source3/torture/scanner.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB torture tester - scanning functions
   4    Copyright (C) Andrew Tridgell 2001
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "torture/proto.h"
  22
  23 #define VERBOSE 0
  24 #define OP_MIN 0
  25 #define OP_MAX 20
  26
  27 #define DATA_SIZE 1024
  28 #define PARAM_SIZE 1024
  29
  30 /****************************************************************************
  31 look for a partial hit
  32 ****************************************************************************/
  33 static void trans2_check_hit(const char *format, int op, int level, NTSTATUS status)
  34 {
  35         if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
  36             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
  37             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
  38             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
  39             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
  40                 return;
  41         }
  42 #if VERBOSE
  43         printf("possible %s hit op=%3d level=%5d status=%s\n",
  44                format, op, level, nt_errstr(status));
  45 #endif
  46 }
  47
  48 /****************************************************************************
  49 check for existance of a trans2 call
  50 ****************************************************************************/
  51 static NTSTATUS try_trans2(struct cli_state *cli,
  52                          int op,
  53                          uint8_t *param, uint8_t *data,
  54                          uint32_t param_len, uint32_t data_len,
  55                          uint32_t *rparam_len, uint32_t *rdata_len)
  56 {
  57         uint16_t setup[1];
  58         uint8_t *rparam=NULL, *rdata=NULL;
  59         NTSTATUS status;
  60
  61         SSVAL(setup+0, 0, op);
  62
  63         status = cli_trans(talloc_tos(), cli, SMBtrans2,
  64                            NULL, -1, /* name, fid */
  65                            op, 0,
  66                            NULL, 0, 0, /* setup */
  67                            param, param_len, 2,
  68                            data, data_len, cli->max_xmit,
  69                            NULL,                /* recv_flags2 */
  70                            NULL, 0, NULL,       /* rsetup */
  71                            &rparam, 0, rparam_len,
  72                            &rdata, 0, rdata_len);
  73
  74         TALLOC_FREE(rdata);
  75         TALLOC_FREE(rparam);
  76
  77         return status;
  78 }
  79
  80
  81 static NTSTATUS try_trans2_len(struct cli_state *cli,
  82                              const char *format,
  83                              int op, int level,
  84                              uint8_t *param, uint8_t *data,
  85                              uint32_t param_len, uint32_t *data_len,
  86                              uint32_t *rparam_len, uint32_t *rdata_len)
  87 {
  88         NTSTATUS ret=NT_STATUS_OK;
  89
  90         ret = try_trans2(cli, op, param, data, param_len,
  91                          DATA_SIZE, rparam_len, rdata_len);
  92 #if VERBOSE
  93         printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
  94 #endif
  95         if (!NT_STATUS_IS_OK(ret)) return ret;
  96
  97         *data_len = 0;
  98         while (*data_len < DATA_SIZE) {
  99                 ret = try_trans2(cli, op, param, data, param_len,
 100                                  *data_len, rparam_len, rdata_len);
 101                 if (NT_STATUS_IS_OK(ret)) break;
 102                 *data_len += 2;
 103         }
 104         if (NT_STATUS_IS_OK(ret)) {
 105                 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
 106                        format, level, *data_len, *rparam_len, *rdata_len);
 107         } else {
 108                 trans2_check_hit(format, op, level, ret);
 109         }
 110         return ret;
 111 }
 112
 113 /****************************************************************************
 114 check for existance of a trans2 call
 115 ****************************************************************************/
 116 static bool scan_trans2(struct cli_state *cli, int op, int level,
 117                         int fnum, int dnum, const char *fname)
 118 {
 119         uint32_t data_len = 0;
 120         uint32_t param_len = 0;
 121         uint32_t rparam_len, rdata_len;
 122         uint8_t param[PARAM_SIZE], data[DATA_SIZE];
 123         NTSTATUS status;
 124
 125         memset(data, 0, sizeof(data));
 126         data_len = 4;
 127
 128         /* try with a info level only */
 129         param_len = 2;
 130         SSVAL(param, 0, level);
 131         status = try_trans2_len(cli, "void", op, level, param, data, param_len, &data_len,
 132                             &rparam_len, &rdata_len);
 133         if (NT_STATUS_IS_OK(status)) return True;
 134
 135         /* try with a file descriptor */
 136         param_len = 6;
 137         SSVAL(param, 0, fnum);
 138         SSVAL(param, 2, level);
 139         SSVAL(param, 4, 0);
 140         status = try_trans2_len(cli, "fnum", op, level, param, data, param_len, &data_len,
 141                                 &rparam_len, &rdata_len);
 142         if (NT_STATUS_IS_OK(status)) return True;
 143
 144
 145         /* try with a notify style */
 146         param_len = 6;
 147         SSVAL(param, 0, dnum);
 148         SSVAL(param, 2, dnum);
 149         SSVAL(param, 4, level);
 150         status = try_trans2_len(cli, "notify", op, level, param, data, param_len, &data_len,
 151                                 &rparam_len, &rdata_len);
 152         if (NT_STATUS_IS_OK(status)) return True;
 153
 154         /* try with a file name */
 155         param_len = 6;
 156         SSVAL(param, 0, level);
 157         SSVAL(param, 2, 0);
 158         SSVAL(param, 4, 0);
 159         param_len += clistr_push(cli, &param[6], fname, -1, STR_TERMINATE);
 160
 161         status = try_trans2_len(cli, "fname", op, level, param, data, param_len, &data_len,
 162                                 &rparam_len, &rdata_len);
 163         if (NT_STATUS_IS_OK(status)) return True;
 164
 165         /* try with a new file name */
 166         param_len = 6;
 167         SSVAL(param, 0, level);
 168         SSVAL(param, 2, 0);
 169         SSVAL(param, 4, 0);
 170         param_len += clistr_push(cli, &param[6], "\\newfile.dat", -1, STR_TERMINATE);
 171
 172         status = try_trans2_len(cli, "newfile", op, level, param, data, param_len, &data_len,
 173                                 &rparam_len, &rdata_len);
 174         cli_unlink(cli, "\\newfile.dat", aSYSTEM | aHIDDEN);
 175         cli_rmdir(cli, "\\newfile.dat");
 176         if (NT_STATUS_IS_OK(status)) return True;
 177
 178         /* try dfs style  */
 179         cli_mkdir(cli, "\\testdir");
 180         param_len = 2;
 181         SSVAL(param, 0, level);
 182         param_len += clistr_push(cli, &param[2], "\\testdir", -1, STR_TERMINATE);
 183
 184         status = try_trans2_len(cli, "dfs", op, level, param, data, param_len, &data_len,
 185                                 &rparam_len, &rdata_len);
 186         cli_rmdir(cli, "\\testdir");
 187         if (NT_STATUS_IS_OK(status)) return True;
 188
 189         return False;
 190 }
 191
 192
 193 bool torture_trans2_scan(int dummy)
 194 {
 195         static struct cli_state *cli;
 196         int op, level;
 197         const char *fname = "\\scanner.dat";
 198         uint16_t fnum, dnum;
 199
 200         printf("starting trans2 scan test\n");
 201
 202         if (!torture_open_connection(&cli, 0)) {
 203                 return False;
 204         }
 205
 206         if (!NT_STATUS_IS_OK(cli_open(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
 207                          DENY_NONE, &fnum))) {
 208                 printf("open of %s failed\n", fname);
 209                 return false;
 210         }
 211         if (!NT_STATUS_IS_OK(cli_open(cli, "\\", O_RDONLY, DENY_NONE, &dnum))) {
 212                 printf("open of \\ failed\n");
 213                 return false;
 214         }
 215
 216         for (op=OP_MIN; op<=OP_MAX; op++) {
 217                 printf("Scanning op=%d\n", op);
 218                 for (level = 0; level <= 50; level++) {
 219                         scan_trans2(cli, op, level, fnum, dnum, fname);
 220                 }
 221
 222                 for (level = 0x100; level <= 0x130; level++) {
 223                         scan_trans2(cli, op, level, fnum, dnum, fname);
 224                 }
 225
 226                 for (level = 1000; level < 1050; level++) {
 227                         scan_trans2(cli, op, level, fnum, dnum, fname);
 228                 }
 229         }
 230
 231         torture_close_connection(cli);
 232
 233         printf("trans2 scan finished\n");
 234         return True;
 235 }
 236
 237
 238
 239
 240 /****************************************************************************
 241 look for a partial hit
 242 ****************************************************************************/
 243 static void nttrans_check_hit(const char *format, int op, int level, NTSTATUS status)
 244 {
 245         if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
 246             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
 247             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
 248             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
 249             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
 250                 return;
 251         }
 252 #if VERBOSE
 253                 printf("possible %s hit op=%3d level=%5d status=%s\n",
 254                        format, op, level, nt_errstr(status));
 255 #endif
 256 }
 257
 258 /****************************************************************************
 259 check for existance of a nttrans call
 260 ****************************************************************************/
 261 static NTSTATUS try_nttrans(struct cli_state *cli,
 262                             int op,
 263                             uint8_t *param, uint8_t *data,
 264                             int32_t param_len, uint32_t data_len,
 265                             uint32_t *rparam_len,
 266                             uint32_t *rdata_len)
 267 {
 268         uint8_t *rparam=NULL, *rdata=NULL;
 269         NTSTATUS status;
 270
 271         status = cli_trans(talloc_tos(), cli, SMBnttrans,
 272                            NULL, -1, /* name, fid */
 273                            op, 0,
 274                            NULL, 0, 0, /* setup */
 275                            param, param_len, 2,
 276                            data, data_len, cli->max_xmit,
 277                            NULL,                /* recv_flags2 */
 278                            NULL, 0, NULL,       /* rsetup */
 279                            &rparam, 0, rparam_len,
 280                            &rdata, 0, rdata_len);
 281         SAFE_FREE(rdata);
 282         SAFE_FREE(rparam);
 283
 284         return status;
 285 }
 286
 287
 288 static NTSTATUS try_nttrans_len(struct cli_state *cli,
 289                              const char *format,
 290                              int op, int level,
 291                              uint8_t *param, uint8_t *data,
 292                              int param_len, uint32_t *data_len,
 293                              uint32_t *rparam_len, uint32_t *rdata_len)
 294 {
 295         NTSTATUS ret=NT_STATUS_OK;
 296
 297         ret = try_nttrans(cli, op, param, data, param_len,
 298                          DATA_SIZE, rparam_len, rdata_len);
 299 #if VERBOSE
 300         printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
 301 #endif
 302         if (!NT_STATUS_IS_OK(ret)) return ret;
 303
 304         *data_len = 0;
 305         while (*data_len < DATA_SIZE) {
 306                 ret = try_nttrans(cli, op, param, data, param_len,
 307                                  *data_len, rparam_len, rdata_len);
 308                 if (NT_STATUS_IS_OK(ret)) break;
 309                 *data_len += 2;
 310         }
 311         if (NT_STATUS_IS_OK(ret)) {
 312                 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
 313                        format, level, *data_len, *rparam_len, *rdata_len);
 314         } else {
 315                 nttrans_check_hit(format, op, level, ret);
 316         }
 317         return ret;
 318 }
 319
 320 /****************************************************************************
 321 check for existance of a nttrans call
 322 ****************************************************************************/
 323 static bool scan_nttrans(struct cli_state *cli, int op, int level,
 324                         int fnum, int dnum, const char *fname)
 325 {
 326         uint32_t data_len = 0;
 327         uint32_t param_len = 0;
 328         uint32_t rparam_len, rdata_len;
 329         uint8_t param[PARAM_SIZE], data[DATA_SIZE];
 330         NTSTATUS status;
 331
 332         memset(data, 0, sizeof(data));
 333         data_len = 4;
 334
 335         /* try with a info level only */
 336         param_len = 2;
 337         SSVAL(param, 0, level);
 338         status = try_nttrans_len(cli, "void", op, level, param, data, param_len, &data_len,
 339                             &rparam_len, &rdata_len);
 340         if (NT_STATUS_IS_OK(status)) return True;
 341
 342         /* try with a file descriptor */
 343         param_len = 6;
 344         SSVAL(param, 0, fnum);
 345         SSVAL(param, 2, level);
 346         SSVAL(param, 4, 0);
 347         status = try_nttrans_len(cli, "fnum", op, level, param, data, param_len, &data_len,
 348                                 &rparam_len, &rdata_len);
 349         if (NT_STATUS_IS_OK(status)) return True;
 350
 351
 352         /* try with a notify style */
 353         param_len = 6;
 354         SSVAL(param, 0, dnum);
 355         SSVAL(param, 2, dnum);
 356         SSVAL(param, 4, level);
 357         status = try_nttrans_len(cli, "notify", op, level, param, data, param_len, &data_len,
 358                                 &rparam_len, &rdata_len);
 359         if (NT_STATUS_IS_OK(status)) return True;
 360
 361         /* try with a file name */
 362         param_len = 6;
 363         SSVAL(param, 0, level);
 364         SSVAL(param, 2, 0);
 365         SSVAL(param, 4, 0);
 366         param_len += clistr_push(cli, &param[6], fname, -1, STR_TERMINATE);
 367
 368         status = try_nttrans_len(cli, "fname", op, level, param, data, param_len, &data_len,
 369                                 &rparam_len, &rdata_len);
 370         if (NT_STATUS_IS_OK(status)) return True;
 371
 372         /* try with a new file name */
 373         param_len = 6;
 374         SSVAL(param, 0, level);
 375         SSVAL(param, 2, 0);
 376         SSVAL(param, 4, 0);
 377         param_len += clistr_push(cli, &param[6], "\\newfile.dat", -1, STR_TERMINATE);
 378
 379         status = try_nttrans_len(cli, "newfile", op, level, param, data, param_len, &data_len,
 380                                 &rparam_len, &rdata_len);
 381         cli_unlink(cli, "\\newfile.dat", aSYSTEM | aHIDDEN);
 382         cli_rmdir(cli, "\\newfile.dat");
 383         if (NT_STATUS_IS_OK(status)) return True;
 384
 385         /* try dfs style  */
 386         cli_mkdir(cli, "\\testdir");
 387         param_len = 2;
 388         SSVAL(param, 0, level);
 389         param_len += clistr_push(cli, &param[2], "\\testdir", -1, STR_TERMINATE);
 390
 391         status = try_nttrans_len(cli, "dfs", op, level, param, data, param_len, &data_len,
 392                                 &rparam_len, &rdata_len);
 393         cli_rmdir(cli, "\\testdir");
 394         if (NT_STATUS_IS_OK(status)) return True;
 395
 396         return False;
 397 }
 398
 399
 400 bool torture_nttrans_scan(int dummy)
 401 {
 402         static struct cli_state *cli;
 403         int op, level;
 404         const char *fname = "\\scanner.dat";
 405         uint16_t fnum, dnum;
 406
 407         printf("starting nttrans scan test\n");
 408
 409         if (!torture_open_connection(&cli, 0)) {
 410                 return False;
 411         }
 412
 413         cli_open(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
 414                          DENY_NONE, &fnum);
 415         cli_open(cli, "\\", O_RDONLY, DENY_NONE, &dnum);
 416
 417         for (op=OP_MIN; op<=OP_MAX; op++) {
 418                 printf("Scanning op=%d\n", op);
 419                 for (level = 0; level <= 50; level++) {
 420                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 421                 }
 422
 423                 for (level = 0x100; level <= 0x130; level++) {
 424                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 425                 }
 426
 427                 for (level = 1000; level < 1050; level++) {
 428                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 429                 }
 430         }
 431
 432         torture_close_connection(cli);
 433
 434         printf("nttrans scan finished\n");
 435         return True;
 436 }