Get medieval on our ass about SMB1 file descriptors being 16 bits, not an int.
[nivanova/samba-autobuild/.git] / source3 / libsmb / clireadwrite.c
1 /*
2    Unix SMB/CIFS implementation.
3    client file read/write routines
4    Copyright (C) Andrew Tridgell 1994-1998
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 3 of the License, or
9    (at your option) any later version.
10
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15
16    You should have received a copy of the GNU General Public License
17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21
22 /****************************************************************************
23   Calculate the recommended read buffer size
24 ****************************************************************************/
25 static size_t cli_read_max_bufsize(struct cli_state *cli)
26 {
27         if (!client_is_signing_on(cli) && !cli_encryption_on(cli)
28             && (cli->posix_capabilities & CIFS_UNIX_LARGE_READ_CAP)) {
29                 return CLI_SAMBA_MAX_POSIX_LARGE_READX_SIZE;
30         }
31         if (cli->capabilities & CAP_LARGE_READX) {
32                 return cli->is_samba
33                         ? CLI_SAMBA_MAX_LARGE_READX_SIZE
34                         : CLI_WINDOWS_MAX_LARGE_READX_SIZE;
35         }
36         return (cli->max_xmit - (smb_size+32)) & ~1023;
37 }
38
39 /****************************************************************************
40   Calculate the recommended write buffer size
41 ****************************************************************************/
42 static size_t cli_write_max_bufsize(struct cli_state *cli, uint16_t write_mode)
43 {
44         if (write_mode == 0 &&
45             !client_is_signing_on(cli) &&
46             !cli_encryption_on(cli) &&
47             (cli->posix_capabilities & CIFS_UNIX_LARGE_WRITE_CAP) &&
48             (cli->capabilities & CAP_LARGE_FILES)) {
49                 /* Only do massive writes if we can do them direct
50                  * with no signing or encrypting - not on a pipe. */
51                 return CLI_SAMBA_MAX_POSIX_LARGE_WRITEX_SIZE;
52         }
53
54         if (cli->is_samba) {
55                 return CLI_SAMBA_MAX_LARGE_WRITEX_SIZE;
56         }
57
58         if (((cli->capabilities & CAP_LARGE_WRITEX) == 0)
59             || client_is_signing_on(cli)
60             || strequal(cli->dev, "LPT1:")) {
61
62                 /*
63                  * Printer devices are restricted to max_xmit writesize in
64                  * Vista and XPSP3 as are signing connections.
65                  */
66
67                 return (cli->max_xmit - (smb_size+32)) & ~1023;
68         }
69
70         return CLI_WINDOWS_MAX_LARGE_WRITEX_SIZE;
71 }
72
73 struct cli_read_andx_state {
74         size_t size;
75         uint16_t vwv[12];
76         NTSTATUS status;
77         size_t received;
78         uint8_t *buf;
79 };
80
81 static void cli_read_andx_done(struct tevent_req *subreq);
82
83 struct tevent_req *cli_read_andx_create(TALLOC_CTX *mem_ctx,
84                                         struct event_context *ev,
85                                         struct cli_state *cli, uint16_t fnum,
86                                         off_t offset, size_t size,
87                                         struct tevent_req **psmbreq)
88 {
89         struct tevent_req *req, *subreq;
90         struct cli_read_andx_state *state;
91         bool bigoffset = False;
92         uint8_t wct = 10;
93
94         if (size > cli_read_max_bufsize(cli)) {
95                 DEBUG(0, ("cli_read_andx_send got size=%d, can only handle "
96                           "size=%d\n", (int)size,
97                           (int)cli_read_max_bufsize(cli)));
98                 return NULL;
99         }
100
101         req = tevent_req_create(mem_ctx, &state, struct cli_read_andx_state);
102         if (req == NULL) {
103                 return NULL;
104         }
105         state->size = size;
106
107         SCVAL(state->vwv + 0, 0, 0xFF);
108         SCVAL(state->vwv + 0, 1, 0);
109         SSVAL(state->vwv + 1, 0, 0);
110         SSVAL(state->vwv + 2, 0, fnum);
111         SIVAL(state->vwv + 3, 0, offset);
112         SSVAL(state->vwv + 5, 0, size);
113         SSVAL(state->vwv + 6, 0, size);
114         SSVAL(state->vwv + 7, 0, (size >> 16));
115         SSVAL(state->vwv + 8, 0, 0);
116         SSVAL(state->vwv + 9, 0, 0);
117
118         if ((uint64_t)offset >> 32) {
119                 bigoffset = true;
120                 SIVAL(state->vwv + 10, 0,
121                       (((uint64_t)offset)>>32) & 0xffffffff);
122                 wct += 2;
123         }
124
125         subreq = cli_smb_req_create(state, ev, cli, SMBreadX, 0, wct,
126                                     state->vwv, 0, NULL);
127         if (subreq == NULL) {
128                 TALLOC_FREE(req);
129                 return NULL;
130         }
131         tevent_req_set_callback(subreq, cli_read_andx_done, req);
132         *psmbreq = subreq;
133         return req;
134 }
135
136 struct tevent_req *cli_read_andx_send(TALLOC_CTX *mem_ctx,
137                                       struct event_context *ev,
138                                       struct cli_state *cli, uint16_t fnum,
139                                       off_t offset, size_t size)
140 {
141         struct tevent_req *req, *subreq;
142
143         req = cli_read_andx_create(mem_ctx, ev, cli, fnum, offset, size,
144                                    &subreq);
145         if ((req == NULL) || !cli_smb_req_send(subreq)) {
146                 TALLOC_FREE(req);
147                 return NULL;
148         }
149         return req;
150 }
151
152 static void cli_read_andx_done(struct tevent_req *subreq)
153 {
154         struct tevent_req *req = tevent_req_callback_data(
155                 subreq, struct tevent_req);
156         struct cli_read_andx_state *state = tevent_req_data(
157                 req, struct cli_read_andx_state);
158         uint8_t *inbuf;
159         uint8_t wct;
160         uint16_t *vwv;
161         uint32_t num_bytes;
162         uint8_t *bytes;
163
164         state->status = cli_smb_recv(subreq, 12, &wct, &vwv, &num_bytes,
165                                      &bytes);
166         if (NT_STATUS_IS_ERR(state->status)) {
167                 tevent_req_nterror(req, state->status);
168                 return;
169         }
170
171         /* size is the number of bytes the server returned.
172          * Might be zero. */
173         state->received = SVAL(vwv + 5, 0);
174         state->received |= (((unsigned int)SVAL(vwv + 7, 0)) << 16);
175
176         if (state->received > state->size) {
177                 DEBUG(5,("server returned more than we wanted!\n"));
178                 tevent_req_nterror(req, NT_STATUS_UNEXPECTED_IO_ERROR);
179                 return;
180         }
181
182         /*
183          * bcc field must be valid for small reads, for large reads the 16-bit
184          * bcc field can't be correct.
185          */
186
187         if ((state->received < 0xffff) && (state->received > num_bytes)) {
188                 DEBUG(5, ("server announced more bytes than sent\n"));
189                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
190                 return;
191         }
192
193         inbuf = cli_smb_inbuf(subreq);
194         state->buf = (uint8_t *)smb_base(inbuf) + SVAL(vwv+6, 0);
195
196         if (trans_oob(smb_len(inbuf), SVAL(vwv+6, 0), state->received)
197             || (state->buf < bytes)) {
198                 DEBUG(5, ("server returned invalid read&x data offset\n"));
199                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
200                 return;
201         }
202         tevent_req_done(req);
203 }
204
205 /*
206  * Pull the data out of a finished async read_and_x request. rcvbuf is
207  * talloced from the request, so better make sure that you copy it away before
208  * you talloc_free(req). "rcvbuf" is NOT a talloc_ctx of its own, so do not
209  * talloc_move it!
210  */
211
212 NTSTATUS cli_read_andx_recv(struct tevent_req *req, ssize_t *received,
213                             uint8_t **rcvbuf)
214 {
215         struct cli_read_andx_state *state = tevent_req_data(
216                 req, struct cli_read_andx_state);
217         NTSTATUS status;
218
219         if (tevent_req_is_nterror(req, &status)) {
220                 return status;
221         }
222         *received = state->received;
223         *rcvbuf = state->buf;
224         return NT_STATUS_OK;
225 }
226
227 struct cli_pull_subreq {
228         struct tevent_req *req;
229         ssize_t received;
230         uint8_t *buf;
231 };
232
233 /*
234  * Parallel read support.
235  *
236  * cli_pull sends as many read&x requests as the server would allow via
237  * max_mux at a time. When replies flow back in, the data is written into
238  * the callback function "sink" in the right order.
239  */
240
241 struct cli_pull_state {
242         struct tevent_req *req;
243
244         struct event_context *ev;
245         struct cli_state *cli;
246         uint16_t fnum;
247         off_t start_offset;
248         SMB_OFF_T size;
249
250         NTSTATUS (*sink)(char *buf, size_t n, void *priv);
251         void *priv;
252
253         size_t chunk_size;
254
255         /*
256          * Outstanding requests
257          */
258         int num_reqs;
259         struct cli_pull_subreq *reqs;
260
261         /*
262          * For how many bytes did we send requests already?
263          */
264         SMB_OFF_T requested;
265
266         /*
267          * Next request index to push into "sink". This walks around the "req"
268          * array, taking care that the requests are pushed to "sink" in the
269          * right order. If necessary (i.e. replies don't come in in the right
270          * order), replies are held back in "reqs".
271          */
272         int top_req;
273
274         /*
275          * How many bytes did we push into "sink"?
276          */
277
278         SMB_OFF_T pushed;
279 };
280
281 static char *cli_pull_print(struct tevent_req *req, TALLOC_CTX *mem_ctx)
282 {
283         struct cli_pull_state *state = tevent_req_data(
284                 req, struct cli_pull_state);
285         char *result;
286
287         result = tevent_req_print(mem_ctx, req);
288         if (result == NULL) {
289                 return NULL;
290         }
291
292         return talloc_asprintf_append_buffer(
293                 result, "num_reqs=%d, top_req=%d",
294                 state->num_reqs, state->top_req);
295 }
296
297 static void cli_pull_read_done(struct tevent_req *read_req);
298
299 /*
300  * Prepare an async pull request
301  */
302
303 struct tevent_req *cli_pull_send(TALLOC_CTX *mem_ctx,
304                                  struct event_context *ev,
305                                  struct cli_state *cli,
306                                  uint16_t fnum, off_t start_offset,
307                                  SMB_OFF_T size, size_t window_size,
308                                  NTSTATUS (*sink)(char *buf, size_t n,
309                                                   void *priv),
310                                  void *priv)
311 {
312         struct tevent_req *req;
313         struct cli_pull_state *state;
314         int i;
315
316         req = tevent_req_create(mem_ctx, &state, struct cli_pull_state);
317         if (req == NULL) {
318                 return NULL;
319         }
320         tevent_req_set_print_fn(req, cli_pull_print);
321         state->req = req;
322
323         state->cli = cli;
324         state->ev = ev;
325         state->fnum = fnum;
326         state->start_offset = start_offset;
327         state->size = size;
328         state->sink = sink;
329         state->priv = priv;
330
331         state->pushed = 0;
332         state->top_req = 0;
333
334         if (size == 0) {
335                 tevent_req_done(req);
336                 return tevent_req_post(req, ev);
337         }
338
339         state->chunk_size = cli_read_max_bufsize(cli);
340
341         state->num_reqs = MAX(window_size/state->chunk_size, 1);
342         state->num_reqs = MIN(state->num_reqs, cli->max_mux);
343
344         state->reqs = TALLOC_ZERO_ARRAY(state, struct cli_pull_subreq,
345                                         state->num_reqs);
346         if (state->reqs == NULL) {
347                 goto failed;
348         }
349
350         state->requested = 0;
351
352         for (i=0; i<state->num_reqs; i++) {
353                 struct cli_pull_subreq *subreq = &state->reqs[i];
354                 SMB_OFF_T size_left;
355                 size_t request_thistime;
356
357                 if (state->requested >= size) {
358                         state->num_reqs = i;
359                         break;
360                 }
361
362                 size_left = size - state->requested;
363                 request_thistime = MIN(size_left, state->chunk_size);
364
365                 subreq->req = cli_read_andx_send(
366                         state->reqs, ev, cli, fnum,
367                         state->start_offset + state->requested,
368                         request_thistime);
369
370                 if (subreq->req == NULL) {
371                         goto failed;
372                 }
373                 tevent_req_set_callback(subreq->req, cli_pull_read_done, req);
374                 state->requested += request_thistime;
375         }
376         return req;
377
378 failed:
379         TALLOC_FREE(req);
380         return NULL;
381 }
382
383 /*
384  * Handle incoming read replies, push the data into sink and send out new
385  * requests if necessary.
386  */
387
388 static void cli_pull_read_done(struct tevent_req *subreq)
389 {
390         struct tevent_req *req = tevent_req_callback_data(
391                 subreq, struct tevent_req);
392         struct cli_pull_state *state = tevent_req_data(
393                 req, struct cli_pull_state);
394         struct cli_pull_subreq *pull_subreq = NULL;
395         NTSTATUS status;
396         int i;
397
398         for (i = 0; i < state->num_reqs; i++) {
399                 pull_subreq = &state->reqs[i];
400                 if (subreq == pull_subreq->req) {
401                         break;
402                 }
403         }
404         if (i == state->num_reqs) {
405                 /* Huh -- received something we did not send?? */
406                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
407                 return;
408         }
409
410         status = cli_read_andx_recv(subreq, &pull_subreq->received,
411                                     &pull_subreq->buf);
412         if (!NT_STATUS_IS_OK(status)) {
413                 tevent_req_nterror(state->req, status);
414                 return;
415         }
416
417         /*
418          * This loop is the one to take care of out-of-order replies. All
419          * pending requests are in state->reqs, state->reqs[top_req] is the
420          * one that is to be pushed next. If however a request later than
421          * top_req is replied to, then we can't push yet. If top_req is
422          * replied to at a later point then, we need to push all the finished
423          * requests.
424          */
425
426         while (state->reqs[state->top_req].req != NULL) {
427                 struct cli_pull_subreq *top_subreq;
428
429                 DEBUG(11, ("cli_pull_read_done: top_req = %d\n",
430                            state->top_req));
431
432                 top_subreq = &state->reqs[state->top_req];
433
434                 if (tevent_req_is_in_progress(top_subreq->req)) {
435                         DEBUG(11, ("cli_pull_read_done: top request not yet "
436                                    "done\n"));
437                         return;
438                 }
439
440                 DEBUG(10, ("cli_pull_read_done: Pushing %d bytes, %d already "
441                            "pushed\n", (int)top_subreq->received,
442                            (int)state->pushed));
443
444                 status = state->sink((char *)top_subreq->buf,
445                                      top_subreq->received, state->priv);
446                 if (!NT_STATUS_IS_OK(status)) {
447                         tevent_req_nterror(state->req, status);
448                         return;
449                 }
450                 state->pushed += top_subreq->received;
451
452                 TALLOC_FREE(state->reqs[state->top_req].req);
453
454                 if (state->requested < state->size) {
455                         struct tevent_req *new_req;
456                         SMB_OFF_T size_left;
457                         size_t request_thistime;
458
459                         size_left = state->size - state->requested;
460                         request_thistime = MIN(size_left, state->chunk_size);
461
462                         DEBUG(10, ("cli_pull_read_done: Requesting %d bytes "
463                                    "at %d, position %d\n",
464                                    (int)request_thistime,
465                                    (int)(state->start_offset
466                                          + state->requested),
467                                    state->top_req));
468
469                         new_req = cli_read_andx_send(
470                                 state->reqs, state->ev, state->cli,
471                                 state->fnum,
472                                 state->start_offset + state->requested,
473                                 request_thistime);
474
475                         if (tevent_req_nomem(new_req, state->req)) {
476                                 return;
477                         }
478                         tevent_req_set_callback(new_req, cli_pull_read_done,
479                                                 req);
480
481                         state->reqs[state->top_req].req = new_req;
482                         state->requested += request_thistime;
483                 }
484
485                 state->top_req = (state->top_req+1) % state->num_reqs;
486         }
487
488         tevent_req_done(req);
489 }
490
491 NTSTATUS cli_pull_recv(struct tevent_req *req, SMB_OFF_T *received)
492 {
493         struct cli_pull_state *state = tevent_req_data(
494                 req, struct cli_pull_state);
495         NTSTATUS status;
496
497         if (tevent_req_is_nterror(req, &status)) {
498                 return status;
499         }
500         *received = state->pushed;
501         return NT_STATUS_OK;
502 }
503
504 NTSTATUS cli_pull(struct cli_state *cli, uint16_t fnum,
505                   off_t start_offset, SMB_OFF_T size, size_t window_size,
506                   NTSTATUS (*sink)(char *buf, size_t n, void *priv),
507                   void *priv, SMB_OFF_T *received)
508 {
509         TALLOC_CTX *frame = talloc_stackframe();
510         struct event_context *ev;
511         struct tevent_req *req;
512         NTSTATUS status = NT_STATUS_OK;
513
514         if (cli_has_async_calls(cli)) {
515                 /*
516                  * Can't use sync call while an async call is in flight
517                  */
518                 status = NT_STATUS_INVALID_PARAMETER;
519                 goto fail;
520         }
521
522         ev = event_context_init(frame);
523         if (ev == NULL) {
524                 status = NT_STATUS_NO_MEMORY;
525                 goto fail;
526         }
527
528         req = cli_pull_send(frame, ev, cli, fnum, start_offset, size,
529                             window_size, sink, priv);
530         if (req == NULL) {
531                 status = NT_STATUS_NO_MEMORY;
532                 goto fail;
533         }
534
535         if (!tevent_req_poll(req, ev)) {
536                 status = map_nt_error_from_unix(errno);
537                 goto fail;
538         }
539
540         status = cli_pull_recv(req, received);
541  fail:
542         TALLOC_FREE(frame);
543         if (!NT_STATUS_IS_OK(status)) {
544                 cli_set_error(cli, status);
545         }
546         return status;
547 }
548
549 static NTSTATUS cli_read_sink(char *buf, size_t n, void *priv)
550 {
551         char **pbuf = (char **)priv;
552         memcpy(*pbuf, buf, n);
553         *pbuf += n;
554         return NT_STATUS_OK;
555 }
556
557 ssize_t cli_read(struct cli_state *cli, uint16_t fnum, char *buf,
558                  off_t offset, size_t size)
559 {
560         NTSTATUS status;
561         SMB_OFF_T ret;
562
563         status = cli_pull(cli, fnum, offset, size, size,
564                           cli_read_sink, &buf, &ret);
565         if (!NT_STATUS_IS_OK(status)) {
566                 cli_set_error(cli, status);
567                 return -1;
568         }
569         return ret;
570 }
571
572 /****************************************************************************
573  Issue a single SMBwrite and don't wait for a reply.
574 ****************************************************************************/
575
576 static bool cli_issue_write(struct cli_state *cli,
577                                 uint16_t fnum,
578                                 off_t offset,
579                                 uint16 mode,
580                                 const char *buf,
581                                 size_t size,
582                                 int i)
583 {
584         char *p;
585         bool large_writex = false;
586         /* We can only do direct writes if not signing and not encrypting. */
587         bool direct_writes = !client_is_signing_on(cli) && !cli_encryption_on(cli);
588
589         if (!direct_writes && size + 1 > cli->bufsize) {
590                 cli->outbuf = (char *)SMB_REALLOC(cli->outbuf, size + 1024);
591                 if (!cli->outbuf) {
592                         return False;
593                 }
594                 cli->inbuf = (char *)SMB_REALLOC(cli->inbuf, size + 1024);
595                 if (cli->inbuf == NULL) {
596                         SAFE_FREE(cli->outbuf);
597                         return False;
598                 }
599                 cli->bufsize = size + 1024;
600         }
601
602         memset(cli->outbuf,'\0',smb_size);
603         memset(cli->inbuf,'\0',smb_size);
604
605         if (cli->capabilities & CAP_LARGE_FILES) {
606                 large_writex = True;
607         }
608
609         if (large_writex) {
610                 cli_set_message(cli->outbuf,14,0,True);
611         } else {
612                 cli_set_message(cli->outbuf,12,0,True);
613         }
614
615         SCVAL(cli->outbuf,smb_com,SMBwriteX);
616         SSVAL(cli->outbuf,smb_tid,cli->cnum);
617         cli_setup_packet(cli);
618
619         SCVAL(cli->outbuf,smb_vwv0,0xFF);
620         SSVAL(cli->outbuf,smb_vwv2,fnum);
621
622         SIVAL(cli->outbuf,smb_vwv3,offset);
623         SIVAL(cli->outbuf,smb_vwv5,0);
624         SSVAL(cli->outbuf,smb_vwv7,mode);
625
626         SSVAL(cli->outbuf,smb_vwv8,(mode & 0x0008) ? size : 0);
627         /*
628          * According to CIFS-TR-1p00, this following field should only
629          * be set if CAP_LARGE_WRITEX is set. We should check this
630          * locally. However, this check might already have been
631          * done by our callers.
632          */
633         SSVAL(cli->outbuf,smb_vwv9,(size>>16));
634         SSVAL(cli->outbuf,smb_vwv10,size);
635         /* +1 is pad byte. */
636         SSVAL(cli->outbuf,smb_vwv11,
637               smb_buf(cli->outbuf) - smb_base(cli->outbuf) + 1);
638
639         if (large_writex) {
640                 SIVAL(cli->outbuf,smb_vwv12,(((uint64_t)offset)>>32) & 0xffffffff);
641         }
642
643         p = smb_base(cli->outbuf) + SVAL(cli->outbuf,smb_vwv11) -1;
644         *p++ = '\0'; /* pad byte. */
645         if (!direct_writes) {
646                 memcpy(p, buf, size);
647         }
648         if (size > 0x1FFFF) {
649                 /* This is a POSIX 14 word large write. */
650                 set_message_bcc(cli->outbuf, 0); /* Set bcc to zero. */
651                 _smb_setlen_large(cli->outbuf,smb_size + 28 + 1 /* pad */ + size - 4);
652         } else {
653                 cli_setup_bcc(cli, p+size);
654         }
655
656         SSVAL(cli->outbuf,smb_mid,cli->mid + i);
657
658         show_msg(cli->outbuf);
659         if (direct_writes) {
660                 /* For direct writes we now need to write the data
661                  * directly out of buf. */
662                 return cli_send_smb_direct_writeX(cli, buf, size);
663         } else {
664                 return cli_send_smb(cli);
665         }
666 }
667
668 /****************************************************************************
669   write to a file
670   write_mode: 0x0001 disallow write cacheing
671               0x0002 return bytes remaining
672               0x0004 use raw named pipe protocol
673               0x0008 start of message mode named pipe protocol
674 ****************************************************************************/
675
676 ssize_t cli_write(struct cli_state *cli,
677                  uint16_t fnum, uint16 write_mode,
678                  const char *buf, off_t offset, size_t size)
679 {
680         ssize_t bwritten = 0;
681         unsigned int issued = 0;
682         unsigned int received = 0;
683         int mpx = 1;
684         size_t writesize;
685         int blocks;
686
687         if(cli->max_mux > 1) {
688                 mpx = cli->max_mux-1;
689         } else {
690                 mpx = 1;
691         }
692
693         writesize = cli_write_max_bufsize(cli, write_mode);
694
695         blocks = (size + (writesize-1)) / writesize;
696
697         while (received < blocks) {
698
699                 while ((issued - received < mpx) && (issued < blocks)) {
700                         ssize_t bsent = issued * writesize;
701                         ssize_t size1 = MIN(writesize, size - bsent);
702
703                         if (!cli_issue_write(cli, fnum, offset + bsent,
704                                         write_mode,
705                                         buf + bsent,
706                                         size1, issued))
707                                 return -1;
708                         issued++;
709                 }
710
711                 if (!cli_receive_smb(cli)) {
712                         return bwritten;
713                 }
714
715                 received++;
716
717                 if (cli_is_error(cli))
718                         break;
719
720                 bwritten += SVAL(cli->inbuf, smb_vwv2);
721                 if (writesize > 0xFFFF) {
722                         bwritten += (((int)(SVAL(cli->inbuf, smb_vwv4)))<<16);
723                 }
724         }
725
726         while (received < issued && cli_receive_smb(cli)) {
727                 received++;
728         }
729
730         return bwritten;
731 }
732
733 /****************************************************************************
734   write to a file using a SMBwrite and not bypassing 0 byte writes
735 ****************************************************************************/
736
737 ssize_t cli_smbwrite(struct cli_state *cli,
738                      uint16_t fnum, char *buf, off_t offset, size_t size1)
739 {
740         char *p;
741         ssize_t total = 0;
742
743         do {
744                 size_t size = MIN(size1, cli->max_xmit - 48);
745
746                 memset(cli->outbuf,'\0',smb_size);
747                 memset(cli->inbuf,'\0',smb_size);
748
749                 cli_set_message(cli->outbuf,5, 0,True);
750
751                 SCVAL(cli->outbuf,smb_com,SMBwrite);
752                 SSVAL(cli->outbuf,smb_tid,cli->cnum);
753                 cli_setup_packet(cli);
754
755                 SSVAL(cli->outbuf,smb_vwv0,fnum);
756                 SSVAL(cli->outbuf,smb_vwv1,size);
757                 SIVAL(cli->outbuf,smb_vwv2,offset);
758                 SSVAL(cli->outbuf,smb_vwv4,0);
759
760                 p = smb_buf(cli->outbuf);
761                 *p++ = 1;
762                 SSVAL(p, 0, size); p += 2;
763                 memcpy(p, buf + total, size); p += size;
764
765                 cli_setup_bcc(cli, p);
766
767                 if (!cli_send_smb(cli))
768                         return -1;
769
770                 if (!cli_receive_smb(cli))
771                         return -1;
772
773                 if (cli_is_error(cli))
774                         return -1;
775
776                 size = SVAL(cli->inbuf,smb_vwv0);
777                 if (size == 0)
778                         break;
779
780                 size1 -= size;
781                 total += size;
782                 offset += size;
783
784         } while (size1);
785
786         return total;
787 }
788
789 /*
790  * Send a write&x request
791  */
792
793 struct cli_write_andx_state {
794         size_t size;
795         uint16_t vwv[14];
796         size_t written;
797         uint8_t pad;
798         struct iovec iov[2];
799 };
800
801 static void cli_write_andx_done(struct tevent_req *subreq);
802
803 struct tevent_req *cli_write_andx_create(TALLOC_CTX *mem_ctx,
804                                          struct event_context *ev,
805                                          struct cli_state *cli, uint16_t fnum,
806                                          uint16_t mode, const uint8_t *buf,
807                                          off_t offset, size_t size,
808                                          struct tevent_req **reqs_before,
809                                          int num_reqs_before,
810                                          struct tevent_req **psmbreq)
811 {
812         struct tevent_req *req, *subreq;
813         struct cli_write_andx_state *state;
814         bool bigoffset = ((cli->capabilities & CAP_LARGE_FILES) != 0);
815         uint8_t wct = bigoffset ? 14 : 12;
816         size_t max_write = cli_write_max_bufsize(cli, mode);
817         uint16_t *vwv;
818
819         req = tevent_req_create(mem_ctx, &state, struct cli_write_andx_state);
820         if (req == NULL) {
821                 return NULL;
822         }
823
824         size = MIN(size, max_write);
825
826         vwv = state->vwv;
827
828         SCVAL(vwv+0, 0, 0xFF);
829         SCVAL(vwv+0, 1, 0);
830         SSVAL(vwv+1, 0, 0);
831         SSVAL(vwv+2, 0, fnum);
832         SIVAL(vwv+3, 0, offset);
833         SIVAL(vwv+5, 0, 0);
834         SSVAL(vwv+7, 0, mode);
835         SSVAL(vwv+8, 0, 0);
836         SSVAL(vwv+9, 0, (size>>16));
837         SSVAL(vwv+10, 0, size);
838
839         SSVAL(vwv+11, 0,
840               cli_smb_wct_ofs(reqs_before, num_reqs_before)
841               + 1               /* the wct field */
842               + wct * 2         /* vwv */
843               + 2               /* num_bytes field */
844               + 1               /* pad */);
845
846         if (bigoffset) {
847                 SIVAL(vwv+12, 0, (((uint64_t)offset)>>32) & 0xffffffff);
848         }
849
850         state->pad = 0;
851         state->iov[0].iov_base = &state->pad;
852         state->iov[0].iov_len = 1;
853         state->iov[1].iov_base = CONST_DISCARD(uint8_t *, buf);
854         state->iov[1].iov_len = size;
855
856         subreq = cli_smb_req_create(state, ev, cli, SMBwriteX, 0, wct, vwv,
857                                     2, state->iov);
858         if (tevent_req_nomem(subreq, req)) {
859                 return tevent_req_post(req, ev);
860         }
861         tevent_req_set_callback(subreq, cli_write_andx_done, req);
862         *psmbreq = subreq;
863         return req;
864 }
865
866 struct tevent_req *cli_write_andx_send(TALLOC_CTX *mem_ctx,
867                                        struct event_context *ev,
868                                        struct cli_state *cli, uint16_t fnum,
869                                        uint16_t mode, const uint8_t *buf,
870                                        off_t offset, size_t size)
871 {
872         struct tevent_req *req, *subreq;
873
874         req = cli_write_andx_create(mem_ctx, ev, cli, fnum, mode, buf, offset,
875                                     size, NULL, 0, &subreq);
876         if ((req == NULL) || !cli_smb_req_send(subreq)) {
877                 TALLOC_FREE(req);
878                 return NULL;
879         }
880         return req;
881 }
882
883 static void cli_write_andx_done(struct tevent_req *subreq)
884 {
885         struct tevent_req *req = tevent_req_callback_data(
886                 subreq, struct tevent_req);
887         struct cli_write_andx_state *state = tevent_req_data(
888                 req, struct cli_write_andx_state);
889         uint8_t wct;
890         uint16_t *vwv;
891         NTSTATUS status;
892
893         status = cli_smb_recv(subreq, 6, &wct, &vwv, NULL, NULL);
894         if (NT_STATUS_IS_ERR(status)) {
895                 TALLOC_FREE(subreq);
896                 tevent_req_nterror(req, status);
897                 return;
898         }
899         state->written = SVAL(vwv+2, 0);
900         state->written |= SVAL(vwv+4, 0)<<16;
901         tevent_req_done(req);
902 }
903
904 NTSTATUS cli_write_andx_recv(struct tevent_req *req, size_t *pwritten)
905 {
906         struct cli_write_andx_state *state = tevent_req_data(
907                 req, struct cli_write_andx_state);
908         NTSTATUS status;
909
910         if (tevent_req_is_nterror(req, &status)) {
911                 return status;
912         }
913         *pwritten = state->written;
914         return NT_STATUS_OK;
915 }
916
917 struct cli_writeall_state {
918         struct event_context *ev;
919         struct cli_state *cli;
920         uint16_t fnum;
921         uint16_t mode;
922         const uint8_t *buf;
923         off_t offset;
924         size_t size;
925         size_t written;
926 };
927
928 static void cli_writeall_written(struct tevent_req *req);
929
930 static struct tevent_req *cli_writeall_send(TALLOC_CTX *mem_ctx,
931                                             struct event_context *ev,
932                                             struct cli_state *cli,
933                                             uint16_t fnum,
934                                             uint16_t mode,
935                                             const uint8_t *buf,
936                                             off_t offset, size_t size)
937 {
938         struct tevent_req *req, *subreq;
939         struct cli_writeall_state *state;
940
941         req = tevent_req_create(mem_ctx, &state, struct cli_writeall_state);
942         if (req == NULL) {
943                 return NULL;
944         }
945         state->ev = ev;
946         state->cli = cli;
947         state->fnum = fnum;
948         state->mode = mode;
949         state->buf = buf;
950         state->offset = offset;
951         state->size = size;
952         state->written = 0;
953
954         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
955                                      state->mode, state->buf, state->offset,
956                                      state->size);
957         if (tevent_req_nomem(subreq, req)) {
958                 return tevent_req_post(req, ev);
959         }
960         tevent_req_set_callback(subreq, cli_writeall_written, req);
961         return req;
962 }
963
964 static void cli_writeall_written(struct tevent_req *subreq)
965 {
966         struct tevent_req *req = tevent_req_callback_data(
967                 subreq, struct tevent_req);
968         struct cli_writeall_state *state = tevent_req_data(
969                 req, struct cli_writeall_state);
970         NTSTATUS status;
971         size_t written, to_write;
972
973         status = cli_write_andx_recv(subreq, &written);
974         TALLOC_FREE(subreq);
975         if (!NT_STATUS_IS_OK(status)) {
976                 tevent_req_nterror(req, status);
977                 return;
978         }
979
980         state->written += written;
981
982         if (state->written > state->size) {
983                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
984                 return;
985         }
986
987         to_write = state->size - state->written;
988
989         if (to_write == 0) {
990                 tevent_req_done(req);
991                 return;
992         }
993
994         subreq = cli_write_andx_send(state, state->ev, state->cli, state->fnum,
995                                      state->mode,
996                                      state->buf + state->written,
997                                      state->offset + state->written, to_write);
998         if (tevent_req_nomem(subreq, req)) {
999                 return;
1000         }
1001         tevent_req_set_callback(subreq, cli_writeall_written, req);
1002 }
1003
1004 static NTSTATUS cli_writeall_recv(struct tevent_req *req)
1005 {
1006         return tevent_req_simple_recv_ntstatus(req);
1007 }
1008
1009 struct cli_push_write_state {
1010         struct tevent_req *req;/* This is the main request! Not the subreq */
1011         uint32_t idx;
1012         off_t ofs;
1013         uint8_t *buf;
1014         size_t size;
1015 };
1016
1017 struct cli_push_state {
1018         struct event_context *ev;
1019         struct cli_state *cli;
1020         uint16_t fnum;
1021         uint16_t mode;
1022         off_t start_offset;
1023         size_t window_size;
1024
1025         size_t (*source)(uint8_t *buf, size_t n, void *priv);
1026         void *priv;
1027
1028         bool eof;
1029
1030         size_t chunk_size;
1031         off_t next_offset;
1032
1033         /*
1034          * Outstanding requests
1035          */
1036         uint32_t pending;
1037         uint32_t num_reqs;
1038         struct cli_push_write_state **reqs;
1039 };
1040
1041 static void cli_push_written(struct tevent_req *req);
1042
1043 static bool cli_push_write_setup(struct tevent_req *req,
1044                                  struct cli_push_state *state,
1045                                  uint32_t idx)
1046 {
1047         struct cli_push_write_state *substate;
1048         struct tevent_req *subreq;
1049
1050         substate = talloc(state->reqs, struct cli_push_write_state);
1051         if (!substate) {
1052                 return false;
1053         }
1054         substate->req = req;
1055         substate->idx = idx;
1056         substate->ofs = state->next_offset;
1057         substate->buf = talloc_array(substate, uint8_t, state->chunk_size);
1058         if (!substate->buf) {
1059                 talloc_free(substate);
1060                 return false;
1061         }
1062         substate->size = state->source(substate->buf,
1063                                        state->chunk_size,
1064                                        state->priv);
1065         if (substate->size == 0) {
1066                 state->eof = true;
1067                 /* nothing to send */
1068                 talloc_free(substate);
1069                 return true;
1070         }
1071
1072         subreq = cli_writeall_send(substate,
1073                                    state->ev, state->cli,
1074                                    state->fnum, state->mode,
1075                                    substate->buf,
1076                                    substate->ofs,
1077                                    substate->size);
1078         if (!subreq) {
1079                 talloc_free(substate);
1080                 return false;
1081         }
1082         tevent_req_set_callback(subreq, cli_push_written, substate);
1083
1084         state->reqs[idx] = substate;
1085         state->pending += 1;
1086         state->next_offset += substate->size;
1087
1088         return true;
1089 }
1090
1091 struct tevent_req *cli_push_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
1092                                  struct cli_state *cli,
1093                                  uint16_t fnum, uint16_t mode,
1094                                  off_t start_offset, size_t window_size,
1095                                  size_t (*source)(uint8_t *buf, size_t n,
1096                                                   void *priv),
1097                                  void *priv)
1098 {
1099         struct tevent_req *req;
1100         struct cli_push_state *state;
1101         uint32_t i;
1102
1103         req = tevent_req_create(mem_ctx, &state, struct cli_push_state);
1104         if (req == NULL) {
1105                 return NULL;
1106         }
1107         state->cli = cli;
1108         state->ev = ev;
1109         state->fnum = fnum;
1110         state->start_offset = start_offset;
1111         state->mode = mode;
1112         state->source = source;
1113         state->priv = priv;
1114         state->eof = false;
1115         state->pending = 0;
1116         state->next_offset = start_offset;
1117
1118         state->chunk_size = cli_write_max_bufsize(cli, mode);
1119
1120         if (window_size == 0) {
1121                 window_size = cli->max_mux * state->chunk_size;
1122         }
1123         state->num_reqs = window_size/state->chunk_size;
1124         if ((window_size % state->chunk_size) > 0) {
1125                 state->num_reqs += 1;
1126         }
1127         state->num_reqs = MIN(state->num_reqs, cli->max_mux);
1128         state->num_reqs = MAX(state->num_reqs, 1);
1129
1130         state->reqs = TALLOC_ZERO_ARRAY(state, struct cli_push_write_state *,
1131                                         state->num_reqs);
1132         if (state->reqs == NULL) {
1133                 goto failed;
1134         }
1135
1136         for (i=0; i<state->num_reqs; i++) {
1137                 if (!cli_push_write_setup(req, state, i)) {
1138                         goto failed;
1139                 }
1140
1141                 if (state->eof) {
1142                         break;
1143                 }
1144         }
1145
1146         if (state->pending == 0) {
1147                 tevent_req_done(req);
1148                 return tevent_req_post(req, ev);
1149         }
1150
1151         return req;
1152
1153  failed:
1154         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1155         return tevent_req_post(req, ev);
1156 }
1157
1158 static void cli_push_written(struct tevent_req *subreq)
1159 {
1160         struct cli_push_write_state *substate = tevent_req_callback_data(
1161                 subreq, struct cli_push_write_state);
1162         struct tevent_req *req = substate->req;
1163         struct cli_push_state *state = tevent_req_data(
1164                 req, struct cli_push_state);
1165         NTSTATUS status;
1166         uint32_t idx = substate->idx;
1167
1168         state->reqs[idx] = NULL;
1169         state->pending -= 1;
1170
1171         status = cli_writeall_recv(subreq);
1172         TALLOC_FREE(subreq);
1173         TALLOC_FREE(substate);
1174         if (!NT_STATUS_IS_OK(status)) {
1175                 tevent_req_nterror(req, status);
1176                 return;
1177         }
1178
1179         if (!state->eof) {
1180                 if (!cli_push_write_setup(req, state, idx)) {
1181                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1182                         return;
1183                 }
1184         }
1185
1186         if (state->pending == 0) {
1187                 tevent_req_done(req);
1188                 return;
1189         }
1190 }
1191
1192 NTSTATUS cli_push_recv(struct tevent_req *req)
1193 {
1194         return tevent_req_simple_recv_ntstatus(req);
1195 }
1196
1197 NTSTATUS cli_push(struct cli_state *cli, uint16_t fnum, uint16_t mode,
1198                   off_t start_offset, size_t window_size,
1199                   size_t (*source)(uint8_t *buf, size_t n, void *priv),
1200                   void *priv)
1201 {
1202         TALLOC_CTX *frame = talloc_stackframe();
1203         struct event_context *ev;
1204         struct tevent_req *req;
1205         NTSTATUS status = NT_STATUS_OK;
1206
1207         if (cli_has_async_calls(cli)) {
1208                 /*
1209                  * Can't use sync call while an async call is in flight
1210                  */
1211                 status = NT_STATUS_INVALID_PARAMETER;
1212                 goto fail;
1213         }
1214
1215         ev = event_context_init(frame);
1216         if (ev == NULL) {
1217                 status = NT_STATUS_NO_MEMORY;
1218                 goto fail;
1219         }
1220
1221         req = cli_push_send(frame, ev, cli, fnum, mode, start_offset,
1222                             window_size, source, priv);
1223         if (req == NULL) {
1224                 status = NT_STATUS_NO_MEMORY;
1225                 goto fail;
1226         }
1227
1228         if (!tevent_req_poll(req, ev)) {
1229                 status = map_nt_error_from_unix(errno);
1230                 goto fail;
1231         }
1232
1233         status = cli_push_recv(req);
1234  fail:
1235         TALLOC_FREE(frame);
1236         if (!NT_STATUS_IS_OK(status)) {
1237                 cli_set_error(cli, status);
1238         }
1239         return status;
1240 }