561b6e528eb60ddfb16dda2df3378c28875a330c
[kai/samba.git] / source4 / libcli / smb2 / transport.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    SMB2 client transport context management functions
5
6    Copyright (C) Andrew Tridgell 2005
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libcli/raw/libcliraw.h"
24 #include "libcli/raw/raw_proto.h"
25 #include "libcli/smb2/smb2.h"
26 #include "libcli/smb2/smb2_calls.h"
27 #include "lib/socket/socket.h"
28 #include "lib/events/events.h"
29 #include "lib/stream/packet.h"
30 #include "lib/util/dlinklist.h"
31
32
33 /*
34   an event has happened on the socket
35 */
36 static void smb2_transport_event_handler(struct event_context *ev, 
37                                          struct fd_event *fde, 
38                                          uint16_t flags, void *private)
39 {
40         struct smb2_transport *transport = talloc_get_type(private,
41                                                            struct smb2_transport);
42         if (flags & EVENT_FD_READ) {
43                 packet_recv(transport->packet);
44                 return;
45         }
46         if (flags & EVENT_FD_WRITE) {
47                 packet_queue_run(transport->packet);
48         }
49 }
50
51 /*
52   destroy a transport
53  */
54 static int transport_destructor(struct smb2_transport *transport)
55 {
56         smb2_transport_dead(transport, NT_STATUS_LOCAL_DISCONNECT);
57         return 0;
58 }
59
60
61 /*
62   handle receive errors
63 */
64 static void smb2_transport_error(void *private, NTSTATUS status)
65 {
66         struct smb2_transport *transport = talloc_get_type(private, 
67                                                            struct smb2_transport);
68         smb2_transport_dead(transport, status);
69 }
70
71 static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob);
72
73 /*
74   create a transport structure based on an established socket
75 */
76 struct smb2_transport *smb2_transport_init(struct smbcli_socket *sock,
77                                            TALLOC_CTX *parent_ctx,
78                                            struct smbcli_options *options)
79 {
80         struct smb2_transport *transport;
81
82         transport = talloc_zero(parent_ctx, struct smb2_transport);
83         if (!transport) return NULL;
84
85         transport->socket = talloc_steal(transport, sock);
86         transport->options = *options;
87
88         /* setup the stream -> packet parser */
89         transport->packet = packet_init(transport);
90         if (transport->packet == NULL) {
91                 talloc_free(transport);
92                 return NULL;
93         }
94         packet_set_private(transport->packet, transport);
95         packet_set_socket(transport->packet, transport->socket->sock);
96         packet_set_callback(transport->packet, smb2_transport_finish_recv);
97         packet_set_full_request(transport->packet, packet_full_request_nbt);
98         packet_set_error_handler(transport->packet, smb2_transport_error);
99         packet_set_event_context(transport->packet, transport->socket->event.ctx);
100         packet_set_nofree(transport->packet);
101
102         /* take over event handling from the socket layer - it only
103            handles events up until we are connected */
104         talloc_free(transport->socket->event.fde);
105         transport->socket->event.fde = event_add_fd(transport->socket->event.ctx,
106                                                     transport->socket,
107                                                     socket_get_fd(transport->socket->sock),
108                                                     EVENT_FD_READ,
109                                                     smb2_transport_event_handler,
110                                                     transport);
111
112         packet_set_fde(transport->packet, transport->socket->event.fde);
113         packet_set_serialise(transport->packet);
114
115         talloc_set_destructor(transport, transport_destructor);
116
117         return transport;
118 }
119
120 /*
121   mark the transport as dead
122 */
123 void smb2_transport_dead(struct smb2_transport *transport, NTSTATUS status)
124 {
125         smbcli_sock_dead(transport->socket);
126
127         if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL, status)) {
128                 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
129         }
130
131         /* kill all pending receives */
132         while (transport->pending_recv) {
133                 struct smb2_request *req = transport->pending_recv;
134                 req->state = SMB2_REQUEST_ERROR;
135                 req->status = status;
136                 DLIST_REMOVE(transport->pending_recv, req);
137                 if (req->async.fn) {
138                         req->async.fn(req);
139                 }
140         }
141 }
142
143 static NTSTATUS smb2_handle_oplock_break(struct smb2_transport *transport,
144                                          const DATA_BLOB *blob)
145 {
146         uint8_t *hdr;
147         uint16_t opcode;
148
149         hdr = blob->data+NBT_HDR_SIZE;
150
151         if (blob->length < (SMB2_MIN_SIZE+0x18)) {
152                 DEBUG(1,("Discarding smb2 oplock reply of size %u\n",
153                          (unsigned)blob->length));
154                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
155         }
156
157         opcode  = SVAL(hdr, SMB2_HDR_OPCODE);
158
159         if (opcode != SMB2_OP_BREAK) {
160                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
161         }
162
163         if (transport->oplock.handler) {
164                 uint8_t *body = hdr+SMB2_HDR_BODY;
165                 struct smb2_handle h;
166                 uint8_t level;
167
168                 level = CVAL(body, 0x02);
169                 smb2_pull_handle(body+0x08, &h);
170
171                 transport->oplock.handler(transport, &h, level,
172                                           transport->oplock.private_data);
173         } else {
174                 DEBUG(5,("Got SMB2 oplock break with no handler\n"));
175         }
176
177         return NT_STATUS_OK;
178 }
179
180 /*
181   we have a full request in our receive buffer - match it to a pending request
182   and process
183  */
184 static NTSTATUS smb2_transport_finish_recv(void *private, DATA_BLOB blob)
185 {
186         struct smb2_transport *transport = talloc_get_type(private, 
187                                                              struct smb2_transport);
188         uint8_t *buffer, *hdr;
189         int len;
190         struct smb2_request *req = NULL;
191         uint64_t seqnum;
192         uint32_t flags;
193         uint16_t buffer_code;
194         uint32_t dynamic_size;
195         uint32_t i;
196         NTSTATUS status;
197
198         buffer = blob.data;
199         len = blob.length;
200
201         hdr = buffer+NBT_HDR_SIZE;
202
203         if (len < SMB2_MIN_SIZE) {
204                 DEBUG(1,("Discarding smb2 reply of size %d\n", len));
205                 goto error;
206         }
207
208         status = smb2_check_signature(transport, buffer, len);
209         if (!NT_STATUS_IS_OK(status)) {
210                 talloc_free(buffer);
211                 return status;
212         }
213         
214         flags   = IVAL(hdr, SMB2_HDR_FLAGS);
215         seqnum  = BVAL(hdr, SMB2_HDR_MESSAGE_ID);
216
217         /* see MS-SMB2 3.2.5.19 */
218         if (seqnum == UINT64_MAX) {
219                 return smb2_handle_oplock_break(transport, &blob);
220         }
221
222         /* match the incoming request against the list of pending requests */
223         for (req=transport->pending_recv; req; req=req->next) {
224                 if (req->seqnum == seqnum) break;
225         }
226
227         if (!req) {
228                 DEBUG(1,("Discarding unmatched reply with seqnum 0x%llx op %d\n", 
229                          (long long)seqnum, SVAL(hdr, SMB2_HDR_OPCODE)));
230                 goto error;
231         }
232
233         /* fill in the 'in' portion of the matching request */
234         req->in.buffer = buffer;
235         talloc_steal(req, buffer);
236         req->in.size = len;
237         req->in.allocated = req->in.size;
238
239         req->in.hdr       = hdr;
240         req->in.body      = hdr+SMB2_HDR_BODY;
241         req->in.body_size = req->in.size - (SMB2_HDR_BODY+NBT_HDR_SIZE);
242         req->status       = NT_STATUS(IVAL(hdr, SMB2_HDR_STATUS));
243
244         if (NT_STATUS_EQUAL(req->status, STATUS_PENDING)) {
245                 if (flags & 0x00000002) {
246                         req->cancel.can_cancel = true;
247                         req->cancel.pending_id = IVAL(hdr, SMB2_HDR_PID);
248                         for (i=0; i< req->cancel.do_cancel; i++) {
249                                 smb2_cancel(req);
250                         }
251                 }
252                 talloc_free(buffer);
253                 return NT_STATUS_OK;
254         }
255
256         buffer_code = SVAL(req->in.body, 0);
257         req->in.body_fixed = (buffer_code & ~1);
258         req->in.dynamic = NULL;
259         dynamic_size = req->in.body_size - req->in.body_fixed;
260         if (dynamic_size != 0 && (buffer_code & 1)) {
261                 req->in.dynamic = req->in.body + req->in.body_fixed;
262                 if (smb2_oob(&req->in, req->in.dynamic, dynamic_size)) {
263                         DEBUG(1,("SMB2 request invalid dynamic size 0x%x\n", 
264                                  dynamic_size));
265                         goto error;
266                 }
267         }
268
269         smb2_setup_bufinfo(req);
270
271         DEBUG(2, ("SMB2 RECV seqnum=0x%llx\n", (long long)req->seqnum));
272         dump_data(5, req->in.body, req->in.body_size);
273
274         /* if this request has an async handler then call that to
275            notify that the reply has been received. This might destroy
276            the request so it must happen last */
277         DLIST_REMOVE(transport->pending_recv, req);
278         req->state = SMB2_REQUEST_DONE;
279         if (req->async.fn) {
280                 req->async.fn(req);
281         }
282         return NT_STATUS_OK;
283
284 error:
285         dump_data(5, buffer, len);
286         if (req) {
287                 DLIST_REMOVE(transport->pending_recv, req);
288                 req->state = SMB2_REQUEST_ERROR;
289                 if (req->async.fn) {
290                         req->async.fn(req);
291                 }
292         } else {
293                 talloc_free(buffer);
294         }
295         return NT_STATUS_UNSUCCESSFUL;
296 }
297
298 /*
299   handle timeouts of individual smb requests
300 */
301 static void smb2_timeout_handler(struct event_context *ev, struct timed_event *te, 
302                                  struct timeval t, void *private)
303 {
304         struct smb2_request *req = talloc_get_type(private, struct smb2_request);
305
306         if (req->state == SMB2_REQUEST_RECV) {
307                 DLIST_REMOVE(req->transport->pending_recv, req);
308         }
309         req->status = NT_STATUS_IO_TIMEOUT;
310         req->state = SMB2_REQUEST_ERROR;
311         if (req->async.fn) {
312                 req->async.fn(req);
313         }
314 }
315
316
317 /*
318   destroy a request
319 */
320 static int smb2_request_destructor(struct smb2_request *req)
321 {
322         if (req->state == SMB2_REQUEST_RECV) {
323                 DLIST_REMOVE(req->transport->pending_recv, req);
324         }
325         return 0;
326 }
327
328
329 /*
330   put a request into the send queue
331 */
332 void smb2_transport_send(struct smb2_request *req)
333 {
334         DATA_BLOB blob;
335         NTSTATUS status;
336
337         _smb2_setlen(req->out.buffer, req->out.size - NBT_HDR_SIZE);
338
339         DEBUG(2, ("SMB2 send seqnum=0x%llx\n", (long long)req->seqnum));
340         dump_data(5, req->out.body, req->out.body_size);
341
342         /* check if the transport is dead */
343         if (req->transport->socket->sock == NULL) {
344                 req->state = SMB2_REQUEST_ERROR;
345                 req->status = NT_STATUS_NET_WRITE_FAULT;
346                 return;
347         }
348
349         status = smb2_sign_message(req);
350         if (!NT_STATUS_IS_OK(status)) {
351                 req->state = SMB2_REQUEST_ERROR;
352                 req->status = status;
353                 return;
354         }
355         
356         blob = data_blob_const(req->out.buffer, req->out.size);
357         status = packet_send(req->transport->packet, blob);
358         if (!NT_STATUS_IS_OK(status)) {
359                 req->state = SMB2_REQUEST_ERROR;
360                 req->status = status;
361                 return;
362         }
363
364         req->state = SMB2_REQUEST_RECV;
365         DLIST_ADD(req->transport->pending_recv, req);
366
367         /* add a timeout */
368         if (req->transport->options.request_timeout) {
369                 event_add_timed(req->transport->socket->event.ctx, req, 
370                                 timeval_current_ofs(req->transport->options.request_timeout, 0), 
371                                 smb2_timeout_handler, req);
372         }
373
374         talloc_set_destructor(req, smb2_request_destructor);
375 }
376
377 static void idle_handler(struct event_context *ev, 
378                          struct timed_event *te, struct timeval t, void *private)
379 {
380         struct smb2_transport *transport = talloc_get_type(private,
381                                                            struct smb2_transport);
382         struct timeval next = timeval_add(&t, 0, transport->idle.period);
383         transport->socket->event.te = event_add_timed(transport->socket->event.ctx, 
384                                                       transport,
385                                                       next,
386                                                       idle_handler, transport);
387         transport->idle.func(transport, transport->idle.private);
388 }
389
390 /*
391   setup the idle handler for a transport
392   the period is in microseconds
393 */
394 void smb2_transport_idle_handler(struct smb2_transport *transport, 
395                                  void (*idle_func)(struct smb2_transport *, void *),
396                                  uint64_t period,
397                                  void *private)
398 {
399         transport->idle.func = idle_func;
400         transport->idle.private = private;
401         transport->idle.period = period;
402
403         if (transport->socket->event.te != NULL) {
404                 talloc_free(transport->socket->event.te);
405         }
406
407         transport->socket->event.te = event_add_timed(transport->socket->event.ctx, 
408                                                       transport,
409                                                       timeval_current_ofs(0, period),
410                                                       idle_handler, transport);
411 }