source4/libcli/raw/clitransport.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client transport context management functions
   4
   5    Copyright (C) Andrew Tridgell 1994-2005
   6    Copyright (C) James Myers 2003 <myersjj@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24 #include "lib/socket/socket.h"
  25 #include "lib/util/dlinklist.h"
  26 #include "lib/events/events.h"
  27 #include "lib/stream/packet.h"
  28 #include "librpc/gen_ndr/ndr_nbt.h"
  29 #include "param/param.h"
  30
  31
  32 /*
  33   an event has happened on the socket
  34 */
  35 static void smbcli_transport_event_handler(struct event_context *ev,
  36                                            struct fd_event *fde,
  37                                            uint16_t flags, void *private)
  38 {
  39         struct smbcli_transport *transport = talloc_get_type(private,
  40                                                              struct smbcli_transport);
  41         if (flags & EVENT_FD_READ) {
  42                 packet_recv(transport->packet);
  43                 return;
  44         }
  45         if (flags & EVENT_FD_WRITE) {
  46                 packet_queue_run(transport->packet);
  47         }
  48 }
  49
  50 /*
  51   destroy a transport
  52  */
  53 static int transport_destructor(struct smbcli_transport *transport)
  54 {
  55         smbcli_transport_dead(transport, NT_STATUS_LOCAL_DISCONNECT);
  56         return 0;
  57 }
  58
  59
  60 /*
  61   handle receive errors
  62 */
  63 static void smbcli_transport_error(void *private, NTSTATUS status)
  64 {
  65         struct smbcli_transport *transport = talloc_get_type(private, struct smbcli_transport);
  66         smbcli_transport_dead(transport, status);
  67 }
  68
  69 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob);
  70
  71 /*
  72   create a transport structure based on an established socket
  73 */
  74 struct smbcli_transport *smbcli_transport_init(struct smbcli_socket *sock,
  75                                                TALLOC_CTX *parent_ctx, BOOL primary)
  76 {
  77         struct smbcli_transport *transport;
  78
  79         transport = talloc_zero(parent_ctx, struct smbcli_transport);
  80         if (!transport) return NULL;
  81
  82         if (primary) {
  83                 transport->socket = talloc_steal(transport, sock);
  84         } else {
  85                 transport->socket = talloc_reference(transport, sock);
  86         }
  87         transport->negotiate.protocol = PROTOCOL_NT1;
  88         transport->options.use_spnego = lp_use_spnego(global_loadparm) &&
  89                                         lp_nt_status_support(global_loadparm);
  90         transport->options.max_xmit = lp_max_xmit(global_loadparm);
  91         transport->options.max_mux = lp_maxmux(global_loadparm);
  92         transport->options.request_timeout = SMB_REQUEST_TIMEOUT;
  93
  94         transport->negotiate.max_xmit = transport->options.max_xmit;
  95
  96         /* setup the stream -> packet parser */
  97         transport->packet = packet_init(transport);
  98         if (transport->packet == NULL) {
  99                 talloc_free(transport);
 100                 return NULL;
 101         }
 102         packet_set_private(transport->packet, transport);
 103         packet_set_socket(transport->packet, transport->socket->sock);
 104         packet_set_callback(transport->packet, smbcli_transport_finish_recv);
 105         packet_set_full_request(transport->packet, packet_full_request_nbt);
 106         packet_set_error_handler(transport->packet, smbcli_transport_error);
 107         packet_set_event_context(transport->packet, transport->socket->event.ctx);
 108         packet_set_nofree(transport->packet);
 109
 110         smbcli_init_signing(transport);
 111
 112         ZERO_STRUCT(transport->called);
 113
 114         /* take over event handling from the socket layer - it only
 115            handles events up until we are connected */
 116         talloc_free(transport->socket->event.fde);
 117         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
 118                                                     transport->socket->sock,
 119                                                     socket_get_fd(transport->socket->sock),
 120                                                     EVENT_FD_READ,
 121                                                     smbcli_transport_event_handler,
 122                                                     transport);
 123
 124         packet_set_fde(transport->packet, transport->socket->event.fde);
 125         packet_set_serialise(transport->packet);
 126         talloc_set_destructor(transport, transport_destructor);
 127
 128         return transport;
 129 }
 130
 131 /*
 132   mark the transport as dead
 133 */
 134 void smbcli_transport_dead(struct smbcli_transport *transport, NTSTATUS status)
 135 {
 136         smbcli_sock_dead(transport->socket);
 137
 138         if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL, status)) {
 139                 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 140         }
 141
 142         /* kill only the first pending receive - this is so that if
 143          that async function frees the connection we don't die trying
 144          to use old memory. The caller has to cope with only one
 145          network error */
 146         if (transport->pending_recv) {
 147                 struct smbcli_request *req = transport->pending_recv;
 148                 req->state = SMBCLI_REQUEST_ERROR;
 149                 req->status = status;
 150                 DLIST_REMOVE(transport->pending_recv, req);
 151                 if (req->async.fn) {
 152                         req->async.fn(req);
 153                 }
 154         }
 155 }
 156
 157
 158 /*
 159   send a session request
 160 */
 161 struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *transport,
 162                                                      struct nbt_name *calling,
 163                                                      struct nbt_name *called)
 164 {
 165         uint8_t *p;
 166         struct smbcli_request *req;
 167         DATA_BLOB calling_blob, called_blob;
 168         TALLOC_CTX *tmp_ctx = talloc_new(transport);
 169         NTSTATUS status;
 170
 171         status = nbt_name_dup(transport, called, &transport->called);
 172         if (!NT_STATUS_IS_OK(status)) goto failed;
 173
 174         status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
 175         if (!NT_STATUS_IS_OK(status)) goto failed;
 176
 177         status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
 178         if (!NT_STATUS_IS_OK(status)) goto failed;
 179
 180         /* allocate output buffer */
 181         req = smbcli_request_setup_nonsmb(transport,
 182                                           NBT_HDR_SIZE +
 183                                           calling_blob.length + called_blob.length);
 184         if (req == NULL) goto failed;
 185
 186         /* put in the destination name */
 187         p = req->out.buffer + NBT_HDR_SIZE;
 188         memcpy(p, called_blob.data, called_blob.length);
 189         p += called_blob.length;
 190
 191         memcpy(p, calling_blob.data, calling_blob.length);
 192         p += calling_blob.length;
 193
 194         _smb_setlen(req->out.buffer, PTR_DIFF(p, req->out.buffer) - NBT_HDR_SIZE);
 195         SCVAL(req->out.buffer,0,0x81);
 196
 197         if (!smbcli_request_send(req)) {
 198                 smbcli_request_destroy(req);
 199                 goto failed;
 200         }
 201
 202         talloc_free(tmp_ctx);
 203         return req;
 204
 205 failed:
 206         talloc_free(tmp_ctx);
 207         return NULL;
 208 }
 209
 210 /*
 211   map a session request error to a NTSTATUS
 212  */
 213 static NTSTATUS map_session_refused_error(uint8_t error)
 214 {
 215         switch (error) {
 216         case 0x80:
 217         case 0x81:
 218                 return NT_STATUS_REMOTE_NOT_LISTENING;
 219         case 0x82:
 220                 return NT_STATUS_RESOURCE_NAME_NOT_FOUND;
 221         case 0x83:
 222                 return NT_STATUS_REMOTE_RESOURCES;
 223         }
 224         return NT_STATUS_UNEXPECTED_IO_ERROR;
 225 }
 226
 227
 228 /*
 229   finish a smbcli_transport_connect()
 230 */
 231 NTSTATUS smbcli_transport_connect_recv(struct smbcli_request *req)
 232 {
 233         NTSTATUS status;
 234
 235         if (!smbcli_request_receive(req)) {
 236                 smbcli_request_destroy(req);
 237                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 238         }
 239
 240         switch (CVAL(req->in.buffer,0)) {
 241         case 0x82:
 242                 status = NT_STATUS_OK;
 243                 break;
 244         case 0x83:
 245                 status = map_session_refused_error(CVAL(req->in.buffer,4));
 246                 break;
 247         case 0x84:
 248                 DEBUG(1,("Warning: session retarget not supported\n"));
 249                 status = NT_STATUS_NOT_SUPPORTED;
 250                 break;
 251         default:
 252                 status = NT_STATUS_UNEXPECTED_IO_ERROR;
 253                 break;
 254         }
 255
 256         smbcli_request_destroy(req);
 257         return status;
 258 }
 259
 260
 261 /*
 262   send a session request (if needed)
 263 */
 264 BOOL smbcli_transport_connect(struct smbcli_transport *transport,
 265                               struct nbt_name *calling,
 266                               struct nbt_name *called)
 267 {
 268         struct smbcli_request *req;
 269         NTSTATUS status;
 270
 271         if (transport->socket->port == 445) {
 272                 return True;
 273         }
 274
 275         req = smbcli_transport_connect_send(transport,
 276                                             calling, called);
 277         status = smbcli_transport_connect_recv(req);
 278         return NT_STATUS_IS_OK(status);
 279 }
 280
 281 /****************************************************************************
 282 get next mid in sequence
 283 ****************************************************************************/
 284 uint16_t smbcli_transport_next_mid(struct smbcli_transport *transport)
 285 {
 286         uint16_t mid;
 287         struct smbcli_request *req;
 288
 289         mid = transport->next_mid;
 290
 291 again:
 292         /* now check to see if this mid is being used by one of the
 293            pending requests. This is quite efficient because the list is
 294            usually very short */
 295
 296         /* the zero mid is reserved for requests that don't have a mid */
 297         if (mid == 0) mid = 1;
 298
 299         for (req=transport->pending_recv; req; req=req->next) {
 300                 if (req->mid == mid) {
 301                         mid++;
 302                         goto again;
 303                 }
 304         }
 305
 306         transport->next_mid = mid+1;
 307         return mid;
 308 }
 309
 310 static void idle_handler(struct event_context *ev,
 311                          struct timed_event *te, struct timeval t, void *private)
 312 {
 313         struct smbcli_transport *transport = talloc_get_type(private,
 314                                                              struct smbcli_transport);
 315         struct timeval next = timeval_add(&t, 0, transport->idle.period);
 316         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 317                                                       transport,
 318                                                       next,
 319                                                       idle_handler, transport);
 320         transport->idle.func(transport, transport->idle.private);
 321 }
 322
 323 /*
 324   setup the idle handler for a transport
 325   the period is in microseconds
 326 */
 327 void smbcli_transport_idle_handler(struct smbcli_transport *transport,
 328                                    void (*idle_func)(struct smbcli_transport *, void *),
 329                                    uint64_t period,
 330                                    void *private)
 331 {
 332         transport->idle.func = idle_func;
 333         transport->idle.private = private;
 334         transport->idle.period = period;
 335
 336         if (transport->socket->event.te != NULL) {
 337                 talloc_free(transport->socket->event.te);
 338         }
 339
 340         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 341                                                       transport,
 342                                                       timeval_current_ofs(0, period),
 343                                                       idle_handler, transport);
 344 }
 345
 346 /*
 347   we have a full request in our receive buffer - match it to a pending request
 348   and process
 349  */
 350 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob)
 351 {
 352         struct smbcli_transport *transport = talloc_get_type(private,
 353                                                              struct smbcli_transport);
 354         uint8_t *buffer, *hdr, *vwv;
 355         int len;
 356         uint16_t wct=0, mid = 0, op = 0;
 357         struct smbcli_request *req = NULL;
 358
 359         buffer = blob.data;
 360         len = blob.length;
 361
 362         hdr = buffer+NBT_HDR_SIZE;
 363         vwv = hdr + HDR_VWV;
 364
 365         /* see if it could be an oplock break request */
 366         if (smbcli_handle_oplock_break(transport, len, hdr, vwv)) {
 367                 talloc_free(buffer);
 368                 return NT_STATUS_OK;
 369         }
 370
 371         /* at this point we need to check for a readbraw reply, as
 372            these can be any length */
 373         if (transport->readbraw_pending) {
 374                 transport->readbraw_pending = 0;
 375
 376                 /* it must match the first entry in the pending queue
 377                    as the client is not allowed to have outstanding
 378                    readbraw requests */
 379                 req = transport->pending_recv;
 380                 if (!req) goto error;
 381
 382                 req->in.buffer = buffer;
 383                 talloc_steal(req, buffer);
 384                 req->in.size = len;
 385                 req->in.allocated = req->in.size;
 386                 goto async;
 387         }
 388
 389         if (len >= MIN_SMB_SIZE) {
 390                 /* extract the mid for matching to pending requests */
 391                 mid = SVAL(hdr, HDR_MID);
 392                 wct = CVAL(hdr, HDR_WCT);
 393                 op  = CVAL(hdr, HDR_COM);
 394         }
 395
 396         /* match the incoming request against the list of pending requests */
 397         for (req=transport->pending_recv; req; req=req->next) {
 398                 if (req->mid == mid) break;
 399         }
 400
 401         /* see if it's a ntcancel reply for the current MID */
 402         req = smbcli_handle_ntcancel_reply(req, len, hdr);
 403
 404         if (!req) {
 405                 DEBUG(1,("Discarding unmatched reply with mid %d op %d\n", mid, op));
 406                 goto error;
 407         }
 408
 409         /* fill in the 'in' portion of the matching request */
 410         req->in.buffer = buffer;
 411         talloc_steal(req, buffer);
 412         req->in.size = len;
 413         req->in.allocated = req->in.size;
 414
 415         /* handle NBT session replies */
 416         if (req->in.size >= 4 && req->in.buffer[0] != 0) {
 417                 req->status = NT_STATUS_OK;
 418                 goto async;
 419         }
 420
 421         /* handle non-SMB replies */
 422         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
 423                 req->state = SMBCLI_REQUEST_ERROR;
 424                 goto error;
 425         }
 426
 427         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 428                 DEBUG(2,("bad reply size for mid %d\n", mid));
 429                 req->status = NT_STATUS_UNSUCCESSFUL;
 430                 req->state = SMBCLI_REQUEST_ERROR;
 431                 goto error;
 432         }
 433
 434         req->in.hdr = hdr;
 435         req->in.vwv = vwv;
 436         req->in.wct = wct;
 437         if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 438                 req->in.data = req->in.vwv + VWV(wct) + 2;
 439                 req->in.data_size = SVAL(req->in.vwv, VWV(wct));
 440                 if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
 441                         DEBUG(3,("bad data size for mid %d\n", mid));
 442                         /* blergh - w2k3 gives a bogus data size values in some
 443                            openX replies */
 444                         req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
 445                 }
 446         }
 447         req->in.ptr = req->in.data;
 448         req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
 449
 450         if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 451                 int class = CVAL(req->in.hdr,HDR_RCLS);
 452                 int code = SVAL(req->in.hdr,HDR_ERR);
 453                 if (class == 0 && code == 0) {
 454                         transport->error.e.nt_status = NT_STATUS_OK;
 455                 } else {
 456                         transport->error.e.nt_status = NT_STATUS_DOS(class, code);
 457                 }
 458         } else {
 459                 transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
 460         }
 461
 462         req->status = transport->error.e.nt_status;
 463         if (NT_STATUS_IS_OK(req->status)) {
 464                 transport->error.etype = ETYPE_NONE;
 465         } else {
 466                 transport->error.etype = ETYPE_SMB;
 467         }
 468
 469         if (!smbcli_request_check_sign_mac(req)) {
 470                 transport->error.etype = ETYPE_SOCKET;
 471                 transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
 472                 req->state = SMBCLI_REQUEST_ERROR;
 473                 req->status = NT_STATUS_ACCESS_DENIED;
 474                 goto error;
 475         };
 476
 477 async:
 478         /* if this request has an async handler then call that to
 479            notify that the reply has been received. This might destroy
 480            the request so it must happen last */
 481         DLIST_REMOVE(transport->pending_recv, req);
 482         req->state = SMBCLI_REQUEST_DONE;
 483         if (req->async.fn) {
 484                 req->async.fn(req);
 485         }
 486         return NT_STATUS_OK;
 487
 488 error:
 489         if (req) {
 490                 DLIST_REMOVE(transport->pending_recv, req);
 491                 req->state = SMBCLI_REQUEST_ERROR;
 492                 if (req->async.fn) {
 493                         req->async.fn(req);
 494                 }
 495         } else {
 496                 talloc_free(buffer);
 497         }
 498         return NT_STATUS_OK;
 499 }
 500
 501 /*
 502   process some read/write requests that are pending
 503   return False if the socket is dead
 504 */
 505 BOOL smbcli_transport_process(struct smbcli_transport *transport)
 506 {
 507         NTSTATUS status;
 508         size_t npending;
 509
 510         packet_queue_run(transport->packet);
 511         if (transport->socket->sock == NULL) {
 512                 return False;
 513         }
 514
 515         status = socket_pending(transport->socket->sock, &npending);
 516         if (NT_STATUS_IS_OK(status) && npending > 0) {
 517                 packet_recv(transport->packet);
 518         }
 519         if (transport->socket->sock == NULL) {
 520                 return False;
 521         }
 522         return True;
 523 }
 524
 525 /*
 526   handle timeouts of individual smb requests
 527 */
 528 static void smbcli_timeout_handler(struct event_context *ev, struct timed_event *te,
 529                                    struct timeval t, void *private)
 530 {
 531         struct smbcli_request *req = talloc_get_type(private, struct smbcli_request);
 532
 533         if (req->state == SMBCLI_REQUEST_RECV) {
 534                 DLIST_REMOVE(req->transport->pending_recv, req);
 535         }
 536         req->status = NT_STATUS_IO_TIMEOUT;
 537         req->state = SMBCLI_REQUEST_ERROR;
 538         if (req->async.fn) {
 539                 req->async.fn(req);
 540         }
 541 }
 542
 543
 544 /*
 545   destroy a request
 546 */
 547 static int smbcli_request_destructor(struct smbcli_request *req)
 548 {
 549         if (req->state == SMBCLI_REQUEST_RECV) {
 550                 DLIST_REMOVE(req->transport->pending_recv, req);
 551         }
 552         return 0;
 553 }
 554
 555
 556 /*
 557   put a request into the send queue
 558 */
 559 void smbcli_transport_send(struct smbcli_request *req)
 560 {
 561         DATA_BLOB blob;
 562         NTSTATUS status;
 563
 564         /* check if the transport is dead */
 565         if (req->transport->socket->sock == NULL) {
 566                 req->state = SMBCLI_REQUEST_ERROR;
 567                 req->status = NT_STATUS_NET_WRITE_FAULT;
 568                 return;
 569         }
 570
 571         blob = data_blob_const(req->out.buffer, req->out.size);
 572         status = packet_send(req->transport->packet, blob);
 573         if (!NT_STATUS_IS_OK(status)) {
 574                 req->state = SMBCLI_REQUEST_ERROR;
 575                 req->status = status;
 576                 return;
 577         }
 578
 579         if (req->one_way_request) {
 580                 req->state = SMBCLI_REQUEST_DONE;
 581                 smbcli_request_destroy(req);
 582                 return;
 583         }
 584
 585         req->state = SMBCLI_REQUEST_RECV;
 586         DLIST_ADD(req->transport->pending_recv, req);
 587
 588         /* add a timeout */
 589         if (req->transport->options.request_timeout) {
 590                 event_add_timed(req->transport->socket->event.ctx, req,
 591                                 timeval_current_ofs(req->transport->options.request_timeout, 0),
 592                                 smbcli_timeout_handler, req);
 593         }
 594
 595         talloc_set_destructor(req, smbcli_request_destructor);
 596 }
 597
 598
 599 /****************************************************************************
 600  Send an SMBecho (async send)
 601 *****************************************************************************/
 602 struct smbcli_request *smb_raw_echo_send(struct smbcli_transport *transport,
 603                                          struct smb_echo *p)
 604 {
 605         struct smbcli_request *req;
 606
 607         req = smbcli_request_setup_transport(transport, SMBecho, 1, p->in.size);
 608         if (!req) return NULL;
 609
 610         SSVAL(req->out.vwv, VWV(0), p->in.repeat_count);
 611
 612         memcpy(req->out.data, p->in.data, p->in.size);
 613
 614         ZERO_STRUCT(p->out);
 615
 616         if (!smbcli_request_send(req)) {
 617                 smbcli_request_destroy(req);
 618                 return NULL;
 619         }
 620
 621         return req;
 622 }
 623
 624 /****************************************************************************
 625  raw echo interface (async recv)
 626 ****************************************************************************/
 627 NTSTATUS smb_raw_echo_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx,
 628                            struct smb_echo *p)
 629 {
 630         if (!smbcli_request_receive(req) ||
 631             smbcli_request_is_error(req)) {
 632                 goto failed;
 633         }
 634
 635         SMBCLI_CHECK_WCT(req, 1);
 636         p->out.count++;
 637         p->out.sequence_number = SVAL(req->in.vwv, VWV(0));
 638         p->out.size = req->in.data_size;
 639         talloc_free(p->out.data);
 640         p->out.data = talloc_array(mem_ctx, uint8_t, p->out.size);
 641         NT_STATUS_HAVE_NO_MEMORY(p->out.data);
 642
 643         if (!smbcli_raw_pull_data(req, req->in.data, p->out.size, p->out.data)) {
 644                 req->status = NT_STATUS_BUFFER_TOO_SMALL;
 645         }
 646
 647         if (p->out.count == p->in.repeat_count) {
 648                 return smbcli_request_destroy(req);
 649         }
 650
 651         return NT_STATUS_OK;
 652
 653 failed:
 654         return smbcli_request_destroy(req);
 655 }
 656
 657 /****************************************************************************
 658  Send a echo (sync interface)
 659 *****************************************************************************/
 660 NTSTATUS smb_raw_echo(struct smbcli_transport *transport, struct smb_echo *p)
 661 {
 662         struct smbcli_request *req = smb_raw_echo_send(transport, p);
 663         return smbcli_request_simple_recv(req);
 664 }