);
1418  fail:
1419         TALLOC_FREE(frame);
1420         if (!NT_STATUS_IS_OK(status)) {
1421                 cli_set_error(cli, status);
1422         }
1423         return status;
1424 }