source4/libcli/raw/rawtrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    raw trans/trans2/nttrans operations
   4
   5    Copyright (C) James Myers 2003 <myersjj@samba.org>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24
  25 /*
  26   check out of bounds for incoming data
  27 */
  28 static BOOL raw_trans_oob(struct cli_request *req,
  29                           uint_t offset, uint_t count)
  30 {
  31         char *ptr;
  32
  33         if (count == 0) {
  34                 return False;
  35         }
  36
  37         ptr = req->in.hdr + offset;
  38
  39         /* be careful with wraparound! */
  40         if (ptr < req->in.data ||
  41             ptr >= req->in.data + req->in.data_size ||
  42             count > req->in.data_size ||
  43             ptr + count > req->in.data + req->in.data_size) {
  44                 return True;
  45         }
  46         return False;
  47 }
  48
  49 /****************************************************************************
  50   receive a SMB trans or trans2 response allocating the necessary memory
  51   ****************************************************************************/
  52 NTSTATUS smb_raw_trans2_recv(struct cli_request *req,
  53                              TALLOC_CTX *mem_ctx,
  54                              struct smb_trans2 *parms)
  55 {
  56         int total_data=0;
  57         int total_param=0;
  58         char *tdata;
  59         char *tparam;
  60
  61         parms->out.data.length = 0;
  62         parms->out.data.data = NULL;
  63         parms->out.params.length = 0;
  64         parms->out.params.data = NULL;
  65
  66         if (!cli_request_receive(req)) {
  67                 req->status = NT_STATUS_UNSUCCESSFUL;
  68                 return cli_request_destroy(req);
  69         }
  70
  71         /*
  72          * An NT RPC pipe call can return ERRDOS, ERRmoredata
  73          * to a trans call. This is not an error and should not
  74          * be treated as such.
  75          */
  76         if (NT_STATUS_IS_ERR(req->status)) {
  77                 return cli_request_destroy(req);
  78         }
  79
  80         CLI_CHECK_MIN_WCT(req, 10);
  81
  82         /* parse out the lengths */
  83         total_data = SVAL(req->in.vwv, VWV(1));
  84         total_param = SVAL(req->in.vwv, VWV(0));
  85
  86         /* allocate it */
  87         if (total_data != 0) {
  88                 tdata = talloc_realloc(mem_ctx, parms->out.data.data,total_data);
  89                 if (!tdata) {
  90                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
  91                         req->status = NT_STATUS_NO_MEMORY;
  92                         return cli_request_destroy(req);
  93                 }
  94                 parms->out.data.data = tdata;
  95         }
  96
  97         if (total_param != 0) {
  98                 tparam = talloc_realloc(mem_ctx, parms->out.params.data,total_param);
  99                 if (!tparam) {
 100                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
 101                         req->status = NT_STATUS_NO_MEMORY;
 102                         return cli_request_destroy(req);
 103                 }
 104                 parms->out.params.data = tparam;
 105         }
 106
 107         parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
 108         CLI_CHECK_WCT(req, 10 + parms->out.setup_count);
 109
 110         if (parms->out.setup_count > 0) {
 111                 int i;
 112                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 113                 if (!parms->out.setup) {
 114                         req->status = NT_STATUS_NO_MEMORY;
 115                         return cli_request_destroy(req);
 116                 }
 117                 for (i=0;i<parms->out.setup_count;i++) {
 118                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
 119                 }
 120         }
 121
 122         while (1)  {
 123                 uint16 param_count, param_ofs, param_disp;
 124                 uint16 data_count, data_ofs, data_disp;
 125                 uint16 total_data2, total_param2;
 126
 127                 /* parse out the total lengths again - they can shrink! */
 128                 total_data2 = SVAL(req->in.vwv, VWV(1));
 129                 total_param2 = SVAL(req->in.vwv, VWV(0));
 130
 131                 if (total_data2 > total_data ||
 132                     total_param2 > total_param) {
 133                         /* they must *only* shrink */
 134                         DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
 135                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 136                         return cli_request_destroy(req);
 137                 }
 138
 139                 total_data = total_data2;
 140                 total_param = total_param2;
 141
 142                 /* parse params for this lump */
 143                 param_count = SVAL(req->in.vwv, VWV(3));
 144                 param_ofs   = SVAL(req->in.vwv, VWV(4));
 145                 param_disp  = SVAL(req->in.vwv, VWV(5));
 146
 147                 data_count = SVAL(req->in.vwv, VWV(6));
 148                 data_ofs   = SVAL(req->in.vwv, VWV(7));
 149                 data_disp  = SVAL(req->in.vwv, VWV(8));
 150
 151                 if (data_count + data_disp > total_data ||
 152                     param_count + param_disp > total_param) {
 153                         DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
 154                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 155                         return cli_request_destroy(req);
 156                 }
 157
 158                 /* check the server isn't being nasty */
 159                 if (raw_trans_oob(req, param_ofs, param_count) ||
 160                     raw_trans_oob(req, data_ofs, data_count)) {
 161                         DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
 162                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 163                         return cli_request_destroy(req);
 164                 }
 165
 166                 if (data_count) {
 167                         memcpy(parms->out.data.data + data_disp,
 168                                req->in.hdr + data_ofs,
 169                                data_count);
 170                 }
 171
 172                 if (param_count) {
 173                         memcpy(parms->out.params.data + param_disp,
 174                                req->in.hdr + param_ofs,
 175                                param_count);
 176                 }
 177
 178                 parms->out.data.length += data_count;
 179                 parms->out.params.length += param_count;
 180
 181                 if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
 182                         break;
 183
 184                 /* to receive more requests we need to mark this request as not received */
 185                 req->in.buffer = NULL;
 186
 187                 if (!cli_request_receive(req)) {
 188                         req->status = NT_STATUS_UNSUCCESSFUL;
 189                         return cli_request_destroy(req);
 190                 }
 191         }
 192
 193 failed:
 194         return cli_request_destroy(req);
 195 }
 196
 197
 198 /****************************************************************************
 199  trans2 raw async interface - only BLOBs used in this interface.
 200 note that this doesn't yet support multi-part requests
 201 ****************************************************************************/
 202 struct cli_request *smb_raw_trans2_send(struct cli_tree *tree,
 203                                         struct smb_trans2 *parms)
 204 {
 205         uint8 command = SMBtrans2;
 206         int wct = 14 + parms->in.setup_count;
 207         struct cli_request *req;
 208         char *outdata,*outparam;
 209         int data_sent, param_sent;
 210         int i;
 211         const int padding = 3;
 212
 213         req = cli_request_setup(tree, command, wct, padding);
 214         if (!req) {
 215                 return NULL;
 216         }
 217
 218         /* fill in SMB parameters */
 219         data_sent = parms->in.data.length;
 220         param_sent = parms->in.params.length;
 221         outparam = req->out.data + padding;
 222         outdata = outparam + param_sent;
 223
 224         /* make sure we don't leak data via the padding */
 225         memset(req->out.data, 0, padding);
 226
 227         /* primary request */
 228         SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
 229         SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
 230         SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
 231         SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
 232         SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
 233         SSVAL(req->out.vwv,VWV(5),parms->in.flags);
 234         SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
 235         SSVAL(req->out.vwv,VWV(8),0); /* reserved */
 236         SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
 237         SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr));
 238         SSVAL(req->out.vwv,VWV(11),parms->in.data.length);
 239         SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr));
 240         SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
 241         for (i=0;i<parms->in.setup_count;i++)   {
 242                 SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
 243         }
 244         if (parms->in.params.data)      {
 245                 cli_req_append_blob(req, &parms->in.params);
 246         }
 247         if (parms->in.data.data) {
 248                 cli_req_append_blob(req, &parms->in.data);
 249         }
 250
 251         if (!cli_request_send(req)) {
 252                 cli_request_destroy(req);
 253                 return NULL;
 254         }
 255
 256         return req;
 257 }
 258
 259 /*
 260   trans2 synchronous blob interface
 261 */
 262 NTSTATUS smb_raw_trans2(struct cli_tree *tree,
 263                         TALLOC_CTX *mem_ctx,
 264                         struct smb_trans2 *parms)
 265 {
 266         struct cli_request *req;
 267         req = smb_raw_trans2_send(tree, parms);
 268         if (!req) return NT_STATUS_UNSUCCESSFUL;
 269         return smb_raw_trans2_recv(req, mem_ctx, parms);
 270 }
 271
 272
 273 /****************************************************************************
 274   receive a SMB nttrans response allocating the necessary memory
 275   ****************************************************************************/
 276 NTSTATUS smb_raw_nttrans_recv(struct cli_request *req,
 277                               TALLOC_CTX *mem_ctx,
 278                               struct smb_nttrans *parms)
 279 {
 280         uint32 total_data, recvd_data=0;
 281         uint32 total_param, recvd_param=0;
 282
 283         if (!cli_request_receive(req) ||
 284             cli_request_is_error(req)) {
 285                 return cli_request_destroy(req);
 286         }
 287
 288         /* sanity check */
 289         if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 290                 DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n",
 291                          "SMBnttrans",
 292                          CVAL(req->in.hdr,HDR_COM)));
 293                 req->status = NT_STATUS_UNSUCCESSFUL;
 294                 return cli_request_destroy(req);
 295         }
 296
 297         CLI_CHECK_MIN_WCT(req, 18);
 298
 299         /* parse out the lengths */
 300         total_param = IVAL(req->in.vwv, 3);
 301         total_data  = IVAL(req->in.vwv, 7);
 302
 303         parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data);
 304         parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param);
 305
 306         if (parms->out.data.length != total_data ||
 307             parms->out.params.length != total_param) {
 308                 req->status = NT_STATUS_NO_MEMORY;
 309                 return cli_request_destroy(req);
 310         }
 311
 312         parms->out.setup_count = CVAL(req->in.vwv, 35);
 313         CLI_CHECK_WCT(req, 18 + parms->out.setup_count);
 314
 315         if (parms->out.setup_count > 0) {
 316                 int i;
 317                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 318                 if (!parms->out.setup) {
 319                         req->status = NT_STATUS_NO_MEMORY;
 320                         return cli_request_destroy(req);
 321                 }
 322                 for (i=0;i<parms->out.setup_count;i++) {
 323                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(18+i));
 324                 }
 325         }
 326
 327         while (recvd_data < total_data ||
 328                recvd_param < total_param)  {
 329                 uint32 param_count, param_ofs, param_disp;
 330                 uint32 data_count, data_ofs, data_disp;
 331                 uint32 total_data2, total_param2;
 332
 333                 /* parse out the total lengths again - they can shrink! */
 334                 total_param2 = IVAL(req->in.vwv, 3);
 335                 total_data2  = IVAL(req->in.vwv, 7);
 336
 337                 if (total_data2 > total_data ||
 338                     total_param2 > total_param) {
 339                         /* they must *only* shrink */
 340                         DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n"));
 341                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 342                         return cli_request_destroy(req);
 343                 }
 344
 345                 total_data = total_data2;
 346                 total_param = total_param2;
 347                 parms->out.data.length = total_data;
 348                 parms->out.params.length = total_param;
 349
 350                 /* parse params for this lump */
 351                 param_count = IVAL(req->in.vwv, 11);
 352                 param_ofs   = IVAL(req->in.vwv, 15);
 353                 param_disp  = IVAL(req->in.vwv, 19);
 354
 355                 data_count = IVAL(req->in.vwv, 23);
 356                 data_ofs   = IVAL(req->in.vwv, 27);
 357                 data_disp  = IVAL(req->in.vwv, 31);
 358
 359                 if (data_count + data_disp > total_data ||
 360                     param_count + param_disp > total_param) {
 361                         DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n"));
 362                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 363                         return cli_request_destroy(req);
 364                 }
 365
 366                 /* check the server isn't being nasty */
 367                 if (raw_trans_oob(req, param_ofs, param_count) ||
 368                     raw_trans_oob(req, data_ofs, data_count)) {
 369                         DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n"));
 370                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 371                         return cli_request_destroy(req);
 372                 }
 373
 374                 if (data_count) {
 375                         memcpy(parms->out.data.data + data_disp,
 376                                req->in.hdr + data_ofs,
 377                                data_count);
 378                 }
 379
 380                 if (param_count) {
 381                         memcpy(parms->out.params.data + param_disp,
 382                                req->in.hdr + param_ofs,
 383                                param_count);
 384                 }
 385
 386                 recvd_param += param_count;
 387                 recvd_data += data_count;
 388
 389                 if (recvd_data >= total_data &&
 390                     recvd_param >= total_param) {
 391                         break;
 392                 }
 393
 394                 if (!cli_request_receive(req) ||
 395                     cli_request_is_error(req)) {
 396                         return cli_request_destroy(req);
 397                 }
 398
 399                 /* sanity check */
 400                 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 401                         DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n",
 402                                  CVAL(req->in.hdr, HDR_COM)));
 403                         req->status = NT_STATUS_UNSUCCESSFUL;
 404                         return cli_request_destroy(req);
 405                 }
 406         }
 407
 408 failed:
 409         return cli_request_destroy(req);
 410 }
 411
 412
 413 /****************************************************************************
 414  nttrans raw - only BLOBs used in this interface.
 415  at the moment we only handle a single primary request
 416 ****************************************************************************/
 417 struct cli_request *smb_raw_nttrans_send(struct cli_tree *tree,
 418                                          struct smb_nttrans *parms)
 419 {
 420         struct cli_request *req;
 421         char *outdata, *outparam;
 422         int i;
 423         int align = 0;
 424
 425         /* only align if there are parameters or data */
 426         if (parms->in.params.length || parms->in.data.length) {
 427                 align = 3;
 428         }
 429
 430         req = cli_request_setup(tree, SMBnttrans,
 431                                 19 + parms->in.setup_count,
 432                                 align +
 433                                 parms->in.params.length +
 434                                 parms->in.data.length);
 435         if (!req) {
 436                 return NULL;
 437         }
 438
 439         /* fill in SMB parameters */
 440         outparam = req->out.data + align;
 441         outdata = outparam + parms->in.params.length;
 442
 443         SCVAL(req->out.vwv,  0, parms->in.max_setup);
 444         SSVAL(req->out.vwv,  1, 0); /* reserved */
 445         SIVAL(req->out.vwv,  3, parms->in.params.length);
 446         SIVAL(req->out.vwv,  7, parms->in.data.length);
 447         SIVAL(req->out.vwv, 11, parms->in.max_param);
 448         SIVAL(req->out.vwv, 15, parms->in.max_data);
 449         SIVAL(req->out.vwv, 19, parms->in.params.length);
 450         SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
 451         SIVAL(req->out.vwv, 27, parms->in.data.length);
 452         SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
 453         SCVAL(req->out.vwv, 35, parms->in.setup_count);
 454         SSVAL(req->out.vwv, 36, parms->in.function);
 455         for (i=0;i<parms->in.setup_count;i++) {
 456                 SSVAL(req->out.vwv,VWV(19+i),parms->in.setup[i]);
 457         }
 458         if (parms->in.params.length) {
 459                 memcpy(outparam, parms->in.params.data, parms->in.params.length);
 460         }
 461         if (parms->in.data.length) {
 462                 memcpy(outparam, parms->in.data.data, parms->in.data.length);
 463         }
 464
 465         if (!cli_request_send(req)) {
 466                 cli_request_destroy(req);
 467                 return NULL;
 468         }
 469
 470         return req;
 471 }
 472
 473
 474 /****************************************************************************
 475   receive a SMB nttrans response allocating the necessary memory
 476   ****************************************************************************/
 477 NTSTATUS smb_raw_nttrans(struct cli_tree *tree,
 478                          TALLOC_CTX *mem_ctx,
 479                          struct smb_nttrans *parms)
 480 {
 481         struct cli_request *req;
 482
 483         req = smb_raw_nttrans_send(tree, parms);
 484         if (!req) {
 485                 return NT_STATUS_UNSUCCESSFUL;
 486         }
 487
 488         return smb_raw_nttrans_recv(req, mem_ctx, parms);
 489 }