1 files changed, 48 insertions, 45 deletions

diff --git a/source3/smbd/smb2_read.c b/source3/smbd/smb2_read.c
index 05e0b6a88b..41adb03408 100644
--- a/source3/smbd/smb2_read.c
+++ b/source3/smbd/smb2_read.c
@@ -31,7 +31,6 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 					      struct tevent_context *ev,
 					      struct smbd_smb2_request *smb2req,
 					      struct files_struct *in_fsp,
-					      uint32_t in_smbpid,
 					      uint32_t in_length,
 					      uint64_t in_offset,
 					      uint32_t in_minimum,
@@ -45,10 +44,7 @@ static void smbd_smb2_request_read_done(struct tevent_req *subreq);
 NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 {
 	NTSTATUS status;
-	const uint8_t *inhdr;
 	const uint8_t *inbody;
-	int i = req->current_idx;
-	uint32_t in_smbpid;
 	uint32_t in_length;
 	uint64_t in_offset;
 	uint64_t in_file_id_persistent;
@@ -62,10 +58,7 @@ NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 	if (!NT_STATUS_IS_OK(status)) {
 		return smbd_smb2_request_error(req, status);
 	}
-	inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
-	inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
-
-	in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
+	inbody = SMBD_SMB2_IN_BODY_PTR(req);
 
 	in_length		= IVAL(inbody, 0x04);
 	in_offset		= BVAL(inbody, 0x08);
@@ -76,19 +69,24 @@ NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 
 	/* check the max read size */
 	if (in_length > req->sconn->smb2.max_read) {
-		DEBUG(0,("here:%s: 0x%08X: 0x%08X\n",
+		DEBUG(2,("smbd_smb2_request_process_read: "
+			 "client ignored max read: %s: 0x%08X: 0x%08X\n",
 			__location__, in_length, req->sconn->smb2.max_read));
 		return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 	}
 
+	status = smbd_smb2_request_verify_creditcharge(req, in_length);
+	if (!NT_STATUS_IS_OK(status)) {
+		return smbd_smb2_request_error(req, status);
+	}
+
 	in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
 	if (in_fsp == NULL) {
 		return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
 	}
 
-	subreq = smbd_smb2_read_send(req, req->sconn->smb2.event_ctx,
+	subreq = smbd_smb2_read_send(req, req->sconn->ev_ctx,
 				     req, in_fsp,
-				     in_smbpid,
 				     in_length,
 				     in_offset,
 				     in_minimum_count,
@@ -98,15 +96,13 @@ NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
 	}
 	tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
 
-	return smbd_smb2_request_pending_queue(req, subreq);
+	return smbd_smb2_request_pending_queue(req, subreq, 500);
 }
 
 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
 {
 	struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
 					struct smbd_smb2_request);
-	int i = req->current_idx;
-	uint8_t *outhdr;
 	DATA_BLOB outbody;
 	DATA_BLOB outdyn;
 	uint8_t out_data_offset;
@@ -132,8 +128,6 @@ static void smbd_smb2_request_read_done(struct tevent_req *subreq)
 
 	out_data_offset = SMB2_HDR_BODY + 0x10;
 
-	outhdr = (uint8_t *)req->out.vector[i].iov_base;
-
 	outbody = data_blob_talloc(req->out.vector, NULL, 0x10);
 	if (outbody.data == NULL) {
 		error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
@@ -167,6 +161,7 @@ static void smbd_smb2_request_read_done(struct tevent_req *subreq)
 
 struct smbd_smb2_read_state {
 	struct smbd_smb2_request *smb2req;
+	struct smb_request *smbreq;
 	files_struct *fsp;
 	uint32_t in_length;
 	uint64_t in_offset;
@@ -249,7 +244,7 @@ static int smb2_sendfile_send_data(struct smbd_smb2_read_state *state)
 	}
 
 	init_strict_lock_struct(fsp,
-				fsp->fnum,
+				fsp->op->global->open_persistent_id,
 				in_offset,
 				in_length,
 				READ_LOCK,
@@ -279,15 +274,16 @@ static NTSTATUS schedule_smb2_sendfile_read(struct smbd_smb2_request *smb2req,
 	 * reads on most normal files. JRA.
 	*/
 
-	if (!_lp_use_sendfile(SNUM(fsp->conn)) ||
-			smb2req->do_signing ||
-			smb2req->in.vector_count != 4 ||
-			(fsp->base_fsp != NULL) ||
-			(fsp->wcp != NULL) ||
-			(!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
-			(state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
-			(fsp->fsp_name->st.st_ex_size < state->in_offset +
-				state->in_length)) {
+	if (!lp__use_sendfile(SNUM(fsp->conn)) ||
+	    smb2req->do_signing ||
+	    smb2req->do_encryption ||
+	    smb2req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ) ||
+	    (fsp->base_fsp != NULL) ||
+	    (fsp->wcp != NULL) ||
+	    (!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
+	    (state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
+	    (fsp->fsp_name->st.st_ex_size < state->in_offset + state->in_length))
+	{
 		return NT_STATUS_RETRY;
 	}
 
@@ -299,7 +295,7 @@ static NTSTATUS schedule_smb2_sendfile_read(struct smbd_smb2_request *smb2req,
 	/* Make a copy of state attached to the smb2req. Attach
 	   the destructor here as this will trigger the sendfile
 	   call when the request is destroyed. */
-	state_copy = TALLOC_P(smb2req, struct smbd_smb2_read_state);
+	state_copy = talloc(smb2req, struct smbd_smb2_read_state);
 	if (!state_copy) {
 		return NT_STATUS_NO_MEMORY;
 	}
@@ -348,8 +344,8 @@ NTSTATUS smb2_read_complete(struct tevent_req *req, ssize_t nread, int err)
 		return NT_STATUS_END_OF_FILE;
 	}
 
-	DEBUG(3,("smbd_smb2_read: fnum=[%d/%s] length=%lu offset=%lu read=%lu\n",
-		fsp->fnum,
+	DEBUG(3,("smbd_smb2_read: %s, file %s, length=%lu offset=%lu read=%lu\n",
+		fsp_fnum_dbg(fsp),
 		fsp_str_dbg(fsp),
 		(unsigned long)state->in_length,
 		(unsigned long)state->in_offset,
@@ -361,11 +357,19 @@ NTSTATUS smb2_read_complete(struct tevent_req *req, ssize_t nread, int err)
 	return NT_STATUS_OK;
 }
 
+static bool smbd_smb2_read_cancel(struct tevent_req *req)
+{
+	struct smbd_smb2_read_state *state =
+		tevent_req_data(req,
+		struct smbd_smb2_read_state);
+
+	return cancel_smb2_aio(state->smbreq);
+}
+
 static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 					      struct tevent_context *ev,
 					      struct smbd_smb2_request *smb2req,
 					      struct files_struct *fsp,
-					      uint32_t in_smbpid,
 					      uint32_t in_length,
 					      uint64_t in_offset,
 					      uint32_t in_minimum,
@@ -375,7 +379,7 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 	struct tevent_req *req = NULL;
 	struct smbd_smb2_read_state *state = NULL;
 	struct smb_request *smbreq = NULL;
-	connection_struct *conn = smb2req->tcon->compat_conn;
+	connection_struct *conn = smb2req->tcon->compat;
 	ssize_t nread = -1;
 	struct lock_struct lock;
 	int saved_errno;
@@ -392,13 +396,14 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 	state->out_data = data_blob_null;
 	state->out_remaining = 0;
 
-	DEBUG(10,("smbd_smb2_read: %s - fnum[%d]\n",
-		  fsp_str_dbg(fsp), fsp->fnum));
+	DEBUG(10,("smbd_smb2_read: %s - %s\n",
+		  fsp_str_dbg(fsp), fsp_fnum_dbg(fsp)));
 
 	smbreq = smbd_smb2_fake_smb_request(smb2req);
 	if (tevent_req_nomem(smbreq, req)) {
 		return tevent_req_post(req, ev);
 	}
+	state->smbreq = smbreq;
 
 	if (fsp->is_directory) {
 		tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
@@ -420,7 +425,7 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 			return tevent_req_post(req, ev);
 		}
 
-		subreq = np_read_send(state, smbd_event_context(),
+		subreq = np_read_send(state, ev,
 				      fsp->fake_file_handle,
 				      state->out_data.data,
 				      state->out_data.length);
@@ -443,19 +448,15 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 				fsp,
 				state,
 				&state->out_data,
-				(SMB_OFF_T)in_offset,
+				(off_t)in_offset,
 				(size_t)in_length);
 
 	if (NT_STATUS_IS_OK(status)) {
 		/*
-		 * Doing an async read. Don't
-		 * send a "gone async" message
-		 * as we expect this to be less
-		 * than the client timeout period.
-		 * JRA. FIXME for offline files..
-		 * FIXME. Add cancel code..
+		 * Doing an async read, allow this
+		 * request to be canceled
 		 */
-		smb2req->async = true;
+		tevent_req_set_cancel_fn(req, smbd_smb2_read_cancel);
 		return req;
 	}
 
@@ -468,7 +469,7 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 	/* Fallback to synchronous. */
 
 	init_strict_lock_struct(fsp,
-				fsp->fnum,
+				fsp->op->global->open_persistent_id,
 				in_offset,
 				in_length,
 				READ_LOCK,
@@ -508,10 +509,10 @@ static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 
 	SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
 
-	DEBUG(10,("smbd_smb2_read: file %s fnum[%d] offset=%llu "
+	DEBUG(10,("smbd_smb2_read: file %s, %s, offset=%llu "
 		"len=%llu returned %lld\n",
 		fsp_str_dbg(fsp),
-		fsp->fnum,
+		fsp_fnum_dbg(fsp),
 		(unsigned long long)in_offset,
 		(unsigned long long)in_length,
 		(long long)nread));
@@ -539,6 +540,8 @@ static void smbd_smb2_read_pipe_done(struct tevent_req *subreq)
 	status = np_read_recv(subreq, &nread, &is_data_outstanding);
 	TALLOC_FREE(subreq);
 	if (!NT_STATUS_IS_OK(status)) {
+		NTSTATUS old = status;
+		status = nt_status_np_pipe(old);
 		tevent_req_nterror(req, status);
 		return;
 	}