source3/smbd/ipc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Inter-process communication and named pipe handling
   4    Copyright (C) Andrew Tridgell 1992-1998
   5
   6    SMB Version handling
   7    Copyright (C) John H Terpstra 1995-1998
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21    */
  22 /*
  23    This file handles the named pipe and mailslot calls
  24    in the SMBtrans protocol
  25    */
  26
  27 #include "includes.h"
  28 #include "smbd/smbd.h"
  29 #include "smbd/globals.h"
  30 #include "smbprofile.h"
  31 #include "rpc_server/srv_pipe_hnd.h"
  32 #include "source3/lib/substitute.h"
  33
  34 #define NERR_notsupported 50
  35
  36 static void api_no_reply(connection_struct *conn, struct smb_request *req);
  37
  38 /*******************************************************************
  39  copies parameters and data, as needed, into the smb buffer
  40
  41  *both* the data and params sections should be aligned.  this
  42  is fudged in the rpc pipes by
  43  at present, only the data section is.  this may be a possible
  44  cause of some of the ipc problems being experienced.  lkcl26dec97
  45
  46  ******************************************************************/
  47
  48 static void copy_trans_params_and_data(char *outbuf, int align,
  49                                 char *rparam, int param_offset, int param_len,
  50                                 char *rdata, int data_offset, int data_len)
  51 {
  52         char *copy_into = smb_buf(outbuf);
  53
  54         if(param_len < 0)
  55                 param_len = 0;
  56
  57         if(data_len < 0)
  58                 data_len = 0;
  59
  60         DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d] (align %d)\n",
  61                         param_offset, param_offset + param_len,
  62                         data_offset , data_offset  + data_len,
  63                         align));
  64
  65         *copy_into = '\0';
  66
  67         copy_into += 1;
  68
  69         if (param_len)
  70                 memcpy(copy_into, &rparam[param_offset], param_len);
  71
  72         copy_into += param_len;
  73         if (align) {
  74                 memset(copy_into, '\0', align);
  75         }
  76
  77         copy_into += align;
  78
  79         if (data_len )
  80                 memcpy(copy_into, &rdata[data_offset], data_len);
  81 }
  82
  83 NTSTATUS nt_status_np_pipe(NTSTATUS status)
  84 {
  85         if (NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_DISCONNECTED)) {
  86                 status = NT_STATUS_PIPE_DISCONNECTED;
  87         } else if (NT_STATUS_EQUAL(status, NT_STATUS_CONNECTION_RESET)) {
  88                 status = NT_STATUS_PIPE_BROKEN;
  89         }
  90
  91         return status;
  92 }
  93
  94 /****************************************************************************
  95  Send a trans reply.
  96  ****************************************************************************/
  97
  98 void send_trans_reply(connection_struct *conn,
  99                       struct smb_request *req,
 100                       char *rparam, int rparam_len,
 101                       char *rdata, int rdata_len,
 102                       bool buffer_too_large)
 103 {
 104         int this_ldata,this_lparam;
 105         int tot_data_sent = 0;
 106         int tot_param_sent = 0;
 107         int align;
 108
 109         int ldata  = rdata  ? rdata_len : 0;
 110         int lparam = rparam ? rparam_len : 0;
 111         struct smbXsrv_connection *xconn = req->xconn;
 112         int max_send = xconn->smb1.sessions.max_send;
 113         /* HACK: make sure we send at least 128 byte in one go */
 114         int hdr_overhead = SMB_BUFFER_SIZE_MIN - 128;
 115
 116         if (buffer_too_large)
 117                 DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
 118
 119         this_lparam = MIN(lparam,max_send - hdr_overhead);
 120         this_ldata  = MIN(ldata,max_send - (hdr_overhead+this_lparam));
 121
 122         align = ((this_lparam)%4);
 123
 124         reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
 125
 126         /*
 127          * We might have SMBtranss in req which was transferred to the outbuf,
 128          * fix that.
 129          */
 130         SCVAL(req->outbuf, smb_com, SMBtrans);
 131
 132         copy_trans_params_and_data((char *)req->outbuf, align,
 133                                 rparam, tot_param_sent, this_lparam,
 134                                 rdata, tot_data_sent, this_ldata);
 135
 136         SSVAL(req->outbuf,smb_vwv0,lparam);
 137         SSVAL(req->outbuf,smb_vwv1,ldata);
 138         SSVAL(req->outbuf,smb_vwv3,this_lparam);
 139         SSVAL(req->outbuf,smb_vwv4,
 140               smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
 141         SSVAL(req->outbuf,smb_vwv5,0);
 142         SSVAL(req->outbuf,smb_vwv6,this_ldata);
 143         SSVAL(req->outbuf,smb_vwv7,
 144               smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
 145                          req->outbuf));
 146         SSVAL(req->outbuf,smb_vwv8,0);
 147         SSVAL(req->outbuf,smb_vwv9,0);
 148
 149         if (buffer_too_large) {
 150                 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
 151                                  STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
 152         }
 153
 154         show_msg((char *)req->outbuf);
 155         if (!srv_send_smb(xconn, (char *)req->outbuf,
 156                           true, req->seqnum+1,
 157                           IS_CONN_ENCRYPTED(conn), &req->pcd)) {
 158                 exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
 159         }
 160
 161         TALLOC_FREE(req->outbuf);
 162
 163         tot_data_sent = this_ldata;
 164         tot_param_sent = this_lparam;
 165
 166         while (tot_data_sent < ldata || tot_param_sent < lparam)
 167         {
 168                 this_lparam = MIN(lparam-tot_param_sent,
 169                                   max_send - hdr_overhead);
 170                 this_ldata  = MIN(ldata -tot_data_sent,
 171                                   max_send - (hdr_overhead+this_lparam));
 172
 173                 if(this_lparam < 0)
 174                         this_lparam = 0;
 175
 176                 if(this_ldata < 0)
 177                         this_ldata = 0;
 178
 179                 align = (this_lparam%4);
 180
 181                 reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
 182
 183                 /*
 184                  * We might have SMBtranss in req which was transferred to the
 185                  * outbuf, fix that.
 186                  */
 187                 SCVAL(req->outbuf, smb_com, SMBtrans);
 188
 189                 copy_trans_params_and_data((char *)req->outbuf, align,
 190                                            rparam, tot_param_sent, this_lparam,
 191                                            rdata, tot_data_sent, this_ldata);
 192
 193                 SSVAL(req->outbuf,smb_vwv0,lparam);
 194                 SSVAL(req->outbuf,smb_vwv1,ldata);
 195
 196                 SSVAL(req->outbuf,smb_vwv3,this_lparam);
 197                 SSVAL(req->outbuf,smb_vwv4,
 198                       smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
 199                 SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
 200                 SSVAL(req->outbuf,smb_vwv6,this_ldata);
 201                 SSVAL(req->outbuf,smb_vwv7,
 202                       smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
 203                                  req->outbuf));
 204                 SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
 205                 SSVAL(req->outbuf,smb_vwv9,0);
 206
 207                 if (buffer_too_large) {
 208                         error_packet_set((char *)req->outbuf,
 209                                          ERRDOS, ERRmoredata,
 210                                          STATUS_BUFFER_OVERFLOW,
 211                                          __LINE__, __FILE__);
 212                 }
 213
 214                 show_msg((char *)req->outbuf);
 215                 if (!srv_send_smb(xconn, (char *)req->outbuf,
 216                                   true, req->seqnum+1,
 217                                   IS_CONN_ENCRYPTED(conn), &req->pcd))
 218                         exit_server_cleanly("send_trans_reply: srv_send_smb "
 219                                             "failed.");
 220
 221                 tot_data_sent  += this_ldata;
 222                 tot_param_sent += this_lparam;
 223                 TALLOC_FREE(req->outbuf);
 224         }
 225 }
 226
 227 /****************************************************************************
 228  Start the first part of an RPC reply which began with an SMBtrans request.
 229 ****************************************************************************/
 230
 231 struct dcerpc_cmd_state {
 232         struct fake_file_handle *handle;
 233         uint8_t *data;
 234         size_t num_data;
 235         size_t max_read;
 236 };
 237
 238 static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
 239 static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
 240
 241 static void api_dcerpc_cmd(connection_struct *conn, struct smb_request *req,
 242                            files_struct *fsp, uint8_t *data, size_t length,
 243                            size_t max_read)
 244 {
 245         struct tevent_req *subreq;
 246         struct dcerpc_cmd_state *state;
 247         bool busy;
 248
 249         if (!fsp_is_np(fsp)) {
 250                 api_no_reply(conn, req);
 251                 return;
 252         }
 253
 254         /*
 255          * Trans requests are only allowed
 256          * if no other Trans or Read is active
 257          */
 258         busy = np_read_in_progress(fsp->fake_file_handle);
 259         if (busy) {
 260                 reply_nterror(req, NT_STATUS_PIPE_BUSY);
 261                 return;
 262         }
 263
 264         state = talloc(req, struct dcerpc_cmd_state);
 265         if (state == NULL) {
 266                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 267                 return;
 268         }
 269         req->async_priv = state;
 270
 271         state->handle = fsp->fake_file_handle;
 272
 273         /*
 274          * This memdup severely sucks. But doing it properly essentially means
 275          * to rewrite lanman.c, something which I don't really want to do now.
 276          */
 277         state->data = (uint8_t *)talloc_memdup(state, data, length);
 278         if (state->data == NULL) {
 279                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 280                 return;
 281         }
 282         state->num_data = length;
 283         state->max_read = max_read;
 284
 285         subreq = np_write_send(state, req->sconn->ev_ctx, state->handle,
 286                                state->data, length);
 287         if (subreq == NULL) {
 288                 TALLOC_FREE(state);
 289                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 290                 return;
 291         }
 292         tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
 293                                 talloc_move(conn, &req));
 294 }
 295
 296 static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
 297 {
 298         struct smb_request *req = tevent_req_callback_data(
 299                 subreq, struct smb_request);
 300         struct dcerpc_cmd_state *state = talloc_get_type_abort(
 301                 req->async_priv, struct dcerpc_cmd_state);
 302         NTSTATUS status;
 303         ssize_t nwritten = -1;
 304
 305         status = np_write_recv(subreq, &nwritten);
 306         TALLOC_FREE(subreq);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 NTSTATUS old = status;
 309                 status = nt_status_np_pipe(old);
 310
 311                 DEBUG(10, ("Could not write to pipe: %s%s%s\n",
 312                            nt_errstr(old),
 313                            NT_STATUS_EQUAL(old, status)?"":" => ",
 314                            NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
 315                 reply_nterror(req, status);
 316                 goto send;
 317         }
 318         if (nwritten != state->num_data) {
 319                 status = NT_STATUS_PIPE_NOT_AVAILABLE;
 320                 DEBUG(10, ("Could not write to pipe: (%d/%d) => %s\n",
 321                            (int)state->num_data,
 322                            (int)nwritten, nt_errstr(status)));
 323                 reply_nterror(req, status);
 324                 goto send;
 325         }
 326
 327         state->data = talloc_realloc(state, state->data, uint8_t,
 328                                            state->max_read);
 329         if (state->data == NULL) {
 330                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 331                 goto send;
 332         }
 333
 334         subreq = np_read_send(state, req->sconn->ev_ctx,
 335                               state->handle, state->data, state->max_read);
 336         if (subreq == NULL) {
 337                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 338                 goto send;
 339         }
 340         tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
 341         return;
 342
 343  send:
 344         if (!srv_send_smb(
 345                     req->xconn, (char *)req->outbuf,
 346                     true, req->seqnum+1,
 347                     IS_CONN_ENCRYPTED(req->conn) || req->encrypted,
 348                     &req->pcd)) {
 349                 exit_server_cleanly("api_dcerpc_cmd_write_done: "
 350                                     "srv_send_smb failed.");
 351         }
 352         TALLOC_FREE(req);
 353 }
 354
 355 static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
 356 {
 357         struct smb_request *req = tevent_req_callback_data(
 358                 subreq, struct smb_request);
 359         struct dcerpc_cmd_state *state = talloc_get_type_abort(
 360                 req->async_priv, struct dcerpc_cmd_state);
 361         NTSTATUS status;
 362         ssize_t nread;
 363         bool is_data_outstanding;
 364
 365         status = np_read_recv(subreq, &nread, &is_data_outstanding);
 366         TALLOC_FREE(subreq);
 367
 368         if (!NT_STATUS_IS_OK(status)) {
 369                 NTSTATUS old = status;
 370                 status = nt_status_np_pipe(old);
 371
 372                 DEBUG(10, ("Could not read from to pipe: %s%s%s\n",
 373                            nt_errstr(old),
 374                            NT_STATUS_EQUAL(old, status)?"":" => ",
 375                            NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
 376                 reply_nterror(req, status);
 377
 378                 if (!srv_send_smb(req->xconn, (char *)req->outbuf,
 379                                   true, req->seqnum+1,
 380                                   IS_CONN_ENCRYPTED(req->conn)
 381                                   ||req->encrypted, &req->pcd)) {
 382                         exit_server_cleanly("api_dcerpc_cmd_read_done: "
 383                                             "srv_send_smb failed.");
 384                 }
 385                 TALLOC_FREE(req);
 386                 return;
 387         }
 388
 389         send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
 390                          is_data_outstanding);
 391         TALLOC_FREE(req);
 392 }
 393
 394 /****************************************************************************
 395  WaitNamedPipeHandleState
 396 ****************************************************************************/
 397
 398 static void api_WNPHS(connection_struct *conn, struct smb_request *req,
 399                       struct files_struct *fsp, char *param, int param_len)
 400 {
 401         if (!param || param_len < 2) {
 402                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 403                 return;
 404         }
 405
 406         DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
 407                  (int)SVAL(param,0)));
 408
 409         send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 410 }
 411
 412
 413 /****************************************************************************
 414  SetNamedPipeHandleState
 415 ****************************************************************************/
 416
 417 static void api_SNPHS(connection_struct *conn, struct smb_request *req,
 418                       struct files_struct *fsp, char *param, int param_len)
 419 {
 420         if (!param || param_len < 2) {
 421                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 422                 return;
 423         }
 424
 425         DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
 426
 427         send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 428 }
 429
 430
 431 /****************************************************************************
 432  When no reply is generated, indicate unsupported.
 433  ****************************************************************************/
 434
 435 static void api_no_reply(connection_struct *conn, struct smb_request *req)
 436 {
 437         char rparam[4];
 438
 439         /* unsupported */
 440         SSVAL(rparam,0,NERR_notsupported);
 441         SSVAL(rparam,2,0); /* converter word */
 442
 443         DEBUG(3,("Unsupported API fd command\n"));
 444
 445         /* now send the reply */
 446         send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
 447
 448         return;
 449 }
 450
 451 /****************************************************************************
 452  Handle remote api calls delivered to a named pipe already opened.
 453  ****************************************************************************/
 454
 455 static void api_fd_reply(connection_struct *conn, uint64_t vuid,
 456                          struct smb_request *req,
 457                          uint16_t *setup, uint8_t *data, char *params,
 458                          int suwcnt, int tdscnt, int tpscnt,
 459                          int mdrcnt, int mprcnt)
 460 {
 461         struct files_struct *fsp;
 462         int pnum;
 463         int subcommand;
 464
 465         DEBUG(5,("api_fd_reply\n"));
 466
 467         /* First find out the name of this file. */
 468         if (suwcnt != 2) {
 469                 DEBUG(0,("Unexpected named pipe transaction.\n"));
 470                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 471                 return;
 472         }
 473
 474         /* Get the file handle and hence the file name. */
 475         /*
 476          * NB. The setup array has already been transformed
 477          * via SVAL and so is in host byte order.
 478          */
 479         pnum = ((int)setup[1]) & 0xFFFF;
 480         subcommand = ((int)setup[0]) & 0xFFFF;
 481
 482         fsp = file_fsp(req, pnum);
 483
 484         if (!fsp_is_np(fsp)) {
 485                 if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
 486                         /* Win9x does this call with a unicode pipe name, not a pnum. */
 487                         /* Just return success for now... */
 488                         DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
 489                         send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 490                         return;
 491                 }
 492
 493                 DEBUG(1,("api_fd_reply: INVALID PIPE HANDLE: %x\n", pnum));
 494                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 495                 return;
 496         }
 497
 498         if (vuid != fsp->vuid) {
 499                 DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %llu, "
 500                           "expected %llu\n", pnum, (unsigned long long)vuid,
 501                           (unsigned long long)fsp->vuid));
 502                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 503                 return;
 504         }
 505
 506         DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
 507                  subcommand, fsp_str_dbg(fsp), pnum));
 508
 509         DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
 510
 511         switch (subcommand) {
 512         case TRANSACT_DCERPCCMD: {
 513                 /* dce/rpc command */
 514                 api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
 515                                mdrcnt);
 516                 break;
 517         }
 518         case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
 519                 /* Wait Named Pipe Handle state */
 520                 api_WNPHS(conn, req, fsp, params, tpscnt);
 521                 break;
 522         case TRANSACT_SETNAMEDPIPEHANDLESTATE:
 523                 /* Set Named Pipe Handle state */
 524                 api_SNPHS(conn, req, fsp, params, tpscnt);
 525                 break;
 526         default:
 527                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 528                 return;
 529         }
 530 }
 531
 532 /****************************************************************************
 533  Handle named pipe commands.
 534 ****************************************************************************/
 535
 536 static void named_pipe(connection_struct *conn, uint64_t vuid,
 537                        struct smb_request *req,
 538                        const char *name, uint16_t *setup,
 539                        char *data, char *params,
 540                        int suwcnt, int tdscnt,int tpscnt,
 541                        int msrcnt, int mdrcnt, int mprcnt)
 542 {
 543         DEBUG(3,("named pipe command on <%s> name\n", name));
 544
 545         if (strequal(name,"LANMAN")) {
 546                 api_reply(conn, vuid, req,
 547                           data, params,
 548                           tdscnt, tpscnt,
 549                           mdrcnt, mprcnt);
 550                 return;
 551         }
 552
 553         if (strequal(name,"WKSSVC") ||
 554             strequal(name,"SRVSVC") ||
 555             strequal(name,"WINREG") ||
 556             strequal(name,"SAMR") ||
 557             strequal(name,"LSARPC")) {
 558
 559                 DEBUG(4,("named pipe command from Win95 (wow!)\n"));
 560
 561                 api_fd_reply(conn, vuid, req,
 562                              setup, (uint8_t *)data, params,
 563                              suwcnt, tdscnt, tpscnt,
 564                              mdrcnt, mprcnt);
 565                 return;
 566         }
 567
 568         if (strlen(name) < 1) {
 569                 api_fd_reply(conn, vuid, req,
 570                              setup, (uint8_t *)data,
 571                              params, suwcnt, tdscnt,
 572                              tpscnt, mdrcnt, mprcnt);
 573                 return;
 574         }
 575
 576         if (setup)
 577                 DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n",
 578                          (int)setup[0],(int)setup[1]));
 579
 580         reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 581         return;
 582 }
 583
 584 static void handle_trans(connection_struct *conn, struct smb_request *req,
 585                          struct trans_state *state)
 586 {
 587         char *local_machine_name;
 588         int name_offset = 0;
 589
 590         DEBUG(3,("trans <%s> data=%u params=%u setup=%u\n",
 591                  state->name,(unsigned int)state->total_data,(unsigned int)state->total_param,
 592                  (unsigned int)state->setup_count));
 593
 594         /*
 595          * WinCE wierdness....
 596          */
 597
 598         local_machine_name = talloc_asprintf(state, "\\%s\\",
 599                                              get_local_machine_name());
 600
 601         if (local_machine_name == NULL) {
 602                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 603                 return;
 604         }
 605
 606         if (strnequal(state->name, local_machine_name,
 607                       strlen(local_machine_name))) {
 608                 name_offset = strlen(local_machine_name)-1;
 609         }
 610
 611         if (!strnequal(&state->name[name_offset], "\\PIPE",
 612                        strlen("\\PIPE"))) {
 613                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
 614                 return;
 615         }
 616
 617         name_offset += strlen("\\PIPE");
 618
 619         /* Win9x weirdness.  When talking to a unicode server Win9x
 620            only sends \PIPE instead of \PIPE\ */
 621
 622         if (state->name[name_offset] == '\\')
 623                 name_offset++;
 624
 625         DEBUG(5,("calling named_pipe\n"));
 626         named_pipe(conn, state->vuid, req,
 627                    state->name+name_offset,
 628                    state->setup,state->data,
 629                    state->param,
 630                    state->setup_count,state->total_data,
 631                    state->total_param,
 632                    state->max_setup_return,
 633                    state->max_data_return,
 634                    state->max_param_return);
 635
 636         if (state->close_on_completion) {
 637                 struct smbXsrv_tcon *tcon;
 638                 NTSTATUS status;
 639
 640                 tcon = conn->tcon;
 641                 req->conn = NULL;
 642                 conn = NULL;
 643
 644                 /*
 645                  * TODO: cancel all outstanding requests on the tcon
 646                  */
 647                 status = smbXsrv_tcon_disconnect(tcon, state->vuid);
 648                 if (!NT_STATUS_IS_OK(status)) {
 649                         DEBUG(0, ("handle_trans: "
 650                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 651                                   nt_errstr(status)));
 652                         /*
 653                          * If we hit this case, there is something completely
 654                          * wrong, so we better disconnect the transport connection.
 655                          */
 656                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 657                         return;
 658                 }
 659
 660                 TALLOC_FREE(tcon);
 661         }
 662
 663         return;
 664 }
 665
 666 /****************************************************************************
 667  Reply to a SMBtrans.
 668  ****************************************************************************/
 669
 670 void reply_trans(struct smb_request *req)
 671 {
 672         connection_struct *conn = req->conn;
 673         unsigned int dsoff;
 674         unsigned int dscnt;
 675         unsigned int psoff;
 676         unsigned int pscnt;
 677         struct trans_state *state;
 678         NTSTATUS result;
 679
 680         START_PROFILE(SMBtrans);
 681
 682         if (req->wct < 14) {
 683                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 684                 END_PROFILE(SMBtrans);
 685                 return;
 686         }
 687
 688         dsoff = SVAL(req->vwv+12, 0);
 689         dscnt = SVAL(req->vwv+11, 0);
 690         psoff = SVAL(req->vwv+10, 0);
 691         pscnt = SVAL(req->vwv+9, 0);
 692
 693         result = allow_new_trans(conn->pending_trans, req->mid);
 694         if (!NT_STATUS_IS_OK(result)) {
 695                 DEBUG(2, ("Got invalid trans request: %s\n",
 696                           nt_errstr(result)));
 697                 reply_nterror(req, result);
 698                 END_PROFILE(SMBtrans);
 699                 return;
 700         }
 701
 702         if ((state = talloc(conn, struct trans_state)) == NULL) {
 703                 DEBUG(0, ("talloc failed\n"));
 704                 reply_nterror(req, NT_STATUS_NO_MEMORY);
 705                 END_PROFILE(SMBtrans);
 706                 return;
 707         }
 708
 709         state->cmd = SMBtrans;
 710
 711         state->mid = req->mid;
 712         state->vuid = req->vuid;
 713         state->setup_count = CVAL(req->vwv+13, 0);
 714         state->setup = NULL;
 715         state->total_param = SVAL(req->vwv+0, 0);
 716         state->param = NULL;
 717         state->total_data = SVAL(req->vwv+1, 0);
 718         state->data = NULL;
 719         state->max_param_return = SVAL(req->vwv+2, 0);
 720         state->max_data_return = SVAL(req->vwv+3, 0);
 721         state->max_setup_return = CVAL(req->vwv+4, 0);
 722         state->close_on_completion = BITSETW(req->vwv+5, 0);
 723         state->one_way = BITSETW(req->vwv+5, 1);
 724
 725         srvstr_pull_req_talloc(state, req, &state->name, req->buf,
 726                                STR_TERMINATE);
 727
 728         if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
 729                         !state->name)
 730                 goto bad_param;
 731
 732         if (state->total_data)  {
 733
 734                 if (trans_oob(state->total_data, 0, dscnt)
 735                     || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
 736                         goto bad_param;
 737                 }
 738
 739                 /* Can't use talloc here, the core routines do realloc on the
 740                  * params and data. Out of paranoia, 100 bytes too many. */
 741                 state->data = (char *)SMB_MALLOC(state->total_data+100);
 742                 if (state->data == NULL) {
 743                         DEBUG(0,("reply_trans: data malloc fail for %u "
 744                                  "bytes !\n", (unsigned int)state->total_data));
 745                         TALLOC_FREE(state);
 746                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 747                         END_PROFILE(SMBtrans);
 748                         return;
 749                 }
 750                 /* null-terminate the slack space */
 751                 memset(&state->data[state->total_data], 0, 100);
 752
 753                 memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
 754         }
 755
 756         if (state->total_param) {
 757
 758                 if (trans_oob(state->total_param, 0, pscnt)
 759                     || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
 760                         goto bad_param;
 761                 }
 762
 763                 /* Can't use talloc here, the core routines do realloc on the
 764                  * params and data. Out of paranoia, 100 bytes too many */
 765                 state->param = (char *)SMB_MALLOC(state->total_param+100);
 766                 if (state->param == NULL) {
 767                         DEBUG(0,("reply_trans: param malloc fail for %u "
 768                                  "bytes !\n", (unsigned int)state->total_param));
 769                         SAFE_FREE(state->data);
 770                         TALLOC_FREE(state);
 771                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 772                         END_PROFILE(SMBtrans);
 773                         return;
 774                 }
 775                 /* null-terminate the slack space */
 776                 memset(&state->param[state->total_param], 0, 100);
 777
 778                 memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
 779         }
 780
 781         state->received_data  = dscnt;
 782         state->received_param = pscnt;
 783
 784         if (state->setup_count) {
 785                 unsigned int i;
 786
 787                 /*
 788                  * No overflow possible here, state->setup_count is an
 789                  * unsigned int, being filled by a single byte from
 790                  * CVAL(req->vwv+13, 0) above. The cast in the comparison
 791                  * below is not necessary, it's here to clarify things. The
 792                  * validity of req->vwv and req->wct has been checked in
 793                  * init_smb_request already.
 794                  */
 795                 if (state->setup_count + 14 > (unsigned int)req->wct) {
 796                         goto bad_param;
 797                 }
 798
 799                 if((state->setup = talloc_array(
 800                             state, uint16_t, state->setup_count)) == NULL) {
 801                         DEBUG(0,("reply_trans: setup malloc fail for %u "
 802                                  "bytes !\n", (unsigned int)
 803                                  (state->setup_count * sizeof(uint16_t))));
 804                         SAFE_FREE(state->data);
 805                         SAFE_FREE(state->param);
 806                         TALLOC_FREE(state);
 807                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 808                         END_PROFILE(SMBtrans);
 809                         return;
 810                 }
 811
 812                 for (i=0;i<state->setup_count;i++) {
 813                         state->setup[i] = SVAL(req->vwv + 14 + i, 0);
 814                 }
 815         }
 816
 817         state->received_param = pscnt;
 818
 819         if ((state->received_param != state->total_param) ||
 820             (state->received_data != state->total_data)) {
 821                 DLIST_ADD(conn->pending_trans, state);
 822
 823                 /* We need to send an interim response then receive the rest
 824                    of the parameter/data bytes */
 825                 reply_outbuf(req, 0, 0);
 826                 show_msg((char *)req->outbuf);
 827                 END_PROFILE(SMBtrans);
 828                 return;
 829         }
 830
 831         talloc_steal(talloc_tos(), state);
 832
 833         handle_trans(conn, req, state);
 834
 835         SAFE_FREE(state->data);
 836         SAFE_FREE(state->param);
 837         TALLOC_FREE(state);
 838
 839         END_PROFILE(SMBtrans);
 840         return;
 841
 842   bad_param:
 843
 844         DEBUG(0,("reply_trans: invalid trans parameters\n"));
 845         SAFE_FREE(state->data);
 846         SAFE_FREE(state->param);
 847         TALLOC_FREE(state);
 848         END_PROFILE(SMBtrans);
 849         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 850         return;
 851 }
 852
 853 /****************************************************************************
 854  Reply to a secondary SMBtrans.
 855  ****************************************************************************/
 856
 857 void reply_transs(struct smb_request *req)
 858 {
 859         connection_struct *conn = req->conn;
 860         unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
 861         struct trans_state *state;
 862
 863         START_PROFILE(SMBtranss);
 864
 865         show_msg((const char *)req->inbuf);
 866
 867         if (req->wct < 8) {
 868                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 869                 END_PROFILE(SMBtranss);
 870                 return;
 871         }
 872
 873         for (state = conn->pending_trans; state != NULL;
 874              state = state->next) {
 875                 if (state->mid == req->mid) {
 876                         break;
 877                 }
 878         }
 879
 880         if ((state == NULL) || (state->cmd != SMBtrans)) {
 881                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 882                 END_PROFILE(SMBtranss);
 883                 return;
 884         }
 885
 886         /* Revise total_params and total_data in case they have changed
 887          * downwards */
 888
 889         if (SVAL(req->vwv+0, 0) < state->total_param)
 890                 state->total_param = SVAL(req->vwv+0, 0);
 891         if (SVAL(req->vwv+1, 0) < state->total_data)
 892                 state->total_data = SVAL(req->vwv+1, 0);
 893
 894         pcnt = SVAL(req->vwv+2, 0);
 895         poff = SVAL(req->vwv+3, 0);
 896         pdisp = SVAL(req->vwv+4, 0);
 897
 898         dcnt = SVAL(req->vwv+5, 0);
 899         doff = SVAL(req->vwv+6, 0);
 900         ddisp = SVAL(req->vwv+7, 0);
 901
 902         state->received_param += pcnt;
 903         state->received_data += dcnt;
 904
 905         if ((state->received_data > state->total_data) ||
 906             (state->received_param > state->total_param))
 907                 goto bad_param;
 908
 909         if (pcnt) {
 910                 if (trans_oob(state->total_param, pdisp, pcnt)
 911                     || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
 912                         goto bad_param;
 913                 }
 914                 memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
 915         }
 916
 917         if (dcnt) {
 918                 if (trans_oob(state->total_data, ddisp, dcnt)
 919                     || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
 920                         goto bad_param;
 921                 }
 922                 memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
 923         }
 924
 925         if ((state->received_param < state->total_param) ||
 926             (state->received_data < state->total_data)) {
 927                 END_PROFILE(SMBtranss);
 928                 return;
 929         }
 930
 931         talloc_steal(talloc_tos(), state);
 932
 933         handle_trans(conn, req, state);
 934
 935         DLIST_REMOVE(conn->pending_trans, state);
 936         SAFE_FREE(state->data);
 937         SAFE_FREE(state->param);
 938         TALLOC_FREE(state);
 939
 940         END_PROFILE(SMBtranss);
 941         return;
 942
 943   bad_param:
 944
 945         DEBUG(0,("reply_transs: invalid trans parameters\n"));
 946         DLIST_REMOVE(conn->pending_trans, state);
 947         SAFE_FREE(state->data);
 948         SAFE_FREE(state->param);
 949         TALLOC_FREE(state);
 950         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 951         END_PROFILE(SMBtranss);
 952         return;
 953 }