source3/libsmb/clirap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    client RAP calls
   4    Copyright (C) Andrew Tridgell         1994-1998
   5    Copyright (C) Gerald (Jerry) Carter   2004
   6    Copyright (C) James Peach             2007
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "../libcli/auth/libcli_auth.h"
  24 #include "../librpc/gen_ndr/rap.h"
  25 #include "../lib/crypto/arcfour.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "async_smb.h"
  28 #include "libsmb/libsmb.h"
  29 #include "libsmb/clirap.h"
  30 #include "trans2.h"
  31 #include "../libcli/smb/smbXcli_base.h"
  32
  33 #define PIPE_LANMAN   "\\PIPE\\LANMAN"
  34
  35 /****************************************************************************
  36  Call a remote api
  37 ****************************************************************************/
  38
  39 bool cli_api(struct cli_state *cli,
  40              char *param, int prcnt, int mprcnt,
  41              char *data, int drcnt, int mdrcnt,
  42              char **rparam, unsigned int *rprcnt,
  43              char **rdata, unsigned int *rdrcnt)
  44 {
  45         NTSTATUS status;
  46
  47         uint8_t *my_rparam, *my_rdata;
  48         uint32_t num_my_rparam, num_my_rdata;
  49
  50         status = cli_trans(talloc_tos(), cli, SMBtrans,
  51                            PIPE_LANMAN, 0, /* name, fid */
  52                            0, 0,           /* function, flags */
  53                            NULL, 0, 0,     /* setup */
  54                            (uint8_t *)param, prcnt, mprcnt, /* Params, length, max */
  55                            (uint8_t *)data, drcnt, mdrcnt,  /* Data, length, max */
  56                            NULL,                 /* recv_flags2 */
  57                            NULL, 0, NULL,        /* rsetup */
  58                            &my_rparam, 0, &num_my_rparam,
  59                            &my_rdata, 0, &num_my_rdata);
  60         if (!NT_STATUS_IS_OK(status)) {
  61                 return false;
  62         }
  63
  64         /*
  65          * I know this memcpy massively hurts, but there are just tons
  66          * of callers of cli_api that eventually need changing to
  67          * talloc
  68          */
  69
  70         *rparam = (char *)memdup(my_rparam, num_my_rparam);
  71         if (*rparam == NULL) {
  72                 goto fail;
  73         }
  74         *rprcnt = num_my_rparam;
  75         TALLOC_FREE(my_rparam);
  76
  77         *rdata = (char *)memdup(my_rdata, num_my_rdata);
  78         if (*rdata == NULL) {
  79                 goto fail;
  80         }
  81         *rdrcnt = num_my_rdata;
  82         TALLOC_FREE(my_rdata);
  83
  84         return true;
  85 fail:
  86         TALLOC_FREE(my_rdata);
  87         TALLOC_FREE(my_rparam);
  88         *rparam = NULL;
  89         *rprcnt = 0;
  90         *rdata = NULL;
  91         *rdrcnt = 0;
  92         return false;
  93 }
  94
  95 /****************************************************************************
  96  Perform a NetWkstaUserLogon.
  97 ****************************************************************************/
  98
  99 bool cli_NetWkstaUserLogon(struct cli_state *cli,char *user, char *workstation)
 100 {
 101         char *rparam = NULL;
 102         char *rdata = NULL;
 103         char *p;
 104         unsigned int rdrcnt,rprcnt;
 105         char param[1024];
 106
 107         memset(param, 0, sizeof(param));
 108
 109         /* send a SMBtrans command with api NetWkstaUserLogon */
 110         p = param;
 111         SSVAL(p,0,132); /* api number */
 112         p += 2;
 113         strlcpy(p,"OOWb54WrLh",sizeof(param)-PTR_DIFF(p,param));
 114         p = skip_string(param,sizeof(param),p);
 115         strlcpy(p,"WB21BWDWWDDDDDDDzzzD",sizeof(param)-PTR_DIFF(p,param));
 116         p = skip_string(param,sizeof(param),p);
 117         SSVAL(p,0,1);
 118         p += 2;
 119         strlcpy(p,user,sizeof(param)-PTR_DIFF(p,param));
 120         strupper_m(p);
 121         p += 21;
 122         p++;
 123         p += 15;
 124         p++;
 125         strlcpy(p, workstation,sizeof(param)-PTR_DIFF(p,param));
 126         strupper_m(p);
 127         p += 16;
 128         SSVAL(p, 0, CLI_BUFFER_SIZE);
 129         p += 2;
 130         SSVAL(p, 0, CLI_BUFFER_SIZE);
 131         p += 2;
 132
 133         if (cli_api(cli,
 134                     param, PTR_DIFF(p,param),1024,  /* param, length, max */
 135                     NULL, 0, CLI_BUFFER_SIZE,           /* data, length, max */
 136                     &rparam, &rprcnt,               /* return params, return size */
 137                     &rdata, &rdrcnt                 /* return data, return size */
 138                    )) {
 139                 cli->rap_error = rparam? SVAL(rparam,0) : -1;
 140                 p = rdata;
 141
 142                 if (cli->rap_error == 0) {
 143                         DEBUG(4,("NetWkstaUserLogon success\n"));
 144                         /*
 145                          * The cli->privileges = SVAL(p, 24); field was set here
 146                          * but it was not use anywhere else.
 147                          */
 148                         /* The cli->eff_name field used to be set here
 149                            but it wasn't used anywhere else. */
 150                 } else {
 151                         DEBUG(1,("NetwkstaUserLogon gave error %d\n", cli->rap_error));
 152                 }
 153         }
 154
 155         SAFE_FREE(rparam);
 156         SAFE_FREE(rdata);
 157         return (cli->rap_error == 0);
 158 }
 159
 160 /****************************************************************************
 161  Call a NetShareEnum - try and browse available connections on a host.
 162 ****************************************************************************/
 163
 164 int cli_RNetShareEnum(struct cli_state *cli, void (*fn)(const char *, uint32, const char *, void *), void *state)
 165 {
 166         char *rparam = NULL;
 167         char *rdata = NULL;
 168         char *p;
 169         unsigned int rdrcnt,rprcnt;
 170         char param[1024];
 171         int count = -1;
 172
 173         /* now send a SMBtrans command with api RNetShareEnum */
 174         p = param;
 175         SSVAL(p,0,0); /* api number */
 176         p += 2;
 177         strlcpy(p,"WrLeh",sizeof(param)-PTR_DIFF(p,param));
 178         p = skip_string(param,sizeof(param),p);
 179         strlcpy(p,"B13BWz",sizeof(param)-PTR_DIFF(p,param));
 180         p = skip_string(param,sizeof(param),p);
 181         SSVAL(p,0,1);
 182         /*
 183          * Win2k needs a *smaller* buffer than 0xFFFF here -
 184          * it returns "out of server memory" with 0xFFFF !!! JRA.
 185          */
 186         SSVAL(p,2,0xFFE0);
 187         p += 4;
 188
 189         if (cli_api(cli,
 190                     param, PTR_DIFF(p,param), 1024,  /* Param, length, maxlen */
 191                     NULL, 0, 0xFFE0,            /* data, length, maxlen - Win2k needs a small buffer here too ! */
 192                     &rparam, &rprcnt,                /* return params, length */
 193                     &rdata, &rdrcnt))                /* return data, length */
 194                 {
 195                         int res = rparam? SVAL(rparam,0) : -1;
 196
 197                         if (res == 0 || res == ERRmoredata) {
 198                                 int converter=SVAL(rparam,2);
 199                                 int i;
 200                                 char *rdata_end = rdata + rdrcnt;
 201
 202                                 count=SVAL(rparam,4);
 203                                 p = rdata;
 204
 205                                 for (i=0;i<count;i++,p+=20) {
 206                                         char *sname;
 207                                         int type;
 208                                         int comment_offset;
 209                                         const char *cmnt;
 210                                         const char *p1;
 211                                         char *s1, *s2;
 212                                         size_t len;
 213                                         TALLOC_CTX *frame = talloc_stackframe();
 214
 215                                         if (p + 20 > rdata_end) {
 216                                                 TALLOC_FREE(frame);
 217                                                 break;
 218                                         }
 219
 220                                         sname = p;
 221                                         type = SVAL(p,14);
 222                                         comment_offset = (IVAL(p,16) & 0xFFFF) - converter;
 223                                         if (comment_offset < 0 ||
 224                                                         comment_offset > (int)rdrcnt) {
 225                                                 TALLOC_FREE(frame);
 226                                                 break;
 227                                         }
 228                                         cmnt = comment_offset?(rdata+comment_offset):"";
 229
 230                                         /* Work out the comment length. */
 231                                         for (p1 = cmnt, len = 0; *p1 &&
 232                                                         p1 < rdata_end; len++)
 233                                                 p1++;
 234                                         if (!*p1) {
 235                                                 len++;
 236                                         }
 237                                         pull_string_talloc(frame,rdata,0,
 238                                                 &s1,sname,14,STR_ASCII);
 239                                         pull_string_talloc(frame,rdata,0,
 240                                                 &s2,cmnt,len,STR_ASCII);
 241                                         if (!s1 || !s2) {
 242                                                 TALLOC_FREE(frame);
 243                                                 continue;
 244                                         }
 245
 246                                         fn(s1, type, s2, state);
 247
 248                                         TALLOC_FREE(frame);
 249                                 }
 250                         } else {
 251                                 DEBUG(4,("NetShareEnum res=%d\n", res));
 252                         }
 253                 } else {
 254                         DEBUG(4,("NetShareEnum failed\n"));
 255                 }
 256
 257         SAFE_FREE(rparam);
 258         SAFE_FREE(rdata);
 259
 260         return count;
 261 }
 262
 263 /****************************************************************************
 264  Call a NetServerEnum for the specified workgroup and servertype mask.  This
 265  function then calls the specified callback function for each name returned.
 266
 267  The callback function takes 4 arguments: the machine name, the server type,
 268  the comment and a state pointer.
 269 ****************************************************************************/
 270
 271 bool cli_NetServerEnum(struct cli_state *cli, char *workgroup, uint32 stype,
 272                        void (*fn)(const char *, uint32, const char *, void *),
 273                        void *state)
 274 {
 275         char *rparam = NULL;
 276         char *rdata = NULL;
 277         char *rdata_end = NULL;
 278         unsigned int rdrcnt,rprcnt;
 279         char *p;
 280         char param[1024];
 281         int uLevel = 1;
 282         size_t len;
 283         uint32 func = RAP_NetServerEnum2;
 284         char *last_entry = NULL;
 285         int total_cnt = 0;
 286         int return_cnt = 0;
 287         int res;
 288
 289         errno = 0; /* reset */
 290
 291         /*
 292          * This may take more than one transaction, so we should loop until
 293          * we no longer get a more data to process or we have all of the
 294          * items.
 295          */
 296         do {
 297                 /* send a SMBtrans command with api NetServerEnum */
 298                 p = param;
 299                 SIVAL(p,0,func); /* api number */
 300                 p += 2;
 301
 302                 if (func == RAP_NetServerEnum3) {
 303                         strlcpy(p,"WrLehDzz", sizeof(param)-PTR_DIFF(p,param));
 304                 } else {
 305                         strlcpy(p,"WrLehDz", sizeof(param)-PTR_DIFF(p,param));
 306                 }
 307
 308                 p = skip_string(param, sizeof(param), p);
 309                 strlcpy(p,"B16BBDz", sizeof(param)-PTR_DIFF(p,param));
 310
 311                 p = skip_string(param, sizeof(param), p);
 312                 SSVAL(p,0,uLevel);
 313                 SSVAL(p,2,CLI_BUFFER_SIZE);
 314                 p += 4;
 315                 SIVAL(p,0,stype);
 316                 p += 4;
 317
 318                 /* If we have more data, tell the server where
 319                  * to continue from.
 320                  */
 321                 len = push_ascii(p,
 322                                 workgroup,
 323                                 sizeof(param) - PTR_DIFF(p,param) - 1,
 324                                 STR_TERMINATE|STR_UPPER);
 325
 326                 if (len == (size_t)-1) {
 327                         SAFE_FREE(last_entry);
 328                         return false;
 329                 }
 330                 p += len;
 331
 332                 if (func == RAP_NetServerEnum3) {
 333                         len = push_ascii(p,
 334                                         last_entry ? last_entry : "",
 335                                         sizeof(param) - PTR_DIFF(p,param) - 1,
 336                                         STR_TERMINATE);
 337
 338                         if (len == (size_t)-1) {
 339                                 SAFE_FREE(last_entry);
 340                                 return false;
 341                         }
 342                         p += len;
 343                 }
 344
 345                 /* Next time through we need to use the continue api */
 346                 func = RAP_NetServerEnum3;
 347
 348                 if (!cli_api(cli,
 349                         param, PTR_DIFF(p,param), 8, /* params, length, max */
 350                         NULL, 0, CLI_BUFFER_SIZE, /* data, length, max */
 351                             &rparam, &rprcnt, /* return params, return size */
 352                             &rdata, &rdrcnt)) { /* return data, return size */
 353
 354                         /* break out of the loop on error */
 355                         res = -1;
 356                         break;
 357                 }
 358
 359                 rdata_end = rdata + rdrcnt;
 360                 res = rparam ? SVAL(rparam,0) : -1;
 361
 362                 if (res == 0 || res == ERRmoredata ||
 363                     (res != -1 && cli_errno(cli) == 0)) {
 364                         char *sname = NULL;
 365                         int i, count;
 366                         int converter=SVAL(rparam,2);
 367
 368                         /* Get the number of items returned in this buffer */
 369                         count = SVAL(rparam, 4);
 370
 371                         /* The next field contains the number of items left,
 372                          * including those returned in this buffer. So the
 373                          * first time through this should contain all of the
 374                          * entries.
 375                          */
 376                         if (total_cnt == 0) {
 377                                 total_cnt = SVAL(rparam, 6);
 378                         }
 379
 380                         /* Keep track of how many we have read */
 381                         return_cnt += count;
 382                         p = rdata;
 383
 384                         /* The last name in the previous NetServerEnum reply is
 385                          * sent back to server in the NetServerEnum3 request
 386                          * (last_entry). The next reply should repeat this entry
 387                          * as the first element. We have no proof that this is
 388                          * always true, but from traces that seems to be the
 389                          * behavior from Window Servers. So first lets do a lot
 390                          * of checking, just being paranoid. If the string
 391                          * matches then we already saw this entry so skip it.
 392                          *
 393                          * NOTE: sv1_name field must be null terminated and has
 394                          * a max size of 16 (NetBIOS Name).
 395                          */
 396                         if (last_entry && count && p &&
 397                                 (strncmp(last_entry, p, 16) == 0)) {
 398                             count -= 1; /* Skip this entry */
 399                             return_cnt = -1; /* Not part of total, so don't count. */
 400                             p = rdata + 26; /* Skip the whole record */
 401                         }
 402
 403                         for (i = 0; i < count; i++, p += 26) {
 404                                 int comment_offset;
 405                                 const char *cmnt;
 406                                 const char *p1;
 407                                 char *s1, *s2;
 408                                 TALLOC_CTX *frame = talloc_stackframe();
 409                                 uint32_t entry_stype;
 410
 411                                 if (p + 26 > rdata_end) {
 412                                         TALLOC_FREE(frame);
 413                                         break;
 414                                 }
 415
 416                                 sname = p;
 417                                 comment_offset = (IVAL(p,22) & 0xFFFF)-converter;
 418                                 cmnt = comment_offset?(rdata+comment_offset):"";
 419
 420                                 if (comment_offset < 0 || comment_offset >= (int)rdrcnt) {
 421                                         TALLOC_FREE(frame);
 422                                         continue;
 423                                 }
 424
 425                                 /* Work out the comment length. */
 426                                 for (p1 = cmnt, len = 0; *p1 &&
 427                                                 p1 < rdata_end; len++)
 428                                         p1++;
 429                                 if (!*p1) {
 430                                         len++;
 431                                 }
 432
 433                                 entry_stype = IVAL(p,18) & ~SV_TYPE_LOCAL_LIST_ONLY;
 434
 435                                 pull_string_talloc(frame,rdata,0,
 436                                         &s1,sname,16,STR_ASCII);
 437                                 pull_string_talloc(frame,rdata,0,
 438                                         &s2,cmnt,len,STR_ASCII);
 439
 440                                 if (!s1 || !s2) {
 441                                         TALLOC_FREE(frame);
 442                                         continue;
 443                                 }
 444
 445                                 fn(s1, entry_stype, s2, state);
 446                                 TALLOC_FREE(frame);
 447                         }
 448
 449                         /* We are done with the old last entry, so now we can free it */
 450                         if (last_entry) {
 451                                 SAFE_FREE(last_entry); /* This will set it to null */
 452                         }
 453
 454                         /* We always make a copy of  the last entry if we have one */
 455                         if (sname) {
 456                                 last_entry = smb_xstrdup(sname);
 457                         }
 458
 459                         /* If we have more data, but no last entry then error out */
 460                         if (!last_entry && (res == ERRmoredata)) {
 461                                 errno = EINVAL;
 462                                 res = 0;
 463                         }
 464
 465                 }
 466
 467                 SAFE_FREE(rparam);
 468                 SAFE_FREE(rdata);
 469         } while ((res == ERRmoredata) && (total_cnt > return_cnt));
 470
 471         SAFE_FREE(rparam);
 472         SAFE_FREE(rdata);
 473         SAFE_FREE(last_entry);
 474
 475         if (res == -1) {
 476                 errno = cli_errno(cli);
 477         } else {
 478                 if (!return_cnt) {
 479                         /* this is a very special case, when the domain master for the
 480                            work group isn't part of the work group itself, there is something
 481                            wild going on */
 482                         errno = ENOENT;
 483                 }
 484             }
 485
 486         return(return_cnt > 0);
 487 }
 488
 489 /****************************************************************************
 490  Send a SamOEMChangePassword command.
 491 ****************************************************************************/
 492
 493 bool cli_oem_change_password(struct cli_state *cli, const char *user, const char *new_password,
 494                              const char *old_password)
 495 {
 496         char param[1024];
 497         unsigned char data[532];
 498         char *p = param;
 499         unsigned char old_pw_hash[16];
 500         unsigned char new_pw_hash[16];
 501         unsigned int data_len;
 502         unsigned int param_len = 0;
 503         char *rparam = NULL;
 504         char *rdata = NULL;
 505         unsigned int rprcnt, rdrcnt;
 506
 507         if (strlen(user) >= sizeof(fstring)-1) {
 508                 DEBUG(0,("cli_oem_change_password: user name %s is too long.\n", user));
 509                 return False;
 510         }
 511
 512         SSVAL(p,0,214); /* SamOEMChangePassword command. */
 513         p += 2;
 514         strlcpy(p, "zsT", sizeof(param)-PTR_DIFF(p,param));
 515         p = skip_string(param,sizeof(param),p);
 516         strlcpy(p, "B516B16", sizeof(param)-PTR_DIFF(p,param));
 517         p = skip_string(param,sizeof(param),p);
 518         strlcpy(p,user, sizeof(param)-PTR_DIFF(p,param));
 519         p = skip_string(param,sizeof(param),p);
 520         SSVAL(p,0,532);
 521         p += 2;
 522
 523         param_len = PTR_DIFF(p,param);
 524
 525         /*
 526          * Get the Lanman hash of the old password, we
 527          * use this as the key to make_oem_passwd_hash().
 528          */
 529         E_deshash(old_password, old_pw_hash);
 530
 531         encode_pw_buffer(data, new_password, STR_ASCII);
 532
 533 #ifdef DEBUG_PASSWORD
 534         DEBUG(100,("make_oem_passwd_hash\n"));
 535         dump_data(100, data, 516);
 536 #endif
 537         arcfour_crypt( (unsigned char *)data, (unsigned char *)old_pw_hash, 516);
 538
 539         /*
 540          * Now place the old password hash in the data.
 541          */
 542         E_deshash(new_password, new_pw_hash);
 543
 544         E_old_pw_hash( new_pw_hash, old_pw_hash, (uchar *)&data[516]);
 545
 546         data_len = 532;
 547
 548         if (!cli_api(cli,
 549                      param, param_len, 4,               /* param, length, max */
 550                      (char *)data, data_len, 0,         /* data, length, max */
 551                      &rparam, &rprcnt,
 552                      &rdata, &rdrcnt)) {
 553                 DEBUG(0,("cli_oem_change_password: Failed to send password change for user %s\n",
 554                         user ));
 555                 return False;
 556         }
 557
 558         if (rparam) {
 559                 cli->rap_error = SVAL(rparam,0);
 560         }
 561
 562         SAFE_FREE(rparam);
 563         SAFE_FREE(rdata);
 564
 565         return (cli->rap_error == 0);
 566 }
 567
 568 /****************************************************************************
 569  Send a qpathinfo call.
 570 ****************************************************************************/
 571
 572 struct cli_qpathinfo1_state {
 573         struct cli_state *cli;
 574         uint32_t num_data;
 575         uint8_t *data;
 576 };
 577
 578 static void cli_qpathinfo1_done(struct tevent_req *subreq);
 579
 580 struct tevent_req *cli_qpathinfo1_send(TALLOC_CTX *mem_ctx,
 581                                        struct event_context *ev,
 582                                        struct cli_state *cli,
 583                                        const char *fname)
 584 {
 585         struct tevent_req *req = NULL, *subreq = NULL;
 586         struct cli_qpathinfo1_state *state = NULL;
 587
 588         req = tevent_req_create(mem_ctx, &state, struct cli_qpathinfo1_state);
 589         if (req == NULL) {
 590                 return NULL;
 591         }
 592         state->cli = cli;
 593         subreq = cli_qpathinfo_send(state, ev, cli, fname, SMB_INFO_STANDARD,
 594                                     22, CLI_BUFFER_SIZE);
 595         if (tevent_req_nomem(subreq, req)) {
 596                 return tevent_req_post(req, ev);
 597         }
 598         tevent_req_set_callback(subreq, cli_qpathinfo1_done, req);
 599         return req;
 600 }
 601
 602 static void cli_qpathinfo1_done(struct tevent_req *subreq)
 603 {
 604         struct tevent_req *req = tevent_req_callback_data(
 605                 subreq, struct tevent_req);
 606         struct cli_qpathinfo1_state *state = tevent_req_data(
 607                 req, struct cli_qpathinfo1_state);
 608         NTSTATUS status;
 609
 610         status = cli_qpathinfo_recv(subreq, state, &state->data,
 611                                     &state->num_data);
 612         TALLOC_FREE(subreq);
 613         if (!NT_STATUS_IS_OK(status)) {
 614                 tevent_req_nterror(req, status);
 615                 return;
 616         }
 617         tevent_req_done(req);
 618 }
 619
 620 NTSTATUS cli_qpathinfo1_recv(struct tevent_req *req,
 621                              time_t *change_time,
 622                              time_t *access_time,
 623                              time_t *write_time,
 624                              off_t *size,
 625                              uint16 *mode)
 626 {
 627         struct cli_qpathinfo1_state *state = tevent_req_data(
 628                 req, struct cli_qpathinfo1_state);
 629         NTSTATUS status;
 630
 631         time_t (*date_fn)(const void *buf, int serverzone);
 632
 633         if (tevent_req_is_nterror(req, &status)) {
 634                 return status;
 635         }
 636
 637         if (state->cli->win95) {
 638                 date_fn = make_unix_date;
 639         } else {
 640                 date_fn = make_unix_date2;
 641         }
 642
 643         if (change_time) {
 644                 *change_time = date_fn(state->data+0, smb1cli_conn_server_time_zone(state->cli->conn));
 645         }
 646         if (access_time) {
 647                 *access_time = date_fn(state->data+4, smb1cli_conn_server_time_zone(state->cli->conn));
 648         }
 649         if (write_time) {
 650                 *write_time = date_fn(state->data+8, smb1cli_conn_server_time_zone(state->cli->conn));
 651         }
 652         if (size) {
 653                 *size = IVAL(state->data, 12);
 654         }
 655         if (mode) {
 656                 *mode = SVAL(state->data, l1_attrFile);
 657         }
 658         return NT_STATUS_OK;
 659 }
 660
 661 NTSTATUS cli_qpathinfo1(struct cli_state *cli,
 662                         const char *fname,
 663                         time_t *change_time,
 664                         time_t *access_time,
 665                         time_t *write_time,
 666                         off_t *size,
 667                         uint16 *mode)
 668 {
 669         TALLOC_CTX *frame = talloc_stackframe();
 670         struct event_context *ev;
 671         struct tevent_req *req;
 672         NTSTATUS status = NT_STATUS_NO_MEMORY;
 673
 674         if (smbXcli_conn_has_async_calls(cli->conn)) {
 675                 /*
 676                  * Can't use sync call while an async call is in flight
 677                  */
 678                 status = NT_STATUS_INVALID_PARAMETER;
 679                 goto fail;
 680         }
 681         ev = event_context_init(frame);
 682         if (ev == NULL) {
 683                 goto fail;
 684         }
 685         req = cli_qpathinfo1_send(frame, ev, cli, fname);
 686         if (req == NULL) {
 687                 goto fail;
 688         }
 689         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 690                 goto fail;
 691         }
 692         status = cli_qpathinfo1_recv(req, change_time, access_time,
 693                                      write_time, size, mode);
 694  fail:
 695         TALLOC_FREE(frame);
 696         return status;
 697 }
 698
 699 /****************************************************************************
 700  Send a setpathinfo call.
 701 ****************************************************************************/
 702
 703 NTSTATUS cli_setpathinfo_basic(struct cli_state *cli, const char *fname,
 704                                time_t create_time,
 705                                time_t access_time,
 706                                time_t write_time,
 707                                time_t change_time,
 708                                uint16 mode)
 709 {
 710         unsigned int data_len = 0;
 711         char data[40];
 712         char *p;
 713
 714         p = data;
 715
 716         /*
 717          * Add the create, last access, modification, and status change times
 718          */
 719         put_long_date(p, create_time);
 720         p += 8;
 721
 722         put_long_date(p, access_time);
 723         p += 8;
 724
 725         put_long_date(p, write_time);
 726         p += 8;
 727
 728         put_long_date(p, change_time);
 729         p += 8;
 730
 731         /* Add attributes */
 732         SIVAL(p, 0, mode);
 733         p += 4;
 734
 735         /* Add padding */
 736         SIVAL(p, 0, 0);
 737         p += 4;
 738
 739         data_len = PTR_DIFF(p, data);
 740
 741         return cli_setpathinfo(cli, SMB_FILE_BASIC_INFORMATION, fname,
 742                                (uint8_t *)data, data_len);
 743 }
 744
 745 /****************************************************************************
 746  Send a qpathinfo call with the SMB_QUERY_FILE_ALL_INFO info level.
 747 ****************************************************************************/
 748
 749 struct cli_qpathinfo2_state {
 750         uint32_t num_data;
 751         uint8_t *data;
 752 };
 753
 754 static void cli_qpathinfo2_done(struct tevent_req *subreq);
 755
 756 struct tevent_req *cli_qpathinfo2_send(TALLOC_CTX *mem_ctx,
 757                                        struct event_context *ev,
 758                                        struct cli_state *cli,
 759                                        const char *fname)
 760 {
 761         struct tevent_req *req = NULL, *subreq = NULL;
 762         struct cli_qpathinfo2_state *state = NULL;
 763
 764         req = tevent_req_create(mem_ctx, &state, struct cli_qpathinfo2_state);
 765         if (req == NULL) {
 766                 return NULL;
 767         }
 768         subreq = cli_qpathinfo_send(state, ev, cli, fname,
 769                                     SMB_QUERY_FILE_ALL_INFO,
 770                                     68, CLI_BUFFER_SIZE);
 771         if (tevent_req_nomem(subreq, req)) {
 772                 return tevent_req_post(req, ev);
 773         }
 774         tevent_req_set_callback(subreq, cli_qpathinfo2_done, req);
 775         return req;
 776 }
 777
 778 static void cli_qpathinfo2_done(struct tevent_req *subreq)
 779 {
 780         struct tevent_req *req = tevent_req_callback_data(
 781                 subreq, struct tevent_req);
 782         struct cli_qpathinfo2_state *state = tevent_req_data(
 783                 req, struct cli_qpathinfo2_state);
 784         NTSTATUS status;
 785
 786         status = cli_qpathinfo_recv(subreq, state, &state->data,
 787                                     &state->num_data);
 788         TALLOC_FREE(subreq);
 789         if (!NT_STATUS_IS_OK(status)) {
 790                 tevent_req_nterror(req, status);
 791                 return;
 792         }
 793         tevent_req_done(req);
 794 }
 795
 796 NTSTATUS cli_qpathinfo2_recv(struct tevent_req *req,
 797                              struct timespec *create_time,
 798                              struct timespec *access_time,
 799                              struct timespec *write_time,
 800                              struct timespec *change_time,
 801                              off_t *size, uint16 *mode,
 802                              SMB_INO_T *ino)
 803 {
 804         struct cli_qpathinfo2_state *state = tevent_req_data(
 805                 req, struct cli_qpathinfo2_state);
 806         NTSTATUS status;
 807
 808         if (tevent_req_is_nterror(req, &status)) {
 809                 return status;
 810         }
 811
 812         if (create_time) {
 813                 *create_time = interpret_long_date((char *)state->data+0);
 814         }
 815         if (access_time) {
 816                 *access_time = interpret_long_date((char *)state->data+8);
 817         }
 818         if (write_time) {
 819                 *write_time = interpret_long_date((char *)state->data+16);
 820         }
 821         if (change_time) {
 822                 *change_time = interpret_long_date((char *)state->data+24);
 823         }
 824         if (mode) {
 825                 *mode = SVAL(state->data, 32);
 826         }
 827         if (size) {
 828                 *size = IVAL2_TO_SMB_BIG_UINT(state->data,48);
 829         }
 830         if (ino) {
 831                 *ino = IVAL(state->data, 64);
 832         }
 833         return NT_STATUS_OK;
 834 }
 835
 836 NTSTATUS cli_qpathinfo2(struct cli_state *cli, const char *fname,
 837                         struct timespec *create_time,
 838                         struct timespec *access_time,
 839                         struct timespec *write_time,
 840                         struct timespec *change_time,
 841                         off_t *size, uint16 *mode,
 842                         SMB_INO_T *ino)
 843 {
 844         TALLOC_CTX *frame = talloc_stackframe();
 845         struct event_context *ev;
 846         struct tevent_req *req;
 847         NTSTATUS status = NT_STATUS_NO_MEMORY;
 848
 849         if (smbXcli_conn_has_async_calls(cli->conn)) {
 850                 /*
 851                  * Can't use sync call while an async call is in flight
 852                  */
 853                 status = NT_STATUS_INVALID_PARAMETER;
 854                 goto fail;
 855         }
 856         ev = event_context_init(frame);
 857         if (ev == NULL) {
 858                 goto fail;
 859         }
 860         req = cli_qpathinfo2_send(frame, ev, cli, fname);
 861         if (req == NULL) {
 862                 goto fail;
 863         }
 864         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 865                 goto fail;
 866         }
 867         status = cli_qpathinfo2_recv(req, create_time, access_time,
 868                                      write_time, change_time, size, mode, ino);
 869  fail:
 870         TALLOC_FREE(frame);
 871         return status;
 872 }
 873
 874 /****************************************************************************
 875  Get the stream info
 876 ****************************************************************************/
 877
 878 static bool parse_streams_blob(TALLOC_CTX *mem_ctx, const uint8_t *data,
 879                                size_t data_len,
 880                                unsigned int *pnum_streams,
 881                                struct stream_struct **pstreams);
 882
 883 struct cli_qpathinfo_streams_state {
 884         uint32_t num_data;
 885         uint8_t *data;
 886 };
 887
 888 static void cli_qpathinfo_streams_done(struct tevent_req *subreq);
 889
 890 struct tevent_req *cli_qpathinfo_streams_send(TALLOC_CTX *mem_ctx,
 891                                               struct tevent_context *ev,
 892                                               struct cli_state *cli,
 893                                               const char *fname)
 894 {
 895         struct tevent_req *req = NULL, *subreq = NULL;
 896         struct cli_qpathinfo_streams_state *state = NULL;
 897
 898         req = tevent_req_create(mem_ctx, &state,
 899                                 struct cli_qpathinfo_streams_state);
 900         if (req == NULL) {
 901                 return NULL;
 902         }
 903         subreq = cli_qpathinfo_send(state, ev, cli, fname,
 904                                     SMB_FILE_STREAM_INFORMATION,
 905                                     0, CLI_BUFFER_SIZE);
 906         if (tevent_req_nomem(subreq, req)) {
 907                 return tevent_req_post(req, ev);
 908         }
 909         tevent_req_set_callback(subreq, cli_qpathinfo_streams_done, req);
 910         return req;
 911 }
 912
 913 static void cli_qpathinfo_streams_done(struct tevent_req *subreq)
 914 {
 915         struct tevent_req *req = tevent_req_callback_data(
 916                 subreq, struct tevent_req);
 917         struct cli_qpathinfo_streams_state *state = tevent_req_data(
 918                 req, struct cli_qpathinfo_streams_state);
 919         NTSTATUS status;
 920
 921         status = cli_qpathinfo_recv(subreq, state, &state->data,
 922                                     &state->num_data);
 923         TALLOC_FREE(subreq);
 924         if (!NT_STATUS_IS_OK(status)) {
 925                 tevent_req_nterror(req, status);
 926                 return;
 927         }
 928         tevent_req_done(req);
 929 }
 930
 931 NTSTATUS cli_qpathinfo_streams_recv(struct tevent_req *req,
 932                                     TALLOC_CTX *mem_ctx,
 933                                     unsigned int *pnum_streams,
 934                                     struct stream_struct **pstreams)
 935 {
 936         struct cli_qpathinfo_streams_state *state = tevent_req_data(
 937                 req, struct cli_qpathinfo_streams_state);
 938         NTSTATUS status;
 939
 940         if (tevent_req_is_nterror(req, &status)) {
 941                 return status;
 942         }
 943         if (!parse_streams_blob(mem_ctx, state->data, state->num_data,
 944                                 pnum_streams, pstreams)) {
 945                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
 946         }
 947         return NT_STATUS_OK;
 948 }
 949
 950 NTSTATUS cli_qpathinfo_streams(struct cli_state *cli, const char *fname,
 951                                TALLOC_CTX *mem_ctx,
 952                                unsigned int *pnum_streams,
 953                                struct stream_struct **pstreams)
 954 {
 955         TALLOC_CTX *frame = talloc_stackframe();
 956         struct event_context *ev;
 957         struct tevent_req *req;
 958         NTSTATUS status = NT_STATUS_NO_MEMORY;
 959
 960         if (smbXcli_conn_has_async_calls(cli->conn)) {
 961                 /*
 962                  * Can't use sync call while an async call is in flight
 963                  */
 964                 status = NT_STATUS_INVALID_PARAMETER;
 965                 goto fail;
 966         }
 967         ev = event_context_init(frame);
 968         if (ev == NULL) {
 969                 goto fail;
 970         }
 971         req = cli_qpathinfo_streams_send(frame, ev, cli, fname);
 972         if (req == NULL) {
 973                 goto fail;
 974         }
 975         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 976                 goto fail;
 977         }
 978         status = cli_qpathinfo_streams_recv(req, mem_ctx, pnum_streams,
 979                                             pstreams);
 980  fail:
 981         TALLOC_FREE(frame);
 982         return status;
 983 }
 984
 985 static bool parse_streams_blob(TALLOC_CTX *mem_ctx, const uint8_t *rdata,
 986                                size_t data_len,
 987                                unsigned int *pnum_streams,
 988                                struct stream_struct **pstreams)
 989 {
 990         unsigned int num_streams;
 991         struct stream_struct *streams;
 992         unsigned int ofs;
 993
 994         num_streams = 0;
 995         streams = NULL;
 996         ofs = 0;
 997
 998         while ((data_len > ofs) && (data_len - ofs >= 24)) {
 999                 uint32_t nlen, len;
1000                 size_t size;
1001                 void *vstr;
1002                 struct stream_struct *tmp;
1003                 uint8_t *tmp_buf;
1004
1005                 tmp = talloc_realloc(mem_ctx, streams,
1006                                            struct stream_struct,
1007                                            num_streams+1);
1008
1009                 if (tmp == NULL) {
1010                         goto fail;
1011                 }
1012                 streams = tmp;
1013
1014                 nlen                      = IVAL(rdata, ofs + 0x04);
1015
1016                 streams[num_streams].size = IVAL_TO_SMB_OFF_T(
1017                         rdata, ofs + 0x08);
1018                 streams[num_streams].alloc_size = IVAL_TO_SMB_OFF_T(
1019                         rdata, ofs + 0x10);
1020
1021                 if (nlen > data_len - (ofs + 24)) {
1022                         goto fail;
1023                 }
1024
1025                 /*
1026                  * We need to null-terminate src, how do I do this with
1027                  * convert_string_talloc??
1028                  */
1029
1030                 tmp_buf = talloc_array(streams, uint8_t, nlen+2);
1031                 if (tmp_buf == NULL) {
1032                         goto fail;
1033                 }
1034
1035                 memcpy(tmp_buf, rdata+ofs+24, nlen);
1036                 tmp_buf[nlen] = 0;
1037                 tmp_buf[nlen+1] = 0;
1038
1039                 if (!convert_string_talloc(streams, CH_UTF16, CH_UNIX, tmp_buf,
1040                                            nlen+2, &vstr, &size))
1041                 {
1042                         TALLOC_FREE(tmp_buf);
1043                         goto fail;
1044                 }
1045
1046                 TALLOC_FREE(tmp_buf);
1047                 streams[num_streams].name = (char *)vstr;
1048                 num_streams++;
1049
1050                 len = IVAL(rdata, ofs);
1051                 if (len > data_len - ofs) {
1052                         goto fail;
1053                 }
1054                 if (len == 0) break;
1055                 ofs += len;
1056         }
1057
1058         *pnum_streams = num_streams;
1059         *pstreams = streams;
1060         return true;
1061
1062  fail:
1063         TALLOC_FREE(streams);
1064         return false;
1065 }
1066
1067 /****************************************************************************
1068  Send a qfileinfo QUERY_FILE_NAME_INFO call.
1069 ****************************************************************************/
1070
1071 NTSTATUS cli_qfilename(struct cli_state *cli, uint16_t fnum,
1072                        TALLOC_CTX *mem_ctx, char **_name)
1073 {
1074         uint16_t recv_flags2;
1075         uint8_t *rdata;
1076         uint32_t num_rdata;
1077         NTSTATUS status;
1078         char *name = NULL;
1079         uint32_t namelen;
1080
1081         status = cli_qfileinfo(talloc_tos(), cli, fnum,
1082                                SMB_QUERY_FILE_NAME_INFO,
1083                                4, CLI_BUFFER_SIZE, &recv_flags2,
1084                                &rdata, &num_rdata);
1085         if (!NT_STATUS_IS_OK(status)) {
1086                 return status;
1087         }
1088
1089         namelen = IVAL(rdata, 0);
1090         if (namelen > (num_rdata - 4)) {
1091                 TALLOC_FREE(rdata);
1092                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1093         }
1094
1095         clistr_pull_talloc(mem_ctx,
1096                            (const char *)rdata,
1097                            recv_flags2,
1098                            &name,
1099                            rdata + 4,
1100                            namelen,
1101                            STR_UNICODE);
1102         if (name == NULL) {
1103                 status = map_nt_error_from_unix(errno);
1104                 TALLOC_FREE(rdata);
1105                 return status;
1106         }
1107
1108         *_name = name;
1109         TALLOC_FREE(rdata);
1110         return NT_STATUS_OK;
1111 }
1112
1113 /****************************************************************************
1114  Send a qfileinfo call.
1115 ****************************************************************************/
1116
1117 NTSTATUS cli_qfileinfo_basic(struct cli_state *cli, uint16_t fnum,
1118                              uint16 *mode, off_t *size,
1119                              struct timespec *create_time,
1120                              struct timespec *access_time,
1121                              struct timespec *write_time,
1122                              struct timespec *change_time,
1123                              SMB_INO_T *ino)
1124 {
1125         uint8_t *rdata;
1126         uint32_t num_rdata;
1127         NTSTATUS status;
1128
1129         /* if its a win95 server then fail this - win95 totally screws it
1130            up */
1131         if (cli->win95) {
1132                 return NT_STATUS_NOT_SUPPORTED;
1133         }
1134
1135         status = cli_qfileinfo(talloc_tos(), cli, fnum,
1136                                SMB_QUERY_FILE_ALL_INFO,
1137                                68, CLI_BUFFER_SIZE,
1138                                NULL,
1139                                &rdata, &num_rdata);
1140         if (!NT_STATUS_IS_OK(status)) {
1141                 return status;
1142         }
1143
1144         if (create_time) {
1145                 *create_time = interpret_long_date((char *)rdata+0);
1146         }
1147         if (access_time) {
1148                 *access_time = interpret_long_date((char *)rdata+8);
1149         }
1150         if (write_time) {
1151                 *write_time = interpret_long_date((char *)rdata+16);
1152         }
1153         if (change_time) {
1154                 *change_time = interpret_long_date((char *)rdata+24);
1155         }
1156         if (mode) {
1157                 *mode = SVAL(rdata, 32);
1158         }
1159         if (size) {
1160                 *size = IVAL2_TO_SMB_BIG_UINT(rdata,48);
1161         }
1162         if (ino) {
1163                 *ino = IVAL(rdata, 64);
1164         }
1165
1166         TALLOC_FREE(rdata);
1167         return NT_STATUS_OK;
1168 }
1169
1170 /****************************************************************************
1171  Send a qpathinfo BASIC_INFO call.
1172 ****************************************************************************/
1173
1174 struct cli_qpathinfo_basic_state {
1175         uint32_t num_data;
1176         uint8_t *data;
1177 };
1178
1179 static void cli_qpathinfo_basic_done(struct tevent_req *subreq);
1180
1181 struct tevent_req *cli_qpathinfo_basic_send(TALLOC_CTX *mem_ctx,
1182                                             struct event_context *ev,
1183                                             struct cli_state *cli,
1184                                             const char *fname)
1185 {
1186         struct tevent_req *req = NULL, *subreq = NULL;
1187         struct cli_qpathinfo_basic_state *state = NULL;
1188
1189         req = tevent_req_create(mem_ctx, &state,
1190                                 struct cli_qpathinfo_basic_state);
1191         if (req == NULL) {
1192                 return NULL;
1193         }
1194         subreq = cli_qpathinfo_send(state, ev, cli, fname,
1195                                     SMB_QUERY_FILE_BASIC_INFO,
1196                                     36, CLI_BUFFER_SIZE);
1197         if (tevent_req_nomem(subreq, req)) {
1198                 return tevent_req_post(req, ev);
1199         }
1200         tevent_req_set_callback(subreq, cli_qpathinfo_basic_done, req);
1201         return req;
1202 }
1203
1204 static void cli_qpathinfo_basic_done(struct tevent_req *subreq)
1205 {
1206         struct tevent_req *req = tevent_req_callback_data(
1207                 subreq, struct tevent_req);
1208         struct cli_qpathinfo_basic_state *state = tevent_req_data(
1209                 req, struct cli_qpathinfo_basic_state);
1210         NTSTATUS status;
1211
1212         status = cli_qpathinfo_recv(subreq, state, &state->data,
1213                                     &state->num_data);
1214         TALLOC_FREE(subreq);
1215         if (!NT_STATUS_IS_OK(status)) {
1216                 tevent_req_nterror(req, status);
1217                 return;
1218         }
1219         tevent_req_done(req);
1220 }
1221
1222 NTSTATUS cli_qpathinfo_basic_recv(struct tevent_req *req,
1223                                   SMB_STRUCT_STAT *sbuf, uint32 *attributes)
1224 {
1225         struct cli_qpathinfo_basic_state *state = tevent_req_data(
1226                 req, struct cli_qpathinfo_basic_state);
1227         NTSTATUS status;
1228
1229         if (tevent_req_is_nterror(req, &status)) {
1230                 return status;
1231         }
1232
1233         sbuf->st_ex_atime = interpret_long_date((char *)state->data+8);
1234         sbuf->st_ex_mtime = interpret_long_date((char *)state->data+16);
1235         sbuf->st_ex_ctime = interpret_long_date((char *)state->data+24);
1236         *attributes = IVAL(state->data, 32);
1237         return NT_STATUS_OK;
1238 }
1239
1240 NTSTATUS cli_qpathinfo_basic(struct cli_state *cli, const char *name,
1241                              SMB_STRUCT_STAT *sbuf, uint32 *attributes)
1242 {
1243         TALLOC_CTX *frame = talloc_stackframe();
1244         struct event_context *ev;
1245         struct tevent_req *req;
1246         NTSTATUS status = NT_STATUS_NO_MEMORY;
1247
1248         if (smbXcli_conn_has_async_calls(cli->conn)) {
1249                 /*
1250                  * Can't use sync call while an async call is in flight
1251                  */
1252                 status = NT_STATUS_INVALID_PARAMETER;
1253                 goto fail;
1254         }
1255         ev = event_context_init(frame);
1256         if (ev == NULL) {
1257                 goto fail;
1258         }
1259         req = cli_qpathinfo_basic_send(frame, ev, cli, name);
1260         if (req == NULL) {
1261                 goto fail;
1262         }
1263         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
1264                 goto fail;
1265         }
1266         status = cli_qpathinfo_basic_recv(req, sbuf, attributes);
1267  fail:
1268         TALLOC_FREE(frame);
1269         return status;
1270 }
1271
1272 /****************************************************************************
1273  Send a qpathinfo SMB_QUERY_FILE_ALT_NAME_INFO call.
1274 ****************************************************************************/
1275
1276 NTSTATUS cli_qpathinfo_alt_name(struct cli_state *cli, const char *fname, fstring alt_name)
1277 {
1278         uint8_t *rdata;
1279         uint32_t num_rdata;
1280         unsigned int len;
1281         char *converted = NULL;
1282         size_t converted_size = 0;
1283         NTSTATUS status;
1284
1285         status = cli_qpathinfo(talloc_tos(), cli, fname,
1286                                SMB_QUERY_FILE_ALT_NAME_INFO,
1287                                4, CLI_BUFFER_SIZE, &rdata, &num_rdata);
1288         if (!NT_STATUS_IS_OK(status)) {
1289                 return status;
1290         }
1291
1292         len = IVAL(rdata, 0);
1293
1294         if (len > num_rdata - 4) {
1295                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1296         }
1297
1298         /* The returned data is a pushed string, not raw data. */
1299         if (!convert_string_talloc(talloc_tos(),
1300                                    cli_ucs2(cli) ? CH_UTF16LE : CH_DOS,
1301                                    CH_UNIX,
1302                                    rdata + 4,
1303                                    len,
1304                                    &converted,
1305                                    &converted_size)) {
1306                 return NT_STATUS_NO_MEMORY;
1307         }
1308         fstrcpy(alt_name, converted);
1309
1310         TALLOC_FREE(converted);
1311         TALLOC_FREE(rdata);
1312
1313         return NT_STATUS_OK;
1314 }