source4/libcli/raw/rawtrans.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    raw trans/trans2/nttrans operations
   4
   5    Copyright (C) James Myers 2003 <myersjj@samba.org>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/raw/libcliraw.h"
  24
  25
  26 /*
  27   check out of bounds for incoming data
  28 */
  29 static BOOL raw_trans_oob(struct smbcli_request *req,
  30                           uint_t offset, uint_t count)
  31 {
  32         uint8_t *ptr;
  33
  34         if (count == 0) {
  35                 return False;
  36         }
  37
  38         ptr = req->in.hdr + offset;
  39
  40         /* be careful with wraparound! */
  41         if (ptr < req->in.data ||
  42             ptr >= req->in.data + req->in.data_size ||
  43             count > req->in.data_size ||
  44             ptr + count > req->in.data + req->in.data_size) {
  45                 return True;
  46         }
  47         return False;
  48 }
  49
  50 /****************************************************************************
  51   receive a SMB trans or trans2 response allocating the necessary memory
  52   ****************************************************************************/
  53 NTSTATUS smb_raw_trans2_recv(struct smbcli_request *req,
  54                              TALLOC_CTX *mem_ctx,
  55                              struct smb_trans2 *parms)
  56 {
  57         int total_data=0;
  58         int total_param=0;
  59         uint8_t *tdata;
  60         uint8_t *tparam;
  61
  62         parms->out.data.length = 0;
  63         parms->out.data.data = NULL;
  64         parms->out.params.length = 0;
  65         parms->out.params.data = NULL;
  66
  67         if (!smbcli_request_receive(req)) {
  68                 return smbcli_request_destroy(req);
  69         }
  70
  71         /*
  72          * An NT RPC pipe call can return ERRDOS, ERRmoredata
  73          * to a trans call. This is not an error and should not
  74          * be treated as such.
  75          */
  76         if (NT_STATUS_IS_ERR(req->status)) {
  77                 return smbcli_request_destroy(req);
  78         }
  79
  80         SMBCLI_CHECK_MIN_WCT(req, 10);
  81
  82         /* parse out the lengths */
  83         total_data = SVAL(req->in.vwv, VWV(1));
  84         total_param = SVAL(req->in.vwv, VWV(0));
  85
  86         /* allocate it */
  87         if (total_data != 0) {
  88                 tdata = talloc(mem_ctx, total_data);
  89                 if (!tdata) {
  90                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge data buffer to %d bytes\n", total_data));
  91                         req->status = NT_STATUS_NO_MEMORY;
  92                         return smbcli_request_destroy(req);
  93                 }
  94                 parms->out.data.data = tdata;
  95         }
  96
  97         if (total_param != 0) {
  98                 tparam = talloc(mem_ctx, total_param);
  99                 if (!tparam) {
 100                         DEBUG(0,("smb_raw_receive_trans: failed to enlarge param buffer to %d bytes\n", total_param));
 101                         req->status = NT_STATUS_NO_MEMORY;
 102                         return smbcli_request_destroy(req);
 103                 }
 104                 parms->out.params.data = tparam;
 105         }
 106
 107         parms->out.setup_count = SVAL(req->in.vwv, VWV(9));
 108         SMBCLI_CHECK_WCT(req, 10 + parms->out.setup_count);
 109
 110         if (parms->out.setup_count > 0) {
 111                 int i;
 112                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 113                 if (!parms->out.setup) {
 114                         req->status = NT_STATUS_NO_MEMORY;
 115                         return smbcli_request_destroy(req);
 116                 }
 117                 for (i=0;i<parms->out.setup_count;i++) {
 118                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(10+i));
 119                 }
 120         }
 121
 122         while (1)  {
 123                 uint16_t param_count, param_ofs, param_disp;
 124                 uint16_t data_count, data_ofs, data_disp;
 125                 uint16_t total_data2, total_param2;
 126
 127                 /* parse out the total lengths again - they can shrink! */
 128                 total_data2 = SVAL(req->in.vwv, VWV(1));
 129                 total_param2 = SVAL(req->in.vwv, VWV(0));
 130
 131                 if (total_data2 > total_data ||
 132                     total_param2 > total_param) {
 133                         /* they must *only* shrink */
 134                         DEBUG(1,("smb_raw_receive_trans: data/params expanded!\n"));
 135                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 136                         return smbcli_request_destroy(req);
 137                 }
 138
 139                 total_data = total_data2;
 140                 total_param = total_param2;
 141
 142                 /* parse params for this lump */
 143                 param_count = SVAL(req->in.vwv, VWV(3));
 144                 param_ofs   = SVAL(req->in.vwv, VWV(4));
 145                 param_disp  = SVAL(req->in.vwv, VWV(5));
 146
 147                 data_count = SVAL(req->in.vwv, VWV(6));
 148                 data_ofs   = SVAL(req->in.vwv, VWV(7));
 149                 data_disp  = SVAL(req->in.vwv, VWV(8));
 150
 151                 if (data_count + data_disp > total_data ||
 152                     param_count + param_disp > total_param) {
 153                         DEBUG(1,("smb_raw_receive_trans: Buffer overflow\n"));
 154                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 155                         return smbcli_request_destroy(req);
 156                 }
 157
 158                 /* check the server isn't being nasty */
 159                 if (raw_trans_oob(req, param_ofs, param_count) ||
 160                     raw_trans_oob(req, data_ofs, data_count)) {
 161                         DEBUG(1,("smb_raw_receive_trans: out of bounds parameters!\n"));
 162                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 163                         return smbcli_request_destroy(req);
 164                 }
 165
 166                 if (data_count) {
 167                         memcpy(parms->out.data.data + data_disp,
 168                                req->in.hdr + data_ofs,
 169                                data_count);
 170                 }
 171
 172                 if (param_count) {
 173                         memcpy(parms->out.params.data + param_disp,
 174                                req->in.hdr + param_ofs,
 175                                param_count);
 176                 }
 177
 178                 parms->out.data.length += data_count;
 179                 parms->out.params.length += param_count;
 180
 181                 if (total_data <= parms->out.data.length && total_param <= parms->out.params.length)
 182                         break;
 183
 184                 if (!smbcli_request_receive_more(req)) {
 185                         req->status = NT_STATUS_UNSUCCESSFUL;
 186                         return smbcli_request_destroy(req);
 187                 }
 188         }
 189
 190 failed:
 191         return smbcli_request_destroy(req);
 192 }
 193
 194 NTSTATUS smb_raw_trans_recv(struct smbcli_request *req,
 195                              TALLOC_CTX *mem_ctx,
 196                              struct smb_trans2 *parms)
 197 {
 198         return smb_raw_trans2_recv(req, mem_ctx, parms);
 199 }
 200
 201 /****************************************************************************
 202  trans/trans2 raw async interface - only BLOBs used in this interface.
 203  note that this doesn't yet support multi-part requests
 204 ****************************************************************************/
 205 struct smbcli_request *smb_raw_trans_send_backend(struct smbcli_tree *tree,
 206                                                struct smb_trans2 *parms,
 207                                                uint8_t command)
 208 {
 209         int wct = 14 + parms->in.setup_count;
 210         struct smbcli_request *req;
 211         uint8_t *outdata,*outparam;
 212         int i;
 213         int padding;
 214         size_t namelen = 0;
 215
 216         if (command == SMBtrans)
 217                 padding = 1;
 218         else
 219                 padding = 3;
 220
 221         req = smbcli_request_setup(tree, command, wct, padding);
 222         if (!req) {
 223                 return NULL;
 224         }
 225
 226         /* Watch out, this changes the req->out.* pointers */
 227         if (command == SMBtrans && parms->in.trans_name) {
 228                 namelen = smbcli_req_append_string(req, parms->in.trans_name,
 229                                                 STR_TERMINATE);
 230         }
 231
 232         /* fill in SMB parameters */
 233         outparam = req->out.data + padding;
 234         outdata = outparam + parms->in.params.length;
 235
 236         /* make sure we don't leak data via the padding */
 237         memset(req->out.data, 0, padding);
 238
 239         /* primary request */
 240         SSVAL(req->out.vwv,VWV(0),parms->in.params.length);
 241         SSVAL(req->out.vwv,VWV(1),parms->in.data.length);
 242         SSVAL(req->out.vwv,VWV(2),parms->in.max_param);
 243         SSVAL(req->out.vwv,VWV(3),parms->in.max_data);
 244         SSVAL(req->out.vwv,VWV(4),parms->in.max_setup);
 245         SSVAL(req->out.vwv,VWV(5),parms->in.flags);
 246         SIVAL(req->out.vwv,VWV(6),parms->in.timeout);
 247         SSVAL(req->out.vwv,VWV(8),0); /* reserved */
 248         SSVAL(req->out.vwv,VWV(9),parms->in.params.length);
 249         SSVAL(req->out.vwv,VWV(10),PTR_DIFF(outparam,req->out.hdr)+namelen);
 250         SSVAL(req->out.vwv,VWV(11),parms->in.data.length);
 251         SSVAL(req->out.vwv,VWV(12),PTR_DIFF(outdata,req->out.hdr)+namelen);
 252         SSVAL(req->out.vwv,VWV(13),parms->in.setup_count);
 253         for (i=0;i<parms->in.setup_count;i++)   {
 254                 SSVAL(req->out.vwv,VWV(14)+i*2,parms->in.setup[i]);
 255         }
 256         if (parms->in.params.data)      {
 257                 smbcli_req_append_blob(req, &parms->in.params);
 258         }
 259         if (parms->in.data.data) {
 260                 smbcli_req_append_blob(req, &parms->in.data);
 261         }
 262
 263         if (!smbcli_request_send(req)) {
 264                 smbcli_request_destroy(req);
 265                 return NULL;
 266         }
 267
 268         return req;
 269 }
 270
 271 /****************************************************************************
 272  trans/trans2 raw async interface - only BLOBs used in this interface.
 273 note that this doesn't yet support multi-part requests
 274 ****************************************************************************/
 275
 276 struct smbcli_request *smb_raw_trans_send(struct smbcli_tree *tree,
 277                                        struct smb_trans2 *parms)
 278 {
 279         return smb_raw_trans_send_backend(tree, parms, SMBtrans);
 280 }
 281
 282 struct smbcli_request *smb_raw_trans2_send(struct smbcli_tree *tree,
 283                                        struct smb_trans2 *parms)
 284 {
 285         return smb_raw_trans_send_backend(tree, parms, SMBtrans2);
 286 }
 287
 288 /*
 289   trans2 synchronous blob interface
 290 */
 291 NTSTATUS smb_raw_trans2(struct smbcli_tree *tree,
 292                         TALLOC_CTX *mem_ctx,
 293                         struct smb_trans2 *parms)
 294 {
 295         struct smbcli_request *req;
 296         req = smb_raw_trans2_send(tree, parms);
 297         if (!req) return NT_STATUS_UNSUCCESSFUL;
 298         return smb_raw_trans2_recv(req, mem_ctx, parms);
 299 }
 300
 301
 302 /*
 303   trans synchronous blob interface
 304 */
 305 NTSTATUS smb_raw_trans(struct smbcli_tree *tree,
 306                        TALLOC_CTX *mem_ctx,
 307                        struct smb_trans2 *parms)
 308 {
 309         struct smbcli_request *req;
 310         req = smb_raw_trans_send(tree, parms);
 311         if (!req) return NT_STATUS_UNSUCCESSFUL;
 312         return smb_raw_trans_recv(req, mem_ctx, parms);
 313 }
 314
 315 /****************************************************************************
 316   receive a SMB nttrans response allocating the necessary memory
 317   ****************************************************************************/
 318 NTSTATUS smb_raw_nttrans_recv(struct smbcli_request *req,
 319                               TALLOC_CTX *mem_ctx,
 320                               struct smb_nttrans *parms)
 321 {
 322         uint32_t total_data, recvd_data=0;
 323         uint32_t total_param, recvd_param=0;
 324
 325         if (!smbcli_request_receive(req) ||
 326             smbcli_request_is_error(req)) {
 327                 return smbcli_request_destroy(req);
 328         }
 329
 330         /* sanity check */
 331         if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 332                 DEBUG(0,("smb_raw_receive_nttrans: Expected %s response, got command 0x%02x\n",
 333                          "SMBnttrans",
 334                          CVAL(req->in.hdr,HDR_COM)));
 335                 req->status = NT_STATUS_UNSUCCESSFUL;
 336                 return smbcli_request_destroy(req);
 337         }
 338
 339         SMBCLI_CHECK_MIN_WCT(req, 18);
 340
 341         /* parse out the lengths */
 342         total_param = IVAL(req->in.vwv, 3);
 343         total_data  = IVAL(req->in.vwv, 7);
 344
 345         parms->out.data = data_blob_talloc(mem_ctx, NULL, total_data);
 346         parms->out.params = data_blob_talloc(mem_ctx, NULL, total_param);
 347
 348         if (parms->out.data.length != total_data ||
 349             parms->out.params.length != total_param) {
 350                 req->status = NT_STATUS_NO_MEMORY;
 351                 return smbcli_request_destroy(req);
 352         }
 353
 354         parms->out.setup_count = CVAL(req->in.vwv, 35);
 355         SMBCLI_CHECK_WCT(req, 18 + parms->out.setup_count);
 356
 357         if (parms->out.setup_count > 0) {
 358                 int i;
 359                 parms->out.setup = talloc(mem_ctx, 2 * parms->out.setup_count);
 360                 if (!parms->out.setup) {
 361                         req->status = NT_STATUS_NO_MEMORY;
 362                         return smbcli_request_destroy(req);
 363                 }
 364                 for (i=0;i<parms->out.setup_count;i++) {
 365                         parms->out.setup[i] = SVAL(req->in.vwv, VWV(18+i));
 366                 }
 367         }
 368
 369         while (recvd_data < total_data ||
 370                recvd_param < total_param)  {
 371                 uint32_t param_count, param_ofs, param_disp;
 372                 uint32_t data_count, data_ofs, data_disp;
 373                 uint32_t total_data2, total_param2;
 374
 375                 /* parse out the total lengths again - they can shrink! */
 376                 total_param2 = IVAL(req->in.vwv, 3);
 377                 total_data2  = IVAL(req->in.vwv, 7);
 378
 379                 if (total_data2 > total_data ||
 380                     total_param2 > total_param) {
 381                         /* they must *only* shrink */
 382                         DEBUG(1,("smb_raw_receive_nttrans: data/params expanded!\n"));
 383                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 384                         return smbcli_request_destroy(req);
 385                 }
 386
 387                 total_data = total_data2;
 388                 total_param = total_param2;
 389                 parms->out.data.length = total_data;
 390                 parms->out.params.length = total_param;
 391
 392                 /* parse params for this lump */
 393                 param_count = IVAL(req->in.vwv, 11);
 394                 param_ofs   = IVAL(req->in.vwv, 15);
 395                 param_disp  = IVAL(req->in.vwv, 19);
 396
 397                 data_count = IVAL(req->in.vwv, 23);
 398                 data_ofs   = IVAL(req->in.vwv, 27);
 399                 data_disp  = IVAL(req->in.vwv, 31);
 400
 401                 if (data_count + data_disp > total_data ||
 402                     param_count + param_disp > total_param) {
 403                         DEBUG(1,("smb_raw_receive_nttrans: Buffer overflow\n"));
 404                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 405                         return smbcli_request_destroy(req);
 406                 }
 407
 408                 /* check the server isn't being nasty */
 409                 if (raw_trans_oob(req, param_ofs, param_count) ||
 410                     raw_trans_oob(req, data_ofs, data_count)) {
 411                         DEBUG(1,("smb_raw_receive_nttrans: out of bounds parameters!\n"));
 412                         req->status = NT_STATUS_BUFFER_TOO_SMALL;
 413                         return smbcli_request_destroy(req);
 414                 }
 415
 416                 if (data_count) {
 417                         memcpy(parms->out.data.data + data_disp,
 418                                req->in.hdr + data_ofs,
 419                                data_count);
 420                 }
 421
 422                 if (param_count) {
 423                         memcpy(parms->out.params.data + param_disp,
 424                                req->in.hdr + param_ofs,
 425                                param_count);
 426                 }
 427
 428                 recvd_param += param_count;
 429                 recvd_data += data_count;
 430
 431                 if (recvd_data >= total_data &&
 432                     recvd_param >= total_param) {
 433                         break;
 434                 }
 435
 436                 if (!smbcli_request_receive(req) ||
 437                     smbcli_request_is_error(req)) {
 438                         return smbcli_request_destroy(req);
 439                 }
 440
 441                 /* sanity check */
 442                 if (CVAL(req->in.hdr, HDR_COM) != SMBnttrans) {
 443                         DEBUG(0,("smb_raw_receive_nttrans: Expected nttranss, got command 0x%02x\n",
 444                                  CVAL(req->in.hdr, HDR_COM)));
 445                         req->status = NT_STATUS_UNSUCCESSFUL;
 446                         return smbcli_request_destroy(req);
 447                 }
 448         }
 449
 450 failed:
 451         return smbcli_request_destroy(req);
 452 }
 453
 454
 455 /****************************************************************************
 456  nttrans raw - only BLOBs used in this interface.
 457  at the moment we only handle a single primary request
 458 ****************************************************************************/
 459 struct smbcli_request *smb_raw_nttrans_send(struct smbcli_tree *tree,
 460                                          struct smb_nttrans *parms)
 461 {
 462         struct smbcli_request *req;
 463         uint8_t *outdata, *outparam;
 464         int i;
 465         int align = 0;
 466
 467         /* only align if there are parameters or data */
 468         if (parms->in.params.length || parms->in.data.length) {
 469                 align = 3;
 470         }
 471
 472         req = smbcli_request_setup(tree, SMBnttrans,
 473                                 19 + parms->in.setup_count,
 474                                 align +
 475                                 parms->in.params.length +
 476                                 parms->in.data.length);
 477         if (!req) {
 478                 return NULL;
 479         }
 480
 481         /* fill in SMB parameters */
 482         outparam = req->out.data + align;
 483         outdata = outparam + parms->in.params.length;
 484
 485         if (align != 0) {
 486                 memset(req->out.data, 0, align);
 487         }
 488
 489         SCVAL(req->out.vwv,  0, parms->in.max_setup);
 490         SSVAL(req->out.vwv,  1, 0); /* reserved */
 491         SIVAL(req->out.vwv,  3, parms->in.params.length);
 492         SIVAL(req->out.vwv,  7, parms->in.data.length);
 493         SIVAL(req->out.vwv, 11, parms->in.max_param);
 494         SIVAL(req->out.vwv, 15, parms->in.max_data);
 495         SIVAL(req->out.vwv, 19, parms->in.params.length);
 496         SIVAL(req->out.vwv, 23, PTR_DIFF(outparam,req->out.hdr));
 497         SIVAL(req->out.vwv, 27, parms->in.data.length);
 498         SIVAL(req->out.vwv, 31, PTR_DIFF(outdata,req->out.hdr));
 499         SCVAL(req->out.vwv, 35, parms->in.setup_count);
 500         SSVAL(req->out.vwv, 36, parms->in.function);
 501         for (i=0;i<parms->in.setup_count;i++) {
 502                 SSVAL(req->out.vwv,VWV(19+i),parms->in.setup[i]);
 503         }
 504         if (parms->in.params.length) {
 505                 memcpy(outparam, parms->in.params.data, parms->in.params.length);
 506         }
 507         if (parms->in.data.length) {
 508                 memcpy(outdata, parms->in.data.data, parms->in.data.length);
 509         }
 510
 511         if (!smbcli_request_send(req)) {
 512                 smbcli_request_destroy(req);
 513                 return NULL;
 514         }
 515
 516         return req;
 517 }
 518
 519
 520 /****************************************************************************
 521   receive a SMB nttrans response allocating the necessary memory
 522   ****************************************************************************/
 523 NTSTATUS smb_raw_nttrans(struct smbcli_tree *tree,
 524                          TALLOC_CTX *mem_ctx,
 525                          struct smb_nttrans *parms)
 526 {
 527         struct smbcli_request *req;
 528
 529         req = smb_raw_nttrans_send(tree, parms);
 530         if (!req) {
 531                 return NT_STATUS_UNSUCCESSFUL;
 532         }
 533
 534         return smb_raw_nttrans_recv(req, mem_ctx, parms);
 535 }
 536
 537 /*
 538   work out the maximum data size for a trans request while avoiding
 539   multi-part replies
 540
 541   TODO: we only need to avoid multi-part replies because the
 542   multi-part trans receive code is broken.
 543 */
 544 size_t smb_raw_max_trans_data(struct smbcli_tree *tree, size_t param_size)
 545 {
 546         return tree->session->transport->options.max_xmit - (70 + param_size);
 547 }