source3/libsmb/clirap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client RAP calls
   4    Copyright (C) Andrew Tridgell         1994-1998
   5    Copyright (C) Gerald (Jerry) Carter   2004
   6    Copyright (C) James Peach             2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "../libcli/auth/libcli_auth.h"
  24 #include "../librpc/gen_ndr/rap.h"
  25 #include "../lib/crypto/arcfour.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "async_smb.h"
  28 #include "libsmb/libsmb.h"
  29 #include "libsmb/clirap.h"
  30 #include "trans2.h"
  31
  32 #define PIPE_LANMAN   "\\PIPE\\LANMAN"
  33
  34 /****************************************************************************
  35  Call a remote api
  36 ****************************************************************************/
  37
  38 bool cli_api(struct cli_state *cli,
  39              char *param, int prcnt, int mprcnt,
  40              char *data, int drcnt, int mdrcnt,
  41              char **rparam, unsigned int *rprcnt,
  42              char **rdata, unsigned int *rdrcnt)
  43 {
  44         NTSTATUS status;
  45
  46         uint8_t *my_rparam, *my_rdata;
  47         uint32_t num_my_rparam, num_my_rdata;
  48
  49         status = cli_trans(talloc_tos(), cli, SMBtrans,
  50                            PIPE_LANMAN, 0, /* name, fid */
  51                            0, 0,           /* function, flags */
  52                            NULL, 0, 0,     /* setup */
  53                            (uint8_t *)param, prcnt, mprcnt, /* Params, length, max */
  54                            (uint8_t *)data, drcnt, mdrcnt,  /* Data, length, max */
  55                            NULL,                 /* recv_flags2 */
  56                            NULL, 0, NULL,        /* rsetup */
  57                            &my_rparam, 0, &num_my_rparam,
  58                            &my_rdata, 0, &num_my_rdata);
  59         if (!NT_STATUS_IS_OK(status)) {
  60                 return false;
  61         }
  62
  63         /*
  64          * I know this memcpy massively hurts, but there are just tons
  65          * of callers of cli_api that eventually need changing to
  66          * talloc
  67          */
  68
  69         *rparam = (char *)memdup(my_rparam, num_my_rparam);
  70         if (*rparam == NULL) {
  71                 goto fail;
  72         }
  73         *rprcnt = num_my_rparam;
  74         TALLOC_FREE(my_rparam);
  75
  76         *rdata = (char *)memdup(my_rdata, num_my_rdata);
  77         if (*rdata == NULL) {
  78                 goto fail;
  79         }
  80         *rdrcnt = num_my_rdata;
  81         TALLOC_FREE(my_rdata);
  82
  83         return true;
  84 fail:
  85         TALLOC_FREE(my_rdata);
  86         TALLOC_FREE(my_rparam);
  87         *rparam = NULL;
  88         *rprcnt = 0;
  89         *rdata = NULL;
  90         *rdrcnt = 0;
  91         return false;
  92 }
  93
  94 /****************************************************************************
  95  Perform a NetWkstaUserLogon.
  96 ****************************************************************************/
  97
  98 bool cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation)
  99 {
 100         char *rparam = NULL;
 101         char *rdata = NULL;
 102         char *p;
 103         unsigned int rdrcnt,rprcnt;
 104         char param[1024];
 105
 106         memset(param, 0, sizeof(param));
 107
 108         /* send a SMBtrans command with api NetWkstaUserLogon */
 109         p = param;
 110         SSVAL(p,0,132); /* api number */
 111         p += 2;
 112         strlcpy(p,"OOWb54WrLh",sizeof(param)-PTR_DIFF(p,param));
 113         p = skip_string(param,sizeof(param),p);
 114         strlcpy(p,"WB21BWDWWDDDDDDDzzzD",sizeof(param)-PTR_DIFF(p,param));
 115         p = skip_string(param,sizeof(param),p);
 116         SSVAL(p,0,1);
 117         p += 2;
 118         strlcpy(p,user,sizeof(param)-PTR_DIFF(p,param));
 119         strupper_m(p);
 120         p += 21;
 121         p++;
 122         p += 15;
 123         p++;
 124         strlcpy(p, workstation,sizeof(param)-PTR_DIFF(p,param));
 125         strupper_m(p);
 126         p += 16;
 127         SSVAL(p, 0, CLI_BUFFER_SIZE);
 128         p += 2;
 129         SSVAL(p, 0, CLI_BUFFER_SIZE);
 130         p += 2;
 131
 132         if (cli_api(cli,
 133                     param, PTR_DIFF(p,param),1024,  /* param, length, max */
 134                     NULL, 0, CLI_BUFFER_SIZE,           /* data, length, max */
 135                     &rparam, &rprcnt,               /* return params, return size */
 136                     &rdata, &rdrcnt                 /* return data, return size */
 137                    )) {
 138                 cli->rap_error = rparam? SVAL(rparam,0) : -1;
 139                 p = rdata;
 140
 141                 if (cli->rap_error == 0) {
 142                         DEBUG(4,("NetWkstaUserLogon success\n"));
 143                         /*
 144                          * The cli->privileges = SVAL(p, 24); field was set here
 145                          * but it was not use anywhere else.
 146                          */
 147                         /* The cli->eff_name field used to be set here
 148                            but it wasn't used anywhere else. */
 149                 } else {
 150                         DEBUG(1,("NetwkstaUserLogon gave error %d\n", cli->rap_error));
 151                 }
 152         }
 153
 154         SAFE_FREE(rparam);
 155         SAFE_FREE(rdata);
 156         return (cli->rap_error == 0);
 157 }
 158
 159 /****************************************************************************
 160  Call a NetShareEnum - try and browse available connections on a host.
 161 ****************************************************************************/
 162
 163 int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32, const char *, void *), void *state)
 164 {
 165         char *rparam = NULL;
 166         char *rdata = NULL;
 167         char *p;
 168         unsigned int rdrcnt,rprcnt;
 169         char param[1024];
 170         int count = -1;
 171
 172         /* now send a SMBtrans command with api RNetShareEnum */
 173         p = param;
 174         SSVAL(p,0,0); /* api number */
 175         p += 2;
 176         strlcpy(p,"WrLeh",sizeof(param)-PTR_DIFF(p,param));
 177         p = skip_string(param,sizeof(param),p);
 178         strlcpy(p,"B13BWz",sizeof(param)-PTR_DIFF(p,param));
 179         p = skip_string(param,sizeof(param),p);
 180         SSVAL(p,0,1);
 181         /*
 182          * Win2k needs a *smaller* buffer than 0xFFFF here -
 183          * it returns "out of server memory" with 0xFFFF !!! JRA.
 184          */
 185         SSVAL(p,2,0xFFE0);
 186         p += 4;
 187
 188         if (cli_api(cli,
 189                     param, PTR_DIFF(p,param), 1024,  /* Param, length, maxlen */
 190                     NULL, 0, 0xFFE0,            /* data, length, maxlen - Win2k needs a small buffer here too ! */
 191                     &rparam, &rprcnt,                /* return params, length */
 192                     &rdata, &rdrcnt))                /* return data, length */
 193                 {
 194                         int res = rparam? SVAL(rparam,0) : -1;
 195
 196                         if (res == 0 || res == ERRmoredata) {
 197                                 int converter=SVAL(rparam,2);
 198                                 int i;
 199                                 char *rdata_end = rdata + rdrcnt;
 200
 201                                 count=SVAL(rparam,4);
 202                                 p = rdata;
 203
 204                                 for (i=0;i<count;i++,p+=20) {
 205                                         char *sname;
 206                                         int type;
 207                                         int comment_offset;
 208                                         const char *cmnt;
 209                                         const char *p1;
 210                                         char *s1, *s2;
 211                                         size_t len;
 212                                         TALLOC_CTX *frame = talloc_stackframe();
 213
 214                                         if (p + 20 > rdata_end) {
 215                                                 TALLOC_FREE(frame);
 216                                                 break;
 217                                         }
 218
 219                                         sname = p;
 220                                         type = SVAL(p,14);
 221                                         comment_offset = (IVAL(p,16) & 0xFFFF) - converter;
 222                                         if (comment_offset < 0 ||
 223                                                         comment_offset > (int)rdrcnt) {
 224                                                 TALLOC_FREE(frame);
 225                                                 break;
 226                                         }
 227                                         cmnt = comment_offset?(rdata+comment_offset):"";
 228
 229                                         /* Work out the comment length. */
 230                                         for (p1 = cmnt, len = 0; *p1 &&
 231                                                         p1 < rdata_end; len++)
 232                                                 p1++;
 233                                         if (!*p1) {
 234                                                 len++;
 235                                         }
 236                                         pull_string_talloc(frame,rdata,0,
 237                                                 &s1,sname,14,STR_ASCII);
 238                                         pull_string_talloc(frame,rdata,0,
 239                                                 &s2,cmnt,len,STR_ASCII);
 240                                         if (!s1 || !s2) {
 241                                                 TALLOC_FREE(frame);
 242                                                 continue;
 243                                         }
 244
 245                                         fn(s1, type, s2, state);
 246
 247                                         TALLOC_FREE(frame);
 248                                 }
 249                         } else {
 250                                 DEBUG(4,("NetShareEnum res=%d\n", res));
 251                         }
 252                 } else {
 253                         DEBUG(4,("NetShareEnum failed\n"));
 254                 }
 255
 256         SAFE_FREE(rparam);
 257         SAFE_FREE(rdata);
 258
 259         return count;
 260 }
 261
 262 /****************************************************************************
 263  Call a NetServerEnum for the specified workgroup and servertype mask.  This
 264  function then calls the specified callback function for each name returned.
 265
 266  The callback function takes 4 arguments: the machine name, the server type,
 267  the comment and a state pointer.
 268 ****************************************************************************/
 269
 270 bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
 271                        void (*fn)(const char *, uint32, const char *, void *),
 272                        void *state)
 273 {
 274         char *rparam = NULL;
 275         char *rdata = NULL;
 276         char *rdata_end = NULL;
 277         unsigned int rdrcnt,rprcnt;
 278         char *p;
 279         char param[1024];
 280         int uLevel = 1;
 281         size_t len;
 282         uint32 func = RAP_NetServerEnum2;
 283         char *last_entry = NULL;
 284         int total_cnt = 0;
 285         int return_cnt = 0;
 286         int res;
 287
 288         errno = 0; /* reset */
 289
 290         /*
 291          * This may take more than one transaction, so we should loop until
 292          * we no longer get a more data to process or we have all of the
 293          * items.
 294          */
 295         do {
 296                 /* send a SMBtrans command with api NetServerEnum */
 297                 p = param;
 298                 SIVAL(p,0,func); /* api number */
 299                 p += 2;
 300
 301                 if (func == RAP_NetServerEnum3) {
 302                         strlcpy(p,"WrLehDzz", sizeof(param)-PTR_DIFF(p,param));
 303                 } else {
 304                         strlcpy(p,"WrLehDz", sizeof(param)-PTR_DIFF(p,param));
 305                 }
 306
 307                 p = skip_string(param, sizeof(param), p);
 308                 strlcpy(p,"B16BBDz", sizeof(param)-PTR_DIFF(p,param));
 309
 310                 p = skip_string(param, sizeof(param), p);
 311                 SSVAL(p,0,uLevel);
 312                 SSVAL(p,2,CLI_BUFFER_SIZE);
 313                 p += 4;
 314                 SIVAL(p,0,stype);
 315                 p += 4;
 316
 317                 /* If we have more data, tell the server where
 318                  * to continue from.
 319                  */
 320                 len = push_ascii(p,
 321                                 workgroup,
 322                                 sizeof(param) - PTR_DIFF(p,param) - 1,
 323                                 STR_TERMINATE|STR_UPPER);
 324
 325                 if (len == (size_t)-1) {
 326                         SAFE_FREE(last_entry);
 327                         return false;
 328                 }
 329                 p += len;
 330
 331                 if (func == RAP_NetServerEnum3) {
 332                         len = push_ascii(p,
 333                                         last_entry ? last_entry : "",
 334                                         sizeof(param) - PTR_DIFF(p,param) - 1,
 335                                         STR_TERMINATE);
 336
 337                         if (len == (size_t)-1) {
 338                                 SAFE_FREE(last_entry);
 339                                 return false;
 340                         }
 341                         p += len;
 342                 }
 343
 344                 /* Next time through we need to use the continue api */
 345                 func = RAP_NetServerEnum3;
 346
 347                 if (!cli_api(cli,
 348                         param, PTR_DIFF(p,param), 8, /* params, length, max */
 349                         NULL, 0, CLI_BUFFER_SIZE, /* data, length, max */
 350                             &rparam, &rprcnt, /* return params, return size */
 351                             &rdata, &rdrcnt)) { /* return data, return size */
 352
 353                         /* break out of the loop on error */
 354                         res = -1;
 355                         break;
 356                 }
 357
 358                 rdata_end = rdata + rdrcnt;
 359                 res = rparam ? SVAL(rparam,0) : -1;
 360
 361                 if (res == 0 || res == ERRmoredata ||
 362                     (res != -1 && cli_errno(cli) == 0)) {
 363                         char *sname = NULL;
 364                         int i, count;
 365                         int converter=SVAL(rparam,2);
 366
 367                         /* Get the number of items returned in this buffer */
 368                         count = SVAL(rparam, 4);
 369
 370                         /* The next field contains the number of items left,
 371                          * including those returned in this buffer. So the
 372                          * first time through this should contain all of the
 373                          * entries.
 374                          */
 375                         if (total_cnt == 0) {
 376                                 total_cnt = SVAL(rparam, 6);
 377                         }
 378
 379                         /* Keep track of how many we have read */
 380                         return_cnt += count;
 381                         p = rdata;
 382
 383                         /* The last name in the previous NetServerEnum reply is
 384                          * sent back to server in the NetServerEnum3 request
 385                          * (last_entry). The next reply should repeat this entry
 386                          * as the first element. We have no proof that this is
 387                          * always true, but from traces that seems to be the
 388                          * behavior from Window Servers. So first lets do a lot
 389                          * of checking, just being paranoid. If the string
 390                          * matches then we already saw this entry so skip it.
 391                          *
 392                          * NOTE: sv1_name field must be null terminated and has
 393                          * a max size of 16 (NetBIOS Name).
 394                          */
 395                         if (last_entry && count && p &&
 396                                 (strncmp(last_entry, p, 16) == 0)) {
 397                             count -= 1; /* Skip this entry */
 398                             return_cnt = -1; /* Not part of total, so don't count. */
 399                             p = rdata + 26; /* Skip the whole record */
 400                         }
 401
 402                         for (i = 0; i < count; i++, p += 26) {
 403                                 int comment_offset;
 404                                 const char *cmnt;
 405                                 const char *p1;
 406                                 char *s1, *s2;
 407                                 TALLOC_CTX *frame = talloc_stackframe();
 408                                 uint32_t entry_stype;
 409
 410                                 if (p + 26 > rdata_end) {
 411                                         TALLOC_FREE(frame);
 412                                         break;
 413                                 }
 414
 415                                 sname = p;
 416                                 comment_offset = (IVAL(p,22) & 0xFFFF)-converter;
 417                                 cmnt = comment_offset?(rdata+comment_offset):"";
 418
 419                                 if (comment_offset < 0 || comment_offset >= (int)rdrcnt) {
 420                                         TALLOC_FREE(frame);
 421                                         continue;
 422                                 }
 423
 424                                 /* Work out the comment length. */
 425                                 for (p1 = cmnt, len = 0; *p1 &&
 426                                                 p1 < rdata_end; len++)
 427                                         p1++;
 428                                 if (!*p1) {
 429                                         len++;
 430                                 }
 431
 432                                 entry_stype = IVAL(p,18) & ~SV_TYPE_LOCAL_LIST_ONLY;
 433
 434                                 pull_string_talloc(frame,rdata,0,
 435                                         &s1,sname,16,STR_ASCII);
 436                                 pull_string_talloc(frame,rdata,0,
 437                                         &s2,cmnt,len,STR_ASCII);
 438
 439                                 if (!s1 || !s2) {
 440                                         TALLOC_FREE(frame);
 441                                         continue;
 442                                 }
 443
 444                                 fn(s1, entry_stype, s2, state);
 445                                 TALLOC_FREE(frame);
 446                         }
 447
 448                         /* We are done with the old last entry, so now we can free it */
 449                         if (last_entry) {
 450                                 SAFE_FREE(last_entry); /* This will set it to null */
 451                         }
 452
 453                         /* We always make a copy of  the last entry if we have one */
 454                         if (sname) {
 455                                 last_entry = smb_xstrdup(sname);
 456                         }
 457
 458                         /* If we have more data, but no last entry then error out */
 459                         if (!last_entry && (res == ERRmoredata)) {
 460                                 errno = EINVAL;
 461                                 res = 0;
 462                         }
 463
 464                 }
 465
 466                 SAFE_FREE(rparam);
 467                 SAFE_FREE(rdata);
 468         } while ((res == ERRmoredata) && (total_cnt > return_cnt));
 469
 470         SAFE_FREE(rparam);
 471         SAFE_FREE(rdata);
 472         SAFE_FREE(last_entry);
 473
 474         if (res == -1) {
 475                 errno = cli_errno(cli);
 476         } else {
 477                 if (!return_cnt) {
 478                         /* this is a very special case, when the domain master for the
 479                            work group isn't part of the work group itself, there is something
 480                            wild going on */
 481                         errno = ENOENT;
 482                 }
 483             }
 484
 485         return(return_cnt > 0);
 486 }
 487
 488 /****************************************************************************
 489  Send a SamOEMChangePassword command.
 490 ****************************************************************************/
 491
 492 bool cli_oem_change_password(struct cli_state *cli, const char *user, const char *new_password,
 493                              const char *old_password)
 494 {
 495         char param[1024];
 496         unsigned char data[532];
 497         char *p = param;
 498         unsigned char old_pw_hash[16];
 499         unsigned char new_pw_hash[16];
 500         unsigned int data_len;
 501         unsigned int param_len = 0;
 502         char *rparam = NULL;
 503         char *rdata = NULL;
 504         unsigned int rprcnt, rdrcnt;
 505
 506         if (strlen(user) >= sizeof(fstring)-1) {
 507                 DEBUG(0,("cli_oem_change_password: user name %s is too long.\n", user));
 508                 return False;
 509         }
 510
 511         SSVAL(p,0,214); /* SamOEMChangePassword command. */
 512         p += 2;
 513         strlcpy(p, "zsT", sizeof(param)-PTR_DIFF(p,param));
 514         p = skip_string(param,sizeof(param),p);
 515         strlcpy(p, "B516B16", sizeof(param)-PTR_DIFF(p,param));
 516         p = skip_string(param,sizeof(param),p);
 517         strlcpy(p,user, sizeof(param)-PTR_DIFF(p,param));
 518         p = skip_string(param,sizeof(param),p);
 519         SSVAL(p,0,532);
 520         p += 2;
 521
 522         param_len = PTR_DIFF(p,param);
 523
 524         /*
 525          * Get the Lanman hash of the old password, we
 526          * use this as the key to make_oem_passwd_hash().
 527          */
 528         E_deshash(old_password, old_pw_hash);
 529
 530         encode_pw_buffer(data, new_password, STR_ASCII);
 531
 532 #ifdef DEBUG_PASSWORD
 533         DEBUG(100,("make_oem_passwd_hash\n"));
 534         dump_data(100, data, 516);
 535 #endif
 536         arcfour_crypt( (unsigned char *)data, (unsigned char *)old_pw_hash, 516);
 537
 538         /*
 539          * Now place the old password hash in the data.
 540          */
 541         E_deshash(new_password, new_pw_hash);
 542
 543         E_old_pw_hash( new_pw_hash, old_pw_hash, (uchar *)&data[516]);
 544
 545         data_len = 532;
 546
 547         if (!cli_api(cli,
 548                      param, param_len, 4,               /* param, length, max */
 549                      (char *)data, data_len, 0,         /* data, length, max */
 550                      &rparam, &rprcnt,
 551                      &rdata, &rdrcnt)) {
 552                 DEBUG(0,("cli_oem_change_password: Failed to send password change for user %s\n",
 553                         user ));
 554                 return False;
 555         }
 556
 557         if (rparam) {
 558                 cli->rap_error = SVAL(rparam,0);
 559         }
 560
 561         SAFE_FREE(rparam);
 562         SAFE_FREE(rdata);
 563
 564         return (cli->rap_error == 0);
 565 }
 566
 567 /****************************************************************************
 568  Send a qpathinfo call.
 569 ****************************************************************************/
 570
 571 struct cli_qpathinfo1_state {
 572         struct cli_state *cli;
 573         uint32_t num_data;
 574         uint8_t *data;
 575 };
 576
 577 static void cli_qpathinfo1_done(struct tevent_req *subreq);
 578
 579 struct tevent_req *cli_qpathinfo1_send(TALLOC_CTX *mem_ctx,
 580                                        struct event_context *ev,
 581                                        struct cli_state *cli,
 582                                        const char *fname)
 583 {
 584         struct tevent_req *req = NULL, *subreq = NULL;
 585         struct cli_qpathinfo1_state *state = NULL;
 586
 587         req = tevent_req_create(mem_ctx, &state, struct cli_qpathinfo1_state);
 588         if (req == NULL) {
 589                 return NULL;
 590         }
 591         state->cli = cli;
 592         subreq = cli_qpathinfo_send(state, ev, cli, fname, SMB_INFO_STANDARD,
 593                                     22, cli->max_xmit);
 594         if (tevent_req_nomem(subreq, req)) {
 595                 return tevent_req_post(req, ev);
 596         }
 597         tevent_req_set_callback(subreq, cli_qpathinfo1_done, req);
 598         return req;
 599 }
 600
 601 static void cli_qpathinfo1_done(struct tevent_req *subreq)
 602 {
 603         struct tevent_req *req = tevent_req_callback_data(
 604                 subreq, struct tevent_req);
 605         struct cli_qpathinfo1_state *state = tevent_req_data(
 606                 req, struct cli_qpathinfo1_state);
 607         NTSTATUS status;
 608
 609         status = cli_qpathinfo_recv(subreq, state, &state->data,
 610                                     &state->num_data);
 611         TALLOC_FREE(subreq);
 612         if (!NT_STATUS_IS_OK(status)) {
 613                 tevent_req_nterror(req, status);
 614                 return;
 615         }
 616         tevent_req_done(req);
 617 }
 618
 619 NTSTATUS cli_qpathinfo1_recv(struct tevent_req *req,
 620                              time_t *change_time,
 621                              time_t *access_time,
 622                              time_t *write_time,
 623                              SMB_OFF_T *size,
 624                              uint16 *mode)
 625 {
 626         struct cli_qpathinfo1_state *state = tevent_req_data(
 627                 req, struct cli_qpathinfo1_state);
 628         NTSTATUS status;
 629
 630         time_t (*date_fn)(const void *buf, int serverzone);
 631
 632         if (tevent_req_is_nterror(req, &status)) {
 633                 return status;
 634         }
 635
 636         if (state->cli->win95) {
 637                 date_fn = make_unix_date;
 638         } else {
 639                 date_fn = make_unix_date2;
 640         }
 641
 642         if (change_time) {
 643                 *change_time = date_fn(state->data+0, state->cli->serverzone);
 644         }
 645         if (access_time) {
 646                 *access_time = date_fn(state->data+4, state->cli->serverzone);
 647         }
 648         if (write_time) {
 649                 *write_time = date_fn(state->data+8, state->cli->serverzone);
 650         }
 651         if (size) {
 652                 *size = IVAL(state->data, 12);
 653         }
 654         if (mode) {
 655                 *mode = SVAL(state->data, l1_attrFile);
 656         }
 657         return NT_STATUS_OK;
 658 }
 659
 660 NTSTATUS cli_qpathinfo1(struct cli_state *cli,
 661                         const char *fname,
 662                         time_t *change_time,
 663                         time_t *access_time,
 664                         time_t *write_time,
 665                         SMB_OFF_T *size,
 666                         uint16 *mode)
 667 {
 668         TALLOC_CTX *frame = talloc_stackframe();
 669         struct event_context *ev;
 670         struct tevent_req *req;
 671         NTSTATUS status = NT_STATUS_NO_MEMORY;
 672
 673         if (cli_has_async_calls(cli)) {
 674                 /*
 675                  * Can't use sync call while an async call is in flight
 676                  */
 677                 status = NT_STATUS_INVALID_PARAMETER;
 678                 goto fail;
 679         }
 680         ev = event_context_init(frame);
 681         if (ev == NULL) {
 682                 goto fail;
 683         }
 684         req = cli_qpathinfo1_send(frame, ev, cli, fname);
 685         if (req == NULL) {
 686                 goto fail;
 687         }
 688         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 689                 goto fail;
 690         }
 691         status = cli_qpathinfo1_recv(req, change_time, access_time,
 692                                      write_time, size, mode);
 693  fail:
 694         TALLOC_FREE(frame);
 695         return status;
 696 }
 697
 698 /****************************************************************************
 699  Send a setpathinfo call.
 700 ****************************************************************************/
 701
 702 NTSTATUS cli_setpathinfo_basic(struct cli_state *cli, const char *fname,
 703                                time_t create_time,
 704                                time_t access_time,
 705                                time_t write_time,
 706                                time_t change_time,
 707                                uint16 mode)
 708 {
 709         unsigned int data_len = 0;
 710         char data[40];
 711         char *p;
 712
 713         p = data;
 714
 715         /*
 716          * Add the create, last access, modification, and status change times
 717          */
 718         put_long_date(p, create_time);
 719         p += 8;
 720
 721         put_long_date(p, access_time);
 722         p += 8;
 723
 724         put_long_date(p, write_time);
 725         p += 8;
 726
 727         put_long_date(p, change_time);
 728         p += 8;
 729
 730         /* Add attributes */
 731         SIVAL(p, 0, mode);
 732         p += 4;
 733
 734         /* Add padding */
 735         SIVAL(p, 0, 0);
 736         p += 4;
 737
 738         data_len = PTR_DIFF(p, data);
 739
 740         return cli_setpathinfo(cli, SMB_FILE_BASIC_INFORMATION, fname,
 741                                (uint8_t *)data, data_len);
 742 }
 743
 744 /****************************************************************************
 745  Send a qpathinfo call with the SMB_QUERY_FILE_ALL_INFO info level.
 746 ****************************************************************************/
 747
 748 struct cli_qpathinfo2_state {
 749         uint32_t num_data;
 750         uint8_t *data;
 751 };
 752
 753 static void cli_qpathinfo2_done(struct tevent_req *subreq);
 754
 755 struct tevent_req *cli_qpathinfo2_send(TALLOC_CTX *mem_ctx,
 756                                        struct event_context *ev,
 757                                        struct cli_state *cli,
 758                                        const char *fname)
 759 {
 760         struct tevent_req *req = NULL, *subreq = NULL;
 761         struct cli_qpathinfo2_state *state = NULL;
 762
 763         req = tevent_req_create(mem_ctx, &state, struct cli_qpathinfo2_state);
 764         if (req == NULL) {
 765                 return NULL;
 766         }
 767         subreq = cli_qpathinfo_send(state, ev, cli, fname,
 768                                     SMB_QUERY_FILE_ALL_INFO,
 769                                     68, cli->max_xmit);
 770         if (tevent_req_nomem(subreq, req)) {
 771                 return tevent_req_post(req, ev);
 772         }
 773         tevent_req_set_callback(subreq, cli_qpathinfo2_done, req);
 774         return req;
 775 }
 776
 777 static void cli_qpathinfo2_done(struct tevent_req *subreq)
 778 {
 779         struct tevent_req *req = tevent_req_callback_data(
 780                 subreq, struct tevent_req);
 781         struct cli_qpathinfo2_state *state = tevent_req_data(
 782                 req, struct cli_qpathinfo2_state);
 783         NTSTATUS status;
 784
 785         status = cli_qpathinfo_recv(subreq, state, &state->data,
 786                                     &state->num_data);
 787         TALLOC_FREE(subreq);
 788         if (!NT_STATUS_IS_OK(status)) {
 789                 tevent_req_nterror(req, status);
 790                 return;
 791         }
 792         tevent_req_done(req);
 793 }
 794
 795 NTSTATUS cli_qpathinfo2_recv(struct tevent_req *req,
 796                              struct timespec *create_time,
 797                              struct timespec *access_time,
 798                              struct timespec *write_time,
 799                              struct timespec *change_time,
 800                              SMB_OFF_T *size, uint16 *mode,
 801                              SMB_INO_T *ino)
 802 {
 803         struct cli_qpathinfo2_state *state = tevent_req_data(
 804                 req, struct cli_qpathinfo2_state);
 805         NTSTATUS status;
 806
 807         if (tevent_req_is_nterror(req, &status)) {
 808                 return status;
 809         }
 810
 811         if (create_time) {
 812                 *create_time = interpret_long_date((char *)state->data+0);
 813         }
 814         if (access_time) {
 815                 *access_time = interpret_long_date((char *)state->data+8);
 816         }
 817         if (write_time) {
 818                 *write_time = interpret_long_date((char *)state->data+16);
 819         }
 820         if (change_time) {
 821                 *change_time = interpret_long_date((char *)state->data+24);
 822         }
 823         if (mode) {
 824                 *mode = SVAL(state->data, 32);
 825         }
 826         if (size) {
 827                 *size = IVAL2_TO_SMB_BIG_UINT(state->data,48);
 828         }
 829         if (ino) {
 830                 *ino = IVAL(state->data, 64);
 831         }
 832         return NT_STATUS_OK;
 833 }
 834
 835 NTSTATUS cli_qpathinfo2(struct cli_state *cli, const char *fname,
 836                         struct timespec *create_time,
 837                         struct timespec *access_time,
 838                         struct timespec *write_time,
 839                         struct timespec *change_time,
 840                         SMB_OFF_T *size, uint16 *mode,
 841                         SMB_INO_T *ino)
 842 {
 843         TALLOC_CTX *frame = talloc_stackframe();
 844         struct event_context *ev;
 845         struct tevent_req *req;
 846         NTSTATUS status = NT_STATUS_NO_MEMORY;
 847
 848         if (cli_has_async_calls(cli)) {
 849                 /*
 850                  * Can't use sync call while an async call is in flight
 851                  */
 852                 status = NT_STATUS_INVALID_PARAMETER;
 853                 goto fail;
 854         }
 855         ev = event_context_init(frame);
 856         if (ev == NULL) {
 857                 goto fail;
 858         }
 859         req = cli_qpathinfo2_send(frame, ev, cli, fname);
 860         if (req == NULL) {
 861                 goto fail;
 862         }
 863         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 864                 goto fail;
 865         }
 866         status = cli_qpathinfo2_recv(req, create_time, access_time,
 867                                      write_time, change_time, size, mode, ino);
 868  fail:
 869         TALLOC_FREE(frame);
 870         return status;
 871 }
 872
 873 /****************************************************************************
 874  Get the stream info
 875 ****************************************************************************/
 876
 877 static bool parse_streams_blob(TALLOC_CTX *mem_ctx, const uint8_t *data,
 878                                size_t data_len,
 879                                unsigned int *pnum_streams,
 880                                struct stream_struct **pstreams);
 881
 882 struct cli_qpathinfo_streams_state {
 883         uint32_t num_data;
 884         uint8_t *data;
 885 };
 886
 887 static void cli_qpathinfo_streams_done(struct tevent_req *subreq);
 888
 889 struct tevent_req *cli_qpathinfo_streams_send(TALLOC_CTX *mem_ctx,
 890                                               struct tevent_context *ev,
 891                                               struct cli_state *cli,
 892                                               const char *fname)
 893 {
 894         struct tevent_req *req = NULL, *subreq = NULL;
 895         struct cli_qpathinfo_streams_state *state = NULL;
 896
 897         req = tevent_req_create(mem_ctx, &state,
 898                                 struct cli_qpathinfo_streams_state);
 899         if (req == NULL) {
 900                 return NULL;
 901         }
 902         subreq = cli_qpathinfo_send(state, ev, cli, fname,
 903                                     SMB_FILE_STREAM_INFORMATION,
 904                                     0, cli->max_xmit);
 905         if (tevent_req_nomem(subreq, req)) {
 906                 return tevent_req_post(req, ev);
 907         }
 908         tevent_req_set_callback(subreq, cli_qpathinfo_streams_done, req);
 909         return req;
 910 }
 911
 912 static void cli_qpathinfo_streams_done(struct tevent_req *subreq)
 913 {
 914         struct tevent_req *req = tevent_req_callback_data(
 915                 subreq, struct tevent_req);
 916         struct cli_qpathinfo_streams_state *state = tevent_req_data(
 917                 req, struct cli_qpathinfo_streams_state);
 918         NTSTATUS status;
 919
 920         status = cli_qpathinfo_recv(subreq, state, &state->data,
 921                                     &state->num_data);
 922         TALLOC_FREE(subreq);
 923         if (!NT_STATUS_IS_OK(status)) {
 924                 tevent_req_nterror(req, status);
 925                 return;
 926         }
 927         tevent_req_done(req);
 928 }
 929
 930 NTSTATUS cli_qpathinfo_streams_recv(struct tevent_req *req,
 931                                     TALLOC_CTX *mem_ctx,
 932                                     unsigned int *pnum_streams,
 933                                     struct stream_struct **pstreams)
 934 {
 935         struct cli_qpathinfo_streams_state *state = tevent_req_data(
 936                 req, struct cli_qpathinfo_streams_state);
 937         NTSTATUS status;
 938
 939         if (tevent_req_is_nterror(req, &status)) {
 940                 return status;
 941         }
 942         if (!parse_streams_blob(mem_ctx, state->data, state->num_data,
 943                                 pnum_streams, pstreams)) {
 944                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 945         }
 946         return NT_STATUS_OK;
 947 }
 948
 949 NTSTATUS cli_qpathinfo_streams(struct cli_state *cli, const char *fname,
 950                                TALLOC_CTX *mem_ctx,
 951                                unsigned int *pnum_streams,
 952                                struct stream_struct **pstreams)
 953 {
 954         TALLOC_CTX *frame = talloc_stackframe();
 955         struct event_context *ev;
 956         struct tevent_req *req;
 957         NTSTATUS status = NT_STATUS_NO_MEMORY;
 958
 959         if (cli_has_async_calls(cli)) {
 960                 /*
 961                  * Can't use sync call while an async call is in flight
 962                  */
 963                 status = NT_STATUS_INVALID_PARAMETER;
 964                 goto fail;
 965         }
 966         ev = event_context_init(frame);
 967         if (ev == NULL) {
 968                 goto fail;
 969         }
 970         req = cli_qpathinfo_streams_send(frame, ev, cli, fname);
 971         if (req == NULL) {
 972                 goto fail;
 973         }
 974         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 975                 goto fail;
 976         }
 977         status = cli_qpathinfo_streams_recv(req, mem_ctx, pnum_streams,
 978                                             pstreams);
 979  fail:
 980         TALLOC_FREE(frame);
 981         return status;
 982 }
 983
 984 static bool parse_streams_blob(TALLOC_CTX *mem_ctx, const uint8_t *rdata,
 985                                size_t data_len,
 986                                unsigned int *pnum_streams,
 987                                struct stream_struct **pstreams)
 988 {
 989         unsigned int num_streams;
 990         struct stream_struct *streams;
 991         unsigned int ofs;
 992
 993         num_streams = 0;
 994         streams = NULL;
 995         ofs = 0;
 996
 997         while ((data_len > ofs) && (data_len - ofs >= 24)) {
 998                 uint32_t nlen, len;
 999                 size_t size;
1000                 void *vstr;
1001                 struct stream_struct *tmp;
1002                 uint8_t *tmp_buf;
1003
1004                 tmp = talloc_realloc(mem_ctx, streams,
1005                                            struct stream_struct,
1006                                            num_streams+1);
1007
1008                 if (tmp == NULL) {
1009                         goto fail;
1010                 }
1011                 streams = tmp;
1012
1013                 nlen                      = IVAL(rdata, ofs + 0x04);
1014
1015                 streams[num_streams].size = IVAL_TO_SMB_OFF_T(
1016                         rdata, ofs + 0x08);
1017                 streams[num_streams].alloc_size = IVAL_TO_SMB_OFF_T(
1018                         rdata, ofs + 0x10);
1019
1020                 if (nlen > data_len - (ofs + 24)) {
1021                         goto fail;
1022                 }
1023
1024                 /*
1025                  * We need to null-terminate src, how do I do this with
1026                  * convert_string_talloc??
1027                  */
1028
1029                 tmp_buf = talloc_array(streams, uint8_t, nlen+2);
1030                 if (tmp_buf == NULL) {
1031                         goto fail;
1032                 }
1033
1034                 memcpy(tmp_buf, rdata+ofs+24, nlen);
1035                 tmp_buf[nlen] = 0;
1036                 tmp_buf[nlen+1] = 0;
1037
1038                 if (!convert_string_talloc(streams, CH_UTF16, CH_UNIX, tmp_buf,
1039                                            nlen+2, &vstr, &size))
1040                 {
1041                         TALLOC_FREE(tmp_buf);
1042                         goto fail;
1043                 }
1044
1045                 TALLOC_FREE(tmp_buf);
1046                 streams[num_streams].name = (char *)vstr;
1047                 num_streams++;
1048
1049                 len = IVAL(rdata, ofs);
1050                 if (len > data_len - ofs) {
1051                         goto fail;
1052                 }
1053                 if (len == 0) break;
1054                 ofs += len;
1055         }
1056
1057         *pnum_streams = num_streams;
1058         *pstreams = streams;
1059         return true;
1060
1061  fail:
1062         TALLOC_FREE(streams);
1063         return false;
1064 }
1065
1066 /****************************************************************************
1067  Send a qfileinfo QUERY_FILE_NAME_INFO call.
1068 ****************************************************************************/
1069
1070 NTSTATUS cli_qfilename(struct cli_state *cli, uint16_t fnum,
1071                        TALLOC_CTX *mem_ctx, char **_name)
1072 {
1073         uint16_t recv_flags2;
1074         uint8_t *rdata;
1075         uint32_t num_rdata;
1076         NTSTATUS status;
1077         char *name = NULL;
1078         uint32_t namelen;
1079
1080         status = cli_qfileinfo(talloc_tos(), cli, fnum,
1081                                SMB_QUERY_FILE_NAME_INFO,
1082                                4, cli->max_xmit, &recv_flags2,
1083                                &rdata, &num_rdata);
1084         if (!NT_STATUS_IS_OK(status)) {
1085                 return status;
1086         }
1087
1088         namelen = IVAL(rdata, 0);
1089         if (namelen > (num_rdata - 4)) {
1090                 TALLOC_FREE(rdata);
1091                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1092         }
1093
1094         clistr_pull_talloc(mem_ctx,
1095                            (const char *)rdata,
1096                            recv_flags2,
1097                            &name,
1098                            rdata + 4,
1099                            namelen,
1100                            STR_UNICODE);
1101         if (name == NULL) {
1102                 status = map_nt_error_from_unix(errno);
1103                 TALLOC_FREE(rdata);
1104                 return status;
1105         }
1106
1107         *_name = name;
1108         TALLOC_FREE(rdata);
1109         return NT_STATUS_OK;
1110 }
1111
1112 /****************************************************************************
1113  Send a qfileinfo call.
1114 ****************************************************************************/
1115
1116 NTSTATUS cli_qfileinfo_basic(struct cli_state *cli, uint16_t fnum,
1117                              uint16 *mode, SMB_OFF_T *size,
1118                              struct timespec *create_time,
1119                              struct timespec *access_time,
1120                              struct timespec *write_time,
1121                              struct timespec *change_time,
1122                              SMB_INO_T *ino)
1123 {
1124         uint8_t *rdata;
1125         uint32_t num_rdata;
1126         NTSTATUS status;
1127
1128         /* if its a win95 server then fail this - win95 totally screws it
1129            up */
1130         if (cli->win95) {
1131                 return NT_STATUS_NOT_SUPPORTED;
1132         }
1133
1134         status = cli_qfileinfo(talloc_tos(), cli, fnum,
1135                                SMB_QUERY_FILE_ALL_INFO,
1136                                68, MIN(cli->max_xmit, 0xffff),
1137                                NULL,
1138                                &rdata, &num_rdata);
1139         if (!NT_STATUS_IS_OK(status)) {
1140                 return status;
1141         }
1142
1143         if (create_time) {
1144                 *create_time = interpret_long_date((char *)rdata+0);
1145         }
1146         if (access_time) {
1147                 *access_time = interpret_long_date((char *)rdata+8);
1148         }
1149         if (write_time) {
1150                 *write_time = interpret_long_date((char *)rdata+16);
1151         }
1152         if (change_time) {
1153                 *change_time = interpret_long_date((char *)rdata+24);
1154         }
1155         if (mode) {
1156                 *mode = SVAL(rdata, 32);
1157         }
1158         if (size) {
1159                 *size = IVAL2_TO_SMB_BIG_UINT(rdata,48);
1160         }
1161         if (ino) {
1162                 *ino = IVAL(rdata, 64);
1163         }
1164
1165         TALLOC_FREE(rdata);
1166         return NT_STATUS_OK;
1167 }
1168
1169 /****************************************************************************
1170  Send a qpathinfo BASIC_INFO call.
1171 ****************************************************************************/
1172
1173 struct cli_qpathinfo_basic_state {
1174         uint32_t num_data;
1175         uint8_t *data;
1176 };
1177
1178 static void cli_qpathinfo_basic_done(struct tevent_req *subreq);
1179
1180 struct tevent_req *cli_qpathinfo_basic_send(TALLOC_CTX *mem_ctx,
1181                                             struct event_context *ev,
1182                                             struct cli_state *cli,
1183                                             const char *fname)
1184 {
1185         struct tevent_req *req = NULL, *subreq = NULL;
1186         struct cli_qpathinfo_basic_state *state = NULL;
1187
1188         req = tevent_req_create(mem_ctx, &state,
1189                                 struct cli_qpathinfo_basic_state);
1190         if (req == NULL) {
1191                 return NULL;
1192         }
1193         subreq = cli_qpathinfo_send(state, ev, cli, fname,
1194                                     SMB_QUERY_FILE_BASIC_INFO,
1195                                     36, cli->max_xmit);
1196         if (tevent_req_nomem(subreq, req)) {
1197                 return tevent_req_post(req, ev);
1198         }
1199         tevent_req_set_callback(subreq, cli_qpathinfo_basic_done, req);
1200         return req;
1201 }
1202
1203 static void cli_qpathinfo_basic_done(struct tevent_req *subreq)
1204 {
1205         struct tevent_req *req = tevent_req_callback_data(
1206                 subreq, struct tevent_req);
1207         struct cli_qpathinfo_basic_state *state = tevent_req_data(
1208                 req, struct cli_qpathinfo_basic_state);
1209         NTSTATUS status;
1210
1211         status = cli_qpathinfo_recv(subreq, state, &state->data,
1212                                     &state->num_data);
1213         TALLOC_FREE(subreq);
1214         if (!NT_STATUS_IS_OK(status)) {
1215                 tevent_req_nterror(req, status);
1216                 return;
1217         }
1218         tevent_req_done(req);
1219 }
1220
1221 NTSTATUS cli_qpathinfo_basic_recv(struct tevent_req *req,
1222                                   SMB_STRUCT_STAT *sbuf, uint32 *attributes)
1223 {
1224         struct cli_qpathinfo_basic_state *state = tevent_req_data(
1225                 req, struct cli_qpathinfo_basic_state);
1226         NTSTATUS status;
1227
1228         if (tevent_req_is_nterror(req, &status)) {
1229                 return status;
1230         }
1231
1232         sbuf->st_ex_atime = interpret_long_date((char *)state->data+8);
1233         sbuf->st_ex_mtime = interpret_long_date((char *)state->data+16);
1234         sbuf->st_ex_ctime = interpret_long_date((char *)state->data+24);
1235         *attributes = IVAL(state->data, 32);
1236         return NT_STATUS_OK;
1237 }
1238
1239 NTSTATUS cli_qpathinfo_basic(struct cli_state *cli, const char *name,
1240                              SMB_STRUCT_STAT *sbuf, uint32 *attributes)
1241 {
1242         TALLOC_CTX *frame = talloc_stackframe();
1243         struct event_context *ev;
1244         struct tevent_req *req;
1245         NTSTATUS status = NT_STATUS_NO_MEMORY;
1246
1247         if (cli_has_async_calls(cli)) {
1248                 /*
1249                  * Can't use sync call while an async call is in flight
1250                  */
1251                 status = NT_STATUS_INVALID_PARAMETER;
1252                 goto fail;
1253         }
1254         ev = event_context_init(frame);
1255         if (ev == NULL) {
1256                 goto fail;
1257         }
1258         req = cli_qpathinfo_basic_send(frame, ev, cli, name);
1259         if (req == NULL) {
1260                 goto fail;
1261         }
1262         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1263                 goto fail;
1264         }
1265         status = cli_qpathinfo_basic_recv(req, sbuf, attributes);
1266  fail:
1267         TALLOC_FREE(frame);
1268         return status;
1269 }
1270
1271 /****************************************************************************
1272  Send a qpathinfo SMB_QUERY_FILE_ALT_NAME_INFO call.
1273 ****************************************************************************/
1274
1275 NTSTATUS cli_qpathinfo_alt_name(struct cli_state *cli, const char *fname, fstring alt_name)
1276 {
1277         uint8_t *rdata;
1278         uint32_t num_rdata;
1279         unsigned int len;
1280         char *converted = NULL;
1281         size_t converted_size = 0;
1282         NTSTATUS status;
1283
1284         status = cli_qpathinfo(talloc_tos(), cli, fname,
1285                                SMB_QUERY_FILE_ALT_NAME_INFO,
1286                                4, cli->max_xmit, &rdata, &num_rdata);
1287         if (!NT_STATUS_IS_OK(status)) {
1288                 return status;
1289         }
1290
1291         len = IVAL(rdata, 0);
1292
1293         if (len > num_rdata - 4) {
1294                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1295         }
1296
1297         /* The returned data is a pushed string, not raw data. */
1298         if (!convert_string_talloc(talloc_tos(),
1299                                    cli_ucs2(cli) ? CH_UTF16LE : CH_DOS,
1300                                    CH_UNIX,
1301                                    rdata + 4,
1302                                    len,
1303                                    &converted,
1304                                    &converted_size)) {
1305                 return NT_STATUS_NO_MEMORY;
1306         }
1307         fstrcpy(alt_name, converted);
1308
1309         TALLOC_FREE(converted);
1310         TALLOC_FREE(rdata);
1311
1312         return NT_STATUS_OK;
1313 }