source4/smb_server/trans2.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    transaction2 handling
   4    Copyright (C) Andrew Tridgell 2003
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 2 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program; if not, write to the Free Software
  18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19 */
  20 /*
  21    This file handles the parsing of transact2 requests
  22 */
  23
  24 #include "includes.h"
  25 #include "dlinklist.h"
  26 #include "smb_server/smb_server.h"
  27
  28
  29
  30 #define CHECK_MIN_BLOB_SIZE(blob, size) do { \
  31         if ((blob)->length < (size)) { \
  32                 return NT_STATUS_INFO_LENGTH_MISMATCH; \
  33         }} while (0)
  34
  35 /* grow the data allocation size of a trans2 reply - this guarantees
  36    that requests to grow the data size later will not change the
  37    pointer */
  38 static BOOL trans2_grow_data_allocation(struct smbsrv_request *req,
  39                                         struct smb_trans2 *trans,
  40                                         uint32_t new_size)
  41 {
  42         if (new_size <= trans->out.data.length) {
  43                 return True;
  44         }
  45         trans->out.data.data = talloc_realloc(req, trans->out.data.data, new_size);
  46         return (trans->out.data.data != NULL);
  47 }
  48
  49
  50 /* grow the data size of a trans2 reply */
  51 static BOOL trans2_grow_data(struct smbsrv_request *req,
  52                              struct smb_trans2 *trans,
  53                              uint32_t new_size)
  54 {
  55         if (!trans2_grow_data_allocation(req, trans, new_size)) {
  56                 return False;
  57         }
  58         trans->out.data.length = new_size;
  59         return True;
  60 }
  61
  62 /* grow the data, zero filling any new bytes */
  63 static BOOL trans2_grow_data_fill(struct smbsrv_request *req,
  64                                   struct smb_trans2 *trans,
  65                                   uint32_t new_size)
  66 {
  67         uint32_t old_size = trans->out.data.length;
  68         if (!trans2_grow_data(req, trans, new_size)) {
  69                 return False;
  70         }
  71         if (new_size > old_size) {
  72                 memset(trans->out.data.data + old_size, 0, new_size - old_size);
  73         }
  74         return True;
  75 }
  76
  77
  78 /* setup a trans2 reply, given the data and params sizes */
  79 static void trans2_setup_reply(struct smbsrv_request *req,
  80                                struct smb_trans2 *trans,
  81                                uint16_t param_size, uint16_t data_size,
  82                                uint16_t setup_count)
  83 {
  84         trans->out.setup_count = setup_count;
  85         if (setup_count != 0) {
  86                 trans->out.setup = talloc_zero_array_p(req, uint16_t, setup_count);
  87         }
  88         trans->out.params = data_blob_talloc(req, NULL, param_size);
  89         trans->out.data = data_blob_talloc(req, NULL, data_size);
  90 }
  91
  92
  93 /*
  94   pull a string from a blob in a trans2 request
  95 */
  96 static size_t trans2_pull_blob_string(struct smbsrv_request *req,
  97                                       const DATA_BLOB *blob,
  98                                       uint16_t offset,
  99                                       const char **str,
 100                                       int flags)
 101 {
 102         /* we use STR_NO_RANGE_CHECK because the params are allocated
 103            separately in a DATA_BLOB, so we need to do our own range
 104            checking */
 105         if (offset >= blob->length) {
 106                 *str = NULL;
 107                 return 0;
 108         }
 109
 110         return req_pull_string(req, str,
 111                                blob->data + offset,
 112                                blob->length - offset,
 113                                STR_NO_RANGE_CHECK | flags);
 114 }
 115
 116 /*
 117   push a string into the data section of a trans2 request
 118   return the number of bytes consumed in the output
 119 */
 120 static size_t trans2_push_data_string(struct smbsrv_request *req,
 121                                       struct smb_trans2 *trans,
 122                                       uint32_t len_offset,
 123                                       uint32_t offset,
 124                                       const WIRE_STRING *str,
 125                                       int dest_len,
 126                                       int flags)
 127 {
 128         int alignment = 0, ret = 0, pkt_len;
 129
 130         /* we use STR_NO_RANGE_CHECK because the params are allocated
 131            separately in a DATA_BLOB, so we need to do our own range
 132            checking */
 133         if (!str->s || offset >= trans->out.data.length) {
 134                 if (flags & STR_LEN8BIT) {
 135                         SCVAL(trans->out.data.data, len_offset, 0);
 136                 } else {
 137                         SIVAL(trans->out.data.data, len_offset, 0);
 138                 }
 139                 return 0;
 140         }
 141
 142         flags |= STR_NO_RANGE_CHECK;
 143
 144         if (dest_len == -1 || (dest_len > trans->out.data.length - offset)) {
 145                 dest_len = trans->out.data.length - offset;
 146         }
 147
 148         if (!(flags & (STR_ASCII|STR_UNICODE))) {
 149                 flags |= (req->flags2 & FLAGS2_UNICODE_STRINGS) ? STR_UNICODE : STR_ASCII;
 150         }
 151
 152         if ((offset&1) && (flags & STR_UNICODE) && !(flags & STR_NOALIGN)) {
 153                 alignment = 1;
 154                 if (dest_len > 0) {
 155                         SCVAL(trans->out.data.data + offset, 0, 0);
 156                         ret = push_string(trans->out.data.data + offset + 1, str->s, dest_len-1, flags);
 157                 }
 158         } else {
 159                 ret = push_string(trans->out.data.data + offset, str->s, dest_len, flags);
 160         }
 161
 162         /* sometimes the string needs to be terminated, but the length
 163            on the wire must not include the termination! */
 164         pkt_len = ret;
 165
 166         if ((flags & STR_LEN_NOTERM) && (flags & STR_TERMINATE)) {
 167                 if ((flags & STR_UNICODE) && ret >= 2) {
 168                         pkt_len = ret-2;
 169                 }
 170                 if ((flags & STR_ASCII) && ret >= 1) {
 171                         pkt_len = ret-1;
 172                 }
 173         }
 174
 175         if (flags & STR_LEN8BIT) {
 176                 SCVAL(trans->out.data.data, len_offset, pkt_len);
 177         } else {
 178                 SIVAL(trans->out.data.data, len_offset, pkt_len);
 179         }
 180
 181         return ret + alignment;
 182 }
 183
 184 /*
 185   append a string to the data section of a trans2 reply
 186   len_offset points to the place in the packet where the length field
 187   should go
 188 */
 189 static void trans2_append_data_string(struct smbsrv_request *req,
 190                                         struct smb_trans2 *trans,
 191                                         const WIRE_STRING *str,
 192                                         uint_t len_offset,
 193                                         int flags)
 194 {
 195         size_t ret;
 196         uint32_t offset;
 197         const int max_bytes_per_char = 3;
 198
 199         offset = trans->out.data.length;
 200         trans2_grow_data(req, trans, offset + (2+strlen_m(str->s))*max_bytes_per_char);
 201         ret = trans2_push_data_string(req, trans, len_offset, offset, str, -1, flags);
 202         trans2_grow_data(req, trans, offset + ret);
 203 }
 204
 205 /*
 206   align the end of the data section of a trans reply on an even boundary
 207 */
 208 static void trans2_align_data(struct smbsrv_request *req, struct smb_trans2 *trans)
 209 {
 210         if ((trans->out.data.length & 1) == 0) {
 211                 return;
 212         }
 213         trans2_grow_data(req, trans, trans->out.data.length+1);
 214         SCVAL(trans->out.data.data, trans->out.data.length-1, 0);
 215 }
 216
 217
 218 /*
 219   trans2 qfsinfo implementation
 220 */
 221 static NTSTATUS trans2_qfsinfo(struct smbsrv_request *req, struct smb_trans2 *trans)
 222 {
 223         union smb_fsinfo fsinfo;
 224         NTSTATUS status;
 225         uint16_t level;
 226         uint_t i;
 227         DATA_BLOB guid_blob;
 228
 229         /* make sure we got enough parameters */
 230         if (trans->in.params.length != 2) {
 231                 return NT_STATUS_FOOBAR;
 232         }
 233
 234         level = SVAL(trans->in.params.data, 0);
 235
 236         switch (level) {
 237         case SMB_QFS_ALLOCATION:
 238                 fsinfo.allocation.level = RAW_QFS_ALLOCATION;
 239
 240                 status = ntvfs_fsinfo(req, &fsinfo);
 241                 if (!NT_STATUS_IS_OK(status)) {
 242                         return status;
 243                 }
 244
 245                 trans2_setup_reply(req, trans, 0, 18, 0);
 246
 247                 SIVAL(trans->out.data.data,  0, fsinfo.allocation.out.fs_id);
 248                 SIVAL(trans->out.data.data,  4, fsinfo.allocation.out.sectors_per_unit);
 249                 SIVAL(trans->out.data.data,  8, fsinfo.allocation.out.total_alloc_units);
 250                 SIVAL(trans->out.data.data, 12, fsinfo.allocation.out.avail_alloc_units);
 251                 SSVAL(trans->out.data.data, 16, fsinfo.allocation.out.bytes_per_sector);
 252
 253                 return NT_STATUS_OK;
 254
 255         case SMB_QFS_VOLUME:
 256                 fsinfo.volume.level = RAW_QFS_VOLUME;
 257
 258                 status = ntvfs_fsinfo(req, &fsinfo);
 259                 if (!NT_STATUS_IS_OK(status)) {
 260                         return status;
 261                 }
 262
 263                 trans2_setup_reply(req, trans, 0, 5, 0);
 264
 265                 SIVAL(trans->out.data.data,       0, fsinfo.volume.out.serial_number);
 266                 /* w2k3 implements this incorrectly for unicode - it
 267                  * leaves the last byte off the string */
 268                 trans2_append_data_string(req, trans,
 269                                           &fsinfo.volume.out.volume_name,
 270                                           4, STR_LEN8BIT|STR_NOALIGN);
 271
 272                 return NT_STATUS_OK;
 273
 274         case SMB_QFS_VOLUME_INFO:
 275         case SMB_QFS_VOLUME_INFORMATION:
 276                 fsinfo.volume_info.level = RAW_QFS_VOLUME_INFO;
 277
 278                 status = ntvfs_fsinfo(req, &fsinfo);
 279                 if (!NT_STATUS_IS_OK(status)) {
 280                         return status;
 281                 }
 282
 283                 trans2_setup_reply(req, trans, 0, 18, 0);
 284
 285                 push_nttime(trans->out.data.data, 0, fsinfo.volume_info.out.create_time);
 286                 SIVAL(trans->out.data.data,       8, fsinfo.volume_info.out.serial_number);
 287                 SSVAL(trans->out.data.data,      16, 0); /* padding */
 288                 trans2_append_data_string(req, trans,
 289                                           &fsinfo.volume_info.out.volume_name,
 290                                           12, STR_UNICODE);
 291
 292                 return NT_STATUS_OK;
 293
 294         case SMB_QFS_SIZE_INFO:
 295         case SMB_QFS_SIZE_INFORMATION:
 296                 fsinfo.size_info.level = RAW_QFS_SIZE_INFO;
 297
 298                 status = ntvfs_fsinfo(req, &fsinfo);
 299                 if (!NT_STATUS_IS_OK(status)) {
 300                         return status;
 301                 }
 302
 303                 trans2_setup_reply(req, trans, 0, 24, 0);
 304
 305                 SBVAL(trans->out.data.data,  0, fsinfo.size_info.out.total_alloc_units);
 306                 SBVAL(trans->out.data.data,  8, fsinfo.size_info.out.avail_alloc_units);
 307                 SIVAL(trans->out.data.data, 16, fsinfo.size_info.out.sectors_per_unit);
 308                 SIVAL(trans->out.data.data, 20, fsinfo.size_info.out.bytes_per_sector);
 309
 310                 return NT_STATUS_OK;
 311
 312         case SMB_QFS_DEVICE_INFO:
 313         case SMB_QFS_DEVICE_INFORMATION:
 314                 fsinfo.device_info.level = RAW_QFS_DEVICE_INFO;
 315
 316                 status = ntvfs_fsinfo(req, &fsinfo);
 317                 if (!NT_STATUS_IS_OK(status)) {
 318                         return status;
 319                 }
 320                 trans2_setup_reply(req, trans, 0, 8, 0);
 321                 SIVAL(trans->out.data.data,      0, fsinfo.device_info.out.device_type);
 322                 SIVAL(trans->out.data.data,      4, fsinfo.device_info.out.characteristics);
 323                 return NT_STATUS_OK;
 324
 325
 326         case SMB_QFS_ATTRIBUTE_INFO:
 327         case SMB_QFS_ATTRIBUTE_INFORMATION:
 328                 fsinfo.attribute_info.level = RAW_QFS_ATTRIBUTE_INFO;
 329
 330                 status = ntvfs_fsinfo(req, &fsinfo);
 331                 if (!NT_STATUS_IS_OK(status)) {
 332                         return status;
 333                 }
 334
 335                 trans2_setup_reply(req, trans, 0, 12, 0);
 336
 337                 SIVAL(trans->out.data.data, 0, fsinfo.attribute_info.out.fs_attr);
 338                 SIVAL(trans->out.data.data, 4, fsinfo.attribute_info.out.max_file_component_length);
 339                 /* this must not be null terminated or win98 gets
 340                    confused!  also note that w2k3 returns this as
 341                    unicode even when ascii is negotiated */
 342                 trans2_append_data_string(req, trans,
 343                                           &fsinfo.attribute_info.out.fs_type,
 344                                           8, STR_UNICODE);
 345                 return NT_STATUS_OK;
 346
 347
 348         case SMB_QFS_QUOTA_INFORMATION:
 349                 fsinfo.quota_information.level = RAW_QFS_QUOTA_INFORMATION;
 350
 351                 status = ntvfs_fsinfo(req, &fsinfo);
 352                 if (!NT_STATUS_IS_OK(status)) {
 353                         return status;
 354                 }
 355
 356                 trans2_setup_reply(req, trans, 0, 48, 0);
 357
 358                 SBVAL(trans->out.data.data,   0, fsinfo.quota_information.out.unknown[0]);
 359                 SBVAL(trans->out.data.data,   8, fsinfo.quota_information.out.unknown[1]);
 360                 SBVAL(trans->out.data.data,  16, fsinfo.quota_information.out.unknown[2]);
 361                 SBVAL(trans->out.data.data,  24, fsinfo.quota_information.out.quota_soft);
 362                 SBVAL(trans->out.data.data,  32, fsinfo.quota_information.out.quota_hard);
 363                 SBVAL(trans->out.data.data,  40, fsinfo.quota_information.out.quota_flags);
 364
 365                 return NT_STATUS_OK;
 366
 367
 368         case SMB_QFS_FULL_SIZE_INFORMATION:
 369                 fsinfo.full_size_information.level = RAW_QFS_FULL_SIZE_INFORMATION;
 370
 371                 status = ntvfs_fsinfo(req, &fsinfo);
 372                 if (!NT_STATUS_IS_OK(status)) {
 373                         return status;
 374                 }
 375
 376                 trans2_setup_reply(req, trans, 0, 32, 0);
 377
 378                 SBVAL(trans->out.data.data,  0, fsinfo.full_size_information.out.total_alloc_units);
 379                 SBVAL(trans->out.data.data,  8, fsinfo.full_size_information.out.call_avail_alloc_units);
 380                 SBVAL(trans->out.data.data, 16, fsinfo.full_size_information.out.actual_avail_alloc_units);
 381                 SIVAL(trans->out.data.data, 24, fsinfo.full_size_information.out.sectors_per_unit);
 382                 SIVAL(trans->out.data.data, 28, fsinfo.full_size_information.out.bytes_per_sector);
 383
 384                 return NT_STATUS_OK;
 385
 386         case SMB_QFS_OBJECTID_INFORMATION:
 387                 fsinfo.objectid_information.level = RAW_QFS_OBJECTID_INFORMATION;
 388
 389                 status = ntvfs_fsinfo(req, &fsinfo);
 390                 if (!NT_STATUS_IS_OK(status)) {
 391                         return status;
 392                 }
 393
 394                 trans2_setup_reply(req, trans, 0, 64, 0);
 395
 396                 status = ndr_push_struct_blob(&guid_blob, req,
 397                                               &fsinfo.objectid_information.out.guid,
 398                                               (ndr_push_flags_fn_t)ndr_push_GUID);
 399                 if (!NT_STATUS_IS_OK(status)) {
 400                         return status;
 401                 }
 402
 403                 memcpy(trans->out.data.data, guid_blob.data, guid_blob.length);
 404
 405                 for (i=0;i<6;i++) {
 406                         SBVAL(trans->out.data.data, 16 + 8*i, fsinfo.objectid_information.out.unknown[i]);
 407                 }
 408                 return NT_STATUS_OK;
 409         }
 410
 411         return NT_STATUS_INVALID_LEVEL;
 412 }
 413
 414
 415 /*
 416   trans2 open implementation
 417 */
 418 static NTSTATUS trans2_open(struct smbsrv_request *req, struct smb_trans2 *trans)
 419 {
 420         union smb_open *io;
 421         NTSTATUS status;
 422
 423         /* make sure we got enough parameters */
 424         if (trans->in.params.length < 29) {
 425                 return NT_STATUS_FOOBAR;
 426         }
 427
 428         io = talloc_p(req, union smb_open);
 429         if (io == NULL) {
 430                 return NT_STATUS_NO_MEMORY;
 431         }
 432
 433         io->t2open.level         = RAW_OPEN_T2OPEN;
 434         io->t2open.in.flags      = SVAL(trans->in.params.data, VWV(0));
 435         io->t2open.in.open_mode  = SVAL(trans->in.params.data, VWV(1));
 436         io->t2open.in.file_attrs = SVAL(trans->in.params.data, VWV(3));
 437         io->t2open.in.write_time = srv_pull_dos_date(req->smb_conn,
 438                                                     trans->in.params.data + VWV(4));;
 439         io->t2open.in.open_func  = SVAL(trans->in.params.data, VWV(6));
 440         io->t2open.in.size       = IVAL(trans->in.params.data, VWV(7));
 441         io->t2open.in.timeout    = IVAL(trans->in.params.data, VWV(9));
 442         io->t2open.in.num_eas    = 0;
 443         io->t2open.in.eas        = NULL;
 444
 445         trans2_pull_blob_string(req, &trans->in.params, 28, &io->t2open.in.fname, 0);
 446
 447         status = ea_pull_list(&trans->in.data, io, &io->t2open.in.num_eas, &io->t2open.in.eas);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 return status;
 450         }
 451
 452         status = ntvfs_openfile(req, io);
 453         if (!NT_STATUS_IS_OK(status)) {
 454                 return status;
 455         }
 456
 457         trans2_setup_reply(req, trans, 30, 0, 0);
 458
 459         SSVAL(trans->out.params.data, VWV(0), io->t2open.out.fnum);
 460         SSVAL(trans->out.params.data, VWV(1), io->t2open.out.attrib);
 461         srv_push_dos_date3(req->smb_conn, trans->out.params.data,
 462                            VWV(2), io->t2open.out.write_time);
 463         SIVAL(trans->out.params.data, VWV(4), io->t2open.out.size);
 464         SSVAL(trans->out.params.data, VWV(6), io->t2open.out.access);
 465         SSVAL(trans->out.params.data, VWV(7), io->t2open.out.ftype);
 466         SSVAL(trans->out.params.data, VWV(8), io->t2open.out.devstate);
 467         SSVAL(trans->out.params.data, VWV(9), io->t2open.out.action);
 468         SIVAL(trans->out.params.data, VWV(10), 0); /* reserved */
 469         SSVAL(trans->out.params.data, VWV(12), 0); /* EaErrorOffset */
 470         SIVAL(trans->out.params.data, VWV(13), 0); /* EaLength */
 471
 472         return status;
 473 }
 474
 475
 476 /*
 477   trans2 mkdir implementation
 478 */
 479 static NTSTATUS trans2_mkdir(struct smbsrv_request *req, struct smb_trans2 *trans)
 480 {
 481         union smb_mkdir *io;
 482         NTSTATUS status;
 483
 484         /* make sure we got enough parameters */
 485         if (trans->in.params.length < 5) {
 486                 return NT_STATUS_FOOBAR;
 487         }
 488
 489         io = talloc_p(req, union smb_mkdir);
 490         if (io == NULL) {
 491                 return NT_STATUS_NO_MEMORY;
 492         }
 493
 494         io->t2mkdir.level = RAW_MKDIR_T2MKDIR;
 495         trans2_pull_blob_string(req, &trans->in.params, 4, &io->t2mkdir.in.path, 0);
 496
 497         status = ea_pull_list(&trans->in.data, io,
 498                               &io->t2mkdir.in.num_eas,
 499                               &io->t2mkdir.in.eas);
 500         if (!NT_STATUS_IS_OK(status)) {
 501                 return status;
 502         }
 503
 504         status = ntvfs_mkdir(req, io);
 505         if (!NT_STATUS_IS_OK(status)) {
 506                 return status;
 507         }
 508
 509         trans2_setup_reply(req, trans, 2, 0, 0);
 510
 511         SSVAL(trans->out.params.data, VWV(0), 0);
 512
 513         return status;
 514 }
 515
 516 /*
 517   fill in the reply from a qpathinfo or qfileinfo call
 518 */
 519 static NTSTATUS trans2_fileinfo_fill(struct smbsrv_request *req, struct smb_trans2 *trans,
 520                                      union smb_fileinfo *st)
 521 {
 522         uint_t i;
 523         uint32_t list_size;
 524
 525         switch (st->generic.level) {
 526         case RAW_FILEINFO_GENERIC:
 527         case RAW_FILEINFO_GETATTR:
 528         case RAW_FILEINFO_GETATTRE:
 529         case RAW_FILEINFO_SEC_DESC:
 530                 /* handled elsewhere */
 531                 return NT_STATUS_INVALID_LEVEL;
 532
 533         case RAW_FILEINFO_BASIC_INFO:
 534         case RAW_FILEINFO_BASIC_INFORMATION:
 535                 trans2_setup_reply(req, trans, 2, 40, 0);
 536
 537                 SSVAL(trans->out.params.data, 0, 0);
 538                 push_nttime(trans->out.data.data,  0, st->basic_info.out.create_time);
 539                 push_nttime(trans->out.data.data,  8, st->basic_info.out.access_time);
 540                 push_nttime(trans->out.data.data, 16, st->basic_info.out.write_time);
 541                 push_nttime(trans->out.data.data, 24, st->basic_info.out.change_time);
 542                 SIVAL(trans->out.data.data,       32, st->basic_info.out.attrib);
 543                 SIVAL(trans->out.data.data,       36, 0); /* padding */
 544                 return NT_STATUS_OK;
 545
 546         case RAW_FILEINFO_STANDARD:
 547                 trans2_setup_reply(req, trans, 2, 22, 0);
 548
 549                 SSVAL(trans->out.params.data, 0, 0);
 550                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 0, st->standard.out.create_time);
 551                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 4, st->standard.out.access_time);
 552                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 8, st->standard.out.write_time);
 553                 SIVAL(trans->out.data.data,        12, st->standard.out.size);
 554                 SIVAL(trans->out.data.data,        16, st->standard.out.alloc_size);
 555                 SSVAL(trans->out.data.data,        20, st->standard.out.attrib);
 556                 return NT_STATUS_OK;
 557
 558         case RAW_FILEINFO_EA_SIZE:
 559                 trans2_setup_reply(req, trans, 2, 26, 0);
 560
 561                 SSVAL(trans->out.params.data, 0, 0);
 562                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 0, st->ea_size.out.create_time);
 563                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 4, st->ea_size.out.access_time);
 564                 srv_push_dos_date2(req->smb_conn, trans->out.data.data, 8, st->ea_size.out.write_time);
 565                 SIVAL(trans->out.data.data,        12, st->ea_size.out.size);
 566                 SIVAL(trans->out.data.data,        16, st->ea_size.out.alloc_size);
 567                 SSVAL(trans->out.data.data,        20, st->ea_size.out.attrib);
 568                 SIVAL(trans->out.data.data,        22, st->ea_size.out.ea_size);
 569                 return NT_STATUS_OK;
 570
 571         case RAW_FILEINFO_NETWORK_OPEN_INFORMATION:
 572                 trans2_setup_reply(req, trans, 2, 56, 0);
 573
 574                 SSVAL(trans->out.params.data, 0, 0);
 575                 push_nttime(trans->out.data.data,  0, st->network_open_information.out.create_time);
 576                 push_nttime(trans->out.data.data,  8, st->network_open_information.out.access_time);
 577                 push_nttime(trans->out.data.data, 16, st->network_open_information.out.write_time);
 578                 push_nttime(trans->out.data.data, 24, st->network_open_information.out.change_time);
 579                 SBVAL(trans->out.data.data,       32, st->network_open_information.out.alloc_size);
 580                 SBVAL(trans->out.data.data,       40, st->network_open_information.out.size);
 581                 SIVAL(trans->out.data.data,       48, st->network_open_information.out.attrib);
 582                 SIVAL(trans->out.data.data,       52, 0); /* padding */
 583                 return NT_STATUS_OK;
 584
 585         case RAW_FILEINFO_STANDARD_INFO:
 586         case RAW_FILEINFO_STANDARD_INFORMATION:
 587                 trans2_setup_reply(req, trans, 2, 24, 0);
 588                 SSVAL(trans->out.params.data, 0, 0);
 589                 SBVAL(trans->out.data.data,  0, st->standard_info.out.alloc_size);
 590                 SBVAL(trans->out.data.data,  8, st->standard_info.out.size);
 591                 SIVAL(trans->out.data.data, 16, st->standard_info.out.nlink);
 592                 SCVAL(trans->out.data.data, 20, st->standard_info.out.delete_pending);
 593                 SCVAL(trans->out.data.data, 21, st->standard_info.out.directory);
 594                 SSVAL(trans->out.data.data, 22, 0); /* padding */
 595                 return NT_STATUS_OK;
 596
 597         case RAW_FILEINFO_ATTRIBUTE_TAG_INFORMATION:
 598                 trans2_setup_reply(req, trans, 2, 8, 0);
 599                 SSVAL(trans->out.params.data, 0, 0);
 600                 SIVAL(trans->out.data.data,  0, st->attribute_tag_information.out.attrib);
 601                 SIVAL(trans->out.data.data,  4, st->attribute_tag_information.out.reparse_tag);
 602                 return NT_STATUS_OK;
 603
 604         case RAW_FILEINFO_EA_INFO:
 605         case RAW_FILEINFO_EA_INFORMATION:
 606                 trans2_setup_reply(req, trans, 2, 4, 0);
 607                 SSVAL(trans->out.params.data, 0, 0);
 608                 SIVAL(trans->out.data.data,  0, st->ea_info.out.ea_size);
 609                 return NT_STATUS_OK;
 610
 611         case RAW_FILEINFO_MODE_INFORMATION:
 612                 trans2_setup_reply(req, trans, 2, 4, 0);
 613                 SSVAL(trans->out.params.data, 0, 0);
 614                 SIVAL(trans->out.data.data,  0, st->mode_information.out.mode);
 615                 return NT_STATUS_OK;
 616
 617         case RAW_FILEINFO_ALIGNMENT_INFORMATION:
 618                 trans2_setup_reply(req, trans, 2, 4, 0);
 619                 SSVAL(trans->out.params.data, 0, 0);
 620                 SIVAL(trans->out.data.data,  0,
 621                       st->alignment_information.out.alignment_requirement);
 622                 return NT_STATUS_OK;
 623
 624         case RAW_FILEINFO_EA_LIST:
 625                 list_size = ea_list_size(st->ea_list.out.num_eas,
 626                                          st->ea_list.out.eas);
 627                 trans2_setup_reply(req, trans, 2, list_size, 0);
 628                 SSVAL(trans->out.params.data, 0, 0);
 629                 ea_put_list(trans->out.data.data,
 630                             st->ea_list.out.num_eas, st->ea_list.out.eas);
 631                 return NT_STATUS_OK;
 632
 633         case RAW_FILEINFO_ALL_EAS:
 634                 list_size = ea_list_size(st->all_eas.out.num_eas,
 635                                                   st->all_eas.out.eas);
 636                 trans2_setup_reply(req, trans, 2, list_size, 0);
 637                 SSVAL(trans->out.params.data, 0, 0);
 638                 ea_put_list(trans->out.data.data,
 639                             st->all_eas.out.num_eas, st->all_eas.out.eas);
 640                 return NT_STATUS_OK;
 641
 642         case RAW_FILEINFO_ACCESS_INFORMATION:
 643                 trans2_setup_reply(req, trans, 2, 4, 0);
 644                 SSVAL(trans->out.params.data, 0, 0);
 645                 SIVAL(trans->out.data.data,  0, st->access_information.out.access_flags);
 646                 return NT_STATUS_OK;
 647
 648         case RAW_FILEINFO_POSITION_INFORMATION:
 649                 trans2_setup_reply(req, trans, 2, 8, 0);
 650                 SSVAL(trans->out.params.data, 0, 0);
 651                 SBVAL(trans->out.data.data,  0, st->position_information.out.position);
 652                 return NT_STATUS_OK;
 653
 654         case RAW_FILEINFO_COMPRESSION_INFO:
 655         case RAW_FILEINFO_COMPRESSION_INFORMATION:
 656                 trans2_setup_reply(req, trans, 2, 16, 0);
 657                 SSVAL(trans->out.params.data, 0, 0);
 658                 SBVAL(trans->out.data.data,  0, st->compression_info.out.compressed_size);
 659                 SSVAL(trans->out.data.data,  8, st->compression_info.out.format);
 660                 SCVAL(trans->out.data.data, 10, st->compression_info.out.unit_shift);
 661                 SCVAL(trans->out.data.data, 11, st->compression_info.out.chunk_shift);
 662                 SCVAL(trans->out.data.data, 12, st->compression_info.out.cluster_shift);
 663                 SSVAL(trans->out.data.data, 13, 0); /* 3 bytes padding */
 664                 SCVAL(trans->out.data.data, 15, 0);
 665                 return NT_STATUS_OK;
 666
 667         case RAW_FILEINFO_IS_NAME_VALID:
 668                 trans2_setup_reply(req, trans, 2, 0, 0);
 669                 SSVAL(trans->out.params.data, 0, 0);
 670                 return NT_STATUS_OK;
 671
 672         case RAW_FILEINFO_INTERNAL_INFORMATION:
 673                 trans2_setup_reply(req, trans, 2, 8, 0);
 674                 SSVAL(trans->out.params.data, 0, 0);
 675                 SBVAL(trans->out.data.data,  0, st->internal_information.out.file_id);
 676                 return NT_STATUS_OK;
 677
 678         case RAW_FILEINFO_ALL_INFO:
 679         case RAW_FILEINFO_ALL_INFORMATION:
 680                 trans2_setup_reply(req, trans, 2, 72, 0);
 681
 682                 SSVAL(trans->out.params.data, 0, 0);
 683                 push_nttime(trans->out.data.data,  0, st->all_info.out.create_time);
 684                 push_nttime(trans->out.data.data,  8, st->all_info.out.access_time);
 685                 push_nttime(trans->out.data.data, 16, st->all_info.out.write_time);
 686                 push_nttime(trans->out.data.data, 24, st->all_info.out.change_time);
 687                 SIVAL(trans->out.data.data,       32, st->all_info.out.attrib);
 688                 SIVAL(trans->out.data.data,       36, 0);
 689                 SBVAL(trans->out.data.data,       40, st->all_info.out.alloc_size);
 690                 SBVAL(trans->out.data.data,       48, st->all_info.out.size);
 691                 SIVAL(trans->out.data.data,       56, st->all_info.out.nlink);
 692                 SCVAL(trans->out.data.data,       60, st->all_info.out.delete_pending);
 693                 SCVAL(trans->out.data.data,       61, st->all_info.out.directory);
 694                 SSVAL(trans->out.data.data,       62, 0); /* padding */
 695                 SIVAL(trans->out.data.data,       64, st->all_info.out.ea_size);
 696                 trans2_append_data_string(req, trans, &st->all_info.out.fname,
 697                                           68, STR_UNICODE);
 698                 return NT_STATUS_OK;
 699
 700         case RAW_FILEINFO_NAME_INFO:
 701         case RAW_FILEINFO_NAME_INFORMATION:
 702                 trans2_setup_reply(req, trans, 2, 4, 0);
 703                 SSVAL(trans->out.params.data, 0, 0);
 704                 trans2_append_data_string(req, trans, &st->name_info.out.fname, 0, STR_UNICODE);
 705                 return NT_STATUS_OK;
 706
 707         case RAW_FILEINFO_ALT_NAME_INFO:
 708         case RAW_FILEINFO_ALT_NAME_INFORMATION:
 709                 trans2_setup_reply(req, trans, 2, 4, 0);
 710                 SSVAL(trans->out.params.data, 0, 0);
 711                 trans2_append_data_string(req, trans, &st->alt_name_info.out.fname, 0, STR_UNICODE);
 712                 return NT_STATUS_OK;
 713
 714         case RAW_FILEINFO_STREAM_INFO:
 715         case RAW_FILEINFO_STREAM_INFORMATION:
 716                 trans2_setup_reply(req, trans, 2, 0, 0);
 717
 718                 SSVAL(trans->out.params.data, 0, 0);
 719
 720                 for (i=0;i<st->stream_info.out.num_streams;i++) {
 721                         uint32_t data_size = trans->out.data.length;
 722                         uint8_t *data;
 723
 724                         trans2_grow_data(req, trans, data_size + 24);
 725                         data = trans->out.data.data + data_size;
 726                         SBVAL(data,  8, st->stream_info.out.streams[i].size);
 727                         SBVAL(data, 16, st->stream_info.out.streams[i].alloc_size);
 728                         trans2_append_data_string(req, trans,
 729                                                   &st->stream_info.out.streams[i].stream_name,
 730                                                   data_size + 4, STR_UNICODE);
 731                         if (i == st->stream_info.out.num_streams - 1) {
 732                                 SIVAL(trans->out.data.data, data_size, 0);
 733                         } else {
 734                                 trans2_grow_data_fill(req, trans, (trans->out.data.length+7)&~7);
 735                                 SIVAL(trans->out.data.data, data_size,
 736                                       trans->out.data.length - data_size);
 737                         }
 738                 }
 739                 return NT_STATUS_OK;
 740         }
 741
 742         return NT_STATUS_INVALID_LEVEL;
 743 }
 744
 745 /*
 746   trans2 qpathinfo implementation
 747 */
 748 static NTSTATUS trans2_qpathinfo(struct smbsrv_request *req, struct smb_trans2 *trans)
 749 {
 750         union smb_fileinfo st;
 751         NTSTATUS status;
 752         uint16_t level;
 753
 754         /* make sure we got enough parameters */
 755         if (trans->in.params.length < 2) {
 756                 return NT_STATUS_FOOBAR;
 757         }
 758
 759         level = SVAL(trans->in.params.data, 0);
 760
 761         trans2_pull_blob_string(req, &trans->in.params, 6, &st.generic.in.fname, 0);
 762         if (st.generic.in.fname == NULL) {
 763                 return NT_STATUS_FOOBAR;
 764         }
 765
 766         /* work out the backend level - we make it 1-1 in the header */
 767         st.generic.level = (enum smb_fileinfo_level)level;
 768         if (st.generic.level >= RAW_FILEINFO_GENERIC) {
 769                 return NT_STATUS_INVALID_LEVEL;
 770         }
 771
 772         if (st.generic.level == RAW_FILEINFO_EA_LIST) {
 773                 status = ea_pull_name_list(&trans->in.data, req,
 774                                            &st.ea_list.in.num_names,
 775                                            &st.ea_list.in.ea_names);
 776                 if (!NT_STATUS_IS_OK(status)) {
 777                         return status;
 778                 }
 779         }
 780
 781         /* call the backend */
 782         status = ntvfs_qpathinfo(req, &st);
 783         if (!NT_STATUS_IS_OK(status)) {
 784                 return status;
 785         }
 786
 787         /* fill in the reply parameters */
 788         status = trans2_fileinfo_fill(req, trans, &st);
 789
 790         return status;
 791 }
 792
 793
 794 /*
 795   trans2 qpathinfo implementation
 796 */
 797 static NTSTATUS trans2_qfileinfo(struct smbsrv_request *req, struct smb_trans2 *trans)
 798 {
 799         union smb_fileinfo st;
 800         NTSTATUS status;
 801         uint16_t level;
 802
 803         /* make sure we got enough parameters */
 804         if (trans->in.params.length < 4) {
 805                 return NT_STATUS_FOOBAR;
 806         }
 807
 808         st.generic.in.fnum  = SVAL(trans->in.params.data, 0);
 809         level = SVAL(trans->in.params.data, 2);
 810
 811         /* work out the backend level - we make it 1-1 in the header */
 812         st.generic.level = (enum smb_fileinfo_level)level;
 813         if (st.generic.level >= RAW_FILEINFO_GENERIC) {
 814                 return NT_STATUS_INVALID_LEVEL;
 815         }
 816
 817         if (st.generic.level == RAW_FILEINFO_EA_LIST) {
 818                 status = ea_pull_name_list(&trans->in.data, req,
 819                                            &st.ea_list.in.num_names,
 820                                            &st.ea_list.in.ea_names);
 821                 if (!NT_STATUS_IS_OK(status)) {
 822                         return status;
 823                 }
 824         }
 825
 826         /* call the backend */
 827         status = ntvfs_qfileinfo(req, &st);
 828         if (!NT_STATUS_IS_OK(status)) {
 829                 return status;
 830         }
 831
 832         /* fill in the reply parameters */
 833         status = trans2_fileinfo_fill(req, trans, &st);
 834
 835         return status;
 836 }
 837
 838
 839 /*
 840   parse a trans2 setfileinfo/setpathinfo data blob
 841 */
 842 static NTSTATUS trans2_parse_sfileinfo(struct smbsrv_request *req,
 843                                        union smb_setfileinfo *st,
 844                                        const DATA_BLOB *blob)
 845 {
 846         uint32_t len;
 847
 848         switch (st->generic.level) {
 849         case RAW_SFILEINFO_GENERIC:
 850         case RAW_SFILEINFO_SETATTR:
 851         case RAW_SFILEINFO_SETATTRE:
 852         case RAW_SFILEINFO_SEC_DESC:
 853                 /* handled elsewhere */
 854                 return NT_STATUS_INVALID_LEVEL;
 855
 856         case RAW_SFILEINFO_STANDARD:
 857                 CHECK_MIN_BLOB_SIZE(blob, 12);
 858                 st->standard.in.create_time = srv_pull_dos_date2(req->smb_conn, blob->data + 0);
 859                 st->standard.in.access_time = srv_pull_dos_date2(req->smb_conn, blob->data + 4);
 860                 st->standard.in.write_time  = srv_pull_dos_date2(req->smb_conn, blob->data + 8);
 861                 return NT_STATUS_OK;
 862
 863         case RAW_SFILEINFO_EA_SET:
 864                 return ea_pull_list(blob, req,
 865                                     &st->ea_set.in.num_eas,
 866                                     &st->ea_set.in.eas);
 867
 868         case SMB_SFILEINFO_BASIC_INFO:
 869         case SMB_SFILEINFO_BASIC_INFORMATION:
 870                 CHECK_MIN_BLOB_SIZE(blob, 36);
 871                 st->basic_info.in.create_time = pull_nttime(blob->data,  0);
 872                 st->basic_info.in.access_time = pull_nttime(blob->data,  8);
 873                 st->basic_info.in.write_time =  pull_nttime(blob->data, 16);
 874                 st->basic_info.in.change_time = pull_nttime(blob->data, 24);
 875                 st->basic_info.in.attrib =      IVAL(blob->data,        32);
 876                 return NT_STATUS_OK;
 877
 878         case SMB_SFILEINFO_DISPOSITION_INFO:
 879         case SMB_SFILEINFO_DISPOSITION_INFORMATION:
 880                 CHECK_MIN_BLOB_SIZE(blob, 1);
 881                 st->disposition_info.in.delete_on_close = CVAL(blob->data, 0);
 882                 return NT_STATUS_OK;
 883
 884         case SMB_SFILEINFO_ALLOCATION_INFO:
 885         case SMB_SFILEINFO_ALLOCATION_INFORMATION:
 886                 CHECK_MIN_BLOB_SIZE(blob, 8);
 887                 st->allocation_info.in.alloc_size = BVAL(blob->data, 0);
 888                 return NT_STATUS_OK;
 889
 890         case RAW_SFILEINFO_END_OF_FILE_INFO:
 891         case RAW_SFILEINFO_END_OF_FILE_INFORMATION:
 892                 CHECK_MIN_BLOB_SIZE(blob, 8);
 893                 st->end_of_file_info.in.size = BVAL(blob->data, 0);
 894                 return NT_STATUS_OK;
 895
 896         case RAW_SFILEINFO_RENAME_INFORMATION: {
 897                 DATA_BLOB blob2;
 898
 899                 CHECK_MIN_BLOB_SIZE(blob, 12);
 900                 st->rename_information.in.overwrite = CVAL(blob->data, 0);
 901                 st->rename_information.in.root_fid  = IVAL(blob->data, 4);
 902                 len                                 = IVAL(blob->data, 8);
 903                 blob2.data = blob->data+12;
 904                 blob2.length = MIN(blob->length, len);
 905                 trans2_pull_blob_string(req, &blob2, 0,
 906                                         &st->rename_information.in.new_name, STR_UNICODE);
 907                 return NT_STATUS_OK;
 908         }
 909
 910         case RAW_SFILEINFO_POSITION_INFORMATION:
 911                 CHECK_MIN_BLOB_SIZE(blob, 8);
 912                 st->position_information.in.position = BVAL(blob->data, 0);
 913                 return NT_STATUS_OK;
 914
 915         case RAW_SFILEINFO_MODE_INFORMATION:
 916                 CHECK_MIN_BLOB_SIZE(blob, 4);
 917                 st->mode_information.in.mode = IVAL(blob->data, 0);
 918                 return NT_STATUS_OK;
 919         }
 920
 921         return NT_STATUS_INVALID_LEVEL;
 922 }
 923
 924 /*
 925   trans2 setfileinfo implementation
 926 */
 927 static NTSTATUS trans2_setfileinfo(struct smbsrv_request *req, struct smb_trans2 *trans)
 928 {
 929         union smb_setfileinfo st;
 930         NTSTATUS status;
 931         uint16_t level, fnum;
 932         DATA_BLOB *blob;
 933
 934         /* make sure we got enough parameters */
 935         if (trans->in.params.length < 4) {
 936                 return NT_STATUS_FOOBAR;
 937         }
 938
 939         fnum  = SVAL(trans->in.params.data, 0);
 940         level = SVAL(trans->in.params.data, 2);
 941
 942         blob = &trans->in.data;
 943
 944         st.generic.file.fnum = fnum;
 945         st.generic.level = (enum smb_setfileinfo_level)level;
 946
 947         status = trans2_parse_sfileinfo(req, &st, blob);
 948         if (!NT_STATUS_IS_OK(status)) {
 949                 return status;
 950         }
 951
 952         status = ntvfs_setfileinfo(req, &st);
 953         if (!NT_STATUS_IS_OK(status)) {
 954                 return status;
 955         }
 956
 957         trans2_setup_reply(req, trans, 2, 0, 0);
 958         SSVAL(trans->out.params.data, 0, 0);
 959         return NT_STATUS_OK;
 960 }
 961
 962 /*
 963   trans2 setpathinfo implementation
 964 */
 965 static NTSTATUS trans2_setpathinfo(struct smbsrv_request *req, struct smb_trans2 *trans)
 966 {
 967         union smb_setfileinfo st;
 968         NTSTATUS status;
 969         uint16_t level;
 970         DATA_BLOB *blob;
 971
 972         /* make sure we got enough parameters */
 973         if (trans->in.params.length < 4) {
 974                 return NT_STATUS_FOOBAR;
 975         }
 976
 977         level = SVAL(trans->in.params.data, 0);
 978         blob = &trans->in.data;
 979         st.generic.level = (enum smb_setfileinfo_level)level;
 980
 981         trans2_pull_blob_string(req, &trans->in.params, 6, &st.generic.file.fname, 0);
 982         if (st.generic.file.fname == NULL) {
 983                 return NT_STATUS_FOOBAR;
 984         }
 985
 986         status = trans2_parse_sfileinfo(req, &st, blob);
 987         if (!NT_STATUS_IS_OK(status)) {
 988                 return status;
 989         }
 990
 991         status = ntvfs_setpathinfo(req, &st);
 992         if (!NT_STATUS_IS_OK(status)) {
 993                 return status;
 994         }
 995
 996         trans2_setup_reply(req, trans, 2, 0, 0);
 997         SSVAL(trans->out.params.data, 0, 0);
 998         return NT_STATUS_OK;
 999 }
1000
1001
1002 /* a structure to encapsulate the state information about an in-progress ffirst/fnext operation */
1003 struct find_state {
1004         struct smbsrv_request *req;
1005         struct smb_trans2 *trans;
1006         enum smb_search_level level;
1007         uint16_t last_entry_offset;
1008         uint16_t flags;
1009 };
1010
1011 /*
1012   fill a single entry in a trans2 find reply
1013 */
1014 static BOOL find_fill_info(struct smbsrv_request *req,
1015                            struct smb_trans2 *trans,
1016                            struct find_state *state,
1017                            union smb_search_data *file)
1018 {
1019         uint8_t *data;
1020         uint_t ofs = trans->out.data.length;
1021         uint32_t ea_size;
1022
1023         switch (state->level) {
1024         case RAW_SEARCH_SEARCH:
1025         case RAW_SEARCH_FFIRST:
1026         case RAW_SEARCH_FUNIQUE:
1027         case RAW_SEARCH_GENERIC:
1028                 /* handled elsewhere */
1029                 break;
1030
1031         case RAW_SEARCH_STANDARD:
1032                 if (state->flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) {
1033                         trans2_grow_data(req, trans, ofs + 27);
1034                         SIVAL(trans->out.data.data, ofs, file->standard.resume_key);
1035                         ofs += 4;
1036                 } else {
1037                         trans2_grow_data(req, trans, ofs + 23);
1038                 }
1039                 data = trans->out.data.data + ofs;
1040                 srv_push_dos_date2(req->smb_conn, data, 0, file->standard.create_time);
1041                 srv_push_dos_date2(req->smb_conn, data, 4, file->standard.access_time);
1042                 srv_push_dos_date2(req->smb_conn, data, 8, file->standard.write_time);
1043                 SIVAL(data, 12, file->standard.size);
1044                 SIVAL(data, 16, file->standard.alloc_size);
1045                 SSVAL(data, 20, file->standard.attrib);
1046                 trans2_append_data_string(req, trans, &file->standard.name,
1047                                           ofs + 22, STR_LEN8BIT | STR_TERMINATE | STR_LEN_NOTERM);
1048                 break;
1049
1050         case RAW_SEARCH_EA_SIZE:
1051                 if (state->flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) {
1052                         trans2_grow_data(req, trans, ofs + 31);
1053                         SIVAL(trans->out.data.data, ofs, file->ea_size.resume_key);
1054                         ofs += 4;
1055                 } else {
1056                         trans2_grow_data(req, trans, ofs + 27);
1057                 }
1058                 data = trans->out.data.data + ofs;
1059                 srv_push_dos_date2(req->smb_conn, data, 0, file->ea_size.create_time);
1060                 srv_push_dos_date2(req->smb_conn, data, 4, file->ea_size.access_time);
1061                 srv_push_dos_date2(req->smb_conn, data, 8, file->ea_size.write_time);
1062                 SIVAL(data, 12, file->ea_size.size);
1063                 SIVAL(data, 16, file->ea_size.alloc_size);
1064                 SSVAL(data, 20, file->ea_size.attrib);
1065                 SIVAL(data, 22, file->ea_size.ea_size);
1066                 trans2_append_data_string(req, trans, &file->ea_size.name,
1067                                           ofs + 26, STR_LEN8BIT | STR_NOALIGN);
1068                 trans2_grow_data(req, trans, trans->out.data.length + 1);
1069                 trans->out.data.data[trans->out.data.length-1] = 0;
1070                 break;
1071
1072         case RAW_SEARCH_EA_LIST:
1073                 ea_size = ea_list_size(file->ea_list.eas.num_eas, file->ea_list.eas.eas);
1074                 if (state->flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) {
1075                         if (!trans2_grow_data(req, trans, ofs + 27 + ea_size)) {
1076                                 return False;
1077                         }
1078                         SIVAL(trans->out.data.data, ofs, file->ea_list.resume_key);
1079                         ofs += 4;
1080                 } else {
1081                         if (!trans2_grow_data(req, trans, ofs + 23 + ea_size)) {
1082                                 return False;
1083                         }
1084                 }
1085                 data = trans->out.data.data + ofs;
1086                 srv_push_dos_date2(req->smb_conn, data, 0, file->ea_list.create_time);
1087                 srv_push_dos_date2(req->smb_conn, data, 4, file->ea_list.access_time);
1088                 srv_push_dos_date2(req->smb_conn, data, 8, file->ea_list.write_time);
1089                 SIVAL(data, 12, file->ea_list.size);
1090                 SIVAL(data, 16, file->ea_list.alloc_size);
1091                 SSVAL(data, 20, file->ea_list.attrib);
1092                 ea_put_list(data+22, file->ea_list.eas.num_eas, file->ea_list.eas.eas);
1093                 trans2_append_data_string(req, trans, &file->ea_list.name,
1094                                           ofs + 22 + ea_size, STR_LEN8BIT | STR_NOALIGN);
1095                 trans2_grow_data(req, trans, trans->out.data.length + 1);
1096                 trans->out.data.data[trans->out.data.length-1] = 0;
1097                 break;
1098
1099         case RAW_SEARCH_DIRECTORY_INFO:
1100                 trans2_grow_data(req, trans, ofs + 64);
1101                 data = trans->out.data.data + ofs;
1102                 SIVAL(data,          4, file->directory_info.file_index);
1103                 push_nttime(data,    8, file->directory_info.create_time);
1104                 push_nttime(data,   16, file->directory_info.access_time);
1105                 push_nttime(data,   24, file->directory_info.write_time);
1106                 push_nttime(data,   32, file->directory_info.change_time);
1107                 SBVAL(data,         40, file->directory_info.size);
1108                 SBVAL(data,         48, file->directory_info.alloc_size);
1109                 SIVAL(data,         56, file->directory_info.attrib);
1110                 trans2_append_data_string(req, trans, &file->directory_info.name,
1111                                           ofs + 60, STR_TERMINATE_ASCII);
1112                 data = trans->out.data.data + ofs;
1113                 SIVAL(data,          0, trans->out.data.length - ofs);
1114                 break;
1115
1116         case RAW_SEARCH_FULL_DIRECTORY_INFO:
1117                 trans2_grow_data(req, trans, ofs + 68);
1118                 data = trans->out.data.data + ofs;
1119                 SIVAL(data,          4, file->full_directory_info.file_index);
1120                 push_nttime(data,    8, file->full_directory_info.create_time);
1121                 push_nttime(data,   16, file->full_directory_info.access_time);
1122                 push_nttime(data,   24, file->full_directory_info.write_time);
1123                 push_nttime(data,   32, file->full_directory_info.change_time);
1124                 SBVAL(data,         40, file->full_directory_info.size);
1125                 SBVAL(data,         48, file->full_directory_info.alloc_size);
1126                 SIVAL(data,         56, file->full_directory_info.attrib);
1127                 SIVAL(data,         64, file->full_directory_info.ea_size);
1128                 trans2_append_data_string(req, trans, &file->full_directory_info.name,
1129                                           ofs + 60, STR_TERMINATE_ASCII);
1130                 data = trans->out.data.data + ofs;
1131                 SIVAL(data,          0, trans->out.data.length - ofs);
1132                 break;
1133
1134         case RAW_SEARCH_NAME_INFO:
1135                 trans2_grow_data(req, trans, ofs + 12);
1136                 data = trans->out.data.data + ofs;
1137                 SIVAL(data,          4, file->name_info.file_index);
1138                 trans2_append_data_string(req, trans, &file->name_info.name,
1139                                           ofs + 8, STR_TERMINATE_ASCII);
1140                 data = trans->out.data.data + ofs;
1141                 SIVAL(data,          0, trans->out.data.length - ofs);
1142                 break;
1143
1144         case RAW_SEARCH_BOTH_DIRECTORY_INFO:
1145                 trans2_grow_data(req, trans, ofs + 94);
1146                 data = trans->out.data.data + ofs;
1147                 SIVAL(data,          4, file->both_directory_info.file_index);
1148                 push_nttime(data,    8, file->both_directory_info.create_time);
1149                 push_nttime(data,   16, file->both_directory_info.access_time);
1150                 push_nttime(data,   24, file->both_directory_info.write_time);
1151                 push_nttime(data,   32, file->both_directory_info.change_time);
1152                 SBVAL(data,         40, file->both_directory_info.size);
1153                 SBVAL(data,         48, file->both_directory_info.alloc_size);
1154                 SIVAL(data,         56, file->both_directory_info.attrib);
1155                 SIVAL(data,         64, file->both_directory_info.ea_size);
1156                 SCVAL(data,         69, 0); /* reserved */
1157                 memset(data+70,0,24);
1158                 trans2_push_data_string(req, trans,
1159                                         68 + ofs, 70 + ofs,
1160                                         &file->both_directory_info.short_name,
1161                                         24, STR_UNICODE | STR_LEN8BIT);
1162                 trans2_append_data_string(req, trans, &file->both_directory_info.name,
1163                                           ofs + 60, STR_TERMINATE_ASCII);
1164                 trans2_align_data(req, trans);
1165                 data = trans->out.data.data + ofs;
1166                 SIVAL(data,          0, trans->out.data.length - ofs);
1167                 break;
1168
1169         case RAW_SEARCH_ID_FULL_DIRECTORY_INFO:
1170                 trans2_grow_data(req, trans, ofs + 80);
1171                 data = trans->out.data.data + ofs;
1172                 SIVAL(data,          4, file->id_full_directory_info.file_index);
1173                 push_nttime(data,    8, file->id_full_directory_info.create_time);
1174                 push_nttime(data,   16, file->id_full_directory_info.access_time);
1175                 push_nttime(data,   24, file->id_full_directory_info.write_time);
1176                 push_nttime(data,   32, file->id_full_directory_info.change_time);
1177                 SBVAL(data,         40, file->id_full_directory_info.size);
1178                 SBVAL(data,         48, file->id_full_directory_info.alloc_size);
1179                 SIVAL(data,         56, file->id_full_directory_info.attrib);
1180                 SIVAL(data,         64, file->id_full_directory_info.ea_size);
1181                 SIVAL(data,         68, 0); /* padding */
1182                 SBVAL(data,         72, file->id_full_directory_info.file_id);
1183                 trans2_append_data_string(req, trans, &file->id_full_directory_info.name,
1184                                           ofs + 60, STR_TERMINATE_ASCII);
1185                 data = trans->out.data.data + ofs;
1186                 SIVAL(data,          0, trans->out.data.length - ofs);
1187                 break;
1188
1189         case RAW_SEARCH_ID_BOTH_DIRECTORY_INFO:
1190                 trans2_grow_data(req, trans, ofs + 104);
1191                 data = trans->out.data.data + ofs;
1192                 SIVAL(data,          4, file->id_both_directory_info.file_index);
1193                 push_nttime(data,    8, file->id_both_directory_info.create_time);
1194                 push_nttime(data,   16, file->id_both_directory_info.access_time);
1195                 push_nttime(data,   24, file->id_both_directory_info.write_time);
1196                 push_nttime(data,   32, file->id_both_directory_info.change_time);
1197                 SBVAL(data,         40, file->id_both_directory_info.size);
1198                 SBVAL(data,         48, file->id_both_directory_info.alloc_size);
1199                 SIVAL(data,         56, file->id_both_directory_info.attrib);
1200                 SIVAL(data,         64, file->id_both_directory_info.ea_size);
1201                 SCVAL(data,         69, 0); /* reserved */
1202                 memset(data+70,0,26);
1203                 trans2_push_data_string(req, trans,
1204                                         68 + ofs, 70 + ofs,
1205                                         &file->id_both_directory_info.short_name,
1206                                         24, STR_UNICODE | STR_LEN8BIT);
1207                 SBVAL(data,         96, file->id_both_directory_info.file_id);
1208                 trans2_append_data_string(req, trans, &file->id_both_directory_info.name,
1209                                           ofs + 60, STR_TERMINATE_ASCII);
1210                 data = trans->out.data.data + ofs;
1211                 SIVAL(data,          0, trans->out.data.length - ofs);
1212                 break;
1213         }
1214
1215         return True;
1216 }
1217
1218 /* callback function for trans2 findfirst/findnext */
1219 static BOOL find_callback(void *private, union smb_search_data *file)
1220 {
1221         struct find_state *state = (struct find_state *)private;
1222         struct smb_trans2 *trans = state->trans;
1223         uint_t old_length;
1224
1225         old_length = trans->out.data.length;
1226
1227         if (!find_fill_info(state->req, trans, state, file) ||
1228             trans->out.data.length > trans->in.max_data) {
1229                 /* restore the old length and tell the backend to stop */
1230                 trans2_grow_data(state->req, trans, old_length);
1231                 return False;
1232         }
1233
1234         state->last_entry_offset = old_length;
1235         return True;
1236 }
1237
1238
1239 /*
1240   trans2 findfirst implementation
1241 */
1242 static NTSTATUS trans2_findfirst(struct smbsrv_request *req, struct smb_trans2 *trans)
1243 {
1244         union smb_search_first search;
1245         NTSTATUS status;
1246         uint16_t level;
1247         uint8_t *param;
1248         struct find_state state;
1249
1250         /* make sure we got all the parameters */
1251         if (trans->in.params.length < 14) {
1252                 return NT_STATUS_FOOBAR;
1253         }
1254
1255         search.t2ffirst.in.search_attrib = SVAL(trans->in.params.data, 0);
1256         search.t2ffirst.in.max_count     = SVAL(trans->in.params.data, 2);
1257         search.t2ffirst.in.flags         = SVAL(trans->in.params.data, 4);
1258         level                            = SVAL(trans->in.params.data, 6);
1259         search.t2ffirst.in.storage_type  = IVAL(trans->in.params.data, 8);
1260
1261         trans2_pull_blob_string(req, &trans->in.params, 12, &search.t2ffirst.in.pattern, 0);
1262         if (search.t2ffirst.in.pattern == NULL) {
1263                 return NT_STATUS_FOOBAR;
1264         }
1265
1266         search.t2ffirst.level = (enum smb_search_level)level;
1267         if (search.t2ffirst.level >= RAW_SEARCH_GENERIC) {
1268                 return NT_STATUS_INVALID_LEVEL;
1269         }
1270
1271         if (search.t2ffirst.level == RAW_SEARCH_EA_LIST) {
1272                 status = ea_pull_name_list(&trans->in.data, req,
1273                                            &search.t2ffirst.in.num_names,
1274                                            &search.t2ffirst.in.ea_names);
1275                 if (!NT_STATUS_IS_OK(status)) {
1276                         return status;
1277                 }
1278         }
1279
1280         /* setup the private state structure that the backend will
1281            give us in the callback */
1282         state.req = req;
1283         state.trans = trans;
1284         state.level = search.t2ffirst.level;
1285         state.last_entry_offset = 0;
1286         state.flags = search.t2ffirst.in.flags;
1287
1288         /* setup for just a header in the reply */
1289         trans2_setup_reply(req, trans, 10, 0, 0);
1290
1291         /* call the backend */
1292         status = ntvfs_search_first(req, &search, &state, find_callback);
1293         if (!NT_STATUS_IS_OK(status)) {
1294                 trans2_setup_reply(req, trans, 0, 0, 0);
1295                 return status;
1296         }
1297
1298         /* fill in the findfirst reply header */
1299         param = trans->out.params.data;
1300         SSVAL(param, VWV(0), search.t2ffirst.out.handle);
1301         SSVAL(param, VWV(1), search.t2ffirst.out.count);
1302         SSVAL(param, VWV(2), search.t2ffirst.out.end_of_search);
1303         SSVAL(param, VWV(3), 0);
1304         SSVAL(param, VWV(4), state.last_entry_offset);
1305
1306         return NT_STATUS_OK;
1307 }
1308
1309
1310 /*
1311   trans2 findnext implementation
1312 */
1313 static NTSTATUS trans2_findnext(struct smbsrv_request *req, struct smb_trans2 *trans)
1314 {
1315         union smb_search_next search;
1316         NTSTATUS status;
1317         uint16_t level;
1318         uint8_t *param;
1319         struct find_state state;
1320
1321         /* make sure we got all the parameters */
1322         if (trans->in.params.length < 12) {
1323                 return NT_STATUS_FOOBAR;
1324         }
1325
1326         search.t2fnext.in.handle        = SVAL(trans->in.params.data, 0);
1327         search.t2fnext.in.max_count     = SVAL(trans->in.params.data, 2);
1328         level                           = SVAL(trans->in.params.data, 4);
1329         search.t2fnext.in.resume_key    = IVAL(trans->in.params.data, 6);
1330         search.t2fnext.in.flags         = SVAL(trans->in.params.data, 10);
1331
1332         trans2_pull_blob_string(req, &trans->in.params, 12, &search.t2fnext.in.last_name, 0);
1333         if (search.t2fnext.in.last_name == NULL) {
1334                 return NT_STATUS_FOOBAR;
1335         }
1336
1337         search.t2fnext.level = (enum smb_search_level)level;
1338         if (search.t2fnext.level >= RAW_SEARCH_GENERIC) {
1339                 return NT_STATUS_INVALID_LEVEL;
1340         }
1341
1342         if (search.t2fnext.level == RAW_SEARCH_EA_LIST) {
1343                 status = ea_pull_name_list(&trans->in.data, req,
1344                                            &search.t2fnext.in.num_names,
1345                                            &search.t2fnext.in.ea_names);
1346                 if (!NT_STATUS_IS_OK(status)) {
1347                         return status;
1348                 }
1349         }
1350
1351         /* setup the private state structure that the backend will give us in the callback */
1352         state.req = req;
1353         state.trans = trans;
1354         state.level = search.t2fnext.level;
1355         state.last_entry_offset = 0;
1356         state.flags = search.t2fnext.in.flags;
1357
1358         /* setup for just a header in the reply */
1359         trans2_setup_reply(req, trans, 8, 0, 0);
1360
1361         /* call the backend */
1362         status = ntvfs_search_next(req, &search, &state, find_callback);
1363         if (!NT_STATUS_IS_OK(status)) {
1364                 return status;
1365         }
1366
1367         /* fill in the findfirst reply header */
1368         param = trans->out.params.data;
1369         SSVAL(param, VWV(0), search.t2fnext.out.count);
1370         SSVAL(param, VWV(1), search.t2fnext.out.end_of_search);
1371         SSVAL(param, VWV(2), 0);
1372         SSVAL(param, VWV(3), state.last_entry_offset);
1373
1374         return NT_STATUS_OK;
1375 }
1376
1377
1378 /*
1379   backend for trans2 requests
1380 */
1381 static NTSTATUS trans2_backend(struct smbsrv_request *req, struct smb_trans2 *trans)
1382 {
1383         NTSTATUS status;
1384
1385         /* direct trans2 pass thru */
1386         status = ntvfs_trans2(req, trans);
1387         if (!NT_STATUS_EQUAL(NT_STATUS_NOT_IMPLEMENTED, status)) {
1388                 return status;
1389         }
1390
1391         /* must have at least one setup word */
1392         if (trans->in.setup_count < 1) {
1393                 return NT_STATUS_FOOBAR;
1394         }
1395
1396         /* the trans2 command is in setup[0] */
1397         switch (trans->in.setup[0]) {
1398         case TRANSACT2_FINDFIRST:
1399                 return trans2_findfirst(req, trans);
1400         case TRANSACT2_FINDNEXT:
1401                 return trans2_findnext(req, trans);
1402         case TRANSACT2_QPATHINFO:
1403                 return trans2_qpathinfo(req, trans);
1404         case TRANSACT2_QFILEINFO:
1405                 return trans2_qfileinfo(req, trans);
1406         case TRANSACT2_SETFILEINFO:
1407                 return trans2_setfileinfo(req, trans);
1408         case TRANSACT2_SETPATHINFO:
1409                 return trans2_setpathinfo(req, trans);
1410         case TRANSACT2_QFSINFO:
1411                 return trans2_qfsinfo(req, trans);
1412         case TRANSACT2_OPEN:
1413                 return trans2_open(req, trans);
1414         case TRANSACT2_MKDIR:
1415                 return trans2_mkdir(req, trans);
1416         }
1417
1418         /* an unknown trans2 command */
1419         return NT_STATUS_FOOBAR;
1420 }
1421
1422
1423 /*
1424   send a continue request
1425 */
1426 static void reply_trans_continue(struct smbsrv_request *req, uint8_t command,
1427                                  struct smb_trans2 *trans)
1428 {
1429         struct smbsrv_trans_partial *tp;
1430         int count;
1431
1432         /* make sure they don't flood us */
1433         for (count=0,tp=req->smb_conn->trans_partial;tp;tp=tp->next) count++;
1434         if (count > 100) {
1435                 req_reply_error(req, NT_STATUS_INSUFFICIENT_RESOURCES);
1436                 return;
1437         }
1438
1439         tp = talloc_p(req, struct smbsrv_trans_partial);
1440
1441         tp->req = talloc_reference(tp, req);
1442         tp->trans = trans;
1443         tp->command = command;
1444
1445         DLIST_ADD(req->smb_conn->trans_partial, tp);
1446
1447         /* send a 'please continue' reply */
1448         req_setup_reply(req, 0, 0);
1449         req_send_reply(req);
1450 }
1451
1452
1453 /*
1454   answer a reconstructed trans request
1455 */
1456 static void reply_trans_complete(struct smbsrv_request *req, uint8_t command,
1457                                  struct smb_trans2 *trans)
1458 {
1459         uint16_t params_left, data_left;
1460         uint8_t *params, *data;
1461         NTSTATUS status;
1462         int i;
1463
1464         /* its a full request, give it to the backend */
1465         if (command == SMBtrans) {
1466                 status = ntvfs_trans(req, trans);
1467         } else {
1468                 status = trans2_backend(req, trans);
1469         }
1470
1471         if (NT_STATUS_IS_ERR(status)) {
1472                 req_reply_error(req, status);
1473                 return;
1474         }
1475
1476         params_left = trans->out.params.length;
1477         data_left   = trans->out.data.length;
1478         params      = trans->out.params.data;
1479         data        = trans->out.data.data;
1480
1481         req_setup_reply(req, 10 + trans->out.setup_count, 0);
1482
1483         if (!NT_STATUS_IS_OK(status)) {
1484                 req_setup_error(req, status);
1485         }
1486
1487         /* we need to divide up the reply into chunks that fit into
1488            the negotiated buffer size */
1489         do {
1490                 uint16_t this_data, this_param, max_bytes;
1491                 uint_t align1 = 1, align2 = (params_left ? 2 : 0);
1492                 struct smbsrv_request *this_req;
1493
1494                 max_bytes = req_max_data(req) - (align1 + align2);
1495
1496                 this_param = params_left;
1497                 if (this_param > max_bytes) {
1498                         this_param = max_bytes;
1499                 }
1500                 max_bytes -= this_param;
1501
1502                 this_data = data_left;
1503                 if (this_data > max_bytes) {
1504                         this_data = max_bytes;
1505                 }
1506
1507                 /* don't destroy unless this is the last chunk */
1508                 if (params_left - this_param != 0 ||
1509                     data_left - this_data != 0) {
1510                         this_req = req_setup_secondary(req);
1511                 } else {
1512                         this_req = req;
1513                 }
1514
1515                 req_grow_data(this_req, this_param + this_data + (align1 + align2));
1516
1517                 SSVAL(this_req->out.vwv, VWV(0), trans->out.params.length);
1518                 SSVAL(this_req->out.vwv, VWV(1), trans->out.data.length);
1519                 SSVAL(this_req->out.vwv, VWV(2), 0);
1520
1521                 SSVAL(this_req->out.vwv, VWV(3), this_param);
1522                 SSVAL(this_req->out.vwv, VWV(4), align1 + PTR_DIFF(this_req->out.data, this_req->out.hdr));
1523                 SSVAL(this_req->out.vwv, VWV(5), PTR_DIFF(params, trans->out.params.data));
1524
1525                 SSVAL(this_req->out.vwv, VWV(6), this_data);
1526                 SSVAL(this_req->out.vwv, VWV(7), align1 + align2 +
1527                       PTR_DIFF(this_req->out.data + this_param, this_req->out.hdr));
1528                 SSVAL(this_req->out.vwv, VWV(8), PTR_DIFF(data, trans->out.data.data));
1529
1530                 SSVAL(this_req->out.vwv, VWV(9), trans->out.setup_count);
1531                 for (i=0;i<trans->out.setup_count;i++) {
1532                         SSVAL(this_req->out.vwv, VWV(10+i), trans->out.setup[i]);
1533                 }
1534
1535                 memset(this_req->out.data, 0, align1);
1536                 if (this_param != 0) {
1537                         memcpy(this_req->out.data + align1, params, this_param);
1538                 }
1539                 memset(this_req->out.data+this_param+align1, 0, align2);
1540                 if (this_data != 0) {
1541                         memcpy(this_req->out.data+this_param+align1+align2, data, this_data);
1542                 }
1543
1544                 params_left -= this_param;
1545                 data_left -= this_data;
1546                 params += this_param;
1547                 data += this_data;
1548
1549                 req_send_reply(this_req);
1550         } while (params_left != 0 || data_left != 0);
1551 }
1552
1553
1554 /*
1555   Reply to an SMBtrans or SMBtrans2 request
1556 */
1557 void reply_trans_generic(struct smbsrv_request *req, uint8_t command)
1558 {
1559         struct smb_trans2 *trans;
1560         int i;
1561         uint16_t param_ofs, data_ofs;
1562         uint16_t param_count, data_count;
1563         uint16_t param_total, data_total;
1564
1565         trans = talloc_p(req, struct smb_trans2);
1566         if (trans == NULL) {
1567                 req_reply_error(req, NT_STATUS_NO_MEMORY);
1568                 return;
1569         }
1570
1571         /* parse request */
1572         if (req->in.wct < 14) {
1573                 req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
1574                 return;
1575         }
1576
1577         param_total           = SVAL(req->in.vwv, VWV(0));
1578         data_total            = SVAL(req->in.vwv, VWV(1));
1579         trans->in.max_param   = SVAL(req->in.vwv, VWV(2));
1580         trans->in.max_data    = SVAL(req->in.vwv, VWV(3));
1581         trans->in.max_setup   = CVAL(req->in.vwv, VWV(4));
1582         trans->in.flags       = SVAL(req->in.vwv, VWV(5));
1583         trans->in.timeout     = IVAL(req->in.vwv, VWV(6));
1584         param_count           = SVAL(req->in.vwv, VWV(9));
1585         param_ofs             = SVAL(req->in.vwv, VWV(10));
1586         data_count            = SVAL(req->in.vwv, VWV(11));
1587         data_ofs              = SVAL(req->in.vwv, VWV(12));
1588         trans->in.setup_count = CVAL(req->in.vwv, VWV(13));
1589
1590         if (req->in.wct != 14 + trans->in.setup_count) {
1591                 req_reply_dos_error(req, ERRSRV, ERRerror);
1592                 return;
1593         }
1594
1595         /* parse out the setup words */
1596         trans->in.setup = talloc_array_p(req, uint16_t, trans->in.setup_count);
1597         if (trans->in.setup_count && !trans->in.setup) {
1598                 req_reply_error(req, NT_STATUS_NO_MEMORY);
1599                 return;
1600         }
1601         for (i=0;i<trans->in.setup_count;i++) {
1602                 trans->in.setup[i] = SVAL(req->in.vwv, VWV(14+i));
1603         }
1604
1605         if (command == SMBtrans) {
1606                 req_pull_string(req, &trans->in.trans_name, req->in.data, -1, STR_TERMINATE);
1607         }
1608
1609         if (!req_pull_blob(req, req->in.hdr + param_ofs, param_count, &trans->in.params) ||
1610             !req_pull_blob(req, req->in.hdr + data_ofs, data_count, &trans->in.data)) {
1611                 req_reply_error(req, NT_STATUS_FOOBAR);
1612                 return;
1613         }
1614
1615         /* is it a partial request? if so, then send a 'send more' message */
1616         if (param_total > param_count || data_total > data_count) {
1617                 reply_trans_continue(req, command, trans);
1618                 return;
1619         }
1620
1621         reply_trans_complete(req, command, trans);
1622 }
1623
1624
1625 /*
1626   Reply to an SMBtranss2 request
1627 */
1628 static void reply_transs_generic(struct smbsrv_request *req, uint8_t command)
1629 {
1630         struct smbsrv_trans_partial *tp;
1631         struct smb_trans2 *trans = NULL;
1632         uint16_t param_ofs, data_ofs;
1633         uint16_t param_count, data_count;
1634         uint16_t param_disp, data_disp;
1635         uint16_t param_total, data_total;
1636         DATA_BLOB params, data;
1637
1638         for (tp=req->smb_conn->trans_partial;tp;tp=tp->next) {
1639                 if (tp->command == command &&
1640                     SVAL(tp->req->in.hdr, HDR_MID) == SVAL(req->in.hdr, HDR_MID)) {
1641                         break;
1642                 }
1643         }
1644
1645         if (tp == NULL) {
1646                 req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
1647                 return;
1648         }
1649
1650         trans = tp->trans;
1651
1652         /* parse request */
1653         if (req->in.wct < 8) {
1654                 req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
1655                 return;
1656         }
1657
1658         param_total           = SVAL(req->in.vwv, VWV(0));
1659         data_total            = SVAL(req->in.vwv, VWV(1));
1660         param_count           = SVAL(req->in.vwv, VWV(2));
1661         param_ofs             = SVAL(req->in.vwv, VWV(3));
1662         param_disp            = SVAL(req->in.vwv, VWV(4));
1663         data_count            = SVAL(req->in.vwv, VWV(5));
1664         data_ofs              = SVAL(req->in.vwv, VWV(6));
1665         data_disp             = SVAL(req->in.vwv, VWV(7));
1666
1667         if (!req_pull_blob(req, req->in.hdr + param_ofs, param_count, &params) ||
1668             !req_pull_blob(req, req->in.hdr + data_ofs, data_count, &data)) {
1669                 req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
1670                 return;
1671         }
1672
1673         /* only allow contiguous requests */
1674         if ((param_count != 0 &&
1675              param_disp != trans->in.params.length) ||
1676             (data_count != 0 &&
1677              data_disp != trans->in.data.length)) {
1678                 req_reply_error(req, NT_STATUS_INVALID_PARAMETER);
1679                 return;
1680         }
1681
1682         /* add to the existing request */
1683         if (param_count != 0) {
1684                 trans->in.params.data = talloc_realloc_p(trans,
1685                                                          trans->in.params.data,
1686                                                          uint8_t,
1687                                                          param_disp + param_count);
1688                 if (trans->in.params.data == NULL) {
1689                         goto failed;
1690                 }
1691                 trans->in.params.length = param_disp + param_count;
1692         }
1693
1694         if (data_count != 0) {
1695                 trans->in.data.data = talloc_realloc_p(trans,
1696                                                        trans->in.data.data,
1697                                                        uint8_t,
1698                                                        data_disp + data_count);
1699                 if (trans->in.data.data == NULL) {
1700                         goto failed;
1701                 }
1702                 trans->in.data.length = data_disp + data_count;
1703         }
1704
1705         memcpy(trans->in.params.data + param_disp, params.data, params.length);
1706         memcpy(trans->in.data.data + data_disp, data.data, data.length);
1707
1708         /* the sequence number of the reply is taken from the last secondary
1709            response */
1710         tp->req->seq_num = req->seq_num;
1711
1712         /* we don't reply to Transs2 requests */
1713         talloc_free(req);
1714
1715         if (trans->in.params.length == param_total &&
1716             trans->in.data.length == data_total) {
1717                 /* its now complete */
1718                 reply_trans_complete(tp->req, command, trans);
1719                 DLIST_REMOVE(tp->req->smb_conn->trans_partial, tp);
1720                 talloc_free(tp);
1721         }
1722         return;
1723
1724 failed:
1725         req_reply_error(tp->req, NT_STATUS_NO_MEMORY);
1726         DLIST_REMOVE(req->smb_conn->trans_partial, tp);
1727         talloc_free(req);
1728         talloc_free(tp);
1729 }
1730
1731
1732 /*
1733   Reply to an SMBtrans2
1734 */
1735 void reply_trans2(struct smbsrv_request *req)
1736 {
1737         reply_trans_generic(req, SMBtrans2);
1738 }
1739
1740 /*
1741   Reply to an SMBtrans
1742 */
1743 void reply_trans(struct smbsrv_request *req)
1744 {
1745         reply_trans_generic(req, SMBtrans);
1746 }
1747
1748 /*
1749   Reply to an SMBtranss request
1750 */
1751 void reply_transs(struct smbsrv_request *req)
1752 {
1753         reply_transs_generic(req, SMBtrans);
1754 }
1755
1756 /*
1757   Reply to an SMBtranss2 request
1758 */
1759 void reply_transs2(struct smbsrv_request *req)
1760 {
1761         reply_transs_generic(req, SMBtrans2);
1762 }
1763