samba.git/libcli/smb/smb2cli_ioctl.c, branch talloc-2.3.2

libcli/smb: make sure we have a body size of 0x31 before dereferencing an ioctl response

2015-11-30T23:38:23+00:00

Found by valgrind, reported by Noel Power :

==7913== Invalid read of size 1
==7913==    at 0xC4F23EE: smb2cli_ioctl_done (smb2cli_ioctl.c:245)
==7913==    by 0x747A744: _tevent_req_notify_callback (tevent_req.c:112)
==7913==    by 0x747A817: tevent_req_finish (tevent_req.c:149)
==7913==    by 0x747A93C: tevent_req_trigger (tevent_req.c:206)
==7913==    by 0x7479B2B: tevent_common_loop_immediate
(tevent_immediate.c:135)
==7913==    by 0xA9CB4BE: run_events_poll (events.c:192)
==7913==    by 0xA9CBB32: s3_event_loop_once (events.c:303)
==7913==    by 0x7478C72: _tevent_loop_once (tevent.c:533)
==7913==    by 0x747AACD: tevent_req_poll (tevent_req.c:256)
==7913==    by 0x505315D: tevent_req_poll_ntstatus (tevent_ntstatus.c:109)
==7913==    by 0xA7201F2: cli_tree_connect (cliconnect.c:2764)
==7913==    by 0x165FF7: cm_prepare_connection (winbindd_cm.c:1276)
==7913==  Address 0x16ce24ec is 764 bytes inside a block of size 813 alloc'd
==7913==    at 0x4C29110: malloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7913==    by 0x768A0C1: __talloc_with_prefix (talloc.c:668)
==7913==    by 0x768A27E: _talloc_pool (talloc.c:721)
==7913==    by 0x768A41E: _talloc_pooled_object (talloc.c:790)
==7913==    by 0x747A594: _tevent_req_create (tevent_req.c:66)
==7913==    by 0xCF6E2FA: read_packet_send (async_sock.c:414)
==7913==    by 0xCF6EB54: read_smb_send (read_smb.c:54)
==7913==    by 0xC4DA146: smbXcli_conn_receive_next (smbXcli_base.c:1027)
==7913==    by 0xC4DA02D: smbXcli_req_set_pending (smbXcli_base.c:978)
==7913==    by 0xC4DF776: smb2cli_req_compound_submit (smbXcli_base.c:3166)
==7913==    by 0xC4DFC1D: smb2cli_req_send (smbXcli_base.c:3268)
==7913==    by 0xC4F2210: smb2cli_ioctl_send (smb2cli_ioctl.c:149)
==7913==

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11622

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

s3: libsmbclient: Add server-side copy support

2015-05-29T00:37:18+00:00

Introduce a new operation, splice, which copies data from one SMBCFILE
to another. Implement this operation using FSCTL_SRV_COPYCHUNK_WRITE for
SMB2+ protocols and using read+write for older protocols. Since the
operation may be long running, it takes a callback which gets called
periodically to indicate progress to the application and given an
opportunity to stop it.

Signed-off-by: Ross Lagerwall 
Reviewed-by: David Disseldorp 
Reviewed-by: Jeremy Allison

libcli/smb: list NT_STATUS_FILE_CLOSED as expected ioctl response.

2014-09-30T21:35:08+00:00

Some IOCTL requests change the behavior with new protocol versions.
E.g. FSCTL_VALIDATE_NEGOTIATE_INFO resulted in NT_STATUS_FILE_CLOSED
for old servers.

As SMB2 signing might be skipped for responses with NT_STATUS_FILE_CLOSED
we need to list it explicitly in the expected return values.

This way we'll get NT_STATUS_ACCESS_DENIED, if the server doesn't
sign the response to a signed requests.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Michael Adam

libcli/smb: fix smb2cli_ioctl*() against Windows 2008.

2013-10-31T00:16:09+00:00

The subsections of [MS-SMB2] "3.2.5.14 Receiving an SMB2 IOCTL Response"
say the client should ignore the InputOffset/InputCount.

We do that only if we ask for max_input_length = 0.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10232

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison 

Autobuild-User(master): Jeremy Allison 
Autobuild-Date(master): Thu Oct 31 01:16:10 CET 2013 on sn-devel-104

libcli/smb: pass max_dyn_len to smb2cli_req_send()

2013-08-15T07:07:06+00:00

This way we can calculate the correct credit charge
for requests with large output buffers.

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Jeremy Allison

libcli/smb: make use of samba_tevent_context_init()

2013-02-19T22:47:44+00:00

Signed-off-by: Stefan Metzmacher 
Reviewed-by: Michael Adam

libcli: Fix smb2cli_ioctl_send() if clause.

2012-12-21T12:56:00+00:00

Found by Coverity.

Signed-off-by: Andreas Schneider 
Reviewed-by: Günther Deschner

libcli/smb: use an explicit TALLOC_FREE(subreq) in smb2cli_*

2012-09-29T08:09:25+00:00

metze

libcli/smb: there's no PID field in the SMB2/3 header anymore

2012-07-25T10:15:05+00:00

It's a reserved field...

metze

libcli/smb: pass smbXcli_tcon to smb2cli_req_create/send()

2012-07-25T10:15:04+00:00

metze