s3-talloc Change TALLOC_ARRAY() to talloc_array()
[samba.git] / source3 / smbd / ipc.c
index 3df740f9cf043fe8f56015d5031708316899d663..b452000e13921ddbac3689d39d32cfaacf28d5b9 100644 (file)
@@ -5,17 +5,17 @@
 
    SMB Version handling
    Copyright (C) John H Terpstra 1995-1998
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
-   
+
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-   
+
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
    */
    */
 
 #include "includes.h"
-
-extern int max_send;
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "smbprofile.h"
+#include "rpc_server/srv_pipe_hnd.h"
 
 #define NERR_notsupported 50
 
-extern int smb_read_error;
+static void api_no_reply(connection_struct *conn, struct smb_request *req);
 
 /*******************************************************************
  copies parameters and data, as needed, into the smb buffer
@@ -46,7 +48,7 @@ static void copy_trans_params_and_data(char *outbuf, int align,
                                char *rparam, int param_offset, int param_len,
                                char *rdata, int data_offset, int data_len)
 {
-       char *copy_into = smb_buf(outbuf)+1;
+       char *copy_into = smb_buf(outbuf);
 
        if(param_len < 0)
                param_len = 0;
@@ -54,14 +56,24 @@ static void copy_trans_params_and_data(char *outbuf, int align,
        if(data_len < 0)
                data_len = 0;
 
-       DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d]\n",
+       DEBUG(5,("copy_trans_params_and_data: params[%d..%d] data[%d..%d] (align %d)\n",
                        param_offset, param_offset + param_len,
-                       data_offset , data_offset  + data_len));
+                       data_offset , data_offset  + data_len,
+                       align));
+
+       *copy_into = '\0';
+
+       copy_into += 1;
 
        if (param_len)
                memcpy(copy_into, &rparam[param_offset], param_len);
 
-       copy_into += param_len + align;
+       copy_into += param_len;
+       if (align) {
+               memset(copy_into, '\0', align);
+       }
+
+       copy_into += align;
 
        if (data_len )
                memcpy(copy_into, &rdata[data_offset], data_len);
@@ -71,13 +83,11 @@ static void copy_trans_params_and_data(char *outbuf, int align,
  Send a trans reply.
  ****************************************************************************/
 
-void send_trans_reply(const char *inbuf,
-                       char *outbuf,
-                       char *rparam,
-                       int rparam_len,
-                       char *rdata,
-                       int rdata_len,
-                       BOOL buffer_too_large)
+void send_trans_reply(connection_struct *conn,
+                     struct smb_request *req,
+                     char *rparam, int rparam_len,
+                     char *rdata, int rdata_len,
+                     bool buffer_too_large)
 {
        int this_ldata,this_lparam;
        int tot_data_sent = 0;
@@ -86,6 +96,8 @@ void send_trans_reply(const char *inbuf,
 
        int ldata  = rdata  ? rdata_len : 0;
        int lparam = rparam ? rparam_len : 0;
+       struct smbd_server_connection *sconn = req->sconn;
+       int max_send = sconn->smb1.sessions.max_send;
 
        if (buffer_too_large)
                DEBUG(5,("send_trans_reply: buffer %d too large\n", ldata ));
@@ -95,37 +107,54 @@ void send_trans_reply(const char *inbuf,
 
        align = ((this_lparam)%4);
 
-       if (buffer_too_large) {
-               ERROR_BOTH(STATUS_BUFFER_OVERFLOW,ERRDOS,ERRmoredata);
-       }
+       reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
 
-       set_message(inbuf,outbuf,10,1+align+this_ldata+this_lparam,True);
+       /*
+        * We might have SMBtranss in req which was transferred to the outbuf,
+        * fix that.
+        */
+       SCVAL(req->outbuf, smb_com, SMBtrans);
 
-       copy_trans_params_and_data(outbuf, align,
+       copy_trans_params_and_data((char *)req->outbuf, align,
                                rparam, tot_param_sent, this_lparam,
                                rdata, tot_data_sent, this_ldata);
 
-       SSVAL(outbuf,smb_vwv0,lparam);
-       SSVAL(outbuf,smb_vwv1,ldata);
-       SSVAL(outbuf,smb_vwv3,this_lparam);
-       SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
-       SSVAL(outbuf,smb_vwv5,0);
-       SSVAL(outbuf,smb_vwv6,this_ldata);
-       SSVAL(outbuf,smb_vwv7,smb_offset(smb_buf(outbuf)+1+this_lparam+align,outbuf));
-       SSVAL(outbuf,smb_vwv8,0);
-       SSVAL(outbuf,smb_vwv9,0);
+       SSVAL(req->outbuf,smb_vwv0,lparam);
+       SSVAL(req->outbuf,smb_vwv1,ldata);
+       SSVAL(req->outbuf,smb_vwv3,this_lparam);
+       SSVAL(req->outbuf,smb_vwv4,
+             smb_offset(smb_buf(req->outbuf)+1, req->outbuf));
+       SSVAL(req->outbuf,smb_vwv5,0);
+       SSVAL(req->outbuf,smb_vwv6,this_ldata);
+       SSVAL(req->outbuf,smb_vwv7,
+             smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                        req->outbuf));
+       SSVAL(req->outbuf,smb_vwv8,0);
+       SSVAL(req->outbuf,smb_vwv9,0);
+
+       if (buffer_too_large) {
+               error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
+                                STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
+       }
+
+       show_msg((char *)req->outbuf);
+       if (!srv_send_smb(sconn, (char *)req->outbuf,
+                         true, req->seqnum+1,
+                         IS_CONN_ENCRYPTED(conn), &req->pcd)) {
+               exit_server_cleanly("send_trans_reply: srv_send_smb failed.");
+       }
 
-       show_msg(outbuf);
-       if (!send_smb(smbd_server_fd(),outbuf))
-               exit_server_cleanly("send_trans_reply: send_smb failed.");
+       TALLOC_FREE(req->outbuf);
 
        tot_data_sent = this_ldata;
        tot_param_sent = this_lparam;
 
        while (tot_data_sent < ldata || tot_param_sent < lparam)
        {
-               this_lparam = MIN(lparam-tot_param_sent, max_send - 500); /* hack */
-               this_ldata  = MIN(ldata -tot_data_sent, max_send - (500+this_lparam));
+               this_lparam = MIN(lparam-tot_param_sent,
+                                 max_send - 500); /* hack */
+               this_ldata  = MIN(ldata -tot_data_sent,
+                                 max_send - (500+this_lparam));
 
                if(this_lparam < 0)
                        this_lparam = 0;
@@ -135,26 +164,49 @@ void send_trans_reply(const char *inbuf,
 
                align = (this_lparam%4);
 
-               set_message(inbuf,outbuf,10,1+this_ldata+this_lparam+align,False);
+               reply_outbuf(req, 10, 1+align+this_ldata+this_lparam);
+
+               /*
+                * We might have SMBtranss in req which was transferred to the
+                * outbuf, fix that.
+                */
+               SCVAL(req->outbuf, smb_com, SMBtrans);
 
-               copy_trans_params_and_data(outbuf, align,
+               copy_trans_params_and_data((char *)req->outbuf, align,
                                           rparam, tot_param_sent, this_lparam,
                                           rdata, tot_data_sent, this_ldata);
-               
-               SSVAL(outbuf,smb_vwv3,this_lparam);
-               SSVAL(outbuf,smb_vwv4,smb_offset(smb_buf(outbuf)+1,outbuf));
-               SSVAL(outbuf,smb_vwv5,tot_param_sent);
-               SSVAL(outbuf,smb_vwv6,this_ldata);
-               SSVAL(outbuf,smb_vwv7,smb_offset(smb_buf(outbuf)+1+this_lparam+align,outbuf));
-               SSVAL(outbuf,smb_vwv8,tot_data_sent);
-               SSVAL(outbuf,smb_vwv9,0);
-
-               show_msg(outbuf);
-               if (!send_smb(smbd_server_fd(),outbuf))
-                       exit_server_cleanly("send_trans_reply: send_smb failed.");
+
+               SSVAL(req->outbuf,smb_vwv0,lparam);
+               SSVAL(req->outbuf,smb_vwv1,ldata);
+
+               SSVAL(req->outbuf,smb_vwv3,this_lparam);
+               SSVAL(req->outbuf,smb_vwv4,
+                     smb_offset(smb_buf(req->outbuf)+1,req->outbuf));
+               SSVAL(req->outbuf,smb_vwv5,tot_param_sent);
+               SSVAL(req->outbuf,smb_vwv6,this_ldata);
+               SSVAL(req->outbuf,smb_vwv7,
+                     smb_offset(smb_buf(req->outbuf)+1+this_lparam+align,
+                                req->outbuf));
+               SSVAL(req->outbuf,smb_vwv8,tot_data_sent);
+               SSVAL(req->outbuf,smb_vwv9,0);
+
+               if (buffer_too_large) {
+                       error_packet_set((char *)req->outbuf,
+                                        ERRDOS, ERRmoredata,
+                                        STATUS_BUFFER_OVERFLOW,
+                                        __LINE__, __FILE__);
+               }
+
+               show_msg((char *)req->outbuf);
+               if (!srv_send_smb(sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(conn), &req->pcd))
+                       exit_server_cleanly("send_trans_reply: srv_send_smb "
+                                           "failed.");
 
                tot_data_sent  += this_ldata;
                tot_param_sent += this_lparam;
+               TALLOC_FREE(req->outbuf);
        }
 }
 
@@ -162,55 +214,168 @@ void send_trans_reply(const char *inbuf,
  Start the first part of an RPC reply which began with an SMBtrans request.
 ****************************************************************************/
 
-static BOOL api_rpc_trans_reply(const char *inbuf,
-                               char *outbuf,
-                               smb_np_struct *p)
+struct dcerpc_cmd_state {
+       struct fake_file_handle *handle;
+       uint8_t *data;
+       size_t num_data;
+       size_t max_read;
+};
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq);
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq);
+
+static void api_dcerpc_cmd(connection_struct *conn, struct smb_request *req,
+                          files_struct *fsp, uint8_t *data, size_t length,
+                          size_t max_read)
 {
-       BOOL is_data_outstanding;
-       char *rdata = (char *)SMB_MALLOC(p->max_trans_reply);
-       int data_len;
+       struct tevent_req *subreq;
+       struct dcerpc_cmd_state *state;
+       bool busy;
+
+       if (!fsp_is_np(fsp)) {
+               api_no_reply(conn, req);
+               return;
+       }
 
-       if(rdata == NULL) {
-               DEBUG(0,("api_rpc_trans_reply: malloc fail.\n"));
-               return False;
+       /*
+        * Trans requests are only allowed
+        * if no other Trans or Read is active
+        */
+       busy = np_read_in_progress(fsp->fake_file_handle);
+       if (busy) {
+               reply_nterror(req, NT_STATUS_PIPE_BUSY);
+               return;
        }
 
-       if((data_len = read_from_pipe( p, rdata, p->max_trans_reply,
-                                       &is_data_outstanding)) < 0) {
-               SAFE_FREE(rdata);
-               return False;
+       state = talloc(req, struct dcerpc_cmd_state);
+       if (state == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
        }
+       req->async_priv = state;
+
+       state->handle = fsp->fake_file_handle;
 
-       send_trans_reply(inbuf, outbuf, NULL, 0, rdata, data_len, is_data_outstanding);
+       /*
+        * This memdup severely sucks. But doing it properly essentially means
+        * to rewrite lanman.c, something which I don't really want to do now.
+        */
+       state->data = (uint8_t *)talloc_memdup(state, data, length);
+       if (state->data == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
+       }
+       state->num_data = length;
+       state->max_read = max_read;
 
-       SAFE_FREE(rdata);
-       return True;
+       subreq = np_write_send(state, server_event_context(), state->handle,
+                              state->data, length);
+       if (subreq == NULL) {
+               TALLOC_FREE(state);
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
+       }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_write_done,
+                               talloc_move(conn, &req));
+}
+
+static void api_dcerpc_cmd_write_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nwritten = -1;
+
+       status = np_write_recv(subreq, &nwritten);
+       TALLOC_FREE(subreq);
+       if (!NT_STATUS_IS_OK(status) || (nwritten != state->num_data)) {
+               DEBUG(10, ("Could not write to pipe: %s (%d/%d)\n",
+                          nt_errstr(status), (int)state->num_data,
+                          (int)nwritten));
+               reply_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
+               goto send;
+       }
+
+       state->data = talloc_realloc(state, state->data, uint8_t,
+                                          state->max_read);
+       if (state->data == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
+
+       subreq = np_read_send(req->conn, server_event_context(),
+                             state->handle, state->data, state->max_read);
+       if (subreq == NULL) {
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               goto send;
+       }
+       tevent_req_set_callback(subreq, api_dcerpc_cmd_read_done, req);
+       return;
+
+ send:
+       if (!srv_send_smb(
+                   req->sconn, (char *)req->outbuf,
+                   true, req->seqnum+1,
+                   IS_CONN_ENCRYPTED(req->conn) || req->encrypted,
+                   &req->pcd)) {
+               exit_server_cleanly("api_dcerpc_cmd_write_done: "
+                                   "srv_send_smb failed.");
+       }
+       TALLOC_FREE(req);
+}
+
+static void api_dcerpc_cmd_read_done(struct tevent_req *subreq)
+{
+       struct smb_request *req = tevent_req_callback_data(
+               subreq, struct smb_request);
+       struct dcerpc_cmd_state *state = talloc_get_type_abort(
+               req->async_priv, struct dcerpc_cmd_state);
+       NTSTATUS status;
+       ssize_t nread;
+       bool is_data_outstanding;
+
+       status = np_read_recv(subreq, &nread, &is_data_outstanding);
+       TALLOC_FREE(subreq);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               DEBUG(10, ("Could not read from to pipe: %s\n",
+                          nt_errstr(status)));
+               reply_nterror(req, status);
+
+               if (!srv_send_smb(req->sconn, (char *)req->outbuf,
+                                 true, req->seqnum+1,
+                                 IS_CONN_ENCRYPTED(req->conn)
+                                 ||req->encrypted, &req->pcd)) {
+                       exit_server_cleanly("api_dcerpc_cmd_read_done: "
+                                           "srv_send_smb failed.");
+               }
+               TALLOC_FREE(req);
+               return;
+       }
+
+       send_trans_reply(req->conn, req, NULL, 0, (char *)state->data, nread,
+                        is_data_outstanding);
+       TALLOC_FREE(req);
 }
 
 /****************************************************************************
  WaitNamedPipeHandleState 
 ****************************************************************************/
 
-static BOOL api_WNPHS(const char *inbuf,
-                       char *outbuf,
-                       smb_np_struct *p,
-                       char *param,
-                       int param_len)
+static void api_WNPHS(connection_struct *conn, struct smb_request *req,
+                     struct files_struct *fsp, char *param, int param_len)
 {
-       uint16 priority;
-
-       if (!param || param_len < 2)
-               return False;
+       if (!param || param_len < 2) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
+       }
 
-       priority = SVAL(param,0);
-       DEBUG(4,("WaitNamedPipeHandleState priority %x\n", priority));
+       DEBUG(4,("WaitNamedPipeHandleState priority %x\n",
+                (int)SVAL(param,0)));
 
-       if (wait_rpc_pipe_hnd_state(p, priority)) {
-               /* now send the reply */
-               send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
-               return True;
-       }
-       return False;
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -218,26 +383,17 @@ static BOOL api_WNPHS(const char *inbuf,
  SetNamedPipeHandleState 
 ****************************************************************************/
 
-static BOOL api_SNPHS(const char *inbuf,
-                       char *outbuf,
-                       smb_np_struct *p,
-                       char *param,
-                       int param_len)
+static void api_SNPHS(connection_struct *conn, struct smb_request *req,
+                     struct files_struct *fsp, char *param, int param_len)
 {
-       uint16 id;
-
-       if (!param || param_len < 2)
-               return False;
+       if (!param || param_len < 2) {
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
+       }
 
-       id = SVAL(param,0);
-       DEBUG(4,("SetNamedPipeHandleState to code %x\n", id));
+       DEBUG(4,("SetNamedPipeHandleState to code %x\n", (int)SVAL(param,0)));
 
-       if (set_rpc_pipe_hnd_state(p, id)) {
-               /* now send the reply */
-               send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
-               return True;
-       }
-       return False;
+       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
 }
 
 
@@ -245,7 +401,7 @@ static BOOL api_SNPHS(const char *inbuf,
  When no reply is generated, indicate unsupported.
  ****************************************************************************/
 
-static BOOL api_no_reply(const char *inbuf, char *outbuf, int max_rdata_len)
+static void api_no_reply(connection_struct *conn, struct smb_request *req)
 {
        char rparam[4];
 
@@ -256,30 +412,22 @@ static BOOL api_no_reply(const char *inbuf, char *outbuf, int max_rdata_len)
        DEBUG(3,("Unsupported API fd command\n"));
 
        /* now send the reply */
-       send_trans_reply(inbuf, outbuf, rparam, 4, NULL, 0, False);
+       send_trans_reply(conn, req, rparam, 4, NULL, 0, False);
 
-       return -1;
+       return;
 }
 
 /****************************************************************************
  Handle remote api calls delivered to a named pipe already opened.
  ****************************************************************************/
 
-static int api_fd_reply(connection_struct *conn,
-                       uint16 vuid,
-                       const char *inbuf,
-                       char *outbuf,
-                       uint16 *setup,
-                       char *data,
-                       char *params,
-                       int suwcnt,
-                       int tdscnt,
-                       int tpscnt,
-                       int mdrcnt,
-                       int mprcnt)
+static void api_fd_reply(connection_struct *conn, uint16 vuid,
+                        struct smb_request *req,
+                        uint16 *setup, uint8_t *data, char *params,
+                        int suwcnt, int tdscnt, int tpscnt,
+                        int mdrcnt, int mprcnt)
 {
-       BOOL reply = False;
-       smb_np_struct *p = NULL;
+       struct files_struct *fsp;
        int pnum;
        int subcommand;
 
@@ -288,100 +436,86 @@ static int api_fd_reply(connection_struct *conn,
        /* First find out the name of this file. */
        if (suwcnt != 2) {
                DEBUG(0,("Unexpected named pipe transaction.\n"));
-               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
        }
 
        /* Get the file handle and hence the file name. */
        /* 
         * NB. The setup array has already been transformed
-        * via SVAL and so is in gost byte order.
+        * via SVAL and so is in host byte order.
         */
        pnum = ((int)setup[1]) & 0xFFFF;
        subcommand = ((int)setup[0]) & 0xFFFF;
 
-       if(!(p = get_rpc_pipe(pnum))) {
+       fsp = file_fsp(req, pnum);
+
+       if (!fsp_is_np(fsp)) {
                if (subcommand == TRANSACT_WAITNAMEDPIPEHANDLESTATE) {
                        /* Win9x does this call with a unicode pipe name, not a pnum. */
                        /* Just return success for now... */
                        DEBUG(3,("Got TRANSACT_WAITNAMEDPIPEHANDLESTATE on text pipe name\n"));
-                       send_trans_reply(inbuf, outbuf, NULL, 0, NULL, 0, False);
-                       return -1;
+                       send_trans_reply(conn, req, NULL, 0, NULL, 0, False);
+                       return;
                }
 
                DEBUG(1,("api_fd_reply: INVALID PIPE HANDLE: %x\n", pnum));
-               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+               reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+               return;
        }
 
-       if (vuid != p->vuid) {
+       if (vuid != fsp->vuid) {
                DEBUG(1, ("Got pipe request (pnum %x) using invalid VUID %d, "
-                         "expected %d\n", pnum, vuid, p->vuid));
-               return ERROR_NT(NT_STATUS_INVALID_HANDLE);
+                         "expected %d\n", pnum, vuid, fsp->vuid));
+               reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+               return;
        }
 
-       DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n", subcommand, p->name, pnum));
-
-       /* record maximum data length that can be transmitted in an SMBtrans */
-       p->max_trans_reply = mdrcnt;
+       DEBUG(3,("Got API command 0x%x on pipe \"%s\" (pnum %x)\n",
+                subcommand, fsp_str_dbg(fsp), pnum));
 
-       DEBUG(10,("api_fd_reply: p:%p max_trans_reply: %d\n", p, p->max_trans_reply));
+       DEBUG(10, ("api_fd_reply: p:%p max_trans_reply: %d\n", fsp, mdrcnt));
 
        switch (subcommand) {
-       case TRANSACT_DCERPCCMD:
+       case TRANSACT_DCERPCCMD: {
                /* dce/rpc command */
-               reply = write_to_pipe(p, data, tdscnt);
-               if (reply)
-                       reply = api_rpc_trans_reply(inbuf, outbuf, p);
+               api_dcerpc_cmd(conn, req, fsp, (uint8_t *)data, tdscnt,
+                              mdrcnt);
                break;
+       }
        case TRANSACT_WAITNAMEDPIPEHANDLESTATE:
                /* Wait Named Pipe Handle state */
-               reply = api_WNPHS(inbuf, outbuf, p, params, tpscnt);
+               api_WNPHS(conn, req, fsp, params, tpscnt);
                break;
        case TRANSACT_SETNAMEDPIPEHANDLESTATE:
                /* Set Named Pipe Handle state */
-               reply = api_SNPHS(inbuf, outbuf, p, params, tpscnt);
+               api_SNPHS(conn, req, fsp, params, tpscnt);
                break;
        default:
-               return ERROR_NT(NT_STATUS_INVALID_PARAMETER);
+               reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
+               return;
        }
-
-       if (!reply)
-               return api_no_reply(inbuf, outbuf, mdrcnt);
-
-       return -1;
 }
 
 /****************************************************************************
  Handle named pipe commands.
 ****************************************************************************/
 
-static int named_pipe(connection_struct *conn,
-                       uint16 vuid,
-                       const char *inbuf,
-                       char *outbuf,
-                       char *name,
-                       uint16 *setup,
-                       char *data,
-                       char *params,
-                       int suwcnt,
-                       int tdscnt,
-                       int tpscnt,
-                       int msrcnt,
-                       int mdrcnt,
-                       int mprcnt)
+static void named_pipe(connection_struct *conn, uint16 vuid,
+                      struct smb_request *req,
+                      const char *name, uint16 *setup,
+                      char *data, char *params,
+                      int suwcnt, int tdscnt,int tpscnt,
+                      int msrcnt, int mdrcnt, int mprcnt)
 {
        DEBUG(3,("named pipe command on <%s> name\n", name));
 
        if (strequal(name,"LANMAN")) {
-               return api_reply(conn,
-                               vuid,
-                               inbuf,
-                               outbuf,
-                               data,
-                               params,
-                               tdscnt,
-                               tpscnt,
-                               mdrcnt,
-                               mprcnt);
+               api_reply(conn, vuid, req,
+                         data, params,
+                         tdscnt, tpscnt,
+                         mdrcnt, mprcnt);
+               return;
        }
 
        if (strequal(name,"WKSSVC") ||
@@ -389,47 +523,34 @@ static int named_pipe(connection_struct *conn,
            strequal(name,"WINREG") ||
            strequal(name,"SAMR") ||
            strequal(name,"LSARPC")) {
+
                DEBUG(4,("named pipe command from Win95 (wow!)\n"));
-               return api_fd_reply(conn,
-                                       vuid,
-                                       inbuf,
-                                       outbuf,
-                                       setup,
-                                       data,
-                                       params,
-                                       suwcnt,
-                                       tdscnt,
-                                       tpscnt,
-                                       mdrcnt,
-                                       mprcnt);
+
+               api_fd_reply(conn, vuid, req,
+                            setup, (uint8_t *)data, params,
+                            suwcnt, tdscnt, tpscnt,
+                            mdrcnt, mprcnt);
+               return;
        }
 
        if (strlen(name) < 1) {
-               return api_fd_reply(conn,
-                                       vuid,
-                                       inbuf,
-                                       outbuf,
-                                       setup,
-                                       data,
-                                       params,
-                                       suwcnt,
-                                       tdscnt,
-                                       tpscnt,
-                                       mdrcnt,
-                                       mprcnt);
+               api_fd_reply(conn, vuid, req,
+                            setup, (uint8_t *)data,
+                            params, suwcnt, tdscnt,
+                            tpscnt, mdrcnt, mprcnt);
+               return;
        }
 
        if (setup)
-               DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n", (int)setup[0],(int)setup[1]));
+               DEBUG(3,("unknown named pipe: setup 0x%X setup1=%d\n",
+                        (int)setup[0],(int)setup[1]));
 
-       return 0;
+       reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+       return;
 }
 
-static NTSTATUS handle_trans(connection_struct *conn,
-                               struct trans_state *state,
-                               const char *inbuf,
-                               char *outbuf,
-                               int *outsize)
+static void handle_trans(connection_struct *conn, struct smb_request *req,
+                        struct trans_state *state)
 {
        char *local_machine_name;
        int name_offset = 0;
@@ -446,7 +567,8 @@ static NTSTATUS handle_trans(connection_struct *conn,
                                             get_local_machine_name());
 
        if (local_machine_name == NULL) {
-               return NT_STATUS_NO_MEMORY;
+               reply_nterror(req, NT_STATUS_NO_MEMORY);
+               return;
        }
 
        if (strnequal(state->name, local_machine_name,
@@ -456,9 +578,10 @@ static NTSTATUS handle_trans(connection_struct *conn,
 
        if (!strnequal(&state->name[name_offset], "\\PIPE",
                       strlen("\\PIPE"))) {
-               return NT_STATUS_NOT_SUPPORTED;
+               reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
+               return;
        }
-       
+
        name_offset += strlen("\\PIPE");
 
        /* Win9x weirdness.  When talking to a unicode server Win9x
@@ -468,58 +591,50 @@ static NTSTATUS handle_trans(connection_struct *conn,
                name_offset++;
 
        DEBUG(5,("calling named_pipe\n"));
-       *outsize = named_pipe(conn,
-                               state->vuid,
-                               inbuf,
-                               outbuf,
-                               state->name+name_offset,
-                               state->setup,state->data,
-                               state->param,
-                               state->setup_count,state->total_data,
-                               state->total_param,
-                               state->max_setup_return,
-                               state->max_data_return,
-                               state->max_param_return);
-
-       if (*outsize == 0) {
-               return NT_STATUS_NOT_SUPPORTED;
-       }
-
-       if (state->close_on_completion)
+       named_pipe(conn, state->vuid, req,
+                  state->name+name_offset,
+                  state->setup,state->data,
+                  state->param,
+                  state->setup_count,state->total_data,
+                  state->total_param,
+                  state->max_setup_return,
+                  state->max_data_return,
+                  state->max_param_return);
+
+       if (state->close_on_completion) {
                close_cnum(conn,state->vuid);
+               req->conn = NULL;
+       }
 
-       return NT_STATUS_OK;
+       return;
 }
 
 /****************************************************************************
  Reply to a SMBtrans.
  ****************************************************************************/
 
-void reply_trans(connection_struct *conn, struct smb_request *req)
+void reply_trans(struct smb_request *req)
 {
-       int outsize = 0;
+       connection_struct *conn = req->conn;
        unsigned int dsoff;
        unsigned int dscnt;
        unsigned int psoff;
        unsigned int pscnt;
        struct trans_state *state;
        NTSTATUS result;
-       char *inbuf, *outbuf;
-       int size, bufsize;
 
        START_PROFILE(SMBtrans);
 
-       if (SVAL(req->inbuf, smb_wct) < 10) {
+       if (req->wct < 14) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBtrans);
                return;
        }
 
-       size = smb_len(req->inbuf) + 4;
-       dsoff = SVAL(req->inbuf, smb_dsoff);
-       dscnt = SVAL(req->inbuf, smb_dscnt);
-       psoff = SVAL(req->inbuf, smb_psoff);
-       pscnt = SVAL(req->inbuf, smb_pscnt);
+       dsoff = SVAL(req->vwv+12, 0);
+       dscnt = SVAL(req->vwv+11, 0);
+       psoff = SVAL(req->vwv+10, 0);
+       pscnt = SVAL(req->vwv+9, 0);
 
        result = allow_new_trans(conn->pending_trans, req->mid);
        if (!NT_STATUS_IS_OK(result)) {
@@ -530,7 +645,7 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
                return;
        }
 
-       if ((state = TALLOC_P(conn->mem_ctx, struct trans_state)) == NULL) {
+       if ((state = TALLOC_P(conn, struct trans_state)) == NULL) {
                DEBUG(0, ("talloc failed\n"));
                reply_nterror(req, NT_STATUS_NO_MEMORY);
                END_PROFILE(SMBtrans);
@@ -541,27 +656,32 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
 
        state->mid = req->mid;
        state->vuid = req->vuid;
-       state->setup_count = CVAL(req->inbuf, smb_suwcnt);
+       state->setup_count = CVAL(req->vwv+13, 0);
        state->setup = NULL;
-       state->total_param = SVAL(req->inbuf, smb_tpscnt);
+       state->total_param = SVAL(req->vwv+0, 0);
        state->param = NULL;
-       state->total_data = SVAL(req->inbuf, smb_tdscnt);
+       state->total_data = SVAL(req->vwv+1, 0);
        state->data = NULL;
-       state->max_param_return = SVAL(req->inbuf, smb_mprcnt);
-       state->max_data_return = SVAL(req->inbuf, smb_mdrcnt);
-       state->max_setup_return = CVAL(req->inbuf, smb_msrcnt);
-       state->close_on_completion = BITSETW(req->inbuf+smb_vwv5,0);
-       state->one_way = BITSETW(req->inbuf+smb_vwv5,1);
-
-       memset(state->name, '\0',sizeof(state->name));
-       srvstr_pull_buf(req->inbuf, req->flags2, state->name,
-                       smb_buf(req->inbuf), sizeof(state->name),
-                       STR_TERMINATE);
-       
-       if ((dscnt > state->total_data) || (pscnt > state->total_param))
+       state->max_param_return = SVAL(req->vwv+2, 0);
+       state->max_data_return = SVAL(req->vwv+3, 0);
+       state->max_setup_return = CVAL(req->vwv+4, 0);
+       state->close_on_completion = BITSETW(req->vwv+5, 0);
+       state->one_way = BITSETW(req->vwv+5, 1);
+
+       srvstr_pull_req_talloc(state, req, &state->name, req->buf,
+                              STR_TERMINATE);
+
+       if ((dscnt > state->total_data) || (pscnt > state->total_param) ||
+                       !state->name)
                goto bad_param;
 
        if (state->total_data)  {
+
+               if (trans_oob(state->total_data, 0, dscnt)
+                   || trans_oob(smb_len(req->inbuf), dsoff, dscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many. */
                state->data = (char *)SMB_MALLOC(state->total_data+100);
@@ -572,20 +692,20 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
                        reply_nterror(req, NT_STATUS_NO_MEMORY);
                        END_PROFILE(SMBtrans);
                        return;
-               } 
+               }
                /* null-terminate the slack space */
                memset(&state->data[state->total_data], 0, 100);
-               if ((dsoff+dscnt < dsoff) || (dsoff+dscnt < dscnt))
-                       goto bad_param;
-               if ((smb_base(req->inbuf)+dsoff+dscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+dsoff+dscnt < smb_base(req->inbuf)))
-                       goto bad_param;
 
                memcpy(state->data,smb_base(req->inbuf)+dsoff,dscnt);
        }
 
        if (state->total_param) {
+
+               if (trans_oob(state->total_param, 0, pscnt)
+                   || trans_oob(smb_len(req->inbuf), psoff, pscnt)) {
+                       goto bad_param;
+               }
+
                /* Can't use talloc here, the core routines do realloc on the
                 * params and data. Out of paranoia, 100 bytes too many */
                state->param = (char *)SMB_MALLOC(state->total_param+100);
@@ -600,12 +720,6 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
                } 
                /* null-terminate the slack space */
                memset(&state->param[state->total_param], 0, 100);
-               if ((psoff+pscnt < psoff) || (psoff+pscnt < pscnt))
-                       goto bad_param;
-               if ((smb_base(req->inbuf)+psoff+pscnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf)+psoff+pscnt < smb_base(req->inbuf)))
-                       goto bad_param;
 
                memcpy(state->param,smb_base(req->inbuf)+psoff,pscnt);
        }
@@ -615,7 +729,20 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
 
        if (state->setup_count) {
                unsigned int i;
-               if((state->setup = TALLOC_ARRAY(
+
+               /*
+                * No overflow possible here, state->setup_count is an
+                * unsigned int, being filled by a single byte from
+                * CVAL(req->vwv+13, 0) above. The cast in the comparison
+                * below is not necessary, it's here to clarify things. The
+                * validity of req->vwv and req->wct has been checked in
+                * init_smb_request already.
+                */
+               if (state->setup_count + 14 > (unsigned int)req->wct) {
+                       goto bad_param;
+               }
+
+               if((state->setup = talloc_array(
                            state, uint16, state->setup_count)) == NULL) {
                        DEBUG(0,("reply_trans: setup malloc fail for %u "
                                 "bytes !\n", (unsigned int)
@@ -627,17 +754,10 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
                        END_PROFILE(SMBtrans);
                        return;
                } 
-               if (req->inbuf+smb_vwv14+(state->setup_count*SIZEOFWORD) >
-                   req->inbuf + size)
-                       goto bad_param;
-               if ((smb_vwv14+(state->setup_count*SIZEOFWORD) < smb_vwv14) ||
-                   (smb_vwv14+(state->setup_count*SIZEOFWORD) <
-                    (state->setup_count*SIZEOFWORD)))
-                       goto bad_param;
 
-               for (i=0;i<state->setup_count;i++)
-                       state->setup[i] = SVAL(req->inbuf,
-                                              smb_vwv14+i*SIZEOFWORD);
+               for (i=0;i<state->setup_count;i++) {
+                       state->setup[i] = SVAL(req->vwv + 14 + i, 0);
+               }
        }
 
        state->received_param = pscnt;
@@ -654,37 +774,14 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
                return;
        }
 
-       if (!(reply_prep_legacy(req, &inbuf, &outbuf, &size, &bufsize))) {
-               SAFE_FREE(state->data);
-               SAFE_FREE(state->param);
-               TALLOC_FREE(state);
-               reply_nterror(req, NT_STATUS_NO_MEMORY);
-               END_PROFILE(SMBtrans);
-               return;
-       }
-
-       result = handle_trans(conn, state, inbuf, outbuf, &outsize);
+       talloc_steal(talloc_tos(), state);
 
-       if (NT_STATUS_IS_OK(result)) {
-               reply_post_legacy(req, outsize);
-       }
+       handle_trans(conn, req, state);
 
        SAFE_FREE(state->data);
        SAFE_FREE(state->param);
        TALLOC_FREE(state);
 
-       if (!NT_STATUS_IS_OK(result)) {
-               reply_nterror(req, result);
-               END_PROFILE(SMBtrans);
-               return;
-       }
-
-       if (outsize == 0) {
-               reply_nterror(req, NT_STATUS_INTERNAL_ERROR);
-               END_PROFILE(SMBtrans);
-               return;
-       }
-
        END_PROFILE(SMBtrans);
        return;
 
@@ -703,20 +800,17 @@ void reply_trans(connection_struct *conn, struct smb_request *req)
  Reply to a secondary SMBtrans.
  ****************************************************************************/
 
-void reply_transs(connection_struct *conn, struct smb_request *req)
+void reply_transs(struct smb_request *req)
 {
-       int outsize = 0;
+       connection_struct *conn = req->conn;
        unsigned int pcnt,poff,dcnt,doff,pdisp,ddisp;
        struct trans_state *state;
-       NTSTATUS result;
-       char *inbuf, *outbuf;
-       int size, bufsize;
 
        START_PROFILE(SMBtranss);
 
-       show_msg((char *)req->inbuf);
+       show_msg((const char *)req->inbuf);
 
-       if (req->wct < 10) {
+       if (req->wct < 8) {
                reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
                END_PROFILE(SMBtranss);
                return;
@@ -738,64 +832,40 @@ void reply_transs(connection_struct *conn, struct smb_request *req)
        /* Revise total_params and total_data in case they have changed
         * downwards */
 
-       if (SVAL(req->inbuf, smb_vwv0) < state->total_param)
-               state->total_param = SVAL(req->inbuf,smb_vwv0);
-       if (SVAL(req->inbuf, smb_vwv1) < state->total_data)
-               state->total_data = SVAL(req->inbuf,smb_vwv1);
-
-       size = smb_len(req->inbuf) + 4;
+       if (SVAL(req->vwv+0, 0) < state->total_param)
+               state->total_param = SVAL(req->vwv+0, 0);
+       if (SVAL(req->vwv+1, 0) < state->total_data)
+               state->total_data = SVAL(req->vwv+1, 0);
 
-       pcnt = SVAL(req->inbuf, smb_spscnt);
-       poff = SVAL(req->inbuf, smb_spsoff);
-       pdisp = SVAL(req->inbuf, smb_spsdisp);
+       pcnt = SVAL(req->vwv+2, 0);
+       poff = SVAL(req->vwv+3, 0);
+       pdisp = SVAL(req->vwv+4, 0);
 
-       dcnt = SVAL(req->inbuf, smb_sdscnt);
-       doff = SVAL(req->inbuf, smb_sdsoff);
-       ddisp = SVAL(req->inbuf, smb_sdsdisp);
+       dcnt = SVAL(req->vwv+5, 0);
+       doff = SVAL(req->vwv+6, 0);
+       ddisp = SVAL(req->vwv+7, 0);
 
        state->received_param += pcnt;
        state->received_data += dcnt;
-               
+
        if ((state->received_data > state->total_data) ||
            (state->received_param > state->total_param))
                goto bad_param;
-               
+
        if (pcnt) {
-               if (pdisp+pcnt > state->total_param)
-                       goto bad_param;
-               if ((pdisp+pcnt < pdisp) || (pdisp+pcnt < pcnt))
-                       goto bad_param;
-               if (pdisp > state->total_param)
-                       goto bad_param;
-               if ((smb_base(req->inbuf) + poff + pcnt
-                    > (char *)req->inbuf + size) ||
-                   (smb_base(req->inbuf) + poff + pcnt
-                    < smb_base(req->inbuf)))
+               if (trans_oob(state->total_param, pdisp, pcnt)
+                   || trans_oob(smb_len(req->inbuf), poff, pcnt)) {
                        goto bad_param;
-               if (state->param + pdisp < state->param)
-                       goto bad_param;
-
-               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,
-                      pcnt);
+               }
+               memcpy(state->param+pdisp,smb_base(req->inbuf)+poff,pcnt);
        }
 
        if (dcnt) {
-               if (ddisp+dcnt > state->total_data)
-                       goto bad_param;
-               if ((ddisp+dcnt < ddisp) || (ddisp+dcnt < dcnt))
-                       goto bad_param;
-               if (ddisp > state->total_data)
+               if (trans_oob(state->total_data, ddisp, dcnt)
+                   || trans_oob(smb_len(req->inbuf), doff, dcnt)) {
                        goto bad_param;
-               if ((smb_base(req->inbuf) + doff + dcnt
-                    > (char *)inbuf + size) ||
-                   (smb_base(req->inbuf) + doff + dcnt
-                    < smb_base(req->inbuf)))
-                       goto bad_param;
-               if (state->data + ddisp < state->data)
-                       goto bad_param;
-
-               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,
-                      dcnt);      
+               }
+               memcpy(state->data+ddisp, smb_base(req->inbuf)+doff,dcnt);
        }
 
        if ((state->received_param < state->total_param) ||
@@ -804,34 +874,15 @@ void reply_transs(connection_struct *conn, struct smb_request *req)
                return;
        }
 
-       if (!reply_prep_legacy(req, &inbuf, &outbuf, &size, &bufsize)) {
-               reply_nterror(req, NT_STATUS_NO_MEMORY);
-               END_PROFILE(SMBtranss);
-               return;
-       }
-
-       /* construct_reply_common has done us the favor to pre-fill the
-        * command field with SMBtranss which is wrong :-)
-        */
-       SCVAL(req->outbuf,smb_com,SMBtrans);
-
-       result = handle_trans(conn, state, inbuf, outbuf, &outsize);
+       talloc_steal(talloc_tos(), state);
 
-       if (NT_STATUS_IS_OK(result)) {
-               reply_post_legacy(req, outsize);
-       }
+       handle_trans(conn, req, state);
 
        DLIST_REMOVE(conn->pending_trans, state);
        SAFE_FREE(state->data);
        SAFE_FREE(state->param);
        TALLOC_FREE(state);
 
-       if ((outsize == 0) || !NT_STATUS_IS_OK(result)) {
-               reply_doserror(req, ERRSRV, ERRnosupport);
-               END_PROFILE(SMBtranss);
-               return;
-       }
-       
        END_PROFILE(SMBtranss);
        return;