Fix sending of large nttrans responses.
[metze/samba/wb-ndr.git] / source / smb_server / smb / nttrans.c
index 9e3c03206299273b65fa936058fe48a0510e20d8..dd2ec15e39c426d9640eedb4eb0a8a1d4323b97c 100644 (file)
@@ -6,7 +6,7 @@
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -15,8 +15,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 /*
    This file handles the parsing of transact2 requests
@@ -27,6 +26,7 @@
 #include "ntvfs/ntvfs.h"
 #include "libcli/raw/libcliraw.h"
 #include "librpc/gen_ndr/ndr_security.h"
+#include "param/param.h"
 
 /*
   hold the state of a nttrans op while in progress. Needed to allow for async backend
@@ -47,7 +47,7 @@ static NTSTATUS nttrans_setup_reply(struct nttrans_op *op,
 {
        trans->out.setup_count = setup_count;
        if (setup_count != 0) {
-               trans->out.setup = talloc_zero_array(op, uint16_t, setup_count);
+               trans->out.setup = talloc_zero_array(op, uint8_t, setup_count*2);
                NT_STATUS_HAVE_NO_MEMORY(trans->out.setup);
        }
        trans->out.params = data_blob_talloc(op, NULL, param_size);
@@ -68,17 +68,14 @@ static NTSTATUS nttrans_create_send(struct nttrans_op *op)
 {
        union smb_open *io = talloc_get_type(op->op_info, union smb_open);
        uint8_t *params;
+       NTSTATUS status;
 
-       op->trans->out.setup_count = 0;
-       op->trans->out.setup       = NULL;
-       op->trans->out.params      = data_blob_talloc(op, NULL, 69);
-       op->trans->out.data        = data_blob(NULL, 0);
-
+       status = nttrans_setup_reply(op, op->trans, 69, 0, 0);
+       NT_STATUS_NOT_OK_RETURN(status);
        params = op->trans->out.params.data;
-       NT_STATUS_HAVE_NO_MEMORY(params);
 
        SSVAL(params,        0, io->ntcreatex.out.oplock_level);
-       SSVAL(params,        2, io->ntcreatex.out.file.fnum);
+       smbsrv_push_fnum(params, 2, io->ntcreatex.out.file.ntvfs);
        SIVAL(params,        4, io->ntcreatex.out.create_action);
        SIVAL(params,        8, 0); /* ea error offset */
        push_nttime(params, 12, io->ntcreatex.out.create_time);
@@ -107,6 +104,7 @@ static NTSTATUS nttrans_create(struct smbsrv_request *req,
        uint32_t sd_length, ea_length;
        NTSTATUS status;
        uint8_t *params;
+       enum ndr_err_code ndr_err;
 
        if (trans->in.params.length < 54) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -159,11 +157,11 @@ static NTSTATUS nttrans_create(struct smbsrv_request *req,
                if (io->ntcreatex.in.sec_desc == NULL) {
                        return NT_STATUS_NO_MEMORY;
                }
-               status = ndr_pull_struct_blob(&blob, io, 
-                                             io->ntcreatex.in.sec_desc, 
-                                             (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-               if (!NT_STATUS_IS_OK(status)) {
-                       return status;
+               ndr_err = ndr_pull_struct_blob(&blob, io, NULL,
+                                              io->ntcreatex.in.sec_desc,
+                                              (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+               if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                       return ndr_map_error2ntstatus(ndr_err);
                }
        }
 
@@ -197,22 +195,23 @@ static NTSTATUS nttrans_create(struct smbsrv_request *req,
  */
 static NTSTATUS nttrans_query_sec_desc_send(struct nttrans_op *op)
 {
-       struct smb_nttrans *trans = op->trans;
        union smb_fileinfo *io = talloc_get_type(op->op_info, union smb_fileinfo);
+       uint8_t *params;
        NTSTATUS status;
+       enum ndr_err_code ndr_err;
 
-       trans->out.setup_count = 0;
-       trans->out.setup       = NULL;
-       trans->out.params      = data_blob_talloc(op, NULL, 4);
-       trans->out.data        = data_blob(NULL, 0);
-       NT_STATUS_HAVE_NO_MEMORY(trans->out.params.data);
-
-       status = ndr_push_struct_blob(&trans->out.data, op, 
-                                     io->query_secdesc.out.sd, 
-                                     (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+       status = nttrans_setup_reply(op, op->trans, 4, 0, 0);
        NT_STATUS_NOT_OK_RETURN(status);
+       params = op->trans->out.params.data;
+
+       ndr_err = ndr_push_struct_blob(&op->trans->out.data, op, NULL,
+                                      io->query_secdesc.out.sd,
+                                      (ndr_push_flags_fn_t)ndr_push_security_descriptor);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               return ndr_map_error2ntstatus(ndr_err);
+       }
 
-       SIVAL(trans->out.params.data, 0, trans->out.data.length);
+       SIVAL(params, 0, op->trans->out.data.length);
 
        return NT_STATUS_OK;
 }
@@ -235,12 +234,13 @@ static NTSTATUS nttrans_query_sec_desc(struct smbsrv_request *req,
        NT_STATUS_HAVE_NO_MEMORY(io);
 
        io->query_secdesc.level            = RAW_FILEINFO_SEC_DESC;
-       io->query_secdesc.in.file.fnum     = SVAL(trans->in.params.data, 0);
+       io->query_secdesc.in.file.ntvfs    = smbsrv_pull_fnum(req, trans->in.params.data, 0);
        io->query_secdesc.in.secinfo_flags = IVAL(trans->in.params.data, 4);
 
        op->op_info = io;
        op->send_fn = nttrans_query_sec_desc_send;
 
+       SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(io->query_secdesc.in.file.ntvfs);
        return ntvfs_qfileinfo(req->ntvfs, io);
 }
 
@@ -253,7 +253,7 @@ static NTSTATUS nttrans_set_sec_desc(struct smbsrv_request *req,
 {
        struct smb_nttrans *trans = op->trans;
        union smb_setfileinfo *io;
-       NTSTATUS status;
+       enum ndr_err_code ndr_err;
 
        if (trans->in.params.length < 8) {
                return NT_STATUS_INVALID_PARAMETER;
@@ -264,22 +264,20 @@ static NTSTATUS nttrans_set_sec_desc(struct smbsrv_request *req,
        NT_STATUS_HAVE_NO_MEMORY(io);
 
        io->set_secdesc.level            = RAW_SFILEINFO_SEC_DESC;
-       io->set_secdesc.in.file.fnum     = SVAL(trans->in.params.data, 0);
+       io->set_secdesc.in.file.ntvfs    = smbsrv_pull_fnum(req, trans->in.params.data, 0);
        io->set_secdesc.in.secinfo_flags = IVAL(trans->in.params.data, 4);
 
        io->set_secdesc.in.sd = talloc(io, struct security_descriptor);
        NT_STATUS_HAVE_NO_MEMORY(io->set_secdesc.in.sd);
 
-       status = ndr_pull_struct_blob(&trans->in.data, req, 
-                                     io->set_secdesc.in.sd, 
-                                     (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
-       NT_STATUS_NOT_OK_RETURN(status);
-
-       trans->out.setup_count = 0;
-       trans->out.setup       = NULL;
-       trans->out.params      = data_blob(NULL, 0);
-       trans->out.data        = data_blob(NULL, 0);
+       ndr_err = ndr_pull_struct_blob(&trans->in.data, req, NULL,
+                                      io->set_secdesc.in.sd,
+                                      (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
+       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+               return ndr_map_error2ntstatus(ndr_err);
+       }
 
+       SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(io->set_secdesc.in.file.ntvfs);
        return ntvfs_setfileinfo(req->ntvfs, io);
 }
 
@@ -292,6 +290,29 @@ static NTSTATUS nttrans_rename(struct smbsrv_request *req,
        return NT_STATUS_NOT_IMPLEMENTED;
 }
 
+/* 
+   parse NTTRANS_IOCTL send
+ */
+static NTSTATUS nttrans_ioctl_send(struct nttrans_op *op)
+{
+       union smb_ioctl *info = talloc_get_type(op->op_info, union smb_ioctl);
+       NTSTATUS status;
+
+       /* 
+        * we pass 0 as data_count here,
+        * because we reuse the DATA_BLOB from the smb_ioctl
+        * struct
+        */
+       status = nttrans_setup_reply(op, op->trans, 0, 0, 1);
+       NT_STATUS_NOT_OK_RETURN(status);
+
+       op->trans->out.setup[0]         = 0;
+       op->trans->out.data             = info->ntioctl.out.blob;
+
+       return NT_STATUS_OK;
+}
+
+
 /* 
    parse NTTRANS_IOCTL request
  */
@@ -300,11 +321,6 @@ static NTSTATUS nttrans_ioctl(struct smbsrv_request *req,
 {
        struct smb_nttrans *trans = op->trans;
        union smb_ioctl *nt;
-       uint32_t function;
-       uint16_t fnum;
-       uint8_t filter;
-       BOOL fsctl;
-       NTSTATUS status;
 
        /* should have at least 4 setup words */
        if (trans->in.setup_count != 4) {
@@ -314,24 +330,18 @@ static NTSTATUS nttrans_ioctl(struct smbsrv_request *req,
        nt = talloc(op, union smb_ioctl);
        NT_STATUS_HAVE_NO_MEMORY(nt);
        
-       function  = IVAL(trans->in.setup, 0);
-       fnum  = SVAL(trans->in.setup, 4);
-       fsctl = CVAL(trans->in.setup, 6);
-       filter = CVAL(trans->in.setup, 7);
-
-       nt->ntioctl.level = RAW_IOCTL_NTIOCTL;
-       nt->ntioctl.in.file.fnum = fnum;
-       nt->ntioctl.in.function = function;
-       nt->ntioctl.in.fsctl = fsctl;
-       nt->ntioctl.in.filter = filter;
-       nt->ntioctl.in.max_data = trans->in.max_data;
-       nt->ntioctl.in.blob = trans->in.data;
-
-       status = nttrans_setup_reply(op, trans, 0, 0, 1);
-       NT_STATUS_NOT_OK_RETURN(status);
-
-       trans->out.setup[0] = 0;
-       
+       nt->ntioctl.level               = RAW_IOCTL_NTIOCTL;
+       nt->ntioctl.in.function         = IVAL(trans->in.setup, 0);
+       nt->ntioctl.in.file.ntvfs       = smbsrv_pull_fnum(req, (uint8_t *)trans->in.setup, 4);
+       nt->ntioctl.in.fsctl            = CVAL(trans->in.setup, 6);
+       nt->ntioctl.in.filter           = CVAL(trans->in.setup, 7);
+       nt->ntioctl.in.max_data         = trans->in.max_data;
+       nt->ntioctl.in.blob             = trans->in.data;
+
+       op->op_info = nt;
+       op->send_fn = nttrans_ioctl_send;
+
+       SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(nt->ntioctl.in.file.ntvfs);
        return ntvfs_ioctl(req->ntvfs, nt);
 }
 
@@ -341,7 +351,7 @@ static NTSTATUS nttrans_ioctl(struct smbsrv_request *req,
  */
 static NTSTATUS nttrans_notify_change_send(struct nttrans_op *op)
 {
-       struct smb_notify *info = talloc_get_type(op->op_info, struct smb_notify);
+       union smb_notify *info = talloc_get_type(op->op_info, union smb_notify);
        size_t size = 0;
        int i;
        NTSTATUS status;
@@ -349,26 +359,25 @@ static NTSTATUS nttrans_notify_change_send(struct nttrans_op *op)
 #define MAX_BYTES_PER_CHAR 3
        
        /* work out how big the reply buffer could be */
-       for (i=0;i<info->out.num_changes;i++) {
-               size += 12 + 3 + (1+strlen(info->out.changes[i].name.s)) * MAX_BYTES_PER_CHAR;
+       for (i=0;i<info->nttrans.out.num_changes;i++) {
+               size += 12 + 3 + (1+strlen(info->nttrans.out.changes[i].name.s)) * MAX_BYTES_PER_CHAR;
        }
 
        status = nttrans_setup_reply(op, op->trans, size, 0, 0);
        NT_STATUS_NOT_OK_RETURN(status);
-
        p = op->trans->out.params.data;
 
        /* construct the changes buffer */
-       for (i=0;i<info->out.num_changes;i++) {
+       for (i=0;i<info->nttrans.out.num_changes;i++) {
                uint32_t ofs;
                ssize_t len;
 
-               SIVAL(p, 4, info->out.changes[i].action);
-               len = push_string(p + 12, info->out.changes[i].name.s, 
+               SIVAL(p, 4, info->nttrans.out.changes[i].action);
+               len = push_string(lp_iconv_convenience(global_loadparm), p + 12, info->nttrans.out.changes[i].name.s, 
                                  op->trans->out.params.length - 
                                  (p+12 - op->trans->out.params.data), STR_UNICODE);
                SIVAL(p, 8, len);
-               
+
                ofs = len + 12;
 
                if (ofs & 3) {
@@ -377,7 +386,7 @@ static NTSTATUS nttrans_notify_change_send(struct nttrans_op *op)
                        ofs += pad;
                }
 
-               if (i == info->out.num_changes-1) {
+               if (i == info->nttrans.out.num_changes-1) {
                        SIVAL(p, 0, 0);
                } else {
                        SIVAL(p, 0, ofs);
@@ -398,24 +407,26 @@ static NTSTATUS nttrans_notify_change(struct smbsrv_request *req,
                                      struct nttrans_op *op)
 {
        struct smb_nttrans *trans = op->trans;
-       struct smb_notify *info;
+       union smb_notify *info;
 
        /* should have at least 4 setup words */
        if (trans->in.setup_count != 4) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       info = talloc(op, struct smb_notify);
+       info = talloc(op, union smb_notify);
        NT_STATUS_HAVE_NO_MEMORY(info);
 
-       info->in.completion_filter = IVAL(trans->in.setup, 0);
-       info->in.file.fnum         = SVAL(trans->in.setup, 4);
-       info->in.recursive         = SVAL(trans->in.setup, 6);
-       info->in.buffer_size       = trans->in.max_param;
+       info->nttrans.level                     = RAW_NOTIFY_NTTRANS;
+       info->nttrans.in.completion_filter      = IVAL(trans->in.setup, 0);
+       info->nttrans.in.file.ntvfs             = smbsrv_pull_fnum(req, (uint8_t *)trans->in.setup, 4);
+       info->nttrans.in.recursive              = SVAL(trans->in.setup, 6);
+       info->nttrans.in.buffer_size            = trans->in.max_param;
 
        op->op_info = info;
        op->send_fn = nttrans_notify_change_send;
-       
+
+       SMBSRV_CHECK_FILE_HANDLE_NTSTATUS(info->nttrans.in.file.ntvfs);
        return ntvfs_notify(req->ntvfs, info);
 }
 
@@ -494,7 +505,6 @@ static void reply_nttrans_send(struct ntvfs_request *ntvfs)
                uint16_t this_data, this_param, max_bytes;
                uint_t align1 = 1, align2 = (params_left ? 2 : 0);
                struct smbsrv_request *this_req;
-               int i;
 
                max_bytes = req_max_data(req) - (align1 + align2);
 
@@ -517,7 +527,7 @@ static void reply_nttrans_send(struct ntvfs_request *ntvfs)
                        this_req = req;
                }
 
-               req_grow_data(req, this_param + this_data + (align1 + align2));
+               req_grow_data(this_req, this_param + this_data + (align1 + align2));
 
                SSVAL(this_req->out.vwv, 0, 0); /* reserved */
                SCVAL(this_req->out.vwv, 2, 0); /* reserved */
@@ -534,10 +544,8 @@ static void reply_nttrans_send(struct ntvfs_request *ntvfs)
                SIVAL(this_req->out.vwv, 31, PTR_DIFF(data, trans->out.data.data));
 
                SCVAL(this_req->out.vwv, 35, trans->out.setup_count);
-               for (i=0;i<trans->out.setup_count;i++) {
-                       SSVAL(this_req->out.vwv, VWV(18+i), trans->out.setup[i]);
-               }
-
+               memcpy((char *)(this_req->out.vwv) + VWV(18), trans->out.setup,
+                      sizeof(uint16_t) * trans->out.setup_count);
                memset(this_req->out.data, 0, align1);
                if (this_param != 0) {
                        memcpy(this_req->out.data + align1, params, this_param);
@@ -565,7 +573,6 @@ void smbsrv_reply_nttrans(struct smbsrv_request *req)
 {
        struct nttrans_op *op;
        struct smb_nttrans *trans;
-       int i;
        uint16_t param_ofs, data_ofs;
        uint16_t param_count, data_count;
        uint16_t param_total, data_total;
@@ -589,17 +596,17 @@ void smbsrv_reply_nttrans(struct smbsrv_request *req)
        op->op_info = NULL;
        op->send_fn = NULL;
 
-       trans->in.max_setup   = CVAL(req->in.vwv, 0);
+       trans->in.max_setup  = CVAL(req->in.vwv, 0);
        param_total          = IVAL(req->in.vwv, 3);
        data_total           = IVAL(req->in.vwv, 7);
-       trans->in.max_param   = IVAL(req->in.vwv, 11);
-       trans->in.max_data    = IVAL(req->in.vwv, 15);
+       trans->in.max_param  = IVAL(req->in.vwv, 11);
+       trans->in.max_data   = IVAL(req->in.vwv, 15);
        param_count          = IVAL(req->in.vwv, 19);
        param_ofs            = IVAL(req->in.vwv, 23);
        data_count           = IVAL(req->in.vwv, 27);
        data_ofs             = IVAL(req->in.vwv, 31);
-       trans->in.setup_count = CVAL(req->in.vwv, 35);
-       trans->in.function       = SVAL(req->in.vwv, 36);
+       trans->in.setup_count= CVAL(req->in.vwv, 35);
+       trans->in.function   = SVAL(req->in.vwv, 36);
 
        if (req->in.wct != 19 + trans->in.setup_count) {
                smbsrv_send_error(req, NT_STATUS_DOS(ERRSRV, ERRerror));
@@ -607,14 +614,13 @@ void smbsrv_reply_nttrans(struct smbsrv_request *req)
        }
 
        /* parse out the setup words */
-       trans->in.setup = talloc_array(req, uint16_t, trans->in.setup_count);
+       trans->in.setup = talloc_array(req, uint8_t, trans->in.setup_count*2);
        if (!trans->in.setup) {
                smbsrv_send_error(req, NT_STATUS_NO_MEMORY);
                return;
        }
-       for (i=0;i<trans->in.setup_count;i++) {
-               trans->in.setup[i] = SVAL(req->in.vwv, VWV(19+i));
-       }
+       memcpy(trans->in.setup, (char *)(req->in.vwv) + VWV(19),
+              sizeof(uint16_t) * trans->in.setup_count);
 
        if (!req_pull_blob(req, req->in.hdr + param_ofs, param_count, &trans->in.params) ||
            !req_pull_blob(req, req->in.hdr + data_ofs, data_count, &trans->in.data)) {