libcli/nbt/nbtname.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    manipulate nbt name structures
   5
   6    Copyright (C) Andrew Tridgell 2005
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23   see rfc1002 for the detailed format of compressed names
  24 */
  25
  26 #include "includes.h"
  27 #include "librpc/gen_ndr/ndr_nbt.h"
  28 #include "librpc/gen_ndr/ndr_misc.h"
  29 #include "system/locale.h"
  30 #include "lib/util/util_net.h"
  31 #include "libcli/nbt/libnbt.h"
  32
  33 /*
  34   decompress a 'compressed' name component
  35  */
  36 static bool decompress_name(char *name, enum nbt_name_type *type)
  37 {
  38         int i;
  39         for (i=0;name[2*i];i++) {
  40                 uint8_t c1 = name[2*i];
  41                 uint8_t c2 = name[1+(2*i)];
  42                 if (c1 < 'A' || c1 > 'P' ||
  43                     c2 < 'A' || c2 > 'P') {
  44                         return false;
  45                 }
  46                 name[i] = ((c1-'A')<<4) | (c2-'A');
  47         }
  48         name[i] = 0;
  49         if (i == 16) {
  50                 *type = (enum nbt_name_type)(name[15]);
  51                 name[15] = 0;
  52                 i--;
  53         } else {
  54                 *type = NBT_NAME_CLIENT;
  55         }
  56
  57         /* trim trailing spaces */
  58         for (;i>0 && name[i-1]==' ';i--) {
  59                 name[i-1] = 0;
  60         }
  61
  62         return true;
  63 }
  64
  65
  66 /*
  67   compress a name component
  68  */
  69 static uint8_t *compress_name(TALLOC_CTX *mem_ctx,
  70                               const uint8_t *name, enum nbt_name_type type)
  71 {
  72         uint8_t *cname;
  73         int i;
  74         uint8_t pad_char;
  75
  76         if (strlen((const char *)name) > 15) {
  77                 return NULL;
  78         }
  79
  80         cname = talloc_array(mem_ctx, uint8_t, 33);
  81         if (cname == NULL) return NULL;
  82
  83         for (i=0;name[i];i++) {
  84                 cname[2*i]   = 'A' + (name[i]>>4);
  85                 cname[1+2*i] = 'A' + (name[i]&0xF);
  86         }
  87         if (strcmp((const char *)name, "*") == 0) {
  88                 pad_char = 0;
  89         } else {
  90                 pad_char = ' ';
  91         }
  92         for (;i<15;i++) {
  93                 cname[2*i]   = 'A' + (pad_char>>4);
  94                 cname[1+2*i] = 'A' + (pad_char&0xF);
  95         }
  96
  97         pad_char = type;
  98         cname[2*i]   = 'A' + (pad_char>>4);
  99         cname[1+2*i] = 'A' + (pad_char&0xF);
 100
 101         cname[32] = 0;
 102         return cname;
 103 }
 104
 105
 106 /**
 107   pull a nbt name from the wire
 108 */
 109 _PUBLIC_ enum ndr_err_code ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name *r)
 110 {
 111         uint8_t *scope;
 112         char *cname;
 113         const char *s;
 114         bool ok;
 115
 116         if (!(ndr_flags & NDR_SCALARS)) {
 117                 return NDR_ERR_SUCCESS;
 118         }
 119
 120         NDR_CHECK(ndr_pull_nbt_string(ndr, ndr_flags, &s));
 121
 122         scope = (uint8_t *)strchr(s, '.');
 123         if (scope) {
 124                 *scope = 0;
 125                 r->scope = talloc_strdup(ndr->current_mem_ctx, (const char *)&scope[1]);
 126                 NDR_ERR_HAVE_NO_MEMORY(r->scope);
 127         } else {
 128                 r->scope = NULL;
 129         }
 130
 131         cname = discard_const_p(char, s);
 132
 133         /* the first component is limited to 16 bytes in the DOS charset,
 134            which is 32 in the 'compressed' form */
 135         if (strlen(cname) > 32) {
 136                 return ndr_pull_error(ndr, NDR_ERR_STRING,
 137                                       "NBT NAME cname > 32");
 138         }
 139
 140         /* decompress the first component */
 141         ok = decompress_name(cname, &r->type);
 142         if (!ok) {
 143                 return ndr_pull_error(ndr, NDR_ERR_STRING,
 144                                       "NBT NAME failed to decompress");
 145         }
 146
 147         r->name = talloc_strdup(ndr->current_mem_ctx, cname);
 148         NDR_ERR_HAVE_NO_MEMORY(r->name);
 149
 150         talloc_free(cname);
 151
 152         return NDR_ERR_SUCCESS;
 153 }
 154
 155 /**
 156   push a nbt name to the wire
 157 */
 158 _PUBLIC_ enum ndr_err_code ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
 159 {
 160         uint8_t *cname, *fullname;
 161         enum ndr_err_code ndr_err;
 162
 163         if (!(ndr_flags & NDR_SCALARS)) {
 164                 return NDR_ERR_SUCCESS;
 165         }
 166
 167         if (strlen(r->name) > 15) {
 168                 return ndr_push_error(ndr, NDR_ERR_STRING,
 169                                       "nbt_name longer as 15 chars: %s",
 170                                       r->name);
 171         }
 172
 173         cname = compress_name(ndr, (const uint8_t *)r->name, r->type);
 174         NDR_ERR_HAVE_NO_MEMORY(cname);
 175
 176         if (r->scope) {
 177                 fullname = (uint8_t *)talloc_asprintf(ndr, "%s.%s", cname, r->scope);
 178                 NDR_ERR_HAVE_NO_MEMORY(fullname);
 179                 talloc_free(cname);
 180         } else {
 181                 fullname = cname;
 182         }
 183
 184         ndr_err = ndr_push_nbt_string(ndr, ndr_flags, (const char *)fullname);
 185
 186         return ndr_err;
 187 }
 188
 189
 190 /**
 191   copy a nbt name structure
 192 */
 193 _PUBLIC_ NTSTATUS nbt_name_dup(TALLOC_CTX *mem_ctx, struct nbt_name *name, struct nbt_name *newname)
 194 {
 195         *newname = *name;
 196         newname->name = talloc_strdup(mem_ctx, newname->name);
 197         NT_STATUS_HAVE_NO_MEMORY(newname->name);
 198         newname->scope = talloc_strdup(mem_ctx, newname->scope);
 199         if (name->scope) {
 200                 NT_STATUS_HAVE_NO_MEMORY(newname->scope);
 201         }
 202         return NT_STATUS_OK;
 203 }
 204
 205 /**
 206   push a nbt name into a blob
 207 */
 208 _PUBLIC_ NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct nbt_name *name)
 209 {
 210         enum ndr_err_code ndr_err;
 211
 212         ndr_err = ndr_push_struct_blob(blob, mem_ctx, name, (ndr_push_flags_fn_t)ndr_push_nbt_name);
 213         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 214                 return ndr_map_error2ntstatus(ndr_err);
 215         }
 216
 217         return NT_STATUS_OK;
 218 }
 219
 220 /**
 221   pull a nbt name from a blob
 222 */
 223 _PUBLIC_ NTSTATUS nbt_name_from_blob(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, struct nbt_name *name)
 224 {
 225         enum ndr_err_code ndr_err;
 226
 227         ndr_err = ndr_pull_struct_blob(blob, mem_ctx, name,
 228                                        (ndr_pull_flags_fn_t)ndr_pull_nbt_name);
 229         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 230                 return ndr_map_error2ntstatus(ndr_err);
 231         }
 232
 233         return NT_STATUS_OK;
 234 }
 235
 236
 237 /**
 238   choose a name to use when calling a server in a NBT session request.
 239   we use heuristics to see if the name we have been given is a IP
 240   address, or a too-long name. If it is then use *SMBSERVER, or a
 241   truncated name
 242 */
 243 _PUBLIC_ void nbt_choose_called_name(TALLOC_CTX *mem_ctx,
 244                             struct nbt_name *n, const char *name, int type)
 245 {
 246         n->scope = NULL;
 247         n->type = type;
 248
 249         if ((name == NULL) || is_ipaddress(name)) {
 250                 n->name = "*SMBSERVER";
 251                 return;
 252         }
 253         if (strlen(name) > 15) {
 254                 const char *p = strchr(name, '.');
 255                 char *s;
 256                 if (p - name > 15) {
 257                         n->name = "*SMBSERVER";
 258                         return;
 259                 }
 260                 s = talloc_strndup(mem_ctx, name, PTR_DIFF(p, name));
 261                 n->name = talloc_strdup_upper(mem_ctx, s);
 262                 return;
 263         }
 264
 265         n->name = talloc_strdup_upper(mem_ctx, name);
 266 }
 267
 268
 269 /*
 270   escape a string into a form containing only a small set of characters,
 271   the rest is hex encoded. This is similar to URL encoding
 272 */
 273 static const char *nbt_hex_encode(TALLOC_CTX *mem_ctx, const char *s)
 274 {
 275         int i, len;
 276         char *ret;
 277         const char *valid_chars = "_-.$@ ";
 278 #define NBT_CHAR_ALLOW(c) (isalnum((unsigned char)c) || strchr(valid_chars, c))
 279
 280         for (len=i=0;s[i];i++,len++) {
 281                 if (!NBT_CHAR_ALLOW(s[i])) {
 282                         len += 2;
 283                 }
 284         }
 285
 286         ret = talloc_array(mem_ctx, char, len+1);
 287         if (ret == NULL) return NULL;
 288
 289         for (len=i=0;s[i];i++) {
 290                 if (NBT_CHAR_ALLOW(s[i])) {
 291                         ret[len++] = s[i];
 292                 } else {
 293                         snprintf(&ret[len], 4, "%%%02x", (unsigned char)s[i]);
 294                         len += 3;
 295                 }
 296         }
 297         ret[len] = 0;
 298
 299         return ret;
 300 }
 301
 302
 303 /**
 304   form a string for a NBT name
 305 */
 306 _PUBLIC_ char *nbt_name_string(TALLOC_CTX *mem_ctx, const struct nbt_name *name)
 307 {
 308         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 309         char *ret;
 310         if (name->scope) {
 311                 ret = talloc_asprintf(mem_ctx, "%s<%02x>-%s",
 312                                       nbt_hex_encode(tmp_ctx, name->name),
 313                                       name->type,
 314                                       nbt_hex_encode(tmp_ctx, name->scope));
 315         } else {
 316                 ret = talloc_asprintf(mem_ctx, "%s<%02x>",
 317                                       nbt_hex_encode(tmp_ctx, name->name),
 318                                       name->type);
 319         }
 320         talloc_free(tmp_ctx);
 321         return ret;
 322 }
 323
 324 /**
 325   pull a nbt name, WINS Replication uses another on wire format for nbt name
 326 */
 327 _PUBLIC_ enum ndr_err_code ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name **_r)
 328 {
 329         struct nbt_name *r;
 330         uint8_t *namebuf;
 331         uint32_t namebuf_len;
 332
 333         if (!(ndr_flags & NDR_SCALARS)) {
 334                 return NDR_ERR_SUCCESS;
 335         }
 336
 337         NDR_CHECK(ndr_pull_align(ndr, 4));
 338         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &namebuf_len));
 339         if (namebuf_len < 1 || namebuf_len > 255) {
 340                 return ndr_pull_error(ndr, NDR_ERR_ALLOC, "value out of range");
 341         }
 342         NDR_PULL_ALLOC_N(ndr, namebuf, namebuf_len);
 343         NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, namebuf, namebuf_len));
 344
 345         if ((namebuf_len % 4) == 0) {
 346                 /*
 347                  * [MS-WINSRA] — v20091104 was wrong
 348                  * regarding section "2.2.10.1 Name Record"
 349                  *
 350                  * If the name buffer is already 4 byte aligned
 351                  * Windows (at least 2003 SP1 and 2008) add 4 extra
 352                  * bytes. This can happen when the name has a scope.
 353                  */
 354                 uint32_t pad;
 355                 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &pad));
 356         }
 357
 358         NDR_PULL_ALLOC(ndr, r);
 359
 360         /* oh wow, what a nasty bug in windows ... */
 361         if (namebuf[0] == 0x1b && namebuf_len >= 16) {
 362                 namebuf[0] = namebuf[15];
 363                 namebuf[15] = 0x1b;
 364         }
 365
 366         if (namebuf_len < 17) {
 367                 r->type = 0x00;
 368
 369                 r->name = talloc_strndup(r, (char *)namebuf, namebuf_len);
 370                 if (!r->name) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
 371
 372                 r->scope= NULL;
 373
 374                 talloc_free(namebuf);
 375                 *_r = r;
 376                 return NDR_ERR_SUCCESS;
 377         }
 378
 379         r->type = namebuf[15];
 380
 381         namebuf[15] = '\0';
 382         trim_string((char *)namebuf, NULL, " ");
 383         r->name = talloc_strdup(r, (char *)namebuf);
 384         if (!r->name) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
 385
 386         if (namebuf_len > 17) {
 387                 r->scope = talloc_strndup(r, (char *)(namebuf+16), namebuf_len-17);
 388                 if (!r->scope) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
 389         } else {
 390                 r->scope = NULL;
 391         }
 392
 393         talloc_free(namebuf);
 394         *_r = r;
 395         return NDR_ERR_SUCCESS;
 396 }
 397
 398 /**
 399   push a nbt name, WINS Replication uses another on wire format for nbt name
 400 */
 401 _PUBLIC_ enum ndr_err_code ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
 402 {
 403         uint8_t *namebuf;
 404         uint32_t namebuf_len;
 405         uint32_t _name_len;
 406         uint32_t scope_len = 0;
 407
 408         if (r == NULL) {
 409                 return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER,
 410                                       "wrepl_nbt_name NULL pointer");
 411         }
 412
 413         if (!(ndr_flags & NDR_SCALARS)) {
 414                 return NDR_ERR_SUCCESS;
 415         }
 416
 417         _name_len = strlen(r->name);
 418         if (_name_len > 15) {
 419                 return ndr_push_error(ndr, NDR_ERR_STRING,
 420                                       "wrepl_nbt_name longer as 15 chars: %s",
 421                                       r->name);
 422         }
 423
 424         if (r->scope) {
 425                 scope_len = strlen(r->scope);
 426         }
 427         if (scope_len > 238) {
 428                 return ndr_push_error(ndr, NDR_ERR_STRING,
 429                                       "wrepl_nbt_name scope longer as 238 chars: %s",
 430                                       r->scope);
 431         }
 432
 433         namebuf = (uint8_t *)talloc_asprintf(ndr, "%-15s%c%s",
 434                                              r->name, 'X',
 435                                              (r->scope?r->scope:""));
 436         if (!namebuf) return ndr_push_error(ndr, NDR_ERR_ALLOC, "out of memory");
 437
 438         namebuf_len = strlen((char *)namebuf) + 1;
 439
 440         /*
 441          * we need to set the type here, and use a place-holder in the talloc_asprintf()
 442          * as the type can be 0x00, and then the namebuf_len = strlen(namebuf); would give wrong results
 443          */
 444         namebuf[15] = r->type;
 445
 446         /* oh wow, what a nasty bug in windows ... */
 447         if (r->type == 0x1b) {
 448                 namebuf[15] = namebuf[0];
 449                 namebuf[0] = 0x1b;
 450         }
 451
 452         NDR_CHECK(ndr_push_align(ndr, 4));
 453         NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, namebuf_len));
 454         NDR_CHECK(ndr_push_array_uint8(ndr, NDR_SCALARS, namebuf, namebuf_len));
 455
 456         if ((namebuf_len % 4) == 0) {
 457                 /*
 458                  * [MS-WINSRA] — v20091104 was wrong
 459                  * regarding section "2.2.10.1 Name Record"
 460                  *
 461                  * If the name buffer is already 4 byte aligned
 462                  * Windows (at least 2003 SP1 and 2008) add 4 extra
 463                  * bytes. This can happen when the name has a scope.
 464                  */
 465                 NDR_CHECK(ndr_push_zero(ndr, 4));
 466         }
 467
 468         talloc_free(namebuf);
 469         return NDR_ERR_SUCCESS;
 470 }
 471
 472 _PUBLIC_ void ndr_print_wrepl_nbt_name(struct ndr_print *ndr, const char *name, const struct nbt_name *r)
 473 {
 474         char *s = nbt_name_string(ndr, r);
 475         ndr_print_string(ndr, name, s);
 476         talloc_free(s);
 477 }
 478
 479 _PUBLIC_ enum ndr_err_code ndr_push_nbt_res_rec(struct ndr_push *ndr, int ndr_flags, const struct nbt_res_rec *r)
 480 {
 481         {
 482                 uint32_t _flags_save_STRUCT = ndr->flags;
 483                 ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
 484                 if (ndr_flags & NDR_SCALARS) {
 485                         NDR_CHECK(ndr_push_align(ndr, 4));
 486                         NDR_CHECK(ndr_push_nbt_name(ndr, NDR_SCALARS, &r->name));
 487                         NDR_CHECK(ndr_push_nbt_qtype(ndr, NDR_SCALARS, r->rr_type));
 488                         NDR_CHECK(ndr_push_nbt_qclass(ndr, NDR_SCALARS, r->rr_class));
 489                         NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->ttl));
 490                         NDR_CHECK(ndr_push_set_switch_value(ndr, &r->rdata, ((((r->rr_type) == NBT_QTYPE_NETBIOS) && ((r->rdata).data.length == 2))?0:r->rr_type)));
 491                         NDR_CHECK(ndr_push_nbt_rdata(ndr, NDR_SCALARS, &r->rdata));
 492                 }
 493                 if (ndr_flags & NDR_BUFFERS) {
 494                 }
 495                 ndr->flags = _flags_save_STRUCT;
 496         }
 497         return NDR_ERR_SUCCESS;
 498 }