This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "libcli/raw/libcliraw.h"
#include "libcli/smb2/smb2.h"
-#include "include/dlinklist.h"
+#include "lib/util/dlinklist.h"
#include "lib/events/events.h"
+#include "libcli/smb2/smb2_calls.h"
+#include "param/param.h"
+
+/* fill in the bufinfo */
+void smb2_setup_bufinfo(struct smb2_request *req)
+{
+ req->in.bufinfo.mem_ctx = req;
+ req->in.bufinfo.flags = BUFINFO_FLAG_UNICODE | BUFINFO_FLAG_SMB2;
+ req->in.bufinfo.align_base = req->in.buffer;
+ if (req->in.dynamic) {
+ req->in.bufinfo.data = req->in.dynamic;
+ req->in.bufinfo.data_size = req->in.body_size - req->in.body_fixed;
+ } else {
+ req->in.bufinfo.data = NULL;
+ req->in.bufinfo.data_size = 0;
+ }
+}
/*
initialise a smb2 request
*/
struct smb2_request *smb2_request_init(struct smb2_transport *transport, uint16_t opcode,
- uint16_t body_fixed_size, BOOL body_dynamic_present,
+ uint16_t body_fixed_size, bool body_dynamic_present,
uint32_t body_dynamic_size)
{
struct smb2_request *req;
+ uint64_t seqnum;
if (body_dynamic_present) {
if (body_dynamic_size == 0) {
req = talloc(transport, struct smb2_request);
if (req == NULL) return NULL;
+ seqnum = transport->seqnum++;
+ if (seqnum == UINT64_MAX) {
+ seqnum = transport->seqnum++;
+ }
+
req->state = SMB2_REQUEST_INIT;
req->transport = transport;
req->session = NULL;
req->tree = NULL;
- req->seqnum = transport->seqnum++;
+ req->seqnum = seqnum;
req->status = NT_STATUS_OK;
req->async.fn = NULL;
req->next = req->prev = NULL;
+ ZERO_STRUCT(req->cancel);
ZERO_STRUCT(req->in);
-
+
req->out.size = SMB2_HDR_BODY+NBT_HDR_SIZE+body_fixed_size;
req->out.allocated = req->out.size + body_dynamic_size;
- req->out.buffer = talloc_size(req, req->out.allocated);
+ req->out.buffer = talloc_array(req, uint8_t, req->out.allocated);
if (req->out.buffer == NULL) {
talloc_free(req);
return NULL;
req->out.body_size = body_fixed_size;
req->out.dynamic = (body_dynamic_size ? req->out.body + body_fixed_size : NULL);
- SIVAL(req->out.hdr, 0, SMB2_MAGIC);
- SSVAL(req->out.hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
- SSVAL(req->out.hdr, SMB2_HDR_PAD1, 0);
- SIVAL(req->out.hdr, SMB2_HDR_STATUS, 0);
- SSVAL(req->out.hdr, SMB2_HDR_OPCODE, opcode);
- SSVAL(req->out.hdr, SMB2_HDR_UNKNOWN1,0);
- SIVAL(req->out.hdr, SMB2_HDR_FLAGS, 0);
- SIVAL(req->out.hdr, SMB2_HDR_UNKNOWN2,0);
- SBVAL(req->out.hdr, SMB2_HDR_SEQNUM, req->seqnum);
- SIVAL(req->out.hdr, SMB2_HDR_PID, 0);
- SIVAL(req->out.hdr, SMB2_HDR_TID, 0);
- SBVAL(req->out.hdr, SMB2_HDR_UID, 0);
- memset(req->out.hdr+SMB2_HDR_SIG, 0, 16);
+ SIVAL(req->out.hdr, 0, SMB2_MAGIC);
+ SSVAL(req->out.hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
+ SSVAL(req->out.hdr, SMB2_HDR_EPOCH, 0);
+ SIVAL(req->out.hdr, SMB2_HDR_STATUS, 0);
+ SSVAL(req->out.hdr, SMB2_HDR_OPCODE, opcode);
+ SSVAL(req->out.hdr, SMB2_HDR_CREDIT, 0);
+ SIVAL(req->out.hdr, SMB2_HDR_FLAGS, 0);
+ SIVAL(req->out.hdr, SMB2_HDR_NEXT_COMMAND, 0);
+ SBVAL(req->out.hdr, SMB2_HDR_MESSAGE_ID, req->seqnum);
+ SIVAL(req->out.hdr, SMB2_HDR_PID, 0);
+ SIVAL(req->out.hdr, SMB2_HDR_TID, 0);
+ SBVAL(req->out.hdr, SMB2_HDR_SESSION_ID, 0);
+ memset(req->out.hdr+SMB2_HDR_SIGNATURE, 0, 16);
/* set the length of the fixed body part and +1 if there's a dynamic part also */
SSVAL(req->out.body, 0, body_fixed_size + (body_dynamic_size?1:0));
initialise a smb2 request for tree operations
*/
struct smb2_request *smb2_request_init_tree(struct smb2_tree *tree, uint16_t opcode,
- uint16_t body_fixed_size, BOOL body_dynamic_present,
+ uint16_t body_fixed_size, bool body_dynamic_present,
uint32_t body_dynamic_size)
{
struct smb2_request *req = smb2_request_init(tree->session->transport, opcode,
body_dynamic_size);
if (req == NULL) return NULL;
- SBVAL(req->out.hdr, SMB2_HDR_UID, tree->session->uid);
+ SBVAL(req->out.hdr, SMB2_HDR_SESSION_ID, tree->session->uid);
SIVAL(req->out.hdr, SMB2_HDR_TID, tree->tid);
req->session = tree->session;
req->tree = tree;
/*
receive a response to a packet
*/
-BOOL smb2_request_receive(struct smb2_request *req)
+bool smb2_request_receive(struct smb2_request *req)
{
/* req can be NULL when a send has failed. This eliminates lots of NULL
checks in each module */
- if (!req) return False;
+ if (!req) return false;
/* keep receiving packets until this one is replied to */
while (req->state <= SMB2_REQUEST_RECV) {
if (event_loop_once(req->transport->socket->event.ctx) != 0) {
- return False;
+ return false;
}
}
}
/* Return true if the last packet was in error */
-BOOL smb2_request_is_error(struct smb2_request *req)
+bool smb2_request_is_error(struct smb2_request *req)
{
return NT_STATUS_IS_ERR(req->status);
}
/* Return true if the last packet was OK */
-BOOL smb2_request_is_ok(struct smb2_request *req)
+bool smb2_request_is_ok(struct smb2_request *req)
{
return NT_STATUS_IS_OK(req->status);
}
/*
check if a range in the reply body is out of bounds
*/
-BOOL smb2_oob(struct smb2_request_buffer *buf, const uint8_t *ptr, size_t size)
+bool smb2_oob(struct smb2_request_buffer *buf, const uint8_t *ptr, size_t size)
{
+ if (size == 0) {
+ /* zero bytes is never out of range */
+ return false;
+ }
/* be careful with wraparound! */
if (ptr < buf->body ||
ptr >= buf->body + buf->body_size ||
size > buf->body_size ||
ptr + size > buf->body + buf->body_size) {
- return True;
+ return true;
}
- return False;
+ return false;
}
size_t smb2_padding_size(uint32_t offset, size_t n)
dynamic_ofs = buf->dynamic - buf->buffer;
- buffer_ptr = talloc_realloc_size(buf, buf->buffer, newsize);
+ buffer_ptr = talloc_realloc(buf, buf->buffer, uint8_t, newsize);
NT_STATUS_HAVE_NO_MEMORY(buffer_ptr);
buf->buffer = buffer_ptr;
}
ofs = SVAL(ptr, 0);
size = SVAL(ptr, 2);
- if (ofs == 0 || size == 0) {
+ if (ofs == 0) {
*blob = data_blob(NULL, 0);
return NT_STATUS_OK;
}
return NT_STATUS_BUFFER_TOO_SMALL;
}
- if (blob.length == 0) {
+ if (blob.data == NULL) {
+ if (blob.length != 0) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
SSVAL(ptr, 0, 0);
SSVAL(ptr, 2, 0);
return NT_STATUS_OK;
return NT_STATUS_BUFFER_TOO_SMALL;
}
- if (blob.length == 0) {
+ if (blob.data == NULL) {
+ if (blob.length != 0) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
SSVAL(ptr, 0, 0);
SIVAL(ptr, 2, 0);
return NT_STATUS_OK;
return NT_STATUS_BUFFER_TOO_SMALL;
}
- if (blob.length == 0) {
+ if (blob.data == NULL) {
+ if (blob.length != 0) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
SIVAL(ptr, 0, 0);
SIVAL(ptr, 4, 0);
return NT_STATUS_OK;
return NT_STATUS_BUFFER_TOO_SMALL;
}
- if (blob.length == 0) {
+ if (blob.data == NULL) {
+ if (blob.length != 0) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
SIVAL(ptr, 0, 0);
SIVAL(ptr, 4, 0);
return NT_STATUS_OK;
}
ofs = SVAL(ptr, 0);
size = IVAL(ptr, 2);
- if (ofs == 0 || size == 0) {
+ if (ofs == 0) {
*blob = data_blob(NULL, 0);
return NT_STATUS_OK;
}
}
ofs = IVAL(ptr, 0);
size = IVAL(ptr, 4);
- if (ofs == 0 || size == 0) {
+ if (ofs == 0) {
+ *blob = data_blob(NULL, 0);
+ return NT_STATUS_OK;
+ }
+ if (smb2_oob(buf, buf->hdr + ofs, size)) {
+ return NT_STATUS_BUFFER_TOO_SMALL;
+ }
+ *blob = data_blob_talloc(mem_ctx, buf->hdr + ofs, size);
+ NT_STATUS_HAVE_NO_MEMORY(blob->data);
+ return NT_STATUS_OK;
+}
+
+/*
+ pull a uint16_t ofs/ uint32_t length/blob triple from a data blob
+ the ptr points to the start of the offset/length pair
+
+ In this varient the uint16_t is padded by an extra 2 bytes, making
+ the size aligned on 4 byte boundary
+*/
+NTSTATUS smb2_pull_o16As32_blob(struct smb2_request_buffer *buf, TALLOC_CTX *mem_ctx, uint8_t *ptr, DATA_BLOB *blob)
+{
+ uint32_t ofs, size;
+ if (smb2_oob(buf, ptr, 8)) {
+ return NT_STATUS_BUFFER_TOO_SMALL;
+ }
+ ofs = SVAL(ptr, 0);
+ size = IVAL(ptr, 4);
+ if (ofs == 0) {
*blob = data_blob(NULL, 0);
return NT_STATUS_OK;
}
}
size = IVAL(ptr, 0);
ofs = IVAL(ptr, 4);
- if (ofs == 0 || size == 0) {
+ if (ofs == 0) {
*blob = data_blob(NULL, 0);
return NT_STATUS_OK;
}
status = smb2_pull_o16s16_blob(buf, mem_ctx, ptr, &blob);
NT_STATUS_NOT_OK_RETURN(status);
+ if (blob.data == NULL) {
+ *str = NULL;
+ return NT_STATUS_OK;
+ }
+
if (blob.length == 0) {
char *s;
s = talloc_strdup(mem_ctx, "");
return NT_STATUS_OK;
}
- size = convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
+ size = convert_string_talloc(mem_ctx, lp_iconv_convenience(global_loadparm), CH_UTF16, CH_UNIX,
blob.data, blob.length, &vstr);
data_blob_free(&blob);
- (*str) = vstr;
+ (*str) = (char *)vstr;
if (size == -1) {
return NT_STATUS_ILLEGAL_CHARACTER;
}
NTSTATUS status;
ssize_t size;
- if (strcmp("", str) == 0) {
+ if (str == NULL) {
return smb2_push_o16s16_blob(buf, ofs, data_blob(NULL, 0));
}
- size = convert_string_talloc(buf->buffer, CH_UNIX, CH_UTF16,
+ if (*str == 0) {
+ blob.data = str;
+ blob.length = 0;
+ return smb2_push_o16s16_blob(buf, ofs, blob);
+ }
+
+ size = convert_string_talloc(buf->buffer, lp_iconv_convenience(global_loadparm), CH_UNIX, CH_UTF16,
str, strlen(str), (void **)&blob.data);
if (size == -1) {
return NT_STATUS_ILLEGAL_CHARACTER;
git.samba.org / samba.git / blobdiff