source/libcli/raw/clitransport.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client transport context management functions
   4
   5    Copyright (C) Andrew Tridgell 1994-2005
   6    Copyright (C) James Myers 2003 <myersjj@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "lib/socket/socket.h"
  26 #include "dlinklist.h"
  27 #include "lib/events/events.h"
  28 #include "lib/stream/packet.h"
  29
  30
  31 /*
  32   an event has happened on the socket
  33 */
  34 static void smbcli_transport_event_handler(struct event_context *ev,
  35                                            struct fd_event *fde,
  36                                            uint16_t flags, void *private)
  37 {
  38         struct smbcli_transport *transport = talloc_get_type(private,
  39                                                              struct smbcli_transport);
  40         if (flags & EVENT_FD_READ) {
  41                 packet_recv(transport->packet);
  42                 return;
  43         }
  44         if (flags & EVENT_FD_WRITE) {
  45                 packet_queue_run(transport->packet);
  46         }
  47 }
  48
  49 /*
  50   destroy a transport
  51  */
  52 static int transport_destructor(void *ptr)
  53 {
  54         struct smbcli_transport *transport = ptr;
  55
  56         smbcli_transport_dead(transport);
  57         return 0;
  58 }
  59
  60
  61 /*
  62   handle receive errors
  63 */
  64 static void smbcli_transport_error(void *private, NTSTATUS status)
  65 {
  66         struct smbcli_transport *transport = talloc_get_type(private, struct smbcli_transport);
  67         smbcli_transport_dead(transport);
  68 }
  69
  70 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob);
  71
  72 /*
  73   create a transport structure based on an established socket
  74 */
  75 struct smbcli_transport *smbcli_transport_init(struct smbcli_socket *sock,
  76                                                TALLOC_CTX *parent_ctx, BOOL primary)
  77 {
  78         struct smbcli_transport *transport;
  79
  80         transport = talloc_zero(parent_ctx, struct smbcli_transport);
  81         if (!transport) return NULL;
  82
  83         if (primary) {
  84                 transport->socket = talloc_steal(transport, sock);
  85         } else {
  86                 transport->socket = talloc_reference(transport, sock);
  87         }
  88         transport->negotiate.protocol = PROTOCOL_NT1;
  89         transport->options.use_spnego = lp_use_spnego() && lp_nt_status_support();
  90         transport->options.max_xmit = lp_max_xmit();
  91         transport->options.max_mux = lp_maxmux();
  92         transport->options.request_timeout = SMB_REQUEST_TIMEOUT;
  93
  94         transport->negotiate.max_xmit = transport->options.max_xmit;
  95
  96         /* setup the stream -> packet parser */
  97         transport->packet = packet_init(transport);
  98         if (transport->packet == NULL) {
  99                 talloc_free(transport);
 100                 return NULL;
 101         }
 102         packet_set_private(transport->packet, transport);
 103         packet_set_socket(transport->packet, transport->socket->sock);
 104         packet_set_callback(transport->packet, smbcli_transport_finish_recv);
 105         packet_set_full_request(transport->packet, packet_full_request_nbt);
 106         packet_set_error_handler(transport->packet, smbcli_transport_error);
 107         packet_set_event_context(transport->packet, transport->socket->event.ctx);
 108
 109         smbcli_init_signing(transport);
 110
 111         ZERO_STRUCT(transport->called);
 112
 113         /* take over event handling from the socket layer - it only
 114            handles events up until we are connected */
 115         talloc_free(transport->socket->event.fde);
 116         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
 117                                                     transport->socket,
 118                                                     socket_get_fd(transport->socket->sock),
 119                                                     EVENT_FD_READ,
 120                                                     smbcli_transport_event_handler,
 121                                                     transport);
 122
 123         packet_set_serialise(transport->packet, transport->socket->event.fde);
 124
 125         talloc_set_destructor(transport, transport_destructor);
 126
 127         return transport;
 128 }
 129
 130 /*
 131   mark the transport as dead
 132 */
 133 void smbcli_transport_dead(struct smbcli_transport *transport)
 134 {
 135         smbcli_sock_dead(transport->socket);
 136
 137         /* kill all pending receives */
 138         while (transport->pending_recv) {
 139                 struct smbcli_request *req = transport->pending_recv;
 140                 req->state = SMBCLI_REQUEST_ERROR;
 141                 req->status = NT_STATUS_NET_WRITE_FAULT;
 142                 DLIST_REMOVE(transport->pending_recv, req);
 143                 if (req->async.fn) {
 144                         req->async.fn(req);
 145                 }
 146         }
 147 }
 148
 149
 150 /*
 151   send a session request
 152 */
 153 struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *transport,
 154                                                      struct nbt_name *calling,
 155                                                      struct nbt_name *called)
 156 {
 157         uint8_t *p;
 158         struct smbcli_request *req;
 159         DATA_BLOB calling_blob, called_blob;
 160         TALLOC_CTX *tmp_ctx = talloc_new(transport);
 161         NTSTATUS status;
 162
 163         status = nbt_name_dup(transport, called, &transport->called);
 164         if (!NT_STATUS_IS_OK(status)) goto failed;
 165
 166         status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
 167         if (!NT_STATUS_IS_OK(status)) goto failed;
 168
 169         status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
 170         if (!NT_STATUS_IS_OK(status)) goto failed;
 171
 172         /* allocate output buffer */
 173         req = smbcli_request_setup_nonsmb(transport,
 174                                           NBT_HDR_SIZE +
 175                                           calling_blob.length + called_blob.length);
 176         if (req == NULL) goto failed;
 177
 178         /* put in the destination name */
 179         p = req->out.buffer + NBT_HDR_SIZE;
 180         memcpy(p, called_blob.data, called_blob.length);
 181         p += called_blob.length;
 182
 183         memcpy(p, calling_blob.data, calling_blob.length);
 184         p += calling_blob.length;
 185
 186         _smb_setlen(req->out.buffer, PTR_DIFF(p, req->out.buffer)-4);
 187         SCVAL(req->out.buffer,0,0x81);
 188
 189         if (!smbcli_request_send(req)) {
 190                 smbcli_request_destroy(req);
 191                 goto failed;
 192         }
 193
 194         talloc_free(tmp_ctx);
 195         return req;
 196
 197 failed:
 198         talloc_free(tmp_ctx);
 199         return NULL;
 200 }
 201
 202 /*
 203   map a session request error to a NTSTATUS
 204  */
 205 static NTSTATUS map_session_refused_error(uint8_t error)
 206 {
 207         switch (error) {
 208         case 0x80:
 209         case 0x81:
 210                 return NT_STATUS_REMOTE_NOT_LISTENING;
 211         case 0x82:
 212                 return NT_STATUS_RESOURCE_NAME_NOT_FOUND;
 213         case 0x83:
 214                 return NT_STATUS_REMOTE_RESOURCES;
 215         }
 216         return NT_STATUS_UNEXPECTED_IO_ERROR;
 217 }
 218
 219
 220 /*
 221   finish a smbcli_transport_connect()
 222 */
 223 NTSTATUS smbcli_transport_connect_recv(struct smbcli_request *req)
 224 {
 225         NTSTATUS status;
 226
 227         if (!smbcli_request_receive(req)) {
 228                 smbcli_request_destroy(req);
 229                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 230         }
 231
 232         switch (CVAL(req->in.buffer,0)) {
 233         case 0x82:
 234                 status = NT_STATUS_OK;
 235                 break;
 236         case 0x83:
 237                 status = map_session_refused_error(CVAL(req->in.buffer,4));
 238                 break;
 239         case 0x84:
 240                 DEBUG(1,("Warning: session retarget not supported\n"));
 241                 status = NT_STATUS_NOT_SUPPORTED;
 242                 break;
 243         default:
 244                 status = NT_STATUS_UNEXPECTED_IO_ERROR;
 245                 break;
 246         }
 247
 248         smbcli_request_destroy(req);
 249         return status;
 250 }
 251
 252
 253 /*
 254   send a session request (if needed)
 255 */
 256 BOOL smbcli_transport_connect(struct smbcli_transport *transport,
 257                               struct nbt_name *calling,
 258                               struct nbt_name *called)
 259 {
 260         struct smbcli_request *req;
 261         NTSTATUS status;
 262
 263         if (transport->socket->port == 445) {
 264                 return True;
 265         }
 266
 267         req = smbcli_transport_connect_send(transport,
 268                                             calling, called);
 269         status = smbcli_transport_connect_recv(req);
 270         return NT_STATUS_IS_OK(status);
 271 }
 272
 273 /****************************************************************************
 274 get next mid in sequence
 275 ****************************************************************************/
 276 uint16_t smbcli_transport_next_mid(struct smbcli_transport *transport)
 277 {
 278         uint16_t mid;
 279         struct smbcli_request *req;
 280
 281         mid = transport->next_mid;
 282
 283 again:
 284         /* now check to see if this mid is being used by one of the
 285            pending requests. This is quite efficient because the list is
 286            usually very short */
 287
 288         /* the zero mid is reserved for requests that don't have a mid */
 289         if (mid == 0) mid = 1;
 290
 291         for (req=transport->pending_recv; req; req=req->next) {
 292                 if (req->mid == mid) {
 293                         mid++;
 294                         goto again;
 295                 }
 296         }
 297
 298         transport->next_mid = mid+1;
 299         return mid;
 300 }
 301
 302 static void idle_handler(struct event_context *ev,
 303                          struct timed_event *te, struct timeval t, void *private)
 304 {
 305         struct smbcli_transport *transport = talloc_get_type(private,
 306                                                              struct smbcli_transport);
 307         struct timeval next = timeval_add(&t, 0, transport->idle.period);
 308         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 309                                                       transport,
 310                                                       next,
 311                                                       idle_handler, transport);
 312         transport->idle.func(transport, transport->idle.private);
 313 }
 314
 315 /*
 316   setup the idle handler for a transport
 317   the period is in microseconds
 318 */
 319 void smbcli_transport_idle_handler(struct smbcli_transport *transport,
 320                                    void (*idle_func)(struct smbcli_transport *, void *),
 321                                    uint64_t period,
 322                                    void *private)
 323 {
 324         transport->idle.func = idle_func;
 325         transport->idle.private = private;
 326         transport->idle.period = period;
 327
 328         if (transport->socket->event.te != NULL) {
 329                 talloc_free(transport->socket->event.te);
 330         }
 331
 332         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 333                                                       transport,
 334                                                       timeval_current_ofs(0, period),
 335                                                       idle_handler, transport);
 336 }
 337
 338 /*
 339   we have a full request in our receive buffer - match it to a pending request
 340   and process
 341  */
 342 static NTSTATUS smbcli_transport_finish_recv(void *private, DATA_BLOB blob)
 343 {
 344         struct smbcli_transport *transport = talloc_get_type(private,
 345                                                              struct smbcli_transport);
 346         uint8_t *buffer, *hdr, *vwv;
 347         int len;
 348         uint16_t wct=0, mid = 0, op = 0;
 349         struct smbcli_request *req;
 350
 351         buffer = blob.data;
 352         len = blob.length;
 353
 354         hdr = buffer+NBT_HDR_SIZE;
 355         vwv = hdr + HDR_VWV;
 356
 357         /* see if it could be an oplock break request */
 358         if (handle_oplock_break(transport, len, hdr, vwv)) {
 359                 talloc_free(buffer);
 360                 return NT_STATUS_OK;
 361         }
 362
 363         /* at this point we need to check for a readbraw reply, as
 364            these can be any length */
 365         if (transport->readbraw_pending) {
 366                 transport->readbraw_pending = 0;
 367
 368                 /* it must match the first entry in the pending queue
 369                    as the client is not allowed to have outstanding
 370                    readbraw requests */
 371                 req = transport->pending_recv;
 372                 if (!req) goto error;
 373
 374                 req->in.buffer = buffer;
 375                 talloc_steal(req, buffer);
 376                 req->in.size = len;
 377                 req->in.allocated = req->in.size;
 378                 goto async;
 379         }
 380
 381         if (len >= MIN_SMB_SIZE) {
 382                 /* extract the mid for matching to pending requests */
 383                 mid = SVAL(hdr, HDR_MID);
 384                 wct = CVAL(hdr, HDR_WCT);
 385                 op  = CVAL(hdr, HDR_COM);
 386         }
 387
 388         /* match the incoming request against the list of pending requests */
 389         for (req=transport->pending_recv; req; req=req->next) {
 390                 if (req->mid == mid) break;
 391         }
 392
 393         if (!req) {
 394                 DEBUG(1,("Discarding unmatched reply with mid %d op %d\n", mid, op));
 395                 goto error;
 396         }
 397
 398         /* fill in the 'in' portion of the matching request */
 399         req->in.buffer = buffer;
 400         talloc_steal(req, buffer);
 401         req->in.size = len;
 402         req->in.allocated = req->in.size;
 403
 404         /* handle NBT session replies */
 405         if (req->in.size >= 4 && req->in.buffer[0] != 0) {
 406                 req->status = NT_STATUS_OK;
 407                 goto async;
 408         }
 409
 410         /* handle non-SMB replies */
 411         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
 412                 req->state = SMBCLI_REQUEST_ERROR;
 413                 goto error;
 414         }
 415
 416         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 417                 DEBUG(2,("bad reply size for mid %d\n", mid));
 418                 req->status = NT_STATUS_UNSUCCESSFUL;
 419                 req->state = SMBCLI_REQUEST_ERROR;
 420                 goto error;
 421         }
 422
 423         req->in.hdr = hdr;
 424         req->in.vwv = vwv;
 425         req->in.wct = wct;
 426         if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 427                 req->in.data = req->in.vwv + VWV(wct) + 2;
 428                 req->in.data_size = SVAL(req->in.vwv, VWV(wct));
 429                 if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
 430                         DEBUG(3,("bad data size for mid %d\n", mid));
 431                         /* blergh - w2k3 gives a bogus data size values in some
 432                            openX replies */
 433                         req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
 434                 }
 435         }
 436         req->in.ptr = req->in.data;
 437         req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
 438
 439         if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 440                 int class = CVAL(req->in.hdr,HDR_RCLS);
 441                 int code = SVAL(req->in.hdr,HDR_ERR);
 442                 if (class == 0 && code == 0) {
 443                         transport->error.e.nt_status = NT_STATUS_OK;
 444                 } else {
 445                         transport->error.e.nt_status = NT_STATUS_DOS(class, code);
 446                 }
 447         } else {
 448                 transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
 449         }
 450
 451         req->status = transport->error.e.nt_status;
 452         if (NT_STATUS_IS_OK(req->status)) {
 453                 transport->error.etype = ETYPE_NONE;
 454         } else {
 455                 transport->error.etype = ETYPE_SMB;
 456         }
 457
 458         if (!smbcli_request_check_sign_mac(req)) {
 459                 transport->error.etype = ETYPE_SOCKET;
 460                 transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
 461                 req->state = SMBCLI_REQUEST_ERROR;
 462                 req->status = NT_STATUS_ACCESS_DENIED;
 463                 goto error;
 464         };
 465
 466 async:
 467         /* if this request has an async handler then call that to
 468            notify that the reply has been received. This might destroy
 469            the request so it must happen last */
 470         DLIST_REMOVE(transport->pending_recv, req);
 471         req->state = SMBCLI_REQUEST_DONE;
 472         if (req->async.fn) {
 473                 req->async.fn(req);
 474         }
 475         return NT_STATUS_OK;
 476
 477 error:
 478         if (req) {
 479                 DLIST_REMOVE(transport->pending_recv, req);
 480                 req->state = SMBCLI_REQUEST_ERROR;
 481         }
 482         return NT_STATUS_OK;
 483 }
 484
 485 /*
 486   process some read/write requests that are pending
 487   return False if the socket is dead
 488 */
 489 BOOL smbcli_transport_process(struct smbcli_transport *transport)
 490 {
 491         NTSTATUS status;
 492         size_t npending;
 493
 494         packet_queue_run(transport->packet);
 495         if (transport->socket->sock == NULL) {
 496                 return False;
 497         }
 498
 499         status = socket_pending(transport->socket->sock, &npending);
 500         if (NT_STATUS_IS_OK(status) && npending > 0) {
 501                 packet_recv(transport->packet);
 502         }
 503         if (transport->socket->sock == NULL) {
 504                 return False;
 505         }
 506         return True;
 507 }
 508
 509 /*
 510   handle timeouts of individual smb requests
 511 */
 512 static void smbcli_timeout_handler(struct event_context *ev, struct timed_event *te,
 513                                    struct timeval t, void *private)
 514 {
 515         struct smbcli_request *req = talloc_get_type(private, struct smbcli_request);
 516
 517         if (req->state == SMBCLI_REQUEST_SEND) {
 518                 DLIST_REMOVE(req->transport->pending_send, req);
 519         }
 520         if (req->state == SMBCLI_REQUEST_RECV) {
 521                 DLIST_REMOVE(req->transport->pending_recv, req);
 522         }
 523         req->status = NT_STATUS_IO_TIMEOUT;
 524         req->state = SMBCLI_REQUEST_ERROR;
 525         if (req->async.fn) {
 526                 req->async.fn(req);
 527         }
 528 }
 529
 530
 531 /*
 532   destroy a request
 533 */
 534 static int smbcli_request_destructor(void *ptr)
 535 {
 536         struct smbcli_request *req = talloc_get_type(ptr, struct smbcli_request);
 537         if (req->state == SMBCLI_REQUEST_SEND) {
 538                 DLIST_REMOVE(req->transport->pending_send, req);
 539         }
 540         if (req->state == SMBCLI_REQUEST_RECV) {
 541                 DLIST_REMOVE(req->transport->pending_recv, req);
 542         }
 543         return 0;
 544 }
 545
 546
 547 /*
 548   put a request into the send queue
 549 */
 550 void smbcli_transport_send(struct smbcli_request *req)
 551 {
 552         DATA_BLOB blob;
 553         NTSTATUS status;
 554
 555         /* check if the transport is dead */
 556         if (req->transport->socket->sock == NULL) {
 557                 req->state = SMBCLI_REQUEST_ERROR;
 558                 req->status = NT_STATUS_NET_WRITE_FAULT;
 559                 return;
 560         }
 561
 562         /* put it on the socket queue */
 563         blob = data_blob_const(req->out.buffer, req->out.size);
 564         status = packet_send(req->transport->packet, blob);
 565         if (!NT_STATUS_IS_OK(status)) {
 566                 req->state = SMBCLI_REQUEST_ERROR;
 567                 req->status = status;
 568                 return;
 569         }
 570
 571         if (req->one_way_request) {
 572                 req->state = SMBCLI_REQUEST_DONE;
 573                 smbcli_request_destroy(req);
 574                 return;
 575         }
 576
 577         req->state = SMBCLI_REQUEST_RECV;
 578         DLIST_ADD(req->transport->pending_recv, req);
 579
 580         /* add a timeout */
 581         if (req->transport->options.request_timeout) {
 582                 event_add_timed(req->transport->socket->event.ctx, req,
 583                                 timeval_current_ofs(req->transport->options.request_timeout, 0),
 584                                 smbcli_timeout_handler, req);
 585         }
 586
 587         talloc_set_destructor(req, smbcli_request_destructor);
 588 }