2 Unix SMB/CIFS implementation.
3 raw trans/trans2/nttrans operations
5 Copyright (C) James Myers 2003 <myersjj@samba.org>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23 #include "libcli/raw/libcliraw.h"
27 check out of bounds for incoming data
29 static BOOL raw_trans_oob(struct smbcli_request *req,
30 uint_t offset, uint_t count)
38 ptr = req->in.hdr + offset;
40 /* be careful with wraparound! */
41 if (ptr < req->in.data ||
42 ptr >= req->in.data + req->in.data_size ||
43 count > req->in.data_size ||
44 ptr + count > req->in.data + req->in.data_size) {
50 /****************************************************************************
51 receive a SMB trans or trans2 response allocating the necessary memory
52 ****************************************************************************/
53 NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
55 struct smb_trans2 *parms)
62 parms->out.data.length = 0;
63 parms->out.data.data = NULL;
64 parms->out.params.length = 0;
65 parms->out.params.data = NULL;
67 if (!smbcli_request_receive(req)) {
68 return smbcli_request_destroy(req);
72 * An NT RPC pipe call can return ERRDOS, ERRmoredata
73 * to a trans call. This is not an error and should not
76 if (NT_STATUS_IS_ERR(req->status)) {
77 return smbcli_request_destroy(req);
80 SMBCLI_CHECK_MIN_WCT(req, 10);
82 /* parse out the lengths */
83 total_data = SVAL(req->in.vwv, VWV(1));
84 total_param = SVAL(req->in.vwv, VWV(0));
87 if (total_data != 0) {
88 tdata = talloc(mem_ctx, total_data);
90 DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
91 req->status = NT_STATUS_NO_MEMORY;
92 return smbcli_request_destroy(req);
94 parms->out.data.data = tdata;
97 if (total_param != 0) {
98 tparam = talloc(mem_ctx, total_param);
100 DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
101 req->status = NT_STATUS_NO_MEMORY;
102 return smbcli_request_destroy(req);
104 parms->out.params.data = tparam;
107 parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
108 SMBCLI_CHECK_WCT(req, 10 + parms->out.setup_count);
110 if (parms->out.setup_count > 0) {
112 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
113 if (!parms->out.setup) {
114 req->status = NT_STATUS_NO_MEMORY;
115 return smbcli_request_destroy(req);
117 for (i=0;i<parms->out.setup_count;i++) {
118 parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
123 uint16_t param_count, param_ofs, param_disp;
124 uint16_t data_count, data_ofs, data_disp;
125 uint16_t total_data2, total_param2;
127 /* parse out the total lengths again - they can shrink! */
128 total_data2 = SVAL(req->in.vwv, VWV(1));
129 total_param2 = SVAL(req->in.vwv, VWV(0));
131 if (total_data2 > total_data ||
132 total_param2 > total_param) {
133 /* they must *only* shrink */
134 DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
135 req->status = NT_STATUS_BUFFER_TOO_SMALL;
136 return smbcli_request_destroy(req);
139 total_data = total_data2;
140 total_param = total_param2;
142 /* parse params for this lump */
143 param_count = SVAL(req->in.vwv, VWV(3));
144 param_ofs = SVAL(req->in.vwv, VWV(4));
145 param_disp = SVAL(req->in.vwv, VWV(5));
147 data_count = SVAL(req->in.vwv, VWV(6));
148 data_ofs = SVAL(req->in.vwv, VWV(7));
149 data_disp = SVAL(req->in.vwv, VWV(8));
151 if (data_count + data_disp > total_data ||
152 param_count + param_disp > total_param) {
153 DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
154 req->status = NT_STATUS_BUFFER_TOO_SMALL;
155 return smbcli_request_destroy(req);
158 /* check the server isn't being nasty */
159 if (raw_trans_oob(req, param_ofs, param_count) ||
160 raw_trans_oob(req, data_ofs, data_count)) {
161 DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
162 req->status = NT_STATUS_BUFFER_TOO_SMALL;
163 return smbcli_request_destroy(req);
167 memcpy(parms->out.data.data + data_disp,
168 req->in.hdr + data_ofs,
173 memcpy(parms->out.params.data + param_disp,
174 req->in.hdr + param_ofs,
178 parms->out.data.length += data_count;
179 parms->out.params.length += param_count;
181 if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
184 if (!smbcli_request_receive_more(req)) {
185 req->status = NT_STATUS_UNSUCCESSFUL;
186 return smbcli_request_destroy(req);
191 return smbcli_request_destroy(req);
194 NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
196 struct smb_trans2 *parms)
198 return smb_raw_trans2_recv(req, mem_ctx, parms);
201 /****************************************************************************
202 trans/trans2 raw async interface - only BLOBs used in this interface.
203 note that this doesn't yet support multi-part requests
204 ****************************************************************************/
205 struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
206 struct smb_trans2 *parms,
209 int wct = 14 + parms->in.setup_count;
210 struct smbcli_request *req;
211 char *outdata,*outparam;
216 if (command == SMBtrans)
221 req = smbcli_request_setup(tree, command, wct, padding);
226 /* Watch out, this changes the req->out.* pointers */
227 if (command == SMBtrans && parms->in.trans_name) {
228 namelen = smbcli_req_append_string(req, parms->in.trans_name,
232 /* fill in SMB parameters */
233 outparam = req->out.data + padding;
234 outdata = outparam + parms->in.params.length;
236 /* make sure we don't leak data via the padding */
237 memset(req->out.data, 0, padding);
239 /* primary request */
240 SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
241 SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
242 SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
243 SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
244 SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
245 SSVAL(req->out.vwv,VWV(5),parms->in.flags);
246 SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
247 SSVAL(req->out.vwv,VWV(8),0); /* reserved */
248 SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
249 SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr)+namelen);
250 SSVAL(req->out.vwv,VWV(11),parms->in.data.length);
251 SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr)+namelen);
252 SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
253 for (i=0;i<parms->in.setup_count;i++) {
254 SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
256 if (parms->in.params.data) {
257 smbcli_req_append_blob(req, &parms->in.params);
259 if (parms->in.data.data) {
260 smbcli_req_append_blob(req, &parms->in.data);
263 if (!smbcli_request_send(req)) {
264 smbcli_request_destroy(req);
271 /****************************************************************************
272 trans/trans2 raw async interface - only BLOBs used in this interface.
273 note that this doesn't yet support multi-part requests
274 ****************************************************************************/
276 struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
277 struct smb_trans2 *parms)
279 return smb_raw_trans_send_backend(tree, parms, SMBtrans);
282 struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
283 struct smb_trans2 *parms)
285 return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
289 trans2 synchronous blob interface
291 NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
293 struct smb_trans2 *parms)
295 struct smbcli_request *req;
296 req = smb_raw_trans2_send(tree, parms);
297 if (!req) return NT_STATUS_UNSUCCESSFUL;
298 return smb_raw_trans2_recv(req, mem_ctx, parms);
303 trans synchronous blob interface
305 NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
307 struct smb_trans2 *parms)
309 struct smbcli_request *req;
310 req = smb_raw_trans_send(tree, parms);
311 if (!req) return NT_STATUS_UNSUCCESSFUL;
312 return smb_raw_trans_recv(req, mem_ctx, parms);
315 /****************************************************************************
316 receive a SMB nttrans response allocating the necessary memory
317 ****************************************************************************/
318 NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
320 struct smb_nttrans *parms)
322 uint32_t total_data, recvd_data=0;
323 uint32_t total_param, recvd_param=0;
325 if (!smbcli_request_receive(req) ||
326 smbcli_request_is_error(req)) {
327 return smbcli_request_destroy(req);
331 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
332 DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n",
334 CVAL(req->in.hdr,HDR_COM)));
335 req->status = NT_STATUS_UNSUCCESSFUL;
336 return smbcli_request_destroy(req);
339 SMBCLI_CHECK_MIN_WCT(req, 18);
341 /* parse out the lengths */
342 total_param = IVAL(req->in.vwv, 3);
343 total_data = IVAL(req->in.vwv, 7);
345 parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data);
346 parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param);
348 if (parms->out.data.length != total_data ||
349 parms->out.params.length != total_param) {
350 req->status = NT_STATUS_NO_MEMORY;
351 return smbcli_request_destroy(req);
354 parms->out.setup_count = CVAL(req->in.vwv, 35);
355 SMBCLI_CHECK_WCT(req, 18 + parms->out.setup_count);
357 if (parms->out.setup_count > 0) {
359 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
360 if (!parms->out.setup) {
361 req->status = NT_STATUS_NO_MEMORY;
362 return smbcli_request_destroy(req);
364 for (i=0;i<parms->out.setup_count;i++) {
365 parms->out.setup[i] = SVAL(req->in.vwv, VWV(18+i));
369 while (recvd_data < total_data ||
370 recvd_param < total_param) {
371 uint32_t param_count, param_ofs, param_disp;
372 uint32_t data_count, data_ofs, data_disp;
373 uint32_t total_data2, total_param2;
375 /* parse out the total lengths again - they can shrink! */
376 total_param2 = IVAL(req->in.vwv, 3);
377 total_data2 = IVAL(req->in.vwv, 7);
379 if (total_data2 > total_data ||
380 total_param2 > total_param) {
381 /* they must *only* shrink */
382 DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n"));
383 req->status = NT_STATUS_BUFFER_TOO_SMALL;
384 return smbcli_request_destroy(req);
387 total_data = total_data2;
388 total_param = total_param2;
389 parms->out.data.length = total_data;
390 parms->out.params.length = total_param;
392 /* parse params for this lump */
393 param_count = IVAL(req->in.vwv, 11);
394 param_ofs = IVAL(req->in.vwv, 15);
395 param_disp = IVAL(req->in.vwv, 19);
397 data_count = IVAL(req->in.vwv, 23);
398 data_ofs = IVAL(req->in.vwv, 27);
399 data_disp = IVAL(req->in.vwv, 31);
401 if (data_count + data_disp > total_data ||
402 param_count + param_disp > total_param) {
403 DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n"));
404 req->status = NT_STATUS_BUFFER_TOO_SMALL;
405 return smbcli_request_destroy(req);
408 /* check the server isn't being nasty */
409 if (raw_trans_oob(req, param_ofs, param_count) ||
410 raw_trans_oob(req, data_ofs, data_count)) {
411 DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n"));
412 req->status = NT_STATUS_BUFFER_TOO_SMALL;
413 return smbcli_request_destroy(req);
417 memcpy(parms->out.data.data + data_disp,
418 req->in.hdr + data_ofs,
423 memcpy(parms->out.params.data + param_disp,
424 req->in.hdr + param_ofs,
428 recvd_param += param_count;
429 recvd_data += data_count;
431 if (recvd_data >= total_data &&
432 recvd_param >= total_param) {
436 if (!smbcli_request_receive(req) ||
437 smbcli_request_is_error(req)) {
438 return smbcli_request_destroy(req);
442 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
443 DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n",
444 CVAL(req->in.hdr, HDR_COM)));
445 req->status = NT_STATUS_UNSUCCESSFUL;
446 return smbcli_request_destroy(req);
451 return smbcli_request_destroy(req);
455 /****************************************************************************
456 nttrans raw - only BLOBs used in this interface.
457 at the moment we only handle a single primary request
458 ****************************************************************************/
459 struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
460 struct smb_nttrans *parms)
462 struct smbcli_request *req;
463 char *outdata, *outparam;
467 /* only align if there are parameters or data */
468 if (parms->in.params.length || parms->in.data.length) {
472 req = smbcli_request_setup(tree, SMBnttrans,
473 19 + parms->in.setup_count,
475 parms->in.params.length +
476 parms->in.data.length);
481 /* fill in SMB parameters */
482 outparam = req->out.data + align;
483 outdata = outparam + parms->in.params.length;
486 memset(req->out.data, 0, align);
489 SCVAL(req->out.vwv, 0, parms->in.max_setup);
490 SSVAL(req->out.vwv, 1, 0); /* reserved */
491 SIVAL(req->out.vwv, 3, parms->in.params.length);
492 SIVAL(req->out.vwv, 7, parms->in.data.length);
493 SIVAL(req->out.vwv, 11, parms->in.max_param);
494 SIVAL(req->out.vwv, 15, parms->in.max_data);
495 SIVAL(req->out.vwv, 19, parms->in.params.length);
496 SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
497 SIVAL(req->out.vwv, 27, parms->in.data.length);
498 SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
499 SCVAL(req->out.vwv, 35, parms->in.setup_count);
500 SSVAL(req->out.vwv, 36, parms->in.function);
501 for (i=0;i<parms->in.setup_count;i++) {
502 SSVAL(req->out.vwv,VWV(19+i),parms->in.setup[i]);
504 if (parms->in.params.length) {
505 memcpy(outparam, parms->in.params.data, parms->in.params.length);
507 if (parms->in.data.length) {
508 memcpy(outdata, parms->in.data.data, parms->in.data.length);
511 if (!smbcli_request_send(req)) {
512 smbcli_request_destroy(req);
520 /****************************************************************************
521 receive a SMB nttrans response allocating the necessary memory
522 ****************************************************************************/
523 NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
525 struct smb_nttrans *parms)
527 struct smbcli_request *req;
529 req = smb_raw_nttrans_send(tree, parms);
531 return NT_STATUS_UNSUCCESSFUL;
534 return smb_raw_nttrans_recv(req, mem_ctx, parms);
538 work out the maximum data size for a trans request while avoiding
541 TODO: we only need to avoid multi-part replies because the
542 multi-part trans receive code is broken.
544 size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
546 return tree->session->transport->options.max_xmit - (70 + param_size);