source4/libcli/raw/clitransport.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client transport context management functions
   4
   5    Copyright (C) Andrew Tridgell 1994-2005
   6    Copyright (C) James Myers 2003 <myersjj@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "lib/socket/socket.h"
  26 #include "dlinklist.h"
  27 #include "lib/events/events.h"
  28 #include "lib/stream/packet.h"
  29
  30
  31 /*
  32   an event has happened on the socket
  33 */
  34 static void smbcli_transport_event_handler(struct event_context *ev,
  35                                            struct fd_event *fde,
  36                                            uint16_t flags, void *private)
  37 {
  38         struct smbcli_transport *transport = talloc_get_type(private,
  39                                                              struct smbcli_transport);
  40         if (flags & EVENT_FD_READ) {
  41                 packet_recv(transport->packet);
  42                 return;
  43         }
  44         if (flags & EVENT_FD_WRITE) {
  45                 packet_queue_run(transport->packet);
  46         }
  47 }
  48
  49 /*
  50   destroy a transport
  51  */
  52 static int transport_destructor(void *ptr)
  53 {
  54         struct smbcli_transport *transport = ptr;
  55
  56         smbcli_transport_dead(transport);
  57         return 0;
  58 }
  59
  60
  61 /*
  62   handle receive errors
  63 */
  64 static void smbcli_transport_error(void *private, NTSTATUS status)
  65 {
  66         struct smbcli_transport *transport = talloc_get_type(private, struct smbcli_transport);
  67         smbcli_transport_dead(transport);
  68 }
  69
  70 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob);
  71
  72 /*
  73   create a transport structure based on an established socket
  74 */
  75 struct smbcli_transport *smbcli_transport_init(struct smbcli_socket *sock,
  76                                                TALLOC_CTX *parent_ctx, BOOL primary)
  77 {
  78         struct smbcli_transport *transport;
  79
  80         transport = talloc_zero(parent_ctx, struct smbcli_transport);
  81         if (!transport) return NULL;
  82
  83         if (primary) {
  84                 transport->socket = talloc_steal(transport, sock);
  85         } else {
  86                 transport->socket = talloc_reference(transport, sock);
  87         }
  88         transport->negotiate.protocol = PROTOCOL_NT1;
  89         transport->options.use_spnego = lp_use_spnego() && lp_nt_status_support();
  90         transport->options.max_xmit = lp_max_xmit();
  91         transport->options.max_mux = lp_maxmux();
  92         transport->options.request_timeout = SMB_REQUEST_TIMEOUT;
  93
  94         transport->negotiate.max_xmit = transport->options.max_xmit;
  95
  96         /* setup the stream -> packet parser */
  97         transport->packet = packet_init(transport);
  98         if (transport->packet == NULL) {
  99                 talloc_free(transport);
 100                 return NULL;
 101         }
 102         packet_set_private(transport->packet, transport);
 103         packet_set_socket(transport->packet, transport->socket->sock);
 104         packet_set_callback(transport->packet, smbcli_transport_finish_recv);
 105         packet_set_full_request(transport->packet, packet_full_request_nbt);
 106         packet_set_error_handler(transport->packet, smbcli_transport_error);
 107         packet_set_event_context(transport->packet, transport->socket->event.ctx);
 108         packet_set_nofree(transport->packet);
 109
 110         smbcli_init_signing(transport);
 111
 112         ZERO_STRUCT(transport->called);
 113
 114         /* take over event handling from the socket layer - it only
 115            handles events up until we are connected */
 116         talloc_free(transport->socket->event.fde);
 117         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
 118                                                     transport->socket->sock,
 119                                                     socket_get_fd(transport->socket->sock),
 120                                                     EVENT_FD_READ,
 121                                                     smbcli_transport_event_handler,
 122                                                     transport);
 123
 124         packet_set_fde(transport->packet, transport->socket->event.fde);
 125         packet_set_serialise(transport->packet);
 126         talloc_set_destructor(transport, transport_destructor);
 127
 128         return transport;
 129 }
 130
 131 /*
 132   mark the transport as dead
 133 */
 134 void smbcli_transport_dead(struct smbcli_transport *transport)
 135 {
 136         smbcli_sock_dead(transport->socket);
 137
 138         /* kill all pending receives */
 139         while (transport->pending_recv) {
 140                 struct smbcli_request *req = transport->pending_recv;
 141                 req->state = SMBCLI_REQUEST_ERROR;
 142                 req->status = NT_STATUS_NET_WRITE_FAULT;
 143                 DLIST_REMOVE(transport->pending_recv, req);
 144                 if (req->async.fn) {
 145                         req->async.fn(req);
 146                 }
 147         }
 148 }
 149
 150
 151 /*
 152   send a session request
 153 */
 154 struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *transport,
 155                                                      struct nbt_name *calling,
 156                                                      struct nbt_name *called)
 157 {
 158         uint8_t *p;
 159         struct smbcli_request *req;
 160         DATA_BLOB calling_blob, called_blob;
 161         TALLOC_CTX *tmp_ctx = talloc_new(transport);
 162         NTSTATUS status;
 163
 164         status = nbt_name_dup(transport, called, &transport->called);
 165         if (!NT_STATUS_IS_OK(status)) goto failed;
 166
 167         status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
 168         if (!NT_STATUS_IS_OK(status)) goto failed;
 169
 170         status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
 171         if (!NT_STATUS_IS_OK(status)) goto failed;
 172
 173         /* allocate output buffer */
 174         req = smbcli_request_setup_nonsmb(transport,
 175                                           NBT_HDR_SIZE +
 176                                           calling_blob.length + called_blob.length);
 177         if (req == NULL) goto failed;
 178
 179         /* put in the destination name */
 180         p = req->out.buffer + NBT_HDR_SIZE;
 181         memcpy(p, called_blob.data, called_blob.length);
 182         p += called_blob.length;
 183
 184         memcpy(p, calling_blob.data, calling_blob.length);
 185         p += calling_blob.length;
 186
 187         _smb_setlen(req->out.buffer, PTR_DIFF(p, req->out.buffer) - NBT_HDR_SIZE);
 188         SCVAL(req->out.buffer,0,0x81);
 189
 190         if (!smbcli_request_send(req)) {
 191                 smbcli_request_destroy(req);
 192                 goto failed;
 193         }
 194
 195         talloc_free(tmp_ctx);
 196         return req;
 197
 198 failed:
 199         talloc_free(tmp_ctx);
 200         return NULL;
 201 }
 202
 203 /*
 204   map a session request error to a NTSTATUS
 205  */
 206 static NTSTATUS map_session_refused_error(uint8_t error)
 207 {
 208         switch (error) {
 209         case 0x80:
 210         case 0x81:
 211                 return NT_STATUS_REMOTE_NOT_LISTENING;
 212         case 0x82:
 213                 return NT_STATUS_RESOURCE_NAME_NOT_FOUND;
 214         case 0x83:
 215                 return NT_STATUS_REMOTE_RESOURCES;
 216         }
 217         return NT_STATUS_UNEXPECTED_IO_ERROR;
 218 }
 219
 220
 221 /*
 222   finish a smbcli_transport_connect()
 223 */
 224 NTSTATUS smbcli_transport_connect_recv(struct smbcli_request *req)
 225 {
 226         NTSTATUS status;
 227
 228         if (!smbcli_request_receive(req)) {
 229                 smbcli_request_destroy(req);
 230                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 231         }
 232
 233         switch (CVAL(req->in.buffer,0)) {
 234         case 0x82:
 235                 status = NT_STATUS_OK;
 236                 break;
 237         case 0x83:
 238                 status = map_session_refused_error(CVAL(req->in.buffer,4));
 239                 break;
 240         case 0x84:
 241                 DEBUG(1,("Warning: session retarget not supported\n"));
 242                 status = NT_STATUS_NOT_SUPPORTED;
 243                 break;
 244         default:
 245                 status = NT_STATUS_UNEXPECTED_IO_ERROR;
 246                 break;
 247         }
 248
 249         smbcli_request_destroy(req);
 250         return status;
 251 }
 252
 253
 254 /*
 255   send a session request (if needed)
 256 */
 257 BOOL smbcli_transport_connect(struct smbcli_transport *transport,
 258                               struct nbt_name *calling,
 259                               struct nbt_name *called)
 260 {
 261         struct smbcli_request *req;
 262         NTSTATUS status;
 263
 264         if (transport->socket->port == 445) {
 265                 return True;
 266         }
 267
 268         req = smbcli_transport_connect_send(transport,
 269                                             calling, called);
 270         status = smbcli_transport_connect_recv(req);
 271         return NT_STATUS_IS_OK(status);
 272 }
 273
 274 /****************************************************************************
 275 get next mid in sequence
 276 ****************************************************************************/
 277 uint16_t smbcli_transport_next_mid(struct smbcli_transport *transport)
 278 {
 279         uint16_t mid;
 280         struct smbcli_request *req;
 281
 282         mid = transport->next_mid;
 283
 284 again:
 285         /* now check to see if this mid is being used by one of the
 286            pending requests. This is quite efficient because the list is
 287            usually very short */
 288
 289         /* the zero mid is reserved for requests that don't have a mid */
 290         if (mid == 0) mid = 1;
 291
 292         for (req=transport->pending_recv; req; req=req->next) {
 293                 if (req->mid == mid) {
 294                         mid++;
 295                         goto again;
 296                 }
 297         }
 298
 299         transport->next_mid = mid+1;
 300         return mid;
 301 }
 302
 303 static void idle_handler(struct event_context *ev,
 304                          struct timed_event *te, struct timeval t, void *private)
 305 {
 306         struct smbcli_transport *transport = talloc_get_type(private,
 307                                                              struct smbcli_transport);
 308         struct timeval next = timeval_add(&t, 0, transport->idle.period);
 309         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 310                                                       transport,
 311                                                       next,
 312                                                       idle_handler, transport);
 313         transport->idle.func(transport, transport->idle.private);
 314 }
 315
 316 /*
 317   setup the idle handler for a transport
 318   the period is in microseconds
 319 */
 320 void smbcli_transport_idle_handler(struct smbcli_transport *transport,
 321                                    void (*idle_func)(struct smbcli_transport *, void *),
 322                                    uint64_t period,
 323                                    void *private)
 324 {
 325         transport->idle.func = idle_func;
 326         transport->idle.private = private;
 327         transport->idle.period = period;
 328
 329         if (transport->socket->event.te != NULL) {
 330                 talloc_free(transport->socket->event.te);
 331         }
 332
 333         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 334                                                       transport,
 335                                                       timeval_current_ofs(0, period),
 336                                                       idle_handler, transport);
 337 }
 338
 339 /*
 340   we have a full request in our receive buffer - match it to a pending request
 341   and process
 342  */
 343 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob)
 344 {
 345         struct smbcli_transport *transport = talloc_get_type(private,
 346                                                              struct smbcli_transport);
 347         uint8_t *buffer, *hdr, *vwv;
 348         int len;
 349         uint16_t wct=0, mid = 0, op = 0;
 350         struct smbcli_request *req = NULL;
 351
 352         buffer = blob.data;
 353         len = blob.length;
 354
 355         hdr = buffer+NBT_HDR_SIZE;
 356         vwv = hdr + HDR_VWV;
 357
 358         /* see if it could be an oplock break request */
 359         if (smbcli_handle_oplock_break(transport, len, hdr, vwv)) {
 360                 talloc_free(buffer);
 361                 return NT_STATUS_OK;
 362         }
 363
 364         /* at this point we need to check for a readbraw reply, as
 365            these can be any length */
 366         if (transport->readbraw_pending) {
 367                 transport->readbraw_pending = 0;
 368
 369                 /* it must match the first entry in the pending queue
 370                    as the client is not allowed to have outstanding
 371                    readbraw requests */
 372                 req = transport->pending_recv;
 373                 if (!req) goto error;
 374
 375                 req->in.buffer = buffer;
 376                 talloc_steal(req, buffer);
 377                 req->in.size = len;
 378                 req->in.allocated = req->in.size;
 379                 goto async;
 380         }
 381
 382         if (len >= MIN_SMB_SIZE) {
 383                 /* extract the mid for matching to pending requests */
 384                 mid = SVAL(hdr, HDR_MID);
 385                 wct = CVAL(hdr, HDR_WCT);
 386                 op  = CVAL(hdr, HDR_COM);
 387         }
 388
 389         /* match the incoming request against the list of pending requests */
 390         for (req=transport->pending_recv; req; req=req->next) {
 391                 if (req->mid == mid) break;
 392         }
 393
 394         /* see if it's a ntcancel reply for the current MID */
 395         req = smbcli_handle_ntcancel_reply(req, len, hdr);
 396
 397         if (!req) {
 398                 DEBUG(1,("Discarding unmatched reply with mid %d op %d\n", mid, op));
 399                 goto error;
 400         }
 401
 402         /* fill in the 'in' portion of the matching request */
 403         req->in.buffer = buffer;
 404         talloc_steal(req, buffer);
 405         req->in.size = len;
 406         req->in.allocated = req->in.size;
 407
 408         /* handle NBT session replies */
 409         if (req->in.size >= 4 && req->in.buffer[0] != 0) {
 410                 req->status = NT_STATUS_OK;
 411                 goto async;
 412         }
 413
 414         /* handle non-SMB replies */
 415         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
 416                 req->state = SMBCLI_REQUEST_ERROR;
 417                 goto error;
 418         }
 419
 420         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 421                 DEBUG(2,("bad reply size for mid %d\n", mid));
 422                 req->status = NT_STATUS_UNSUCCESSFUL;
 423                 req->state = SMBCLI_REQUEST_ERROR;
 424                 goto error;
 425         }
 426
 427         req->in.hdr = hdr;
 428         req->in.vwv = vwv;
 429         req->in.wct = wct;
 430         if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 431                 req->in.data = req->in.vwv + VWV(wct) + 2;
 432                 req->in.data_size = SVAL(req->in.vwv, VWV(wct));
 433                 if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
 434                         DEBUG(3,("bad data size for mid %d\n", mid));
 435                         /* blergh - w2k3 gives a bogus data size values in some
 436                            openX replies */
 437                         req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
 438                 }
 439         }
 440         req->in.ptr = req->in.data;
 441         req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
 442
 443         if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 444                 int class = CVAL(req->in.hdr,HDR_RCLS);
 445                 int code = SVAL(req->in.hdr,HDR_ERR);
 446                 if (class == 0 && code == 0) {
 447                         transport->error.e.nt_status = NT_STATUS_OK;
 448                 } else {
 449                         transport->error.e.nt_status = NT_STATUS_DOS(class, code);
 450                 }
 451         } else {
 452                 transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
 453         }
 454
 455         req->status = transport->error.e.nt_status;
 456         if (NT_STATUS_IS_OK(req->status)) {
 457                 transport->error.etype = ETYPE_NONE;
 458         } else {
 459                 transport->error.etype = ETYPE_SMB;
 460         }
 461
 462         if (!smbcli_request_check_sign_mac(req)) {
 463                 transport->error.etype = ETYPE_SOCKET;
 464                 transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
 465                 req->state = SMBCLI_REQUEST_ERROR;
 466                 req->status = NT_STATUS_ACCESS_DENIED;
 467                 goto error;
 468         };
 469
 470 async:
 471         /* if this request has an async handler then call that to
 472            notify that the reply has been received. This might destroy
 473            the request so it must happen last */
 474         DLIST_REMOVE(transport->pending_recv, req);
 475         req->state = SMBCLI_REQUEST_DONE;
 476         if (req->async.fn) {
 477                 req->async.fn(req);
 478         }
 479         return NT_STATUS_OK;
 480
 481 error:
 482         if (req) {
 483                 DLIST_REMOVE(transport->pending_recv, req);
 484                 req->state = SMBCLI_REQUEST_ERROR;
 485                 if (req->async.fn) {
 486                         req->async.fn(req);
 487                 }
 488         } else {
 489                 talloc_free(buffer);
 490         }
 491         return NT_STATUS_OK;
 492 }
 493
 494 /*
 495   process some read/write requests that are pending
 496   return False if the socket is dead
 497 */
 498 BOOL smbcli_transport_process(struct smbcli_transport *transport)
 499 {
 500         NTSTATUS status;
 501         size_t npending;
 502
 503         packet_queue_run(transport->packet);
 504         if (transport->socket->sock == NULL) {
 505                 return False;
 506         }
 507
 508         status = socket_pending(transport->socket->sock, &npending);
 509         if (NT_STATUS_IS_OK(status) && npending > 0) {
 510                 packet_recv(transport->packet);
 511         }
 512         if (transport->socket->sock == NULL) {
 513                 return False;
 514         }
 515         return True;
 516 }
 517
 518 /*
 519   handle timeouts of individual smb requests
 520 */
 521 static void smbcli_timeout_handler(struct event_context *ev, struct timed_event *te,
 522                                    struct timeval t, void *private)
 523 {
 524         struct smbcli_request *req = talloc_get_type(private, struct smbcli_request);
 525
 526         if (req->state == SMBCLI_REQUEST_RECV) {
 527                 DLIST_REMOVE(req->transport->pending_recv, req);
 528         }
 529         req->status = NT_STATUS_IO_TIMEOUT;
 530         req->state = SMBCLI_REQUEST_ERROR;
 531         if (req->async.fn) {
 532                 req->async.fn(req);
 533         }
 534 }
 535
 536
 537 /*
 538   destroy a request
 539 */
 540 static int smbcli_request_destructor(void *ptr)
 541 {
 542         struct smbcli_request *req = talloc_get_type(ptr, struct smbcli_request);
 543         if (req->state == SMBCLI_REQUEST_RECV) {
 544                 DLIST_REMOVE(req->transport->pending_recv, req);
 545         }
 546         return 0;
 547 }
 548
 549
 550 /*
 551   put a request into the send queue
 552 */
 553 void smbcli_transport_send(struct smbcli_request *req)
 554 {
 555         DATA_BLOB blob;
 556         NTSTATUS status;
 557
 558         /* check if the transport is dead */
 559         if (req->transport->socket->sock == NULL) {
 560                 req->state = SMBCLI_REQUEST_ERROR;
 561                 req->status = NT_STATUS_NET_WRITE_FAULT;
 562                 return;
 563         }
 564
 565         blob = data_blob_const(req->out.buffer, req->out.size);
 566         status = packet_send(req->transport->packet, blob);
 567         if (!NT_STATUS_IS_OK(status)) {
 568                 req->state = SMBCLI_REQUEST_ERROR;
 569                 req->status = status;
 570                 return;
 571         }
 572
 573         if (req->one_way_request) {
 574                 req->state = SMBCLI_REQUEST_DONE;
 575                 smbcli_request_destroy(req);
 576                 return;
 577         }
 578
 579         req->state = SMBCLI_REQUEST_RECV;
 580         DLIST_ADD(req->transport->pending_recv, req);
 581
 582         /* add a timeout */
 583         if (req->transport->options.request_timeout) {
 584                 event_add_timed(req->transport->socket->event.ctx, req,
 585                                 timeval_current_ofs(req->transport->options.request_timeout, 0),
 586                                 smbcli_timeout_handler, req);
 587         }
 588
 589         talloc_set_destructor(req, smbcli_request_destructor);
 590 }