fb8ab4203f80d9fdc56a8955736a40ba77a0258a
[samba.git] / source4 / libcli / raw / rawtrans.c
1 /* 
2    Unix SMB/CIFS implementation.
3    raw trans/trans2/nttrans operations
4
5    Copyright (C) James Myers 2003 <myersjj@samba.org>
6    
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License as published by
9    the Free Software Foundation; either version 2 of the License, or
10    (at your option) any later version.
11    
12    This program is distributed in the hope that it will be useful,
13    but WITHOUT ANY WARRANTY; without even the implied warranty of
14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15    GNU General Public License for more details.
16    
17    You should have received a copy of the GNU General Public License
18    along with this program; if not, write to the Free Software
19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
20 */
21
22 #include "includes.h"
23 #include "libcli/raw/libcliraw.h"
24
25
26 /*
27   check out of bounds for incoming data
28 */
29 static BOOL raw_trans_oob(struct smbcli_request *req,
30                           uint_t offset, uint_t count)
31 {
32         uint8_t *ptr;
33
34         if (count == 0) {
35                 return False;
36         }
37
38         ptr = req->in.hdr + offset;
39         
40         /* be careful with wraparound! */
41         if (ptr < req->in.data ||
42             ptr >= req->in.data + req->in.data_size ||
43             count > req->in.data_size ||
44             ptr + count > req->in.data + req->in.data_size) {
45                 return True;
46         }
47         return False;   
48 }
49
50 /****************************************************************************
51   receive a SMB trans or trans2 response allocating the necessary memory
52   ****************************************************************************/
53 NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
54                              TALLOC_CTX *mem_ctx,
55                              struct smb_trans2 *parms)
56 {
57         int total_data=0;
58         int total_param=0;
59         uint8_t *tdata;
60         uint8_t *tparam;
61
62         parms->out.data.length = 0;
63         parms->out.data.data = NULL;
64         parms->out.params.length = 0;
65         parms->out.params.data = NULL;
66
67         if (!smbcli_request_receive(req)) {
68                 return smbcli_request_destroy(req);
69         }
70         
71         /*
72          * An NT RPC pipe call can return ERRDOS, ERRmoredata
73          * to a trans call. This is not an error and should not
74          * be treated as such.
75          */
76         if (NT_STATUS_IS_ERR(req->status)) {
77                 return smbcli_request_destroy(req);
78         }
79
80         SMBCLI_CHECK_MIN_WCT(req, 10);
81
82         /* parse out the lengths */
83         total_data = SVAL(req->in.vwv, VWV(1));
84         total_param = SVAL(req->in.vwv, VWV(0));
85
86         /* allocate it */
87         if (total_data != 0) {
88                 tdata = talloc(mem_ctx, total_data);
89                 if (!tdata) {
90                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
91                         req->status = NT_STATUS_NO_MEMORY;
92                         return smbcli_request_destroy(req);
93                 }
94                 parms->out.data.data = tdata;
95         }
96
97         if (total_param != 0) {
98                 tparam = talloc(mem_ctx, total_param);
99                 if (!tparam) {
100                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
101                         req->status = NT_STATUS_NO_MEMORY;
102                         return smbcli_request_destroy(req);
103                 }
104                 parms->out.params.data = tparam;
105         }
106
107         parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
108         SMBCLI_CHECK_WCT(req, 10 + parms->out.setup_count);
109
110         if (parms->out.setup_count > 0) {
111                 int i;
112                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
113                 if (!parms->out.setup) {
114                         req->status = NT_STATUS_NO_MEMORY;
115                         return smbcli_request_destroy(req);
116                 }
117                 for (i=0;i<parms->out.setup_count;i++) {
118                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
119                 }
120         }
121
122         while (1)  {
123                 uint16_t param_count, param_ofs, param_disp;
124                 uint16_t data_count, data_ofs, data_disp;
125                 uint16_t total_data2, total_param2;
126
127                 /* parse out the total lengths again - they can shrink! */
128                 total_data2 = SVAL(req->in.vwv, VWV(1));
129                 total_param2 = SVAL(req->in.vwv, VWV(0));
130
131                 if (total_data2 > total_data ||
132                     total_param2 > total_param) {
133                         /* they must *only* shrink */
134                         DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
135                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
136                         return smbcli_request_destroy(req);
137                 }
138
139                 total_data = total_data2;
140                 total_param = total_param2;             
141
142                 /* parse params for this lump */
143                 param_count = SVAL(req->in.vwv, VWV(3));
144                 param_ofs   = SVAL(req->in.vwv, VWV(4));
145                 param_disp  = SVAL(req->in.vwv, VWV(5));
146
147                 data_count = SVAL(req->in.vwv, VWV(6));
148                 data_ofs   = SVAL(req->in.vwv, VWV(7));
149                 data_disp  = SVAL(req->in.vwv, VWV(8));
150
151                 if (data_count + data_disp > total_data ||
152                     param_count + param_disp > total_param) {
153                         DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
154                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
155                         return smbcli_request_destroy(req);
156                 }
157                 
158                 /* check the server isn't being nasty */
159                 if (raw_trans_oob(req, param_ofs, param_count) ||
160                     raw_trans_oob(req, data_ofs, data_count)) {
161                         DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
162                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
163                         return smbcli_request_destroy(req);
164                 }
165
166                 if (data_count) {
167                         memcpy(parms->out.data.data + data_disp,
168                                req->in.hdr + data_ofs, 
169                                data_count);
170                 }
171
172                 if (param_count) {
173                         memcpy(parms->out.params.data + param_disp,
174                                req->in.hdr + param_ofs, 
175                                param_count);
176                 }
177
178                 parms->out.data.length += data_count;
179                 parms->out.params.length += param_count;
180
181                 if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
182                         break;
183         
184                 if (!smbcli_request_receive_more(req)) {
185                         req->status = NT_STATUS_UNSUCCESSFUL;
186                         return smbcli_request_destroy(req);
187                 }
188         }
189
190 failed:
191         return smbcli_request_destroy(req);
192 }
193
194 NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
195                              TALLOC_CTX *mem_ctx,
196                              struct smb_trans2 *parms)
197 {
198         return smb_raw_trans2_recv(req, mem_ctx, parms);
199 }
200
201 /****************************************************************************
202  trans/trans2 raw async interface - only BLOBs used in this interface.
203  note that this doesn't yet support multi-part requests
204 ****************************************************************************/
205 struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
206                                                struct smb_trans2 *parms,
207                                                uint8_t command)
208 {
209         int wct = 14 + parms->in.setup_count;
210         struct smbcli_request *req; 
211         uint8_t *outdata,*outparam;
212         int i;
213         int padding;
214         size_t namelen = 0;
215
216         if (command == SMBtrans)
217                 padding = 1;
218         else
219                 padding = 3;
220         
221         req = smbcli_request_setup(tree, command, wct, padding);
222         if (!req) {
223                 return NULL;
224         }
225
226         /* Watch out, this changes the req->out.* pointers */
227         if (command == SMBtrans && parms->in.trans_name) {
228                 namelen = smbcli_req_append_string(req, parms->in.trans_name, 
229                                                 STR_TERMINATE);
230         }
231
232         /* fill in SMB parameters */
233         outparam = req->out.data + padding;
234         outdata = outparam + parms->in.params.length;
235
236         /* make sure we don't leak data via the padding */
237         memset(req->out.data, 0, padding);
238
239         /* primary request */
240         SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
241         SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
242         SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
243         SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
244         SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
245         SSVAL(req->out.vwv,VWV(5),parms->in.flags);
246         SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
247         SSVAL(req->out.vwv,VWV(8),0); /* reserved */
248         SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
249         SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr)+namelen);
250         SSVAL(req->out.vwv,VWV(11),parms->in.data.length);
251         SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr)+namelen);
252         SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
253         for (i=0;i<parms->in.setup_count;i++)   {
254                 SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
255         }
256         if (parms->in.params.data)      {
257                 smbcli_req_append_blob(req, &parms->in.params);
258         }
259         if (parms->in.data.data) {
260                 smbcli_req_append_blob(req, &parms->in.data);
261         }
262
263         if (!smbcli_request_send(req)) {
264                 smbcli_request_destroy(req);
265                 return NULL;
266         }
267         
268         return req;
269 }
270
271 /****************************************************************************
272  trans/trans2 raw async interface - only BLOBs used in this interface.
273 note that this doesn't yet support multi-part requests
274 ****************************************************************************/
275
276 struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
277                                        struct smb_trans2 *parms)
278 {
279         return smb_raw_trans_send_backend(tree, parms, SMBtrans);
280 }
281
282 struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
283                                        struct smb_trans2 *parms)
284 {
285         return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
286 }
287
288 /*
289   trans2 synchronous blob interface
290 */
291 NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
292                         TALLOC_CTX *mem_ctx,
293                         struct smb_trans2 *parms)
294 {
295         struct smbcli_request *req;
296         req = smb_raw_trans2_send(tree, parms);
297         if (!req) return NT_STATUS_UNSUCCESSFUL;
298         return smb_raw_trans2_recv(req, mem_ctx, parms);
299 }
300
301
302 /*
303   trans synchronous blob interface
304 */
305 NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
306                        TALLOC_CTX *mem_ctx,
307                        struct smb_trans2 *parms)
308 {
309         struct smbcli_request *req;
310         req = smb_raw_trans_send(tree, parms);
311         if (!req) return NT_STATUS_UNSUCCESSFUL;
312         return smb_raw_trans_recv(req, mem_ctx, parms);
313 }
314
315 /****************************************************************************
316   receive a SMB nttrans response allocating the necessary memory
317   ****************************************************************************/
318 NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
319                               TALLOC_CTX *mem_ctx,
320                               struct smb_nttrans *parms)
321 {
322         uint32_t total_data, recvd_data=0;
323         uint32_t total_param, recvd_param=0;
324
325         if (!smbcli_request_receive(req) ||
326             smbcli_request_is_error(req)) {
327                 return smbcli_request_destroy(req);
328         }
329
330         /* sanity check */
331         if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
332                 DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n",
333                          "SMBnttrans", 
334                          CVAL(req->in.hdr,HDR_COM)));
335                 req->status = NT_STATUS_UNSUCCESSFUL;
336                 return smbcli_request_destroy(req);
337         }
338
339         SMBCLI_CHECK_MIN_WCT(req, 18);
340
341         /* parse out the lengths */
342         total_param = IVAL(req->in.vwv, 3);
343         total_data  = IVAL(req->in.vwv, 7);
344
345         parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data);
346         parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param);
347
348         if (parms->out.data.length != total_data ||
349             parms->out.params.length != total_param) {
350                 req->status = NT_STATUS_NO_MEMORY;
351                 return smbcli_request_destroy(req);
352         }
353
354         parms->out.setup_count = CVAL(req->in.vwv, 35);
355         SMBCLI_CHECK_WCT(req, 18 + parms->out.setup_count);
356
357         if (parms->out.setup_count > 0) {
358                 int i;
359                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
360                 if (!parms->out.setup) {
361                         req->status = NT_STATUS_NO_MEMORY;
362                         return smbcli_request_destroy(req);
363                 }
364                 for (i=0;i<parms->out.setup_count;i++) {
365                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(18+i));
366                 }
367         }
368         
369         while (recvd_data < total_data || 
370                recvd_param < total_param)  {
371                 uint32_t param_count, param_ofs, param_disp;
372                 uint32_t data_count, data_ofs, data_disp;
373                 uint32_t total_data2, total_param2;
374
375                 /* parse out the total lengths again - they can shrink! */
376                 total_param2 = IVAL(req->in.vwv, 3);
377                 total_data2  = IVAL(req->in.vwv, 7);
378
379                 if (total_data2 > total_data ||
380                     total_param2 > total_param) {
381                         /* they must *only* shrink */
382                         DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n"));
383                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
384                         return smbcli_request_destroy(req);
385                 }
386
387                 total_data = total_data2;
388                 total_param = total_param2;
389                 parms->out.data.length = total_data;
390                 parms->out.params.length = total_param;
391
392                 /* parse params for this lump */
393                 param_count = IVAL(req->in.vwv, 11);
394                 param_ofs   = IVAL(req->in.vwv, 15);
395                 param_disp  = IVAL(req->in.vwv, 19);
396
397                 data_count = IVAL(req->in.vwv, 23);
398                 data_ofs   = IVAL(req->in.vwv, 27);
399                 data_disp  = IVAL(req->in.vwv, 31);
400
401                 if (data_count + data_disp > total_data ||
402                     param_count + param_disp > total_param) {
403                         DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n"));
404                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
405                         return smbcli_request_destroy(req);
406                 }
407                 
408                 /* check the server isn't being nasty */
409                 if (raw_trans_oob(req, param_ofs, param_count) ||
410                     raw_trans_oob(req, data_ofs, data_count)) {
411                         DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n"));
412                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
413                         return smbcli_request_destroy(req);
414                 }
415
416                 if (data_count) {
417                         memcpy(parms->out.data.data + data_disp,
418                                req->in.hdr + data_ofs, 
419                                data_count);
420                 }
421
422                 if (param_count) {
423                         memcpy(parms->out.params.data + param_disp,
424                                req->in.hdr + param_ofs, 
425                                param_count);
426                 }
427
428                 recvd_param += param_count;
429                 recvd_data += data_count;
430
431                 if (recvd_data >= total_data &&
432                     recvd_param >= total_param) {
433                         break;
434                 }
435                 
436                 if (!smbcli_request_receive(req) ||
437                     smbcli_request_is_error(req)) {
438                         return smbcli_request_destroy(req);
439                 }
440                 
441                 /* sanity check */
442                 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
443                         DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n",
444                                  CVAL(req->in.hdr, HDR_COM)));
445                         req->status = NT_STATUS_UNSUCCESSFUL;
446                         return smbcli_request_destroy(req);
447                 }
448         }
449
450 failed:
451         return smbcli_request_destroy(req);
452 }
453
454
455 /****************************************************************************
456  nttrans raw - only BLOBs used in this interface.
457  at the moment we only handle a single primary request 
458 ****************************************************************************/
459 struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
460                                          struct smb_nttrans *parms)
461 {
462         struct smbcli_request *req; 
463         uint8_t *outdata, *outparam;
464         int i;
465         int align = 0;
466
467         /* only align if there are parameters or data */
468         if (parms->in.params.length || parms->in.data.length) {
469                 align = 3;
470         }
471         
472         req = smbcli_request_setup(tree, SMBnttrans, 
473                                 19 + parms->in.setup_count, 
474                                 align +
475                                 parms->in.params.length +
476                                 parms->in.data.length);
477         if (!req) {
478                 return NULL;
479         }
480         
481         /* fill in SMB parameters */
482         outparam = req->out.data + align;
483         outdata = outparam + parms->in.params.length;
484
485         if (align != 0) {
486                 memset(req->out.data, 0, align);
487         }
488
489         SCVAL(req->out.vwv,  0, parms->in.max_setup);
490         SSVAL(req->out.vwv,  1, 0); /* reserved */
491         SIVAL(req->out.vwv,  3, parms->in.params.length);
492         SIVAL(req->out.vwv,  7, parms->in.data.length);
493         SIVAL(req->out.vwv, 11, parms->in.max_param);
494         SIVAL(req->out.vwv, 15, parms->in.max_data);
495         SIVAL(req->out.vwv, 19, parms->in.params.length);
496         SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
497         SIVAL(req->out.vwv, 27, parms->in.data.length);
498         SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
499         SCVAL(req->out.vwv, 35, parms->in.setup_count);
500         SSVAL(req->out.vwv, 36, parms->in.function);
501         for (i=0;i<parms->in.setup_count;i++) {
502                 SSVAL(req->out.vwv,VWV(19+i),parms->in.setup[i]);
503         }
504         if (parms->in.params.length) {
505                 memcpy(outparam, parms->in.params.data, parms->in.params.length);
506         }
507         if (parms->in.data.length) {
508                 memcpy(outdata, parms->in.data.data, parms->in.data.length);
509         }
510
511         if (!smbcli_request_send(req)) {
512                 smbcli_request_destroy(req);
513                 return NULL;
514         }
515
516         return req;
517 }
518
519
520 /****************************************************************************
521   receive a SMB nttrans response allocating the necessary memory
522   ****************************************************************************/
523 NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
524                          TALLOC_CTX *mem_ctx,
525                          struct smb_nttrans *parms)
526 {
527         struct smbcli_request *req;
528
529         req = smb_raw_nttrans_send(tree, parms);
530         if (!req) {
531                 return NT_STATUS_UNSUCCESSFUL;
532         }
533
534         return smb_raw_nttrans_recv(req, mem_ctx, parms);
535 }
536
537 /*
538   work out the maximum data size for a trans request while avoiding 
539   multi-part replies
540
541   TODO: we only need to avoid multi-part replies because the
542   multi-part trans receive code is broken.
543 */
544 size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
545 {
546         return tree->session->transport->options.max_xmit - (70 + param_size);
547 }