2 Unix SMB/CIFS implementation.
4 dcerpc over SMB transport
6 Copyright (C) Tim Potter 2003
7 Copyright (C) Andrew Tridgell 2003
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/composite/composite.h"
26 #include "librpc/rpc/dcerpc.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/rpc/rpc_common.h"
30 /* transport private information used by SMB pipe transport */
33 struct smbcli_tree
*tree
;
34 const char *server_name
;
40 tell the dcerpc layer that the transport is dead
42 static void pipe_dead(struct dcecli_connection
*c
, NTSTATUS status
)
44 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
52 if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL
, status
)) {
53 status
= NT_STATUS_UNEXPECTED_NETWORK_ERROR
;
56 if (NT_STATUS_EQUAL(NT_STATUS_OK
, status
)) {
57 status
= NT_STATUS_END_OF_FILE
;
60 if (c
->transport
.recv_data
) {
61 c
->transport
.recv_data(c
, NULL
, status
);
67 this holds the state of an in-flight call
69 struct smb_read_state
{
70 struct dcecli_connection
*c
;
71 struct smbcli_request
*req
;
78 called when a read request has completed
80 static void smb_read_callback(struct smbcli_request
*req
)
82 struct smb_private
*smb
;
83 struct smb_read_state
*state
;
88 state
= talloc_get_type(req
->async
.private_data
, struct smb_read_state
);
89 smb
= talloc_get_type(state
->c
->transport
.private_data
, struct smb_private
);
92 status
= smb_raw_read_recv(state
->req
, io
);
93 if (NT_STATUS_IS_ERR(status
)) {
94 pipe_dead(state
->c
, status
);
99 state
->received
+= io
->readx
.out
.nread
;
101 if (state
->received
< 16) {
102 DEBUG(0,("dcerpc_smb: short packet (length %d) in read callback!\n",
103 (int)state
->received
));
104 pipe_dead(state
->c
, NT_STATUS_INFO_LENGTH_MISMATCH
);
109 frag_length
= dcerpc_get_frag_length(&state
->data
);
111 if (frag_length
<= state
->received
) {
112 DATA_BLOB data
= state
->data
;
113 struct dcecli_connection
*c
= state
->c
;
114 data
.length
= state
->received
;
115 talloc_steal(state
->c
, data
.data
);
117 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
121 /* initiate another read request, as we only got part of a fragment */
122 state
->data
.data
= talloc_realloc(state
, state
->data
.data
, uint8_t, frag_length
);
124 io
->readx
.in
.mincnt
= MIN(state
->c
->srv_max_xmit_frag
,
125 frag_length
- state
->received
);
126 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
127 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
129 state
->req
= smb_raw_read_send(smb
->tree
, io
);
130 if (state
->req
== NULL
) {
131 pipe_dead(state
->c
, NT_STATUS_NO_MEMORY
);
136 state
->req
->async
.fn
= smb_read_callback
;
137 state
->req
->async
.private_data
= state
;
141 trigger a read request from the server, possibly with some initial
142 data in the read buffer
144 static NTSTATUS
send_read_request_continue(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
146 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
148 struct smb_read_state
*state
;
149 struct smbcli_request
*req
;
151 state
= talloc(smb
, struct smb_read_state
);
153 return NT_STATUS_NO_MEMORY
;
159 state
->data
= data_blob_talloc(state
, NULL
, 0x2000);
161 uint32_t frag_length
= blob
->length
>=16?
162 dcerpc_get_frag_length(blob
):0x2000;
164 if (frag_length
< state
->data
.length
) {
166 return NT_STATUS_RPC_PROTOCOL_ERROR
;
169 state
->received
= blob
->length
;
170 state
->data
= data_blob_talloc(state
, NULL
, frag_length
);
171 if (!state
->data
.data
) {
173 return NT_STATUS_NO_MEMORY
;
175 memcpy(state
->data
.data
, blob
->data
, blob
->length
);
178 state
->io
= talloc(state
, union smb_read
);
181 io
->generic
.level
= RAW_READ_READX
;
182 io
->readx
.in
.file
.fnum
= smb
->fnum
;
183 io
->readx
.in
.mincnt
= state
->data
.length
- state
->received
;
184 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
185 io
->readx
.in
.offset
= 0;
186 io
->readx
.in
.remaining
= 0;
187 io
->readx
.in
.read_for_execute
= false;
188 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
189 req
= smb_raw_read_send(smb
->tree
, io
);
191 return NT_STATUS_NO_MEMORY
;
194 req
->async
.fn
= smb_read_callback
;
195 req
->async
.private_data
= state
;
204 trigger a read request from the server
206 static NTSTATUS
send_read_request(struct dcecli_connection
*c
)
208 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
211 return NT_STATUS_CONNECTION_DISCONNECTED
;
214 return send_read_request_continue(c
, NULL
);
218 this holds the state of an in-flight trans call
220 struct smb_trans_state
{
221 struct dcecli_connection
*c
;
222 struct smbcli_request
*req
;
223 struct smb_trans2
*trans
;
227 called when a trans request has completed
229 static void smb_trans_callback(struct smbcli_request
*req
)
231 struct smb_trans_state
*state
= (struct smb_trans_state
*)req
->async
.private_data
;
232 struct dcecli_connection
*c
= state
->c
;
235 status
= smb_raw_trans_recv(req
, state
, state
->trans
);
237 if (NT_STATUS_IS_ERR(status
)) {
238 pipe_dead(c
, status
);
242 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
243 DATA_BLOB data
= state
->trans
->out
.data
;
244 talloc_steal(c
, data
.data
);
246 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
250 /* there is more to receive - setup a readx */
251 send_read_request_continue(c
, &state
->trans
->out
.data
);
256 send a SMBtrans style request
258 static NTSTATUS
smb_send_trans_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
260 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
261 struct smb_trans2
*trans
;
263 struct smb_trans_state
*state
;
266 state
= talloc(smb
, struct smb_trans_state
);
268 return NT_STATUS_NO_MEMORY
;
272 state
->trans
= talloc(state
, struct smb_trans2
);
273 trans
= state
->trans
;
275 trans
->in
.data
= *blob
;
276 trans
->in
.params
= data_blob(NULL
, 0);
278 setup
[0] = TRANSACT_DCERPCCMD
;
279 setup
[1] = smb
->fnum
;
281 if (c
->srv_max_xmit_frag
> 0) {
282 max_data
= MIN(UINT16_MAX
, c
->srv_max_xmit_frag
);
284 max_data
= UINT16_MAX
;
287 trans
->in
.max_param
= 0;
288 trans
->in
.max_data
= max_data
;
289 trans
->in
.max_setup
= 0;
290 trans
->in
.setup_count
= 2;
292 trans
->in
.timeout
= 0;
293 trans
->in
.setup
= setup
;
294 trans
->in
.trans_name
= "\\PIPE\\";
296 state
->req
= smb_raw_trans_send(smb
->tree
, trans
);
297 if (state
->req
== NULL
) {
299 return NT_STATUS_NO_MEMORY
;
302 state
->req
->async
.fn
= smb_trans_callback
;
303 state
->req
->async
.private_data
= state
;
305 talloc_steal(state
, state
->req
);
311 called when a write request has completed
313 static void smb_write_callback(struct smbcli_request
*req
)
315 struct dcecli_connection
*c
= (struct dcecli_connection
*)req
->async
.private_data
;
317 if (!NT_STATUS_IS_OK(req
->status
)) {
318 DEBUG(0,("dcerpc_smb: write callback error\n"));
319 pipe_dead(c
, req
->status
);
322 smbcli_request_destroy(req
);
326 send a packet to the server
328 static NTSTATUS
smb_send_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
,
331 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
333 struct smbcli_request
*req
;
335 if (!smb
|| smb
->dead
) {
336 return NT_STATUS_CONNECTION_DISCONNECTED
;
340 return smb_send_trans_request(c
, blob
);
343 io
.generic
.level
= RAW_WRITE_WRITEX
;
344 io
.writex
.in
.file
.fnum
= smb
->fnum
;
345 io
.writex
.in
.offset
= 0;
346 io
.writex
.in
.wmode
= PIPE_START_MESSAGE
;
347 io
.writex
.in
.remaining
= blob
->length
;
348 io
.writex
.in
.count
= blob
->length
;
349 io
.writex
.in
.data
= blob
->data
;
351 /* we must not timeout at the smb level for rpc requests, as otherwise
352 signing/sealing can be messed up */
353 smb
->tree
->session
->transport
->options
.request_timeout
= 0;
355 req
= smb_raw_write_send(smb
->tree
, &io
);
357 return NT_STATUS_NO_MEMORY
;
360 req
->async
.fn
= smb_write_callback
;
361 req
->async
.private_data
= c
;
364 send_read_request(c
);
371 static void free_request(struct smbcli_request
*req
)
377 shutdown SMB pipe connection
379 static NTSTATUS
smb_shutdown_pipe(struct dcecli_connection
*c
, NTSTATUS status
)
381 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
383 struct smbcli_request
*req
;
385 /* maybe we're still starting up */
386 if (!smb
) return status
;
388 io
.close
.level
= RAW_CLOSE_CLOSE
;
389 io
.close
.in
.file
.fnum
= smb
->fnum
;
390 io
.close
.in
.write_time
= 0;
391 req
= smb_raw_close_send(smb
->tree
, &io
);
393 /* we don't care if this fails, so just free it if it succeeds */
394 req
->async
.fn
= free_request
;
398 c
->transport
.private_data
= NULL
;
404 return SMB server name (called name)
406 static const char *smb_peer_name(struct dcecli_connection
*c
)
408 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
409 if (smb
== NULL
) return "";
410 return smb
->server_name
;
414 return remote name we make the actual connection (good for kerberos)
416 static const char *smb_target_hostname(struct dcecli_connection
*c
)
418 struct smb_private
*smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
419 if (smb
== NULL
) return "";
420 return smb
->tree
->session
->transport
->socket
->hostname
;
424 fetch the user session key
426 static NTSTATUS
smb_session_key(struct dcecli_connection
*c
, DATA_BLOB
*session_key
)
428 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
430 if (smb
== NULL
) return NT_STATUS_CONNECTION_DISCONNECTED
;
431 if (smb
->tree
->session
->user_session_key
.data
) {
432 *session_key
= smb
->tree
->session
->user_session_key
;
435 return NT_STATUS_NO_USER_SESSION_KEY
;
438 struct pipe_open_smb_state
{
439 union smb_open
*open
;
440 struct dcecli_connection
*c
;
441 struct smbcli_tree
*tree
;
442 struct composite_context
*ctx
;
445 static void pipe_open_recv(struct smbcli_request
*req
);
447 struct composite_context
*dcerpc_pipe_open_smb_send(struct dcerpc_pipe
*p
,
448 struct smbcli_tree
*tree
,
449 const char *pipe_name
)
451 struct composite_context
*ctx
;
452 struct pipe_open_smb_state
*state
;
453 struct smbcli_request
*req
;
454 struct dcecli_connection
*c
= p
->conn
;
456 /* if we don't have a binding on this pipe yet, then create one */
457 if (p
->binding
== NULL
) {
460 SMB_ASSERT(tree
->session
->transport
->socket
->hostname
!= NULL
);
461 s
= talloc_asprintf(p
, "ncacn_np:%s", tree
->session
->transport
->socket
->hostname
);
462 if (s
== NULL
) return NULL
;
463 status
= dcerpc_parse_binding(p
, s
, &p
->binding
);
465 if (!NT_STATUS_IS_OK(status
)) {
470 ctx
= composite_create(c
, c
->event_ctx
);
471 if (ctx
== NULL
) return NULL
;
473 state
= talloc(ctx
, struct pipe_open_smb_state
);
474 if (composite_nomem(state
, ctx
)) return ctx
;
475 ctx
->private_data
= state
;
481 state
->open
= talloc(state
, union smb_open
);
482 if (composite_nomem(state
->open
, ctx
)) return ctx
;
484 state
->open
->ntcreatex
.level
= RAW_OPEN_NTCREATEX
;
485 state
->open
->ntcreatex
.in
.flags
= 0;
486 state
->open
->ntcreatex
.in
.root_fid
.fnum
= 0;
487 state
->open
->ntcreatex
.in
.access_mask
=
488 SEC_STD_READ_CONTROL
|
489 SEC_FILE_WRITE_ATTRIBUTE
|
493 state
->open
->ntcreatex
.in
.file_attr
= 0;
494 state
->open
->ntcreatex
.in
.alloc_size
= 0;
495 state
->open
->ntcreatex
.in
.share_access
=
496 NTCREATEX_SHARE_ACCESS_READ
|
497 NTCREATEX_SHARE_ACCESS_WRITE
;
498 state
->open
->ntcreatex
.in
.open_disposition
= NTCREATEX_DISP_OPEN
;
499 state
->open
->ntcreatex
.in
.create_options
= 0;
500 state
->open
->ntcreatex
.in
.impersonation
=
501 NTCREATEX_IMPERSONATION_IMPERSONATION
;
502 state
->open
->ntcreatex
.in
.security_flags
= 0;
504 if ((strncasecmp(pipe_name
, "/pipe/", 6) == 0) ||
505 (strncasecmp(pipe_name
, "\\pipe\\", 6) == 0)) {
508 state
->open
->ntcreatex
.in
.fname
=
509 (pipe_name
[0] == '\\') ?
510 talloc_strdup(state
->open
, pipe_name
) :
511 talloc_asprintf(state
->open
, "\\%s", pipe_name
);
512 if (composite_nomem(state
->open
->ntcreatex
.in
.fname
, ctx
)) return ctx
;
514 req
= smb_raw_open_send(tree
, state
->open
);
515 composite_continue_smb(ctx
, req
, pipe_open_recv
, state
);
519 static void pipe_open_recv(struct smbcli_request
*req
)
521 struct pipe_open_smb_state
*state
= talloc_get_type(req
->async
.private_data
,
522 struct pipe_open_smb_state
);
523 struct composite_context
*ctx
= state
->ctx
;
524 struct dcecli_connection
*c
= state
->c
;
525 struct smb_private
*smb
;
527 ctx
->status
= smb_raw_open_recv(req
, state
, state
->open
);
528 if (!composite_is_ok(ctx
)) return;
531 fill in the transport methods
533 c
->transport
.transport
= NCACN_NP
;
534 c
->transport
.private_data
= NULL
;
535 c
->transport
.shutdown_pipe
= smb_shutdown_pipe
;
536 c
->transport
.peer_name
= smb_peer_name
;
537 c
->transport
.target_hostname
= smb_target_hostname
;
539 c
->transport
.send_request
= smb_send_request
;
540 c
->transport
.send_read
= send_read_request
;
541 c
->transport
.recv_data
= NULL
;
543 /* Over-ride the default session key with the SMB session key */
544 c
->security_state
.session_key
= smb_session_key
;
546 smb
= talloc(c
, struct smb_private
);
547 if (composite_nomem(smb
, ctx
)) return;
549 smb
->fnum
= state
->open
->ntcreatex
.out
.file
.fnum
;
550 smb
->tree
= talloc_reference(smb
, state
->tree
);
551 smb
->server_name
= strupper_talloc(smb
,
552 state
->tree
->session
->transport
->called
.name
);
553 if (composite_nomem(smb
->server_name
, ctx
)) return;
556 c
->transport
.private_data
= smb
;
561 NTSTATUS
dcerpc_pipe_open_smb_recv(struct composite_context
*c
)
563 NTSTATUS status
= composite_wait(c
);
568 _PUBLIC_ NTSTATUS
dcerpc_pipe_open_smb(struct dcerpc_pipe
*p
,
569 struct smbcli_tree
*tree
,
570 const char *pipe_name
)
572 struct composite_context
*ctx
= dcerpc_pipe_open_smb_send(p
, tree
,
574 return dcerpc_pipe_open_smb_recv(ctx
);
578 return the SMB tree used for a dcerpc over SMB pipe
580 _PUBLIC_
struct smbcli_tree
*dcerpc_smb_tree(struct dcecli_connection
*c
)
582 struct smb_private
*smb
;
584 if (c
->transport
.transport
!= NCACN_NP
) return NULL
;
586 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
587 if (!smb
) return NULL
;
593 return the SMB fnum used for a dcerpc over SMB pipe (hack for torture operations)
595 _PUBLIC_
uint16_t dcerpc_smb_fnum(struct dcecli_connection
*c
)
597 struct smb_private
*smb
;
599 if (c
->transport
.transport
!= NCACN_NP
) return 0;
601 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);