source4/libcli/raw/clitransport.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client transport context management functions
   4
   5    Copyright (C) Andrew Tridgell 1994-2005
   6    Copyright (C) James Myers 2003 <myersjj@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "lib/socket/socket.h"
  26 #include "system/time.h"
  27 #include "dlinklist.h"
  28 #include "lib/events/events.h"
  29
  30
  31 static void smbcli_transport_process_recv(struct smbcli_transport *transport);
  32 static void smbcli_transport_process_send(struct smbcli_transport *transport);
  33
  34 /*
  35   an event has happened on the socket
  36 */
  37 static void smbcli_transport_event_handler(struct event_context *ev,
  38                                            struct fd_event *fde,
  39                                            uint16_t flags, void *private)
  40 {
  41         struct smbcli_transport *transport = talloc_get_type(private,
  42                                                              struct smbcli_transport);
  43         if (flags & EVENT_FD_READ) {
  44                 smbcli_transport_process_recv(transport);
  45                 return;
  46         }
  47         if (flags & EVENT_FD_WRITE) {
  48                 smbcli_transport_process_send(transport);
  49         }
  50 }
  51
  52 /*
  53   destroy a transport
  54  */
  55 static int transport_destructor(void *ptr)
  56 {
  57         struct smbcli_transport *transport = ptr;
  58
  59         smbcli_transport_dead(transport);
  60         return 0;
  61 }
  62
  63 /*
  64   create a transport structure based on an established socket
  65 */
  66 struct smbcli_transport *smbcli_transport_init(struct smbcli_socket *sock,
  67                                                TALLOC_CTX *parent_ctx, BOOL primary)
  68 {
  69         struct smbcli_transport *transport;
  70
  71         transport = talloc_zero(parent_ctx, struct smbcli_transport);
  72         if (!transport) return NULL;
  73
  74         if (primary) {
  75                 transport->socket = talloc_steal(transport, sock);
  76         } else {
  77                 transport->socket = talloc_reference(transport, sock);
  78         }
  79         transport->negotiate.protocol = PROTOCOL_NT1;
  80         transport->options.use_spnego = lp_use_spnego();
  81         transport->options.max_xmit = lp_max_xmit();
  82         transport->options.max_mux = lp_maxmux();
  83
  84         transport->negotiate.max_xmit = transport->options.max_xmit;
  85
  86         smbcli_init_signing(transport);
  87
  88         ZERO_STRUCT(transport->called);
  89
  90         /* take over event handling from the socket layer - it only
  91            handles events up until we are connected */
  92         talloc_free(transport->socket->event.fde);
  93         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
  94                                                     transport->socket,
  95                                                     socket_get_fd(transport->socket->sock),
  96                                                     EVENT_FD_READ,
  97                                                     smbcli_transport_event_handler,
  98                                                     transport);
  99
 100         talloc_set_destructor(transport, transport_destructor);
 101
 102         return transport;
 103 }
 104
 105 /*
 106   mark the transport as dead
 107 */
 108 void smbcli_transport_dead(struct smbcli_transport *transport)
 109 {
 110         smbcli_sock_dead(transport->socket);
 111
 112         /* all pending sends become errors */
 113         while (transport->pending_send) {
 114                 struct smbcli_request *req = transport->pending_send;
 115                 req->state = SMBCLI_REQUEST_ERROR;
 116                 req->status = NT_STATUS_NET_WRITE_FAULT;
 117                 DLIST_REMOVE(transport->pending_send, req);
 118                 if (req->async.fn) {
 119                         req->async.fn(req);
 120                 }
 121         }
 122
 123         /* as do all pending receives */
 124         while (transport->pending_recv) {
 125                 struct smbcli_request *req = transport->pending_recv;
 126                 req->state = SMBCLI_REQUEST_ERROR;
 127                 req->status = NT_STATUS_NET_WRITE_FAULT;
 128                 DLIST_REMOVE(transport->pending_recv, req);
 129                 if (req->async.fn) {
 130                         req->async.fn(req);
 131                 }
 132         }
 133 }
 134
 135
 136 /*
 137   enable select for write on a transport
 138 */
 139 static void smbcli_transport_write_enable(struct smbcli_transport *transport)
 140 {
 141         struct fd_event *fde = transport->socket->event.fde;
 142         EVENT_FD_WRITEABLE(fde);
 143 }
 144
 145 /*
 146   disable select for write on a transport
 147 */
 148 static void smbcli_transport_write_disable(struct smbcli_transport *transport)
 149 {
 150         struct fd_event *fde = transport->socket->event.fde;
 151         EVENT_FD_NOT_WRITEABLE(fde);
 152 }
 153
 154 /*
 155   send a session request
 156 */
 157 struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *transport,
 158                                                      struct nbt_name *calling,
 159                                                      struct nbt_name *called)
 160 {
 161         uint8_t *p;
 162         struct smbcli_request *req;
 163         DATA_BLOB calling_blob, called_blob;
 164         TALLOC_CTX *tmp_ctx = talloc_new(transport);
 165         NTSTATUS status;
 166
 167         status = nbt_name_dup(transport, called, &transport->called);
 168         if (!NT_STATUS_IS_OK(status)) goto failed;
 169
 170         status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
 171         if (!NT_STATUS_IS_OK(status)) goto failed;
 172
 173         status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
 174         if (!NT_STATUS_IS_OK(status)) goto failed;
 175
 176         /* allocate output buffer */
 177         req = smbcli_request_setup_nonsmb(transport,
 178                                           NBT_HDR_SIZE +
 179                                           calling_blob.length + called_blob.length);
 180         if (req == NULL) goto failed;
 181
 182         /* put in the destination name */
 183         p = req->out.buffer + NBT_HDR_SIZE;
 184         memcpy(p, called_blob.data, called_blob.length);
 185         p += called_blob.length;
 186
 187         memcpy(p, calling_blob.data, calling_blob.length);
 188         p += calling_blob.length;
 189
 190         _smb_setlen(req->out.buffer, PTR_DIFF(p, req->out.buffer)-4);
 191         SCVAL(req->out.buffer,0,0x81);
 192
 193         if (!smbcli_request_send(req)) {
 194                 smbcli_request_destroy(req);
 195                 goto failed;
 196         }
 197
 198         talloc_free(tmp_ctx);
 199         return req;
 200
 201 failed:
 202         talloc_free(tmp_ctx);
 203         return NULL;
 204 }
 205
 206 /*
 207   map a session request error to a NTSTATUS
 208  */
 209 static NTSTATUS map_session_refused_error(uint8_t error)
 210 {
 211         switch (error) {
 212         case 0x80:
 213         case 0x81:
 214                 return NT_STATUS_REMOTE_NOT_LISTENING;
 215         case 0x82:
 216                 return NT_STATUS_RESOURCE_NAME_NOT_FOUND;
 217         case 0x83:
 218                 return NT_STATUS_REMOTE_RESOURCES;
 219         }
 220         return NT_STATUS_UNEXPECTED_IO_ERROR;
 221 }
 222
 223
 224 /*
 225   finish a smbcli_transport_connect()
 226 */
 227 NTSTATUS smbcli_transport_connect_recv(struct smbcli_request *req)
 228 {
 229         NTSTATUS status;
 230
 231         if (!smbcli_request_receive(req)) {
 232                 smbcli_request_destroy(req);
 233                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 234         }
 235
 236         switch (CVAL(req->in.buffer,0)) {
 237         case 0x82:
 238                 status = NT_STATUS_OK;
 239                 break;
 240         case 0x83:
 241                 status = map_session_refused_error(CVAL(req->in.buffer,4));
 242                 break;
 243         case 0x84:
 244                 DEBUG(1,("Warning: session retarget not supported\n"));
 245                 status = NT_STATUS_NOT_SUPPORTED;
 246                 break;
 247         default:
 248                 status = NT_STATUS_UNEXPECTED_IO_ERROR;
 249                 break;
 250         }
 251
 252         smbcli_request_destroy(req);
 253         return status;
 254 }
 255
 256
 257 /*
 258   send a session request (if needed)
 259 */
 260 BOOL smbcli_transport_connect(struct smbcli_transport *transport,
 261                               struct nbt_name *calling,
 262                               struct nbt_name *called)
 263 {
 264         struct smbcli_request *req;
 265         NTSTATUS status;
 266
 267         if (transport->socket->port == 445) {
 268                 return True;
 269         }
 270
 271         req = smbcli_transport_connect_send(transport,
 272                                             calling, called);
 273         status = smbcli_transport_connect_recv(req);
 274         return NT_STATUS_IS_OK(status);
 275 }
 276
 277 /****************************************************************************
 278 get next mid in sequence
 279 ****************************************************************************/
 280 uint16_t smbcli_transport_next_mid(struct smbcli_transport *transport)
 281 {
 282         uint16_t mid;
 283         struct smbcli_request *req;
 284
 285         mid = transport->next_mid;
 286
 287 again:
 288         /* now check to see if this mid is being used by one of the
 289            pending requests. This is quite efficient because the list is
 290            usually very short */
 291
 292         /* the zero mid is reserved for requests that don't have a mid */
 293         if (mid == 0) mid = 1;
 294
 295         for (req=transport->pending_recv; req; req=req->next) {
 296                 if (req->mid == mid) {
 297                         mid++;
 298                         goto again;
 299                 }
 300         }
 301
 302         transport->next_mid = mid+1;
 303         return mid;
 304 }
 305
 306 static void idle_handler(struct event_context *ev,
 307                          struct timed_event *te, struct timeval t, void *private)
 308 {
 309         struct smbcli_transport *transport = talloc_get_type(private,
 310                                                              struct smbcli_transport);
 311         struct timeval next = timeval_add(&t, 0, transport->idle.period);
 312         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 313                                                       transport,
 314                                                       next,
 315                                                       idle_handler, transport);
 316         transport->idle.func(transport, transport->idle.private);
 317 }
 318
 319 /*
 320   setup the idle handler for a transport
 321   the period is in microseconds
 322 */
 323 void smbcli_transport_idle_handler(struct smbcli_transport *transport,
 324                                    void (*idle_func)(struct smbcli_transport *, void *),
 325                                    uint64_t period,
 326                                    void *private)
 327 {
 328         transport->idle.func = idle_func;
 329         transport->idle.private = private;
 330         transport->idle.period = period;
 331
 332         if (transport->socket->event.te != NULL) {
 333                 talloc_free(transport->socket->event.te);
 334         }
 335
 336         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 337                                                       transport,
 338                                                       timeval_current_ofs(0, period),
 339                                                       idle_handler, transport);
 340 }
 341
 342 /*
 343   process some pending sends
 344 */
 345 static void smbcli_transport_process_send(struct smbcli_transport *transport)
 346 {
 347         while (transport->pending_send) {
 348                 struct smbcli_request *req = transport->pending_send;
 349                 ssize_t ret;
 350                 ret = smbcli_sock_write(transport->socket, req->out.buffer, req->out.size);
 351                 if (ret == -1) {
 352                         if (errno == EAGAIN || errno == EINTR) {
 353                                 return;
 354                         }
 355                         smbcli_transport_dead(transport);
 356                         return;
 357                 }
 358                 req->out.buffer += ret;
 359                 req->out.size -= ret;
 360                 if (req->out.size == 0) {
 361                         DLIST_REMOVE(transport->pending_send, req);
 362                         if (req->one_way_request) {
 363                                 req->state = SMBCLI_REQUEST_DONE;
 364                                 smbcli_request_destroy(req);
 365                         } else {
 366                                 req->state = SMBCLI_REQUEST_RECV;
 367                                 DLIST_ADD(transport->pending_recv, req);
 368                         }
 369                 }
 370         }
 371
 372         /* we're out of requests to send, so don't wait for write
 373            events any more */
 374         smbcli_transport_write_disable(transport);
 375 }
 376
 377 /*
 378   we have a full request in our receive buffer - match it to a pending request
 379   and process
 380  */
 381 static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 382 {
 383         uint8_t *buffer, *hdr, *vwv;
 384         int len;
 385         uint16_t wct=0, mid = 0;
 386         struct smbcli_request *req;
 387
 388         buffer = transport->recv_buffer.buffer;
 389         len = transport->recv_buffer.req_size;
 390
 391         ZERO_STRUCT(transport->recv_buffer);
 392
 393         hdr = buffer+NBT_HDR_SIZE;
 394         vwv = hdr + HDR_VWV;
 395
 396         /* see if it could be an oplock break request */
 397         if (handle_oplock_break(transport, len, hdr, vwv)) {
 398                 talloc_free(buffer);
 399                 return;
 400         }
 401
 402         /* at this point we need to check for a readbraw reply, as
 403            these can be any length */
 404         if (transport->readbraw_pending) {
 405                 transport->readbraw_pending = 0;
 406
 407                 /* it must match the first entry in the pending queue
 408                    as the client is not allowed to have outstanding
 409                    readbraw requests */
 410                 req = transport->pending_recv;
 411                 if (!req) goto error;
 412
 413                 req->in.buffer = buffer;
 414                 talloc_steal(req, buffer);
 415                 req->in.size = len;
 416                 req->in.allocated = req->in.size;
 417                 goto async;
 418         }
 419
 420         if (len >= MIN_SMB_SIZE) {
 421                 /* extract the mid for matching to pending requests */
 422                 mid = SVAL(hdr, HDR_MID);
 423                 wct = CVAL(hdr, HDR_WCT);
 424         }
 425
 426         /* match the incoming request against the list of pending requests */
 427         for (req=transport->pending_recv; req; req=req->next) {
 428                 if (req->mid == mid) break;
 429         }
 430
 431         if (!req) {
 432                 DEBUG(1,("Discarding unmatched reply with mid %d op %d\n",
 433                          mid, CVAL(hdr, HDR_COM)));
 434                 goto error;
 435         }
 436
 437         /* fill in the 'in' portion of the matching request */
 438         req->in.buffer = buffer;
 439         talloc_steal(req, buffer);
 440         req->in.size = len;
 441         req->in.allocated = req->in.size;
 442
 443         /* handle NBT session replies */
 444         if (req->in.size >= 4 && req->in.buffer[0] != 0) {
 445                 req->status = NT_STATUS_OK;
 446                 goto async;
 447         }
 448
 449         /* handle non-SMB replies */
 450         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
 451                 req->state = SMBCLI_REQUEST_ERROR;
 452                 goto error;
 453         }
 454
 455         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 456                 DEBUG(2,("bad reply size for mid %d\n", mid));
 457                 req->status = NT_STATUS_UNSUCCESSFUL;
 458                 req->state = SMBCLI_REQUEST_ERROR;
 459                 goto error;
 460         }
 461
 462         req->in.hdr = hdr;
 463         req->in.vwv = vwv;
 464         req->in.wct = wct;
 465         if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 466                 req->in.data = req->in.vwv + VWV(wct) + 2;
 467                 req->in.data_size = SVAL(req->in.vwv, VWV(wct));
 468                 if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
 469                         DEBUG(3,("bad data size for mid %d\n", mid));
 470                         /* blergh - w2k3 gives a bogus data size values in some
 471                            openX replies */
 472                         req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
 473                 }
 474         }
 475         req->in.ptr = req->in.data;
 476         req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
 477
 478         if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 479                 transport->error.etype = ETYPE_DOS;
 480                 transport->error.e.dos.eclass = CVAL(req->in.hdr,HDR_RCLS);
 481                 transport->error.e.dos.ecode = SVAL(req->in.hdr,HDR_ERR);
 482                 req->status = dos_to_ntstatus(transport->error.e.dos.eclass,
 483                                               transport->error.e.dos.ecode);
 484         } else {
 485                 transport->error.etype = ETYPE_NT;
 486                 transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
 487                 req->status = transport->error.e.nt_status;
 488         }
 489
 490         if (!smbcli_request_check_sign_mac(req)) {
 491                 transport->error.etype = ETYPE_SOCKET;
 492                 transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
 493                 req->state = SMBCLI_REQUEST_ERROR;
 494                 req->status = NT_STATUS_ACCESS_DENIED;
 495                 goto error;
 496         };
 497
 498 async:
 499         /* if this request has an async handler then call that to
 500            notify that the reply has been received. This might destroy
 501            the request so it must happen last */
 502         DLIST_REMOVE(transport->pending_recv, req);
 503         req->state = SMBCLI_REQUEST_DONE;
 504         if (req->async.fn) {
 505                 req->async.fn(req);
 506         }
 507         return;
 508
 509 error:
 510         if (req) {
 511                 DLIST_REMOVE(transport->pending_recv, req);
 512                 req->state = SMBCLI_REQUEST_ERROR;
 513         }
 514 }
 515
 516 /*
 517   process some pending receives
 518 */
 519 static void smbcli_transport_process_recv(struct smbcli_transport *transport)
 520 {
 521         /* a incoming packet goes through 2 stages - first we read the
 522            4 byte header, which tells us how much more is coming. Then
 523            we read the rest */
 524         if (transport->recv_buffer.received < NBT_HDR_SIZE) {
 525                 ssize_t ret;
 526                 ret = smbcli_sock_read(transport->socket,
 527                                     transport->recv_buffer.header +
 528                                     transport->recv_buffer.received,
 529                                     NBT_HDR_SIZE - transport->recv_buffer.received);
 530                 if (ret == -1) {
 531                         smbcli_transport_dead(transport);
 532                         return;
 533                 }
 534
 535                 transport->recv_buffer.received += ret;
 536
 537                 if (transport->recv_buffer.received == NBT_HDR_SIZE) {
 538                         /* we've got a full header */
 539                         transport->recv_buffer.req_size = smb_len(transport->recv_buffer.header) + NBT_HDR_SIZE;
 540                         transport->recv_buffer.buffer = talloc_size(transport,
 541                                                                     NBT_HDR_SIZE+transport->recv_buffer.req_size);
 542                         if (transport->recv_buffer.buffer == NULL) {
 543                                 smbcli_transport_dead(transport);
 544                                 return;
 545                         }
 546                         memcpy(transport->recv_buffer.buffer, transport->recv_buffer.header, NBT_HDR_SIZE);
 547                 }
 548         }
 549
 550         if (transport->recv_buffer.received < transport->recv_buffer.req_size) {
 551                 ssize_t ret;
 552                 ret = smbcli_sock_read(transport->socket,
 553                                     transport->recv_buffer.buffer +
 554                                     transport->recv_buffer.received,
 555                                     transport->recv_buffer.req_size -
 556                                     transport->recv_buffer.received);
 557                 if (ret == -1) {
 558                         smbcli_transport_dead(transport);
 559                         return;
 560                 }
 561                 transport->recv_buffer.received += ret;
 562         }
 563
 564         if (transport->recv_buffer.received != 0 &&
 565             transport->recv_buffer.received == transport->recv_buffer.req_size) {
 566                 smbcli_transport_finish_recv(transport);
 567         }
 568 }
 569
 570 /*
 571   process some read/write requests that are pending
 572   return False if the socket is dead
 573 */
 574 BOOL smbcli_transport_process(struct smbcli_transport *transport)
 575 {
 576         smbcli_transport_process_send(transport);
 577         smbcli_transport_process_recv(transport);
 578         if (transport->socket->sock == NULL) {
 579                 return False;
 580         }
 581         return True;
 582 }
 583
 584
 585
 586 /*
 587   put a request into the send queue
 588 */
 589 void smbcli_transport_send(struct smbcli_request *req)
 590 {
 591         /* check if the transport is dead */
 592         if (req->transport->socket->sock == NULL) {
 593                 req->state = SMBCLI_REQUEST_ERROR;
 594                 req->status = NT_STATUS_NET_WRITE_FAULT;
 595                 return;
 596         }
 597
 598         /* put it on the outgoing socket queue */
 599         req->state = SMBCLI_REQUEST_SEND;
 600         DLIST_ADD_END(req->transport->pending_send, req, struct smbcli_request *);
 601
 602         /* make sure we look for write events */
 603         smbcli_transport_write_enable(req->transport);
 604 }