source/libcli/raw/clitransport.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB client transport context management functions
   4
   5    Copyright (C) Andrew Tridgell 1994-2005
   6    Copyright (C) James Myers 2003 <myersjj@samba.org>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24 #include "libcli/raw/libcliraw.h"
  25 #include "lib/socket/socket.h"
  26 #include "dlinklist.h"
  27 #include "lib/events/events.h"
  28
  29
  30 static void smbcli_transport_process_recv(struct smbcli_transport *transport);
  31 static void smbcli_transport_process_send(struct smbcli_transport *transport);
  32
  33 /*
  34   an event has happened on the socket
  35 */
  36 static void smbcli_transport_event_handler(struct event_context *ev,
  37                                            struct fd_event *fde,
  38                                            uint16_t flags, void *private)
  39 {
  40         struct smbcli_transport *transport = talloc_get_type(private,
  41                                                              struct smbcli_transport);
  42         if (flags & EVENT_FD_READ) {
  43                 smbcli_transport_process_recv(transport);
  44                 return;
  45         }
  46         if (flags & EVENT_FD_WRITE) {
  47                 smbcli_transport_process_send(transport);
  48         }
  49 }
  50
  51 /*
  52   destroy a transport
  53  */
  54 static int transport_destructor(void *ptr)
  55 {
  56         struct smbcli_transport *transport = ptr;
  57
  58         smbcli_transport_dead(transport);
  59         return 0;
  60 }
  61
  62 /*
  63   create a transport structure based on an established socket
  64 */
  65 struct smbcli_transport *smbcli_transport_init(struct smbcli_socket *sock,
  66                                                TALLOC_CTX *parent_ctx, BOOL primary)
  67 {
  68         struct smbcli_transport *transport;
  69
  70         transport = talloc_zero(parent_ctx, struct smbcli_transport);
  71         if (!transport) return NULL;
  72
  73         if (primary) {
  74                 transport->socket = talloc_steal(transport, sock);
  75         } else {
  76                 transport->socket = talloc_reference(transport, sock);
  77         }
  78         transport->negotiate.protocol = PROTOCOL_NT1;
  79         transport->options.use_spnego = lp_use_spnego() && lp_nt_status_support();
  80         transport->options.max_xmit = lp_max_xmit();
  81         transport->options.max_mux = lp_maxmux();
  82         transport->options.request_timeout = SMB_REQUEST_TIMEOUT;
  83
  84         transport->negotiate.max_xmit = transport->options.max_xmit;
  85
  86         smbcli_init_signing(transport);
  87
  88         ZERO_STRUCT(transport->called);
  89
  90         /* take over event handling from the socket layer - it only
  91            handles events up until we are connected */
  92         talloc_free(transport->socket->event.fde);
  93         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
  94                                                     transport->socket,
  95                                                     socket_get_fd(transport->socket->sock),
  96                                                     EVENT_FD_READ,
  97                                                     smbcli_transport_event_handler,
  98                                                     transport);
  99
 100         talloc_set_destructor(transport, transport_destructor);
 101
 102         return transport;
 103 }
 104
 105 /*
 106   mark the transport as dead
 107 */
 108 void smbcli_transport_dead(struct smbcli_transport *transport)
 109 {
 110         smbcli_sock_dead(transport->socket);
 111
 112         /* all pending sends become errors */
 113         while (transport->pending_send) {
 114                 struct smbcli_request *req = transport->pending_send;
 115                 req->state = SMBCLI_REQUEST_ERROR;
 116                 req->status = NT_STATUS_NET_WRITE_FAULT;
 117                 DLIST_REMOVE(transport->pending_send, req);
 118                 if (req->async.fn) {
 119                         req->async.fn(req);
 120                 }
 121         }
 122
 123         /* as do all pending receives */
 124         while (transport->pending_recv) {
 125                 struct smbcli_request *req = transport->pending_recv;
 126                 req->state = SMBCLI_REQUEST_ERROR;
 127                 req->status = NT_STATUS_NET_WRITE_FAULT;
 128                 DLIST_REMOVE(transport->pending_recv, req);
 129                 if (req->async.fn) {
 130                         req->async.fn(req);
 131                 }
 132         }
 133 }
 134
 135
 136 /*
 137   enable select for write on a transport
 138 */
 139 static void smbcli_transport_write_enable(struct smbcli_transport *transport)
 140 {
 141         struct fd_event *fde = transport->socket->event.fde;
 142         EVENT_FD_WRITEABLE(fde);
 143 }
 144
 145 /*
 146   disable select for write on a transport
 147 */
 148 static void smbcli_transport_write_disable(struct smbcli_transport *transport)
 149 {
 150         struct fd_event *fde = transport->socket->event.fde;
 151         EVENT_FD_NOT_WRITEABLE(fde);
 152 }
 153
 154 /*
 155   send a session request
 156 */
 157 struct smbcli_request *smbcli_transport_connect_send(struct smbcli_transport *transport,
 158                                                      struct nbt_name *calling,
 159                                                      struct nbt_name *called)
 160 {
 161         uint8_t *p;
 162         struct smbcli_request *req;
 163         DATA_BLOB calling_blob, called_blob;
 164         TALLOC_CTX *tmp_ctx = talloc_new(transport);
 165         NTSTATUS status;
 166
 167         status = nbt_name_dup(transport, called, &transport->called);
 168         if (!NT_STATUS_IS_OK(status)) goto failed;
 169
 170         status = nbt_name_to_blob(tmp_ctx, &calling_blob, calling);
 171         if (!NT_STATUS_IS_OK(status)) goto failed;
 172
 173         status = nbt_name_to_blob(tmp_ctx, &called_blob, called);
 174         if (!NT_STATUS_IS_OK(status)) goto failed;
 175
 176         /* allocate output buffer */
 177         req = smbcli_request_setup_nonsmb(transport,
 178                                           NBT_HDR_SIZE +
 179                                           calling_blob.length + called_blob.length);
 180         if (req == NULL) goto failed;
 181
 182         /* put in the destination name */
 183         p = req->out.buffer + NBT_HDR_SIZE;
 184         memcpy(p, called_blob.data, called_blob.length);
 185         p += called_blob.length;
 186
 187         memcpy(p, calling_blob.data, calling_blob.length);
 188         p += calling_blob.length;
 189
 190         _smb_setlen(req->out.buffer, PTR_DIFF(p, req->out.buffer)-4);
 191         SCVAL(req->out.buffer,0,0x81);
 192
 193         if (!smbcli_request_send(req)) {
 194                 smbcli_request_destroy(req);
 195                 goto failed;
 196         }
 197
 198         talloc_free(tmp_ctx);
 199         return req;
 200
 201 failed:
 202         talloc_free(tmp_ctx);
 203         return NULL;
 204 }
 205
 206 /*
 207   map a session request error to a NTSTATUS
 208  */
 209 static NTSTATUS map_session_refused_error(uint8_t error)
 210 {
 211         switch (error) {
 212         case 0x80:
 213         case 0x81:
 214                 return NT_STATUS_REMOTE_NOT_LISTENING;
 215         case 0x82:
 216                 return NT_STATUS_RESOURCE_NAME_NOT_FOUND;
 217         case 0x83:
 218                 return NT_STATUS_REMOTE_RESOURCES;
 219         }
 220         return NT_STATUS_UNEXPECTED_IO_ERROR;
 221 }
 222
 223
 224 /*
 225   finish a smbcli_transport_connect()
 226 */
 227 NTSTATUS smbcli_transport_connect_recv(struct smbcli_request *req)
 228 {
 229         NTSTATUS status;
 230
 231         if (!smbcli_request_receive(req)) {
 232                 smbcli_request_destroy(req);
 233                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
 234         }
 235
 236         switch (CVAL(req->in.buffer,0)) {
 237         case 0x82:
 238                 status = NT_STATUS_OK;
 239                 break;
 240         case 0x83:
 241                 status = map_session_refused_error(CVAL(req->in.buffer,4));
 242                 break;
 243         case 0x84:
 244                 DEBUG(1,("Warning: session retarget not supported\n"));
 245                 status = NT_STATUS_NOT_SUPPORTED;
 246                 break;
 247         default:
 248                 status = NT_STATUS_UNEXPECTED_IO_ERROR;
 249                 break;
 250         }
 251
 252         smbcli_request_destroy(req);
 253         return status;
 254 }
 255
 256
 257 /*
 258   send a session request (if needed)
 259 */
 260 BOOL smbcli_transport_connect(struct smbcli_transport *transport,
 261                               struct nbt_name *calling,
 262                               struct nbt_name *called)
 263 {
 264         struct smbcli_request *req;
 265         NTSTATUS status;
 266
 267         if (transport->socket->port == 445) {
 268                 return True;
 269         }
 270
 271         req = smbcli_transport_connect_send(transport,
 272                                             calling, called);
 273         status = smbcli_transport_connect_recv(req);
 274         return NT_STATUS_IS_OK(status);
 275 }
 276
 277 /****************************************************************************
 278 get next mid in sequence
 279 ****************************************************************************/
 280 uint16_t smbcli_transport_next_mid(struct smbcli_transport *transport)
 281 {
 282         uint16_t mid;
 283         struct smbcli_request *req;
 284
 285         mid = transport->next_mid;
 286
 287 again:
 288         /* now check to see if this mid is being used by one of the
 289            pending requests. This is quite efficient because the list is
 290            usually very short */
 291
 292         /* the zero mid is reserved for requests that don't have a mid */
 293         if (mid == 0) mid = 1;
 294
 295         for (req=transport->pending_recv; req; req=req->next) {
 296                 if (req->mid == mid) {
 297                         mid++;
 298                         goto again;
 299                 }
 300         }
 301
 302         transport->next_mid = mid+1;
 303         return mid;
 304 }
 305
 306 static void idle_handler(struct event_context *ev,
 307                          struct timed_event *te, struct timeval t, void *private)
 308 {
 309         struct smbcli_transport *transport = talloc_get_type(private,
 310                                                              struct smbcli_transport);
 311         struct timeval next = timeval_add(&t, 0, transport->idle.period);
 312         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 313                                                       transport,
 314                                                       next,
 315                                                       idle_handler, transport);
 316         transport->idle.func(transport, transport->idle.private);
 317 }
 318
 319 /*
 320   setup the idle handler for a transport
 321   the period is in microseconds
 322 */
 323 void smbcli_transport_idle_handler(struct smbcli_transport *transport,
 324                                    void (*idle_func)(struct smbcli_transport *, void *),
 325                                    uint64_t period,
 326                                    void *private)
 327 {
 328         transport->idle.func = idle_func;
 329         transport->idle.private = private;
 330         transport->idle.period = period;
 331
 332         if (transport->socket->event.te != NULL) {
 333                 talloc_free(transport->socket->event.te);
 334         }
 335
 336         transport->socket->event.te = event_add_timed(transport->socket->event.ctx,
 337                                                       transport,
 338                                                       timeval_current_ofs(0, period),
 339                                                       idle_handler, transport);
 340 }
 341
 342 /*
 343   process some pending sends
 344 */
 345 static void smbcli_transport_process_send(struct smbcli_transport *transport)
 346 {
 347         while (transport->pending_send) {
 348                 struct smbcli_request *req = transport->pending_send;
 349                 NTSTATUS status;
 350                 size_t nwritten;
 351
 352                 status = smbcli_sock_write(transport->socket, req->out.buffer,
 353                                            req->out.size, &nwritten);
 354                 if (NT_STATUS_IS_ERR(status)) {
 355                         smbcli_transport_dead(transport);
 356                 }
 357                 if (!NT_STATUS_IS_OK(status)) {
 358                         return;
 359                 }
 360                 req->out.buffer += nwritten;
 361                 req->out.size -= nwritten;
 362                 if (req->out.size == 0) {
 363                         DLIST_REMOVE(transport->pending_send, req);
 364                         if (req->one_way_request) {
 365                                 req->state = SMBCLI_REQUEST_DONE;
 366                                 smbcli_request_destroy(req);
 367                         } else {
 368                                 req->state = SMBCLI_REQUEST_RECV;
 369                                 DLIST_ADD(transport->pending_recv, req);
 370                         }
 371                 }
 372         }
 373
 374         /* we're out of requests to send, so don't wait for write
 375            events any more */
 376         smbcli_transport_write_disable(transport);
 377 }
 378
 379 /*
 380   we have a full request in our receive buffer - match it to a pending request
 381   and process
 382  */
 383 static void smbcli_transport_finish_recv(struct smbcli_transport *transport)
 384 {
 385         uint8_t *buffer, *hdr, *vwv;
 386         int len;
 387         uint16_t wct=0, mid = 0;
 388         struct smbcli_request *req;
 389
 390         buffer = transport->recv_buffer.buffer;
 391         len = transport->recv_buffer.req_size;
 392
 393         ZERO_STRUCT(transport->recv_buffer);
 394
 395         hdr = buffer+NBT_HDR_SIZE;
 396         vwv = hdr + HDR_VWV;
 397
 398         /* see if it could be an oplock break request */
 399         if (handle_oplock_break(transport, len, hdr, vwv)) {
 400                 talloc_free(buffer);
 401                 return;
 402         }
 403
 404         /* at this point we need to check for a readbraw reply, as
 405            these can be any length */
 406         if (transport->readbraw_pending) {
 407                 transport->readbraw_pending = 0;
 408
 409                 /* it must match the first entry in the pending queue
 410                    as the client is not allowed to have outstanding
 411                    readbraw requests */
 412                 req = transport->pending_recv;
 413                 if (!req) goto error;
 414
 415                 req->in.buffer = buffer;
 416                 talloc_steal(req, buffer);
 417                 req->in.size = len;
 418                 req->in.allocated = req->in.size;
 419                 goto async;
 420         }
 421
 422         if (len >= MIN_SMB_SIZE) {
 423                 /* extract the mid for matching to pending requests */
 424                 mid = SVAL(hdr, HDR_MID);
 425                 wct = CVAL(hdr, HDR_WCT);
 426         }
 427
 428         /* match the incoming request against the list of pending requests */
 429         for (req=transport->pending_recv; req; req=req->next) {
 430                 if (req->mid == mid) break;
 431         }
 432
 433         if (!req) {
 434                 DEBUG(1,("Discarding unmatched reply with mid %d op %d\n",
 435                          mid, CVAL(hdr, HDR_COM)));
 436                 goto error;
 437         }
 438
 439         /* fill in the 'in' portion of the matching request */
 440         req->in.buffer = buffer;
 441         talloc_steal(req, buffer);
 442         req->in.size = len;
 443         req->in.allocated = req->in.size;
 444
 445         /* handle NBT session replies */
 446         if (req->in.size >= 4 && req->in.buffer[0] != 0) {
 447                 req->status = NT_STATUS_OK;
 448                 goto async;
 449         }
 450
 451         /* handle non-SMB replies */
 452         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE) {
 453                 req->state = SMBCLI_REQUEST_ERROR;
 454                 goto error;
 455         }
 456
 457         if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 458                 DEBUG(2,("bad reply size for mid %d\n", mid));
 459                 req->status = NT_STATUS_UNSUCCESSFUL;
 460                 req->state = SMBCLI_REQUEST_ERROR;
 461                 goto error;
 462         }
 463
 464         req->in.hdr = hdr;
 465         req->in.vwv = vwv;
 466         req->in.wct = wct;
 467         if (req->in.size >= NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct)) {
 468                 req->in.data = req->in.vwv + VWV(wct) + 2;
 469                 req->in.data_size = SVAL(req->in.vwv, VWV(wct));
 470                 if (req->in.size < NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct) + req->in.data_size) {
 471                         DEBUG(3,("bad data size for mid %d\n", mid));
 472                         /* blergh - w2k3 gives a bogus data size values in some
 473                            openX replies */
 474                         req->in.data_size = req->in.size - (NBT_HDR_SIZE + MIN_SMB_SIZE + VWV(wct));
 475                 }
 476         }
 477         req->in.ptr = req->in.data;
 478         req->flags2 = SVAL(req->in.hdr, HDR_FLG2);
 479
 480         if (!(req->flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
 481                 int class = CVAL(req->in.hdr,HDR_RCLS);
 482                 int code = SVAL(req->in.hdr,HDR_ERR);
 483                 if (class == 0 && code == 0) {
 484                         transport->error.e.nt_status = NT_STATUS_OK;
 485                 } else {
 486                         transport->error.e.nt_status = NT_STATUS_DOS(class, code);
 487                 }
 488         } else {
 489                 transport->error.e.nt_status = NT_STATUS(IVAL(req->in.hdr, HDR_RCLS));
 490         }
 491
 492         req->status = transport->error.e.nt_status;
 493         if (NT_STATUS_IS_OK(req->status)) {
 494                 transport->error.etype = ETYPE_NONE;
 495         } else {
 496                 transport->error.etype = ETYPE_SMB;
 497         }
 498
 499         if (!smbcli_request_check_sign_mac(req)) {
 500                 transport->error.etype = ETYPE_SOCKET;
 501                 transport->error.e.socket_error = SOCKET_READ_BAD_SIG;
 502                 req->state = SMBCLI_REQUEST_ERROR;
 503                 req->status = NT_STATUS_ACCESS_DENIED;
 504                 goto error;
 505         };
 506
 507 async:
 508         /* if this request has an async handler then call that to
 509            notify that the reply has been received. This might destroy
 510            the request so it must happen last */
 511         DLIST_REMOVE(transport->pending_recv, req);
 512         req->state = SMBCLI_REQUEST_DONE;
 513         if (req->async.fn) {
 514                 req->async.fn(req);
 515         }
 516         return;
 517
 518 error:
 519         if (req) {
 520                 DLIST_REMOVE(transport->pending_recv, req);
 521                 req->state = SMBCLI_REQUEST_ERROR;
 522         }
 523 }
 524
 525 /*
 526   process some pending receives
 527 */
 528 static void smbcli_transport_process_recv(struct smbcli_transport *transport)
 529 {
 530         /* a incoming packet goes through 2 stages - first we read the
 531            4 byte header, which tells us how much more is coming. Then
 532            we read the rest */
 533         if (transport->recv_buffer.received < NBT_HDR_SIZE) {
 534                 NTSTATUS status;
 535                 size_t nread;
 536                 status = smbcli_sock_read(transport->socket,
 537                                           transport->recv_buffer.header +
 538                                           transport->recv_buffer.received,
 539                                           NBT_HDR_SIZE - transport->recv_buffer.received,
 540                                           &nread);
 541                 if (NT_STATUS_IS_ERR(status)) {
 542                         smbcli_transport_dead(transport);
 543                 }
 544                 if (!NT_STATUS_IS_OK(status)) {
 545                         return;
 546                 }
 547
 548                 transport->recv_buffer.received += nread;
 549
 550                 if (transport->recv_buffer.received == NBT_HDR_SIZE) {
 551                         /* we've got a full header */
 552                         transport->recv_buffer.req_size = smb_len(transport->recv_buffer.header) + NBT_HDR_SIZE;
 553                         transport->recv_buffer.buffer = talloc_size(transport,
 554                                                                     NBT_HDR_SIZE+transport->recv_buffer.req_size);
 555                         if (transport->recv_buffer.buffer == NULL) {
 556                                 smbcli_transport_dead(transport);
 557                                 return;
 558                         }
 559                         memcpy(transport->recv_buffer.buffer, transport->recv_buffer.header, NBT_HDR_SIZE);
 560                 }
 561         }
 562
 563         if (transport->recv_buffer.received < transport->recv_buffer.req_size) {
 564                 NTSTATUS status;
 565                 size_t nread;
 566                 status = smbcli_sock_read(transport->socket,
 567                                           transport->recv_buffer.buffer +
 568                                           transport->recv_buffer.received,
 569                                           transport->recv_buffer.req_size -
 570                                           transport->recv_buffer.received,
 571                                           &nread);
 572                 if (NT_STATUS_IS_ERR(status)) {
 573                         smbcli_transport_dead(transport);
 574                 }
 575                 if (!NT_STATUS_IS_OK(status)) {
 576                         return;
 577                 }
 578                 transport->recv_buffer.received += nread;
 579         }
 580
 581         if (transport->recv_buffer.received != 0 &&
 582             transport->recv_buffer.received == transport->recv_buffer.req_size) {
 583                 smbcli_transport_finish_recv(transport);
 584         }
 585 }
 586
 587 /*
 588   process some read/write requests that are pending
 589   return False if the socket is dead
 590 */
 591 BOOL smbcli_transport_process(struct smbcli_transport *transport)
 592 {
 593         smbcli_transport_process_send(transport);
 594         smbcli_transport_process_recv(transport);
 595         if (transport->socket->sock == NULL) {
 596                 return False;
 597         }
 598         return True;
 599 }
 600
 601 /*
 602   handle timeouts of individual smb requests
 603 */
 604 static void smbcli_timeout_handler(struct event_context *ev, struct timed_event *te,
 605                                    struct timeval t, void *private)
 606 {
 607         struct smbcli_request *req = talloc_get_type(private, struct smbcli_request);
 608
 609         if (req->state == SMBCLI_REQUEST_SEND) {
 610                 DLIST_REMOVE(req->transport->pending_send, req);
 611         }
 612         if (req->state == SMBCLI_REQUEST_RECV) {
 613                 DLIST_REMOVE(req->transport->pending_recv, req);
 614         }
 615         req->status = NT_STATUS_IO_TIMEOUT;
 616         req->state = SMBCLI_REQUEST_ERROR;
 617         if (req->async.fn) {
 618                 req->async.fn(req);
 619         }
 620 }
 621
 622
 623 /*
 624   destroy a request
 625 */
 626 static int smbcli_request_destructor(void *ptr)
 627 {
 628         struct smbcli_request *req = talloc_get_type(ptr, struct smbcli_request);
 629         if (req->state == SMBCLI_REQUEST_SEND) {
 630                 DLIST_REMOVE(req->transport->pending_send, req);
 631         }
 632         if (req->state == SMBCLI_REQUEST_RECV) {
 633                 DLIST_REMOVE(req->transport->pending_recv, req);
 634         }
 635         return 0;
 636 }
 637
 638
 639 /*
 640   put a request into the send queue
 641 */
 642 void smbcli_transport_send(struct smbcli_request *req)
 643 {
 644         /* check if the transport is dead */
 645         if (req->transport->socket->sock == NULL) {
 646                 req->state = SMBCLI_REQUEST_ERROR;
 647                 req->status = NT_STATUS_NET_WRITE_FAULT;
 648                 return;
 649         }
 650
 651         /* put it on the outgoing socket queue */
 652         req->state = SMBCLI_REQUEST_SEND;
 653         DLIST_ADD_END(req->transport->pending_send, req, struct smbcli_request *);
 654
 655         /* make sure we look for write events */
 656         smbcli_transport_write_enable(req->transport);
 657
 658         /* add a timeout */
 659         if (req->transport->options.request_timeout) {
 660                 event_add_timed(req->transport->socket->event.ctx, req,
 661                                 timeval_current_ofs(req->transport->options.request_timeout, 0),
 662                                 smbcli_timeout_handler, req);
 663         }
 664
 665         talloc_set_destructor(req, smbcli_request_destructor);
 666 }