source3/libsmb/clireadwrite.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client file read/write routines
   4    Copyright (C) Andrew Tridgell 1994-1998
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libsmb/libsmb.h"
  22 #include "../lib/util/tevent_ntstatus.h"
  23 #include "async_smb.h"
  24 #include "trans2.h"
  25 #include "../libcli/smb/smbXcli_base.h"
  26
  27 /****************************************************************************
  28   Calculate the recommended read buffer size
  29 ****************************************************************************/
  30 static size_t cli_read_max_bufsize(struct cli_state *cli)
  31 {
  32         uint8_t wct = 12;
  33         uint32_t min_space;
  34         uint32_t data_offset;
  35         uint32_t useable_space = 0;
  36
  37         data_offset = HDR_VWV;
  38         data_offset += wct * sizeof(uint16_t);
  39         data_offset += sizeof(uint16_t); /* byte count */
  40         data_offset += 1; /* pad */
  41
  42         min_space = cli_state_available_size(cli, data_offset);
  43
  44         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_READ_CAP) {
  45                 useable_space = 0xFFFFFF - data_offset;
  46
  47                 if (smb1cli_conn_signing_is_active(cli->conn)) {
  48                         return min_space;
  49                 }
  50
  51                 if (smb1cli_conn_encryption_on(cli->conn)) {
  52                         return min_space;
  53                 }
  54
  55                 return useable_space;
  56         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_READX) {
  57                 /*
  58                  * Note: CAP_LARGE_READX also works with signing
  59                  */
  60                 useable_space = 0x1FFFF - data_offset;
  61
  62                 useable_space = MIN(useable_space, UINT16_MAX);
  63
  64                 return useable_space;
  65         }
  66
  67         return min_space;
  68 }
  69
  70 /****************************************************************************
  71   Calculate the recommended write buffer size
  72 ****************************************************************************/
  73 static size_t cli_write_max_bufsize(struct cli_state *cli,
  74                                     uint16_t write_mode,
  75                                     uint8_t wct)
  76 {
  77         uint32_t min_space;
  78         uint32_t data_offset;
  79         uint32_t useable_space = 0;
  80
  81         data_offset = HDR_VWV;
  82         data_offset += wct * sizeof(uint16_t);
  83         data_offset += sizeof(uint16_t); /* byte count */
  84         data_offset += 1; /* pad */
  85
  86         min_space = cli_state_available_size(cli, data_offset);
  87
  88         if (cli->server_posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) {
  89                 useable_space = 0xFFFFFF - data_offset;
  90         } else if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_WRITEX) {
  91                 useable_space = 0x1FFFF - data_offset;
  92         } else {
  93                 return min_space;
  94         }
  95
  96         if (write_mode != 0) {
  97                 return min_space;
  98         }
  99
 100         if (smb1cli_conn_signing_is_active(cli->conn)) {
 101                 return min_space;
 102         }
 103
 104         if (smb1cli_conn_encryption_on(cli->conn)) {
 105                 return min_space;
 106         }
 107
 108         if (strequal(cli->dev, "LPT1:")) {
 109                 return min_space;
 110         }
 111
 112         return useable_space;
 113 }
 114
 115 struct cli_read_andx_state {
 116         size_t size;
 117         uint16_t vwv[12];
 118         NTSTATUS status;
 119         size_t received;
 120         uint8_t *buf;
 121 };
 122
 123 static void cli_read_andx_done(struct tevent_req *subreq);
 124
 125 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
 126                                         struct tevent_context *ev,
 127                                         struct cli_state *cli, uint16_t fnum,
 128                                         off_t offset, size_t size,
 129                                         struct tevent_req **psmbreq)
 130 {
 131         struct tevent_req *req, *subreq;
 132         struct cli_read_andx_state *state;
 133         uint8_t wct = 10;
 134
 135         req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
 136         if (req == NULL) {
 137                 return NULL;
 138         }
 139         state->size = size;
 140
 141         SCVAL(state->vwv + 0, 0, 0xFF);
 142         SCVAL(state->vwv + 0, 1, 0);
 143         SSVAL(state->vwv + 1, 0, 0);
 144         SSVAL(state->vwv + 2, 0, fnum);
 145         SIVAL(state->vwv + 3, 0, offset);
 146         SSVAL(state->vwv + 5, 0, size);
 147         SSVAL(state->vwv + 6, 0, size);
 148         SSVAL(state->vwv + 7, 0, (size >> 16));
 149         SSVAL(state->vwv + 8, 0, 0);
 150         SSVAL(state->vwv + 9, 0, 0);
 151
 152         if (smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) {
 153                 SIVAL(state->vwv + 10, 0,
 154                       (((uint64_t)offset)>>32) & 0xffffffff);
 155                 wct = 12;
 156         } else {
 157                 if ((((uint64_t)offset) & 0xffffffff00000000LL) != 0) {
 158                         DEBUG(10, ("cli_read_andx_send got large offset where "
 159                                    "the server does not support it\n"));
 160                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 161                         return tevent_req_post(req, ev);
 162                 }
 163         }
 164
 165         subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, wct,
 166                                     state->vwv, 0, NULL);
 167         if (subreq == NULL) {
 168                 TALLOC_FREE(req);
 169                 return NULL;
 170         }
 171         tevent_req_set_callback(subreq, cli_read_andx_done, req);
 172         *psmbreq = subreq;
 173         return req;
 174 }
 175
 176 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
 177                                       struct tevent_context *ev,
 178                                       struct cli_state *cli, uint16_t fnum,
 179                                       off_t offset, size_t size)
 180 {
 181         struct tevent_req *req, *subreq;
 182         NTSTATUS status;
 183
 184         req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
 185                                    &subreq);
 186         if (req == NULL) {
 187                 return NULL;
 188         }
 189
 190         status = smb1cli_req_chain_submit(&subreq, 1);
 191         if (tevent_req_nterror(req, status)) {
 192                 return tevent_req_post(req, ev);
 193         }
 194         return req;
 195 }
 196
 197 static void cli_read_andx_done(struct tevent_req *subreq)
 198 {
 199         struct tevent_req *req = tevent_req_callback_data(
 200                 subreq, struct tevent_req);
 201         struct cli_read_andx_state *state = tevent_req_data(
 202                 req, struct cli_read_andx_state);
 203         uint8_t *inbuf;
 204         uint8_t wct;
 205         uint16_t *vwv;
 206         uint32_t num_bytes;
 207         uint8_t *bytes;
 208
 209         state->status = cli_smb_recv(subreq, state, &inbuf, 12, &wct, &vwv,
 210                                      &num_bytes, &bytes);
 211         TALLOC_FREE(subreq);
 212         if (NT_STATUS_IS_ERR(state->status)) {
 213                 tevent_req_nterror(req, state->status);
 214                 return;
 215         }
 216
 217         /* size is the number of bytes the server returned.
 218          * Might be zero. */
 219         state->received = SVAL(vwv + 5, 0);
 220         state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
 221
 222         if (state->received > state->size) {
 223                 DEBUG(5,("server returned more than we wanted!\n"));
 224                 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
 225                 return;
 226         }
 227
 228         /*
 229          * bcc field must be valid for small reads, for large reads the 16-bit
 230          * bcc field can't be correct.
 231          */
 232
 233         if ((state->received < 0xffff) && (state->received > num_bytes)) {
 234                 DEBUG(5, ("server announced more bytes than sent\n"));
 235                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 236                 return;
 237         }
 238
 239         state->buf = discard_const_p(uint8_t, smb_base(inbuf)) + SVAL(vwv+6, 0);
 240
 241         if (trans_oob(smb_len_tcp(inbuf), SVAL(vwv+6, 0), state->received)
 242             || ((state->received != 0) && (state->buf < bytes))) {
 243                 DEBUG(5, ("server returned invalid read&x data offset\n"));
 244                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 245                 return;
 246         }
 247         tevent_req_done(req);
 248 }
 249
 250 /*
 251  * Pull the data out of a finished async read_and_x request. rcvbuf is
 252  * talloced from the request, so better make sure that you copy it away before
 253  * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
 254  * talloc_move it!
 255  */
 256
 257 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
 258                             uint8_t **rcvbuf)
 259 {
 260         struct cli_read_andx_state *state = tevent_req_data(
 261                 req, struct cli_read_andx_state);
 262         NTSTATUS status;
 263
 264         if (tevent_req_is_nterror(req, &status)) {
 265                 return status;
 266         }
 267         *received = state->received;
 268         *rcvbuf = state->buf;
 269         return NT_STATUS_OK;
 270 }
 271
 272 struct cli_pull_chunk;
 273
 274 struct cli_pull_state {
 275         struct tevent_context *ev;
 276         struct cli_state *cli;
 277         uint16_t fnum;
 278         off_t start_offset;
 279         off_t size;
 280
 281         NTSTATUS (*sink)(char *buf, size_t n, void *priv);
 282         void *priv;
 283
 284         size_t chunk_size;
 285         off_t next_offset;
 286         off_t remaining;
 287
 288         /*
 289          * How many bytes did we push into "sink"?
 290          */
 291         off_t pushed;
 292
 293         /*
 294          * Outstanding requests
 295          *
 296          * The maximum is 256:
 297          * - which would be a window of 256 MByte
 298          *   for SMB2 with multi-credit
 299          *   or smb1 unix extentions.
 300          */
 301         uint16_t max_chunks;
 302         uint16_t num_chunks;
 303         uint16_t num_waiting;
 304         struct cli_pull_chunk *chunks;
 305 };
 306
 307 struct cli_pull_chunk {
 308         struct cli_pull_chunk *prev, *next;
 309         struct tevent_req *req;/* This is the main request! Not the subreq */
 310         struct tevent_req *subreq;
 311         off_t ofs;
 312         uint8_t *buf;
 313         size_t total_size;
 314         size_t tmp_size;
 315         bool done;
 316 };
 317
 318 static void cli_pull_setup_chunks(struct tevent_req *req);
 319 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk);
 320 static void cli_pull_chunk_done(struct tevent_req *subreq);
 321
 322 /*
 323  * Parallel read support.
 324  *
 325  * cli_pull sends as many read&x requests as the server would allow via
 326  * max_mux at a time. When replies flow back in, the data is written into
 327  * the callback function "sink" in the right order.
 328  */
 329
 330 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
 331                                  struct tevent_context *ev,
 332                                  struct cli_state *cli,
 333                                  uint16_t fnum, off_t start_offset,
 334                                  off_t size, size_t window_size,
 335                                  NTSTATUS (*sink)(char *buf, size_t n,
 336                                                   void *priv),
 337                                  void *priv)
 338 {
 339         struct tevent_req *req;
 340         struct cli_pull_state *state;
 341         size_t page_size = 1024;
 342         uint64_t tmp64;
 343
 344         req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
 345         if (req == NULL) {
 346                 return NULL;
 347         }
 348         state->cli = cli;
 349         state->ev = ev;
 350         state->fnum = fnum;
 351         state->start_offset = start_offset;
 352         state->size = size;
 353         state->sink = sink;
 354         state->priv = priv;
 355         state->next_offset = start_offset;
 356         state->remaining = size;
 357
 358         if (size == 0) {
 359                 tevent_req_done(req);
 360                 return tevent_req_post(req, ev);
 361         }
 362
 363         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 364                 state->chunk_size = smb2cli_conn_max_read_size(cli->conn);
 365         } else {
 366                 state->chunk_size = cli_read_max_bufsize(cli);
 367         }
 368         if (state->chunk_size > page_size) {
 369                 state->chunk_size &= ~(page_size - 1);
 370         }
 371
 372         if (window_size == 0) {
 373                 /*
 374                  * We use 16 MByte as default window size.
 375                  */
 376                 window_size = 16 * 1024 * 1024;
 377         }
 378
 379         tmp64 = window_size/state->chunk_size;
 380         if ((window_size % state->chunk_size) > 0) {
 381                 tmp64 += 1;
 382         }
 383         tmp64 = MAX(tmp64, 1);
 384         tmp64 = MIN(tmp64, 256);
 385         state->max_chunks = tmp64;
 386
 387         /*
 388          * We defer the callback because of the complex
 389          * substate/subfunction logic
 390          */
 391         tevent_req_defer_callback(req, ev);
 392
 393         cli_pull_setup_chunks(req);
 394         if (!tevent_req_is_in_progress(req)) {
 395                 return tevent_req_post(req, ev);
 396         }
 397
 398         return req;
 399 }
 400
 401 static void cli_pull_setup_chunks(struct tevent_req *req)
 402 {
 403         struct cli_pull_state *state =
 404                 tevent_req_data(req,
 405                 struct cli_pull_state);
 406         struct cli_pull_chunk *chunk, *next = NULL;
 407         size_t i;
 408
 409         for (chunk = state->chunks; chunk; chunk = next) {
 410                 /*
 411                  * Note that chunk might be removed from this call.
 412                  */
 413                 next = chunk->next;
 414                 cli_pull_chunk_ship(chunk);
 415                 if (!tevent_req_is_in_progress(req)) {
 416                         return;
 417                 }
 418         }
 419
 420         for (i = state->num_chunks; i < state->max_chunks; i++) {
 421
 422                 if (state->num_waiting > 0) {
 423                         return;
 424                 }
 425
 426                 if (state->remaining == 0) {
 427                         break;
 428                 }
 429
 430                 chunk = talloc_zero(state, struct cli_pull_chunk);
 431                 if (tevent_req_nomem(chunk, req)) {
 432                         return;
 433                 }
 434                 chunk->req = req;
 435                 chunk->ofs = state->next_offset;
 436                 chunk->total_size = MIN(state->remaining, state->chunk_size);
 437                 state->next_offset += chunk->total_size;
 438                 state->remaining -= chunk->total_size;
 439
 440                 DLIST_ADD_END(state->chunks, chunk, NULL);
 441                 state->num_chunks++;
 442                 state->num_waiting++;
 443
 444                 cli_pull_chunk_ship(chunk);
 445                 if (!tevent_req_is_in_progress(req)) {
 446                         return;
 447                 }
 448         }
 449
 450         if (state->remaining > 0) {
 451                 return;
 452         }
 453
 454         if (state->num_chunks > 0) {
 455                 return;
 456         }
 457
 458         tevent_req_done(req);
 459 }
 460
 461 static void cli_pull_chunk_ship(struct cli_pull_chunk *chunk)
 462 {
 463         struct tevent_req *req = chunk->req;
 464         struct cli_pull_state *state =
 465                 tevent_req_data(req,
 466                 struct cli_pull_state);
 467         bool ok;
 468         off_t ofs;
 469         size_t size;
 470
 471         if (chunk->done) {
 472                 NTSTATUS status;
 473
 474                 if (chunk != state->chunks) {
 475                         /*
 476                          * this chunk is not the
 477                          * first one in the list.
 478                          *
 479                          * which means we should not
 480                          * push it into the sink yet.
 481                          */
 482                         return;
 483                 }
 484
 485                 if (chunk->tmp_size == 0) {
 486                         /*
 487                          * we git a short read, we're done
 488                          */
 489                         tevent_req_done(req);
 490                         return;
 491                 }
 492
 493                 status = state->sink((char *)chunk->buf,
 494                                      chunk->tmp_size,
 495                                      state->priv);
 496                 if (tevent_req_nterror(req, status)) {
 497                         return;
 498                 }
 499                 state->pushed += chunk->tmp_size;
 500
 501                 if (chunk->tmp_size < chunk->total_size) {
 502                         /*
 503                          * we git a short read, we're done
 504                          */
 505                         tevent_req_done(req);
 506                         return;
 507                 }
 508
 509                 DLIST_REMOVE(state->chunks, chunk);
 510                 SMB_ASSERT(state->num_chunks > 0);
 511                 state->num_chunks--;
 512                 TALLOC_FREE(chunk);
 513
 514                 return;
 515         }
 516
 517         if (chunk->subreq != NULL) {
 518                 return;
 519         }
 520
 521         SMB_ASSERT(state->num_waiting > 0);
 522
 523         ofs = chunk->ofs + chunk->tmp_size;
 524         size = chunk->total_size - chunk->tmp_size;
 525
 526         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 527                 uint32_t max_size;
 528
 529                 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
 530                 if (!ok) {
 531                         return;
 532                 }
 533
 534                 /*
 535                  * downgrade depending on the available credits
 536                  */
 537                 size = MIN(max_size, size);
 538
 539                 chunk->subreq = cli_smb2_read_send(chunk,
 540                                                    state->ev,
 541                                                    state->cli,
 542                                                    state->fnum,
 543                                                    ofs,
 544                                                    size);
 545                 if (tevent_req_nomem(chunk->subreq, req)) {
 546                         return;
 547                 }
 548         } else {
 549                 ok = smb1cli_conn_req_possible(state->cli->conn);
 550                 if (!ok) {
 551                         return;
 552                 }
 553
 554                 chunk->subreq = cli_read_andx_send(chunk,
 555                                                    state->ev,
 556                                                    state->cli,
 557                                                    state->fnum,
 558                                                    ofs,
 559                                                    size);
 560                 if (tevent_req_nomem(chunk->subreq, req)) {
 561                         return;
 562                 }
 563         }
 564         tevent_req_set_callback(chunk->subreq,
 565                                 cli_pull_chunk_done,
 566                                 chunk);
 567
 568         state->num_waiting--;
 569         return;
 570 }
 571
 572 static void cli_pull_chunk_done(struct tevent_req *subreq)
 573 {
 574         struct cli_pull_chunk *chunk =
 575                 tevent_req_callback_data(subreq,
 576                 struct cli_pull_chunk);
 577         struct tevent_req *req = chunk->req;
 578         struct cli_pull_state *state =
 579                 tevent_req_data(req,
 580                 struct cli_pull_state);
 581         NTSTATUS status;
 582         size_t expected = chunk->total_size - chunk->tmp_size;
 583         ssize_t received;
 584         uint8_t *buf = NULL;
 585
 586         chunk->subreq = NULL;
 587
 588         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
 589                 status = cli_smb2_read_recv(subreq, &received, &buf);
 590         } else {
 591                 status = cli_read_andx_recv(subreq, &received, &buf);
 592         }
 593         if (NT_STATUS_EQUAL(status, NT_STATUS_END_OF_FILE)) {
 594                 received = 0;
 595                 status = NT_STATUS_OK;
 596         }
 597         if (tevent_req_nterror(req, status)) {
 598                 return;
 599         }
 600
 601         if (received > expected) {
 602                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 603                 return;
 604         }
 605
 606         if (received == 0) {
 607                 /*
 608                  * We got EOF we're done
 609                  */
 610                 chunk->done = true;
 611                 cli_pull_setup_chunks(req);
 612                 return;
 613         }
 614
 615         if (received == chunk->total_size) {
 616                 /*
 617                  * We got it in the first run.
 618                  *
 619                  * We don't call TALLOC_FREE(subreq)
 620                  * here and keep the returned buffer.
 621                  */
 622                 chunk->buf = buf;
 623         } else if (chunk->buf == NULL) {
 624                 chunk->buf = talloc_array(chunk, uint8_t, chunk->total_size);
 625                 if (tevent_req_nomem(chunk->buf, req)) {
 626                         return;
 627                 }
 628         }
 629
 630         if (received != chunk->total_size) {
 631                 uint8_t *p = chunk->buf + chunk->tmp_size;
 632                 memcpy(p, buf, received);
 633                 TALLOC_FREE(subreq);
 634         }
 635
 636         chunk->tmp_size += received;
 637
 638         if (chunk->tmp_size == chunk->total_size) {
 639                 chunk->done = true;
 640         } else {
 641                 state->num_waiting++;
 642         }
 643
 644         cli_pull_setup_chunks(req);
 645 }
 646
 647 NTSTATUS cli_pull_recv(struct tevent_req *req, off_t *received)
 648 {
 649         struct cli_pull_state *state = tevent_req_data(
 650                 req, struct cli_pull_state);
 651         NTSTATUS status;
 652
 653         if (tevent_req_is_nterror(req, &status)) {
 654                 tevent_req_received(req);
 655                 return status;
 656         }
 657         *received = state->pushed;
 658         tevent_req_received(req);
 659         return NT_STATUS_OK;
 660 }
 661
 662 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
 663                   off_t start_offset, off_t size, size_t window_size,
 664                   NTSTATUS (*sink)(char *buf, size_t n, void *priv),
 665                   void *priv, off_t *received)
 666 {
 667         TALLOC_CTX *frame = talloc_stackframe();
 668         struct tevent_context *ev;
 669         struct tevent_req *req;
 670         NTSTATUS status = NT_STATUS_OK;
 671
 672         if (smbXcli_conn_has_async_calls(cli->conn)) {
 673                 /*
 674                  * Can't use sync call while an async call is in flight
 675                  */
 676                 status = NT_STATUS_INVALID_PARAMETER;
 677                 goto fail;
 678         }
 679
 680         ev = samba_tevent_context_init(frame);
 681         if (ev == NULL) {
 682                 status = NT_STATUS_NO_MEMORY;
 683                 goto fail;
 684         }
 685
 686         req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
 687                             window_size, sink, priv);
 688         if (req == NULL) {
 689                 status = NT_STATUS_NO_MEMORY;
 690                 goto fail;
 691         }
 692
 693         if (!tevent_req_poll(req, ev)) {
 694                 status = map_nt_error_from_unix(errno);
 695                 goto fail;
 696         }
 697
 698         status = cli_pull_recv(req, received);
 699  fail:
 700         TALLOC_FREE(frame);
 701         return status;
 702 }
 703
 704 static NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
 705 {
 706         char **pbuf = (char **)priv;
 707         memcpy(*pbuf, buf, n);
 708         *pbuf += n;
 709         return NT_STATUS_OK;
 710 }
 711
 712 NTSTATUS cli_read(struct cli_state *cli, uint16_t fnum,
 713                  char *buf, off_t offset, size_t size,
 714                  size_t *nread)
 715 {
 716         NTSTATUS status;
 717         off_t ret;
 718
 719         status = cli_pull(cli, fnum, offset, size, size,
 720                           cli_read_sink, &buf, &ret);
 721         if (!NT_STATUS_IS_OK(status)) {
 722                 return status;
 723         }
 724
 725         if (nread) {
 726                 *nread = ret;
 727         }
 728
 729         return NT_STATUS_OK;
 730 }
 731
 732 /****************************************************************************
 733   write to a file using a SMBwrite and not bypassing 0 byte writes
 734 ****************************************************************************/
 735
 736 NTSTATUS cli_smbwrite(struct cli_state *cli, uint16_t fnum, char *buf,
 737                       off_t offset, size_t size1, size_t *ptotal)
 738 {
 739         uint8_t *bytes;
 740         ssize_t total = 0;
 741
 742         /*
 743          * 3 bytes prefix
 744          */
 745
 746         bytes = talloc_array(talloc_tos(), uint8_t, 3);
 747         if (bytes == NULL) {
 748                 return NT_STATUS_NO_MEMORY;
 749         }
 750         bytes[0] = 1;
 751
 752         do {
 753                 uint32_t usable_space = cli_state_available_size(cli, 48);
 754                 size_t size = MIN(size1, usable_space);
 755                 struct tevent_req *req;
 756                 uint16_t vwv[5];
 757                 uint16_t *ret_vwv;
 758                 NTSTATUS status;
 759
 760                 SSVAL(vwv+0, 0, fnum);
 761                 SSVAL(vwv+1, 0, size);
 762                 SIVAL(vwv+2, 0, offset);
 763                 SSVAL(vwv+4, 0, 0);
 764
 765                 bytes = talloc_realloc(talloc_tos(), bytes, uint8_t,
 766                                              size+3);
 767                 if (bytes == NULL) {
 768                         return NT_STATUS_NO_MEMORY;
 769                 }
 770                 SSVAL(bytes, 1, size);
 771                 memcpy(bytes + 3, buf + total, size);
 772
 773                 status = cli_smb(talloc_tos(), cli, SMBwrite, 0, 5, vwv,
 774                                  size+3, bytes, &req, 1, NULL, &ret_vwv,
 775                                  NULL, NULL);
 776                 if (!NT_STATUS_IS_OK(status)) {
 777                         TALLOC_FREE(bytes);
 778                         return status;
 779                 }
 780
 781                 size = SVAL(ret_vwv+0, 0);
 782                 TALLOC_FREE(req);
 783                 if (size == 0) {
 784                         break;
 785                 }
 786                 size1 -= size;
 787                 total += size;
 788                 offset += size;
 789
 790         } while (size1);
 791
 792         TALLOC_FREE(bytes);
 793
 794         if (ptotal != NULL) {
 795                 *ptotal = total;
 796         }
 797         return NT_STATUS_OK;
 798 }
 799
 800 /*
 801  * Send a write&x request
 802  */
 803
 804 struct cli_write_andx_state {
 805         size_t size;
 806         uint16_t vwv[14];
 807         size_t written;
 808         uint8_t pad;
 809         struct iovec iov[2];
 810 };
 811
 812 static void cli_write_andx_done(struct tevent_req *subreq);
 813
 814 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
 815                                          struct tevent_context *ev,
 816                                          struct cli_state *cli, uint16_t fnum,
 817                                          uint16_t mode, const uint8_t *buf,
 818                                          off_t offset, size_t size,
 819                                          struct tevent_req **reqs_before,
 820                                          int num_reqs_before,
 821                                          struct tevent_req **psmbreq)
 822 {
 823         struct tevent_req *req, *subreq;
 824         struct cli_write_andx_state *state;
 825         bool bigoffset = ((smb1cli_conn_capabilities(cli->conn) & CAP_LARGE_FILES) != 0);
 826         uint8_t wct = bigoffset ? 14 : 12;
 827         size_t max_write = cli_write_max_bufsize(cli, mode, wct);
 828         uint16_t *vwv;
 829
 830         req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
 831         if (req == NULL) {
 832                 return NULL;
 833         }
 834
 835         state->size = MIN(size, max_write);
 836
 837         vwv = state->vwv;
 838
 839         SCVAL(vwv+0, 0, 0xFF);
 840         SCVAL(vwv+0, 1, 0);
 841         SSVAL(vwv+1, 0, 0);
 842         SSVAL(vwv+2, 0, fnum);
 843         SIVAL(vwv+3, 0, offset);
 844         SIVAL(vwv+5, 0, 0);
 845         SSVAL(vwv+7, 0, mode);
 846         SSVAL(vwv+8, 0, 0);
 847         SSVAL(vwv+9, 0, (state->size>>16));
 848         SSVAL(vwv+10, 0, state->size);
 849
 850         SSVAL(vwv+11, 0,
 851               smb1cli_req_wct_ofs(reqs_before, num_reqs_before)
 852               + 1               /* the wct field */
 853               + wct * 2         /* vwv */
 854               + 2               /* num_bytes field */
 855               + 1               /* pad */);
 856
 857         if (bigoffset) {
 858                 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
 859         }
 860
 861         state->pad = 0;
 862         state->iov[0].iov_base = (void *)&state->pad;
 863         state->iov[0].iov_len = 1;
 864         state->iov[1].iov_base = discard_const_p(void, buf);
 865         state->iov[1].iov_len = state->size;
 866
 867         subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
 868                                     2, state->iov);
 869         if (tevent_req_nomem(subreq, req)) {
 870                 return tevent_req_post(req, ev);
 871         }
 872         tevent_req_set_callback(subreq, cli_write_andx_done, req);
 873         *psmbreq = subreq;
 874         return req;
 875 }
 876
 877 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
 878                                        struct tevent_context *ev,
 879                                        struct cli_state *cli, uint16_t fnum,
 880                                        uint16_t mode, const uint8_t *buf,
 881                                        off_t offset, size_t size)
 882 {
 883         struct tevent_req *req, *subreq;
 884         NTSTATUS status;
 885
 886         req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
 887                                     size, NULL, 0, &subreq);
 888         if (req == NULL) {
 889                 return NULL;
 890         }
 891
 892         status = smb1cli_req_chain_submit(&subreq, 1);
 893         if (tevent_req_nterror(req, status)) {
 894                 return tevent_req_post(req, ev);
 895         }
 896         return req;
 897 }
 898
 899 static void cli_write_andx_done(struct tevent_req *subreq)
 900 {
 901         struct tevent_req *req = tevent_req_callback_data(
 902                 subreq, struct tevent_req);
 903         struct cli_write_andx_state *state = tevent_req_data(
 904                 req, struct cli_write_andx_state);
 905         uint8_t wct;
 906         uint16_t *vwv;
 907         NTSTATUS status;
 908
 909         status = cli_smb_recv(subreq, state, NULL, 6, &wct, &vwv,
 910                               NULL, NULL);
 911         TALLOC_FREE(subreq);
 912         if (NT_STATUS_IS_ERR(status)) {
 913                 tevent_req_nterror(req, status);
 914                 return;
 915         }
 916         state->written = SVAL(vwv+2, 0);
 917         if (state->size > UINT16_MAX) {
 918                 /*
 919                  * It is important that we only set the
 920                  * high bits only if we asked for a large write.
 921                  *
 922                  * OS/2 print shares get this wrong and may send
 923                  * invalid values.
 924                  *
 925                  * See bug #5326.
 926                  */
 927                 state->written |= SVAL(vwv+4, 0)<<16;
 928         }
 929         tevent_req_done(req);
 930 }
 931
 932 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
 933 {
 934         struct cli_write_andx_state *state = tevent_req_data(
 935                 req, struct cli_write_andx_state);
 936         NTSTATUS status;
 937
 938         if (tevent_req_is_nterror(req, &status)) {
 939                 return status;
 940         }
 941         if (pwritten != 0) {
 942                 *pwritten = state->written;
 943         }
 944         return NT_STATUS_OK;
 945 }
 946
 947 struct cli_writeall_state {
 948         struct tevent_context *ev;
 949         struct cli_state *cli;
 950         uint16_t fnum;
 951         uint16_t mode;
 952         const uint8_t *buf;
 953         off_t offset;
 954         size_t size;
 955         size_t written;
 956 };
 957
 958 static void cli_writeall_written(struct tevent_req *req);
 959
 960 static struct tevent_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
 961                                             struct tevent_context *ev,
 962                                             struct cli_state *cli,
 963                                             uint16_t fnum,
 964                                             uint16_t mode,
 965                                             const uint8_t *buf,
 966                                             off_t offset, size_t size)
 967 {
 968         struct tevent_req *req, *subreq;
 969         struct cli_writeall_state *state;
 970
 971         req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
 972         if (req == NULL) {
 973                 return NULL;
 974         }
 975         state->ev = ev;
 976         state->cli = cli;
 977         state->fnum = fnum;
 978         state->mode = mode;
 979         state->buf = buf;
 980         state->offset = offset;
 981         state->size = size;
 982         state->written = 0;
 983
 984         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
 985                                      state->mode, state->buf, state->offset,
 986                                      state->size);
 987         if (tevent_req_nomem(subreq, req)) {
 988                 return tevent_req_post(req, ev);
 989         }
 990         tevent_req_set_callback(subreq, cli_writeall_written, req);
 991         return req;
 992 }
 993
 994 static void cli_writeall_written(struct tevent_req *subreq)
 995 {
 996         struct tevent_req *req = tevent_req_callback_data(
 997                 subreq, struct tevent_req);
 998         struct cli_writeall_state *state = tevent_req_data(
 999                 req, struct cli_writeall_state);
1000         NTSTATUS status;
1001         size_t written, to_write;
1002
1003         status = cli_write_andx_recv(subreq, &written);
1004         TALLOC_FREE(subreq);
1005         if (tevent_req_nterror(req, status)) {
1006                 return;
1007         }
1008
1009         state->written += written;
1010
1011         if (state->written > state->size) {
1012                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1013                 return;
1014         }
1015
1016         to_write = state->size - state->written;
1017
1018         if (to_write == 0) {
1019                 tevent_req_done(req);
1020                 return;
1021         }
1022
1023         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
1024                                      state->mode,
1025                                      state->buf + state->written,
1026                                      state->offset + state->written, to_write);
1027         if (tevent_req_nomem(subreq, req)) {
1028                 return;
1029         }
1030         tevent_req_set_callback(subreq, cli_writeall_written, req);
1031 }
1032
1033 static NTSTATUS cli_writeall_recv(struct tevent_req *req,
1034                                   size_t *pwritten)
1035 {
1036         struct cli_writeall_state *state = tevent_req_data(
1037                 req, struct cli_writeall_state);
1038         NTSTATUS status;
1039
1040         if (tevent_req_is_nterror(req, &status)) {
1041                 return status;
1042         }
1043         if (pwritten != NULL) {
1044                 *pwritten = state->written;
1045         }
1046         return NT_STATUS_OK;
1047 }
1048
1049 NTSTATUS cli_writeall(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1050                       const uint8_t *buf, off_t offset, size_t size,
1051                       size_t *pwritten)
1052 {
1053         TALLOC_CTX *frame = talloc_stackframe();
1054         struct tevent_context *ev;
1055         struct tevent_req *req;
1056         NTSTATUS status = NT_STATUS_NO_MEMORY;
1057
1058         if (smbXcli_conn_has_async_calls(cli->conn)) {
1059                 /*
1060                  * Can't use sync call while an async call is in flight
1061                  */
1062                 status = NT_STATUS_INVALID_PARAMETER;
1063                 goto fail;
1064         }
1065         ev = samba_tevent_context_init(frame);
1066         if (ev == NULL) {
1067                 goto fail;
1068         }
1069         req = cli_writeall_send(frame, ev, cli, fnum, mode, buf, offset, size);
1070         if (req == NULL) {
1071                 goto fail;
1072         }
1073         if (!tevent_req_poll(req, ev)) {
1074                 status = map_nt_error_from_unix(errno);
1075                 goto fail;
1076         }
1077         status = cli_writeall_recv(req, pwritten);
1078  fail:
1079         TALLOC_FREE(frame);
1080         return status;
1081 }
1082
1083 struct cli_push_chunk;
1084
1085 struct cli_push_state {
1086         struct tevent_context *ev;
1087         struct cli_state *cli;
1088         uint16_t fnum;
1089         uint16_t mode;
1090         off_t start_offset;
1091
1092         size_t (*source)(uint8_t *buf, size_t n, void *priv);
1093         void *priv;
1094
1095         bool eof;
1096
1097         size_t chunk_size;
1098         off_t next_offset;
1099
1100         /*
1101          * Outstanding requests
1102          *
1103          * The maximum is 256:
1104          * - which would be a window of 256 MByte
1105          *   for SMB2 with multi-credit
1106          *   or smb1 unix extentions.
1107          */
1108         uint16_t max_chunks;
1109         uint16_t num_chunks;
1110         uint16_t num_waiting;
1111         struct cli_push_chunk *chunks;
1112 };
1113
1114 struct cli_push_chunk {
1115         struct cli_push_chunk *prev, *next;
1116         struct tevent_req *req;/* This is the main request! Not the subreq */
1117         struct tevent_req *subreq;
1118         off_t ofs;
1119         uint8_t *buf;
1120         size_t total_size;
1121         size_t tmp_size;
1122         bool done;
1123 };
1124
1125 static void cli_push_setup_chunks(struct tevent_req *req);
1126 static void cli_push_chunk_ship(struct cli_push_chunk *chunk);
1127 static void cli_push_chunk_done(struct tevent_req *subreq);
1128
1129 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct tevent_context *ev,
1130                                  struct cli_state *cli,
1131                                  uint16_t fnum, uint16_t mode,
1132                                  off_t start_offset, size_t window_size,
1133                                  size_t (*source)(uint8_t *buf, size_t n,
1134                                                   void *priv),
1135                                  void *priv)
1136 {
1137         struct tevent_req *req;
1138         struct cli_push_state *state;
1139         size_t page_size = 1024;
1140         uint64_t tmp64;
1141
1142         req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1143         if (req == NULL) {
1144                 return NULL;
1145         }
1146         state->cli = cli;
1147         state->ev = ev;
1148         state->fnum = fnum;
1149         state->start_offset = start_offset;
1150         state->mode = mode;
1151         state->source = source;
1152         state->priv = priv;
1153         state->next_offset = start_offset;
1154
1155         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1156                 state->chunk_size = smb2cli_conn_max_write_size(cli->conn);
1157         } else {
1158                 state->chunk_size = cli_write_max_bufsize(cli, mode, 14);
1159         }
1160         if (state->chunk_size > page_size) {
1161                 state->chunk_size &= ~(page_size - 1);
1162         }
1163
1164         if (window_size == 0) {
1165                 /*
1166                  * We use 16 MByte as default window size.
1167                  */
1168                 window_size = 16 * 1024 * 1024;
1169         }
1170
1171         tmp64 = window_size/state->chunk_size;
1172         if ((window_size % state->chunk_size) > 0) {
1173                 tmp64 += 1;
1174         }
1175         tmp64 = MAX(tmp64, 1);
1176         tmp64 = MIN(tmp64, 256);
1177         state->max_chunks = tmp64;
1178
1179         /*
1180          * We defer the callback because of the complex
1181          * substate/subfunction logic
1182          */
1183         tevent_req_defer_callback(req, ev);
1184
1185         cli_push_setup_chunks(req);
1186         if (!tevent_req_is_in_progress(req)) {
1187                 return tevent_req_post(req, ev);
1188         }
1189
1190         return req;
1191 }
1192
1193 static void cli_push_setup_chunks(struct tevent_req *req)
1194 {
1195         struct cli_push_state *state =
1196                 tevent_req_data(req,
1197                 struct cli_push_state);
1198         struct cli_push_chunk *chunk, *next = NULL;
1199         size_t i;
1200
1201         for (chunk = state->chunks; chunk; chunk = next) {
1202                 /*
1203                  * Note that chunk might be removed from this call.
1204                  */
1205                 next = chunk->next;
1206                 cli_push_chunk_ship(chunk);
1207                 if (!tevent_req_is_in_progress(req)) {
1208                         return;
1209                 }
1210         }
1211
1212         for (i = state->num_chunks; i < state->max_chunks; i++) {
1213
1214                 if (state->num_waiting > 0) {
1215                         return;
1216                 }
1217
1218                 if (state->eof) {
1219                         break;
1220                 }
1221
1222                 chunk = talloc_zero(state, struct cli_push_chunk);
1223                 if (tevent_req_nomem(chunk, req)) {
1224                         return;
1225                 }
1226                 chunk->req = req;
1227                 chunk->ofs = state->next_offset;
1228                 chunk->buf = talloc_array(chunk,
1229                                           uint8_t,
1230                                           state->chunk_size);
1231                 if (tevent_req_nomem(chunk->buf, req)) {
1232                         return;
1233                 }
1234                 chunk->total_size = state->source(chunk->buf,
1235                                                   state->chunk_size,
1236                                                   state->priv);
1237                 if (chunk->total_size == 0) {
1238                         /* nothing to send */
1239                         talloc_free(chunk);
1240                         state->eof = true;
1241                         break;
1242                 }
1243                 state->next_offset += chunk->total_size;
1244
1245                 DLIST_ADD_END(state->chunks, chunk, NULL);
1246                 state->num_chunks++;
1247                 state->num_waiting++;
1248
1249                 cli_push_chunk_ship(chunk);
1250                 if (!tevent_req_is_in_progress(req)) {
1251                         return;
1252                 }
1253         }
1254
1255         if (!state->eof) {
1256                 return;
1257         }
1258
1259         if (state->num_chunks > 0) {
1260                 return;
1261         }
1262
1263         tevent_req_done(req);
1264 }
1265
1266 static void cli_push_chunk_ship(struct cli_push_chunk *chunk)
1267 {
1268         struct tevent_req *req = chunk->req;
1269         struct cli_push_state *state =
1270                 tevent_req_data(req,
1271                 struct cli_push_state);
1272         bool ok;
1273         const uint8_t *buf;
1274         off_t ofs;
1275         size_t size;
1276
1277         if (chunk->done) {
1278                 DLIST_REMOVE(state->chunks, chunk);
1279                 SMB_ASSERT(state->num_chunks > 0);
1280                 state->num_chunks--;
1281                 TALLOC_FREE(chunk);
1282
1283                 return;
1284         }
1285
1286         if (chunk->subreq != NULL) {
1287                 return;
1288         }
1289
1290         SMB_ASSERT(state->num_waiting > 0);
1291
1292         buf = chunk->buf + chunk->tmp_size;
1293         ofs = chunk->ofs + chunk->tmp_size;
1294         size = chunk->total_size - chunk->tmp_size;
1295
1296         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1297                 uint32_t max_size;
1298
1299                 ok = smb2cli_conn_req_possible(state->cli->conn, &max_size);
1300                 if (!ok) {
1301                         return;
1302                 }
1303
1304                 /*
1305                  * downgrade depending on the available credits
1306                  */
1307                 size = MIN(max_size, size);
1308
1309                 chunk->subreq = cli_smb2_write_send(chunk,
1310                                                     state->ev,
1311                                                     state->cli,
1312                                                     state->fnum,
1313                                                     state->mode,
1314                                                     buf,
1315                                                     ofs,
1316                                                     size);
1317                 if (tevent_req_nomem(chunk->subreq, req)) {
1318                         return;
1319                 }
1320         } else {
1321                 ok = smb1cli_conn_req_possible(state->cli->conn);
1322                 if (!ok) {
1323                         return;
1324                 }
1325
1326                 chunk->subreq = cli_write_andx_send(chunk,
1327                                                     state->ev,
1328                                                     state->cli,
1329                                                     state->fnum,
1330                                                     state->mode,
1331                                                     buf,
1332                                                     ofs,
1333                                                     size);
1334                 if (tevent_req_nomem(chunk->subreq, req)) {
1335                         return;
1336                 }
1337         }
1338         tevent_req_set_callback(chunk->subreq,
1339                                 cli_push_chunk_done,
1340                                 chunk);
1341
1342         state->num_waiting--;
1343         return;
1344 }
1345
1346 static void cli_push_chunk_done(struct tevent_req *subreq)
1347 {
1348         struct cli_push_chunk *chunk =
1349                 tevent_req_callback_data(subreq,
1350                 struct cli_push_chunk);
1351         struct tevent_req *req = chunk->req;
1352         struct cli_push_state *state =
1353                 tevent_req_data(req,
1354                 struct cli_push_state);
1355         NTSTATUS status;
1356         size_t expected = chunk->total_size - chunk->tmp_size;
1357         size_t written;
1358
1359         chunk->subreq = NULL;
1360
1361         if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) {
1362                 status = cli_smb2_write_recv(subreq, &written);
1363         } else {
1364                 status = cli_write_andx_recv(subreq, &written);
1365         }
1366         TALLOC_FREE(subreq);
1367         if (tevent_req_nterror(req, status)) {
1368                 return;
1369         }
1370
1371         if (written > expected) {
1372                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1373                 return;
1374         }
1375
1376         if (written == 0) {
1377                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
1378                 return;
1379         }
1380
1381         chunk->tmp_size += written;
1382
1383         if (chunk->tmp_size == chunk->total_size) {
1384                 chunk->done = true;
1385         } else {
1386                 state->num_waiting++;
1387         }
1388
1389         cli_push_setup_chunks(req);
1390 }
1391
1392 NTSTATUS cli_push_recv(struct tevent_req *req)
1393 {
1394         return tevent_req_simple_recv_ntstatus(req);
1395 }
1396
1397 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1398                   off_t start_offset, size_t window_size,
1399                   size_t (*source)(uint8_t *buf, size_t n, void *priv),
1400                   void *priv)
1401 {
1402         TALLOC_CTX *frame = talloc_stackframe();
1403         struct tevent_context *ev;
1404         struct tevent_req *req;
1405         NTSTATUS status = NT_STATUS_OK;
1406
1407         if (smbXcli_conn_has_async_calls(cli->conn)) {
1408                 /*
1409                  * Can't use sync call while an async call is in flight
1410                  */
1411                 status = NT_STATUS_INVALID_PARAMETER;
1412                 goto fail;
1413         }
1414
1415         ev = samba_tevent_context_init(frame);
1416         if (ev == NULL) {
1417                 status = NT_STATUS_NO_MEMORY;
1418                 goto fail;
1419         }
1420
1421         req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1422                             window_size, source, priv);
1423         if (req == NULL) {
1424                 status = NT_STATUS_NO_MEMORY;
1425                 goto fail;
1426         }
1427
1428         if (!tevent_req_poll(req, ev)) {
1429                 status = map_nt_error_from_unix(errno);
1430                 goto fail;
1431         }
1432
1433         status = cli_push_recv(req);
1434  fail:
1435         TALLOC_FREE(frame);
1436         return status;
1437 }