source4/libcli/raw/rawtrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    raw trans/trans2/nttrans operations
   4
   5    Copyright (C) James Myers 2003 <myersjj@samba.org>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24
  25 /*
  26   check out of bounds for incoming data
  27 */
  28 static BOOL raw_trans_oob(struct smbcli_request *req,
  29                           uint_t offset, uint_t count)
  30 {
  31         char *ptr;
  32
  33         if (count == 0) {
  34                 return False;
  35         }
  36
  37         ptr = req->in.hdr + offset;
  38
  39         /* be careful with wraparound! */
  40         if (ptr < req->in.data ||
  41             ptr >= req->in.data + req->in.data_size ||
  42             count > req->in.data_size ||
  43             ptr + count > req->in.data + req->in.data_size) {
  44                 return True;
  45         }
  46         return False;
  47 }
  48
  49 /****************************************************************************
  50   receive a SMB trans or trans2 response allocating the necessary memory
  51   ****************************************************************************/
  52 NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
  53                              TALLOC_CTX *mem_ctx,
  54                              struct smb_trans2 *parms)
  55 {
  56         int total_data=0;
  57         int total_param=0;
  58         char *tdata;
  59         char *tparam;
  60
  61         parms->out.data.length = 0;
  62         parms->out.data.data = NULL;
  63         parms->out.params.length = 0;
  64         parms->out.params.data = NULL;
  65
  66         if (!smbcli_request_receive(req)) {
  67                 return smbcli_request_destroy(req);
  68         }
  69
  70         /*
  71          * An NT RPC pipe call can return ERRDOS, ERRmoredata
  72          * to a trans call. This is not an error and should not
  73          * be treated as such.
  74          */
  75         if (NT_STATUS_IS_ERR(req->status)) {
  76                 return smbcli_request_destroy(req);
  77         }
  78
  79         SMBCLI_CHECK_MIN_WCT(req, 10);
  80
  81         /* parse out the lengths */
  82         total_data = SVAL(req->in.vwv, VWV(1));
  83         total_param = SVAL(req->in.vwv, VWV(0));
  84
  85         /* allocate it */
  86         if (total_data != 0) {
  87                 tdata = talloc(mem_ctx, total_data);
  88                 if (!tdata) {
  89                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
  90                         req->status = NT_STATUS_NO_MEMORY;
  91                         return smbcli_request_destroy(req);
  92                 }
  93                 parms->out.data.data = tdata;
  94         }
  95
  96         if (total_param != 0) {
  97                 tparam = talloc(mem_ctx, total_param);
  98                 if (!tparam) {
  99                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
 100                         req->status = NT_STATUS_NO_MEMORY;
 101                         return smbcli_request_destroy(req);
 102                 }
 103                 parms->out.params.data = tparam;
 104         }
 105
 106         parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
 107         SMBCLI_CHECK_WCT(req, 10 + parms->out.setup_count);
 108
 109         if (parms->out.setup_count > 0) {
 110                 int i;
 111                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 112                 if (!parms->out.setup) {
 113                         req->status = NT_STATUS_NO_MEMORY;
 114                         return smbcli_request_destroy(req);
 115                 }
 116                 for (i=0;i<parms->out.setup_count;i++) {
 117                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
 118                 }
 119         }
 120
 121         while (1)  {
 122                 uint16_t param_count, param_ofs, param_disp;
 123                 uint16_t data_count, data_ofs, data_disp;
 124                 uint16_t total_data2, total_param2;
 125
 126                 /* parse out the total lengths again - they can shrink! */
 127                 total_data2 = SVAL(req->in.vwv, VWV(1));
 128                 total_param2 = SVAL(req->in.vwv, VWV(0));
 129
 130                 if (total_data2 > total_data ||
 131                     total_param2 > total_param) {
 132                         /* they must *only* shrink */
 133                         DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
 134                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 135                         return smbcli_request_destroy(req);
 136                 }
 137
 138                 total_data = total_data2;
 139                 total_param = total_param2;
 140
 141                 /* parse params for this lump */
 142                 param_count = SVAL(req->in.vwv, VWV(3));
 143                 param_ofs   = SVAL(req->in.vwv, VWV(4));
 144                 param_disp  = SVAL(req->in.vwv, VWV(5));
 145
 146                 data_count = SVAL(req->in.vwv, VWV(6));
 147                 data_ofs   = SVAL(req->in.vwv, VWV(7));
 148                 data_disp  = SVAL(req->in.vwv, VWV(8));
 149
 150                 if (data_count + data_disp > total_data ||
 151                     param_count + param_disp > total_param) {
 152                         DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
 153                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 154                         return smbcli_request_destroy(req);
 155                 }
 156
 157                 /* check the server isn't being nasty */
 158                 if (raw_trans_oob(req, param_ofs, param_count) ||
 159                     raw_trans_oob(req, data_ofs, data_count)) {
 160                         DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
 161                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 162                         return smbcli_request_destroy(req);
 163                 }
 164
 165                 if (data_count) {
 166                         memcpy(parms->out.data.data + data_disp,
 167                                req->in.hdr + data_ofs,
 168                                data_count);
 169                 }
 170
 171                 if (param_count) {
 172                         memcpy(parms->out.params.data + param_disp,
 173                                req->in.hdr + param_ofs,
 174                                param_count);
 175                 }
 176
 177                 parms->out.data.length += data_count;
 178                 parms->out.params.length += param_count;
 179
 180                 if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
 181                         break;
 182
 183                 if (!smbcli_request_receive_more(req)) {
 184                         req->status = NT_STATUS_UNSUCCESSFUL;
 185                         return smbcli_request_destroy(req);
 186                 }
 187         }
 188
 189 failed:
 190         return smbcli_request_destroy(req);
 191 }
 192
 193 NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
 194                              TALLOC_CTX *mem_ctx,
 195                              struct smb_trans2 *parms)
 196 {
 197         return smb_raw_trans2_recv(req, mem_ctx, parms);
 198 }
 199
 200 /****************************************************************************
 201  trans/trans2 raw async interface - only BLOBs used in this interface.
 202  note that this doesn't yet support multi-part requests
 203 ****************************************************************************/
 204 struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
 205                                                struct smb_trans2 *parms,
 206                                                uint8_t command)
 207 {
 208         int wct = 14 + parms->in.setup_count;
 209         struct smbcli_request *req;
 210         char *outdata,*outparam;
 211         int i;
 212         int padding;
 213         size_t namelen = 0;
 214
 215         if (command == SMBtrans)
 216                 padding = 1;
 217         else
 218                 padding = 3;
 219
 220         req = smbcli_request_setup(tree, command, wct, padding);
 221         if (!req) {
 222                 return NULL;
 223         }
 224
 225         /* fill in SMB parameters */
 226         outparam = req->out.data + padding;
 227         outdata = outparam + parms->in.params.length;
 228
 229         /* make sure we don't leak data via the padding */
 230         memset(req->out.data, 0, padding);
 231
 232         if (command == SMBtrans && parms->in.trans_name) {
 233                 namelen = smbcli_req_append_string(req, parms->in.trans_name,
 234                                                 STR_TERMINATE);
 235         }
 236
 237         /* primary request */
 238         SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
 239         SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
 240         SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
 241         SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
 242         SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
 243         SSVAL(req->out.vwv,VWV(5),parms->in.flags);
 244         SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
 245         SSVAL(req->out.vwv,VWV(8),0); /* reserved */
 246         SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
 247         SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr)+namelen);
 248         SSVAL(req->out.vwv,VWV(11),parms->in.data.length);
 249         SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr)+namelen);
 250         SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
 251         for (i=0;i<parms->in.setup_count;i++)   {
 252                 SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
 253         }
 254         if (parms->in.params.data)      {
 255                 smbcli_req_append_blob(req, &parms->in.params);
 256         }
 257         if (parms->in.data.data) {
 258                 smbcli_req_append_blob(req, &parms->in.data);
 259         }
 260
 261         if (!smbcli_request_send(req)) {
 262                 smbcli_request_destroy(req);
 263                 return NULL;
 264         }
 265
 266         return req;
 267 }
 268
 269 /****************************************************************************
 270  trans/trans2 raw async interface - only BLOBs used in this interface.
 271 note that this doesn't yet support multi-part requests
 272 ****************************************************************************/
 273
 274 struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
 275                                        struct smb_trans2 *parms)
 276 {
 277         return smb_raw_trans_send_backend(tree, parms, SMBtrans);
 278 }
 279
 280 struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
 281                                        struct smb_trans2 *parms)
 282 {
 283         return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
 284 }
 285
 286 /*
 287   trans2 synchronous blob interface
 288 */
 289 NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
 290                         TALLOC_CTX *mem_ctx,
 291                         struct smb_trans2 *parms)
 292 {
 293         struct smbcli_request *req;
 294         req = smb_raw_trans2_send(tree, parms);
 295         if (!req) return NT_STATUS_UNSUCCESSFUL;
 296         return smb_raw_trans2_recv(req, mem_ctx, parms);
 297 }
 298
 299
 300 /*
 301   trans synchronous blob interface
 302 */
 303 NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
 304                        TALLOC_CTX *mem_ctx,
 305                        struct smb_trans2 *parms)
 306 {
 307         struct smbcli_request *req;
 308         req = smb_raw_trans_send(tree, parms);
 309         if (!req) return NT_STATUS_UNSUCCESSFUL;
 310         return smb_raw_trans_recv(req, mem_ctx, parms);
 311 }
 312
 313 /****************************************************************************
 314   receive a SMB nttrans response allocating the necessary memory
 315   ****************************************************************************/
 316 NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
 317                               TALLOC_CTX *mem_ctx,
 318                               struct smb_nttrans *parms)
 319 {
 320         uint32_t total_data, recvd_data=0;
 321         uint32_t total_param, recvd_param=0;
 322
 323         if (!smbcli_request_receive(req) ||
 324             smbcli_request_is_error(req)) {
 325                 return smbcli_request_destroy(req);
 326         }
 327
 328         /* sanity check */
 329         if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 330                 DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n",
 331                          "SMBnttrans",
 332                          CVAL(req->in.hdr,HDR_COM)));
 333                 req->status = NT_STATUS_UNSUCCESSFUL;
 334                 return smbcli_request_destroy(req);
 335         }
 336
 337         SMBCLI_CHECK_MIN_WCT(req, 18);
 338
 339         /* parse out the lengths */
 340         total_param = IVAL(req->in.vwv, 3);
 341         total_data  = IVAL(req->in.vwv, 7);
 342
 343         parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data);
 344         parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param);
 345
 346         if (parms->out.data.length != total_data ||
 347             parms->out.params.length != total_param) {
 348                 req->status = NT_STATUS_NO_MEMORY;
 349                 return smbcli_request_destroy(req);
 350         }
 351
 352         parms->out.setup_count = CVAL(req->in.vwv, 35);
 353         SMBCLI_CHECK_WCT(req, 18 + parms->out.setup_count);
 354
 355         if (parms->out.setup_count > 0) {
 356                 int i;
 357                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 358                 if (!parms->out.setup) {
 359                         req->status = NT_STATUS_NO_MEMORY;
 360                         return smbcli_request_destroy(req);
 361                 }
 362                 for (i=0;i<parms->out.setup_count;i++) {
 363                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(18+i));
 364                 }
 365         }
 366
 367         while (recvd_data < total_data ||
 368                recvd_param < total_param)  {
 369                 uint32_t param_count, param_ofs, param_disp;
 370                 uint32_t data_count, data_ofs, data_disp;
 371                 uint32_t total_data2, total_param2;
 372
 373                 /* parse out the total lengths again - they can shrink! */
 374                 total_param2 = IVAL(req->in.vwv, 3);
 375                 total_data2  = IVAL(req->in.vwv, 7);
 376
 377                 if (total_data2 > total_data ||
 378                     total_param2 > total_param) {
 379                         /* they must *only* shrink */
 380                         DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n"));
 381                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 382                         return smbcli_request_destroy(req);
 383                 }
 384
 385                 total_data = total_data2;
 386                 total_param = total_param2;
 387                 parms->out.data.length = total_data;
 388                 parms->out.params.length = total_param;
 389
 390                 /* parse params for this lump */
 391                 param_count = IVAL(req->in.vwv, 11);
 392                 param_ofs   = IVAL(req->in.vwv, 15);
 393                 param_disp  = IVAL(req->in.vwv, 19);
 394
 395                 data_count = IVAL(req->in.vwv, 23);
 396                 data_ofs   = IVAL(req->in.vwv, 27);
 397                 data_disp  = IVAL(req->in.vwv, 31);
 398
 399                 if (data_count + data_disp > total_data ||
 400                     param_count + param_disp > total_param) {
 401                         DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n"));
 402                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 403                         return smbcli_request_destroy(req);
 404                 }
 405
 406                 /* check the server isn't being nasty */
 407                 if (raw_trans_oob(req, param_ofs, param_count) ||
 408                     raw_trans_oob(req, data_ofs, data_count)) {
 409                         DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n"));
 410                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 411                         return smbcli_request_destroy(req);
 412                 }
 413
 414                 if (data_count) {
 415                         memcpy(parms->out.data.data + data_disp,
 416                                req->in.hdr + data_ofs,
 417                                data_count);
 418                 }
 419
 420                 if (param_count) {
 421                         memcpy(parms->out.params.data + param_disp,
 422                                req->in.hdr + param_ofs,
 423                                param_count);
 424                 }
 425
 426                 recvd_param += param_count;
 427                 recvd_data += data_count;
 428
 429                 if (recvd_data >= total_data &&
 430                     recvd_param >= total_param) {
 431                         break;
 432                 }
 433
 434                 if (!smbcli_request_receive(req) ||
 435                     smbcli_request_is_error(req)) {
 436                         return smbcli_request_destroy(req);
 437                 }
 438
 439                 /* sanity check */
 440                 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 441                         DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n",
 442                                  CVAL(req->in.hdr, HDR_COM)));
 443                         req->status = NT_STATUS_UNSUCCESSFUL;
 444                         return smbcli_request_destroy(req);
 445                 }
 446         }
 447
 448 failed:
 449         return smbcli_request_destroy(req);
 450 }
 451
 452
 453 /****************************************************************************
 454  nttrans raw - only BLOBs used in this interface.
 455  at the moment we only handle a single primary request
 456 ****************************************************************************/
 457 struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
 458                                          struct smb_nttrans *parms)
 459 {
 460         struct smbcli_request *req;
 461         char *outdata, *outparam;
 462         int i;
 463         int align = 0;
 464
 465         /* only align if there are parameters or data */
 466         if (parms->in.params.length || parms->in.data.length) {
 467                 align = 3;
 468         }
 469
 470         req = smbcli_request_setup(tree, SMBnttrans,
 471                                 19 + parms->in.setup_count,
 472                                 align +
 473                                 parms->in.params.length +
 474                                 parms->in.data.length);
 475         if (!req) {
 476                 return NULL;
 477         }
 478
 479         /* fill in SMB parameters */
 480         outparam = req->out.data + align;
 481         outdata = outparam + parms->in.params.length;
 482
 483         if (align != 0) {
 484                 memset(req->out.data, 0, align);
 485         }
 486
 487         SCVAL(req->out.vwv,  0, parms->in.max_setup);
 488         SSVAL(req->out.vwv,  1, 0); /* reserved */
 489         SIVAL(req->out.vwv,  3, parms->in.params.length);
 490         SIVAL(req->out.vwv,  7, parms->in.data.length);
 491         SIVAL(req->out.vwv, 11, parms->in.max_param);
 492         SIVAL(req->out.vwv, 15, parms->in.max_data);
 493         SIVAL(req->out.vwv, 19, parms->in.params.length);
 494         SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
 495         SIVAL(req->out.vwv, 27, parms->in.data.length);
 496         SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
 497         SCVAL(req->out.vwv, 35, parms->in.setup_count);
 498         SSVAL(req->out.vwv, 36, parms->in.function);
 499         for (i=0;i<parms->in.setup_count;i++) {
 500                 SSVAL(req->out.vwv,VWV(19+i),parms->in.setup[i]);
 501         }
 502         if (parms->in.params.length) {
 503                 memcpy(outparam, parms->in.params.data, parms->in.params.length);
 504         }
 505         if (parms->in.data.length) {
 506                 memcpy(outparam, parms->in.data.data, parms->in.data.length);
 507         }
 508
 509         if (!smbcli_request_send(req)) {
 510                 smbcli_request_destroy(req);
 511                 return NULL;
 512         }
 513
 514         return req;
 515 }
 516
 517
 518 /****************************************************************************
 519   receive a SMB nttrans response allocating the necessary memory
 520   ****************************************************************************/
 521 NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
 522                          TALLOC_CTX *mem_ctx,
 523                          struct smb_nttrans *parms)
 524 {
 525         struct smbcli_request *req;
 526
 527         req = smb_raw_nttrans_send(tree, parms);
 528         if (!req) {
 529                 return NT_STATUS_UNSUCCESSFUL;
 530         }
 531
 532         return smb_raw_nttrans_recv(req, mem_ctx, parms);
 533 }