2 Unix SMB/CIFS implementation.
3 SMB torture tester - scanning functions
4 Copyright (C) Andrew Tridgell 2001
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "torture/proto.h"
27 #define DATA_SIZE 1024
28 #define PARAM_SIZE 1024
30 /****************************************************************************
31 look for a partial hit
32 ****************************************************************************/
33 static void trans2_check_hit(const char *format
, int op
, int level
, NTSTATUS status
)
35 if (NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL
) ||
36 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED
) ||
37 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED
) ||
38 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL
) ||
39 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS
)) {
43 printf("possible %s hit op=%3d level=%5d status=%s\n",
44 format
, op
, level
, nt_errstr(status
));
48 /****************************************************************************
49 check for existance of a trans2 call
50 ****************************************************************************/
51 static NTSTATUS
try_trans2(struct cli_state
*cli
,
53 uint8_t *param
, uint8_t *data
,
54 uint32_t param_len
, uint32_t data_len
,
55 uint32_t *rparam_len
, uint32_t *rdata_len
)
58 uint8_t *rparam
=NULL
, *rdata
=NULL
;
61 SSVAL(setup
+0, 0, op
);
63 status
= cli_trans(talloc_tos(), cli
, SMBtrans2
,
64 NULL
, -1, /* name, fid */
66 NULL
, 0, 0, /* setup */
68 data
, data_len
, cli
->max_xmit
,
69 NULL
, /* recv_flags2 */
70 NULL
, 0, NULL
, /* rsetup */
71 &rparam
, 0, rparam_len
,
72 &rdata
, 0, rdata_len
);
81 static NTSTATUS
try_trans2_len(struct cli_state
*cli
,
84 uint8_t *param
, uint8_t *data
,
85 uint32_t param_len
, uint32_t *data_len
,
86 uint32_t *rparam_len
, uint32_t *rdata_len
)
88 NTSTATUS ret
=NT_STATUS_OK
;
90 ret
= try_trans2(cli
, op
, param
, data
, param_len
,
91 DATA_SIZE
, rparam_len
, rdata_len
);
93 printf("op=%d level=%d ret=%s\n", op
, level
, nt_errstr(ret
));
95 if (!NT_STATUS_IS_OK(ret
)) return ret
;
98 while (*data_len
< DATA_SIZE
) {
99 ret
= try_trans2(cli
, op
, param
, data
, param_len
,
100 *data_len
, rparam_len
, rdata_len
);
101 if (NT_STATUS_IS_OK(ret
)) break;
104 if (NT_STATUS_IS_OK(ret
)) {
105 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
106 format
, level
, *data_len
, *rparam_len
, *rdata_len
);
108 trans2_check_hit(format
, op
, level
, ret
);
113 /****************************************************************************
114 check for existance of a trans2 call
115 ****************************************************************************/
116 static bool scan_trans2(struct cli_state
*cli
, int op
, int level
,
117 int fnum
, int dnum
, const char *fname
)
119 uint32_t data_len
= 0;
120 uint32_t param_len
= 0;
121 uint32_t rparam_len
, rdata_len
;
122 uint8_t param
[PARAM_SIZE
], data
[DATA_SIZE
];
125 memset(data
, 0, sizeof(data
));
128 /* try with a info level only */
130 SSVAL(param
, 0, level
);
131 status
= try_trans2_len(cli
, "void", op
, level
, param
, data
, param_len
, &data_len
,
132 &rparam_len
, &rdata_len
);
133 if (NT_STATUS_IS_OK(status
)) return True
;
135 /* try with a file descriptor */
137 SSVAL(param
, 0, fnum
);
138 SSVAL(param
, 2, level
);
140 status
= try_trans2_len(cli
, "fnum", op
, level
, param
, data
, param_len
, &data_len
,
141 &rparam_len
, &rdata_len
);
142 if (NT_STATUS_IS_OK(status
)) return True
;
145 /* try with a notify style */
147 SSVAL(param
, 0, dnum
);
148 SSVAL(param
, 2, dnum
);
149 SSVAL(param
, 4, level
);
150 status
= try_trans2_len(cli
, "notify", op
, level
, param
, data
, param_len
, &data_len
,
151 &rparam_len
, &rdata_len
);
152 if (NT_STATUS_IS_OK(status
)) return True
;
154 /* try with a file name */
156 SSVAL(param
, 0, level
);
159 param_len
+= clistr_push(cli
, ¶m
[6], fname
, -1, STR_TERMINATE
);
161 status
= try_trans2_len(cli
, "fname", op
, level
, param
, data
, param_len
, &data_len
,
162 &rparam_len
, &rdata_len
);
163 if (NT_STATUS_IS_OK(status
)) return True
;
165 /* try with a new file name */
167 SSVAL(param
, 0, level
);
170 param_len
+= clistr_push(cli
, ¶m
[6], "\\newfile.dat", -1, STR_TERMINATE
);
172 status
= try_trans2_len(cli
, "newfile", op
, level
, param
, data
, param_len
, &data_len
,
173 &rparam_len
, &rdata_len
);
174 cli_unlink(cli
, "\\newfile.dat", aSYSTEM
| aHIDDEN
);
175 cli_rmdir(cli
, "\\newfile.dat");
176 if (NT_STATUS_IS_OK(status
)) return True
;
179 cli_mkdir(cli
, "\\testdir");
181 SSVAL(param
, 0, level
);
182 param_len
+= clistr_push(cli
, ¶m
[2], "\\testdir", -1, STR_TERMINATE
);
184 status
= try_trans2_len(cli
, "dfs", op
, level
, param
, data
, param_len
, &data_len
,
185 &rparam_len
, &rdata_len
);
186 cli_rmdir(cli
, "\\testdir");
187 if (NT_STATUS_IS_OK(status
)) return True
;
193 bool torture_trans2_scan(int dummy
)
195 static struct cli_state
*cli
;
197 const char *fname
= "\\scanner.dat";
200 printf("starting trans2 scan test\n");
202 if (!torture_open_connection(&cli
, 0)) {
206 if (!NT_STATUS_IS_OK(cli_open(cli
, fname
, O_RDWR
| O_CREAT
| O_TRUNC
,
207 DENY_NONE
, &fnum
))) {
208 printf("open of %s failed\n", fname
);
211 if (!NT_STATUS_IS_OK(cli_open(cli
, "\\", O_RDONLY
, DENY_NONE
, &dnum
))) {
212 printf("open of \\ failed\n");
216 for (op
=OP_MIN
; op
<=OP_MAX
; op
++) {
217 printf("Scanning op=%d\n", op
);
218 for (level
= 0; level
<= 50; level
++) {
219 scan_trans2(cli
, op
, level
, fnum
, dnum
, fname
);
222 for (level
= 0x100; level
<= 0x130; level
++) {
223 scan_trans2(cli
, op
, level
, fnum
, dnum
, fname
);
226 for (level
= 1000; level
< 1050; level
++) {
227 scan_trans2(cli
, op
, level
, fnum
, dnum
, fname
);
231 torture_close_connection(cli
);
233 printf("trans2 scan finished\n");
240 /****************************************************************************
241 look for a partial hit
242 ****************************************************************************/
243 static void nttrans_check_hit(const char *format
, int op
, int level
, NTSTATUS status
)
245 if (NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL
) ||
246 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED
) ||
247 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED
) ||
248 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL
) ||
249 NT_STATUS_V(status
) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS
)) {
253 printf("possible %s hit op=%3d level=%5d status=%s\n",
254 format
, op
, level
, nt_errstr(status
));
258 /****************************************************************************
259 check for existance of a nttrans call
260 ****************************************************************************/
261 static NTSTATUS
try_nttrans(struct cli_state
*cli
,
263 uint8_t *param
, uint8_t *data
,
264 int32_t param_len
, uint32_t data_len
,
265 uint32_t *rparam_len
,
268 uint8_t *rparam
=NULL
, *rdata
=NULL
;
271 status
= cli_trans(talloc_tos(), cli
, SMBnttrans
,
272 NULL
, -1, /* name, fid */
274 NULL
, 0, 0, /* setup */
276 data
, data_len
, cli
->max_xmit
,
277 NULL
, /* recv_flags2 */
278 NULL
, 0, NULL
, /* rsetup */
279 &rparam
, 0, rparam_len
,
280 &rdata
, 0, rdata_len
);
288 static NTSTATUS
try_nttrans_len(struct cli_state
*cli
,
291 uint8_t *param
, uint8_t *data
,
292 int param_len
, uint32_t *data_len
,
293 uint32_t *rparam_len
, uint32_t *rdata_len
)
295 NTSTATUS ret
=NT_STATUS_OK
;
297 ret
= try_nttrans(cli
, op
, param
, data
, param_len
,
298 DATA_SIZE
, rparam_len
, rdata_len
);
300 printf("op=%d level=%d ret=%s\n", op
, level
, nt_errstr(ret
));
302 if (!NT_STATUS_IS_OK(ret
)) return ret
;
305 while (*data_len
< DATA_SIZE
) {
306 ret
= try_nttrans(cli
, op
, param
, data
, param_len
,
307 *data_len
, rparam_len
, rdata_len
);
308 if (NT_STATUS_IS_OK(ret
)) break;
311 if (NT_STATUS_IS_OK(ret
)) {
312 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
313 format
, level
, *data_len
, *rparam_len
, *rdata_len
);
315 nttrans_check_hit(format
, op
, level
, ret
);
320 /****************************************************************************
321 check for existance of a nttrans call
322 ****************************************************************************/
323 static bool scan_nttrans(struct cli_state
*cli
, int op
, int level
,
324 int fnum
, int dnum
, const char *fname
)
326 uint32_t data_len
= 0;
327 uint32_t param_len
= 0;
328 uint32_t rparam_len
, rdata_len
;
329 uint8_t param
[PARAM_SIZE
], data
[DATA_SIZE
];
332 memset(data
, 0, sizeof(data
));
335 /* try with a info level only */
337 SSVAL(param
, 0, level
);
338 status
= try_nttrans_len(cli
, "void", op
, level
, param
, data
, param_len
, &data_len
,
339 &rparam_len
, &rdata_len
);
340 if (NT_STATUS_IS_OK(status
)) return True
;
342 /* try with a file descriptor */
344 SSVAL(param
, 0, fnum
);
345 SSVAL(param
, 2, level
);
347 status
= try_nttrans_len(cli
, "fnum", op
, level
, param
, data
, param_len
, &data_len
,
348 &rparam_len
, &rdata_len
);
349 if (NT_STATUS_IS_OK(status
)) return True
;
352 /* try with a notify style */
354 SSVAL(param
, 0, dnum
);
355 SSVAL(param
, 2, dnum
);
356 SSVAL(param
, 4, level
);
357 status
= try_nttrans_len(cli
, "notify", op
, level
, param
, data
, param_len
, &data_len
,
358 &rparam_len
, &rdata_len
);
359 if (NT_STATUS_IS_OK(status
)) return True
;
361 /* try with a file name */
363 SSVAL(param
, 0, level
);
366 param_len
+= clistr_push(cli
, ¶m
[6], fname
, -1, STR_TERMINATE
);
368 status
= try_nttrans_len(cli
, "fname", op
, level
, param
, data
, param_len
, &data_len
,
369 &rparam_len
, &rdata_len
);
370 if (NT_STATUS_IS_OK(status
)) return True
;
372 /* try with a new file name */
374 SSVAL(param
, 0, level
);
377 param_len
+= clistr_push(cli
, ¶m
[6], "\\newfile.dat", -1, STR_TERMINATE
);
379 status
= try_nttrans_len(cli
, "newfile", op
, level
, param
, data
, param_len
, &data_len
,
380 &rparam_len
, &rdata_len
);
381 cli_unlink(cli
, "\\newfile.dat", aSYSTEM
| aHIDDEN
);
382 cli_rmdir(cli
, "\\newfile.dat");
383 if (NT_STATUS_IS_OK(status
)) return True
;
386 cli_mkdir(cli
, "\\testdir");
388 SSVAL(param
, 0, level
);
389 param_len
+= clistr_push(cli
, ¶m
[2], "\\testdir", -1, STR_TERMINATE
);
391 status
= try_nttrans_len(cli
, "dfs", op
, level
, param
, data
, param_len
, &data_len
,
392 &rparam_len
, &rdata_len
);
393 cli_rmdir(cli
, "\\testdir");
394 if (NT_STATUS_IS_OK(status
)) return True
;
400 bool torture_nttrans_scan(int dummy
)
402 static struct cli_state
*cli
;
404 const char *fname
= "\\scanner.dat";
407 printf("starting nttrans scan test\n");
409 if (!torture_open_connection(&cli
, 0)) {
413 cli_open(cli
, fname
, O_RDWR
| O_CREAT
| O_TRUNC
,
415 cli_open(cli
, "\\", O_RDONLY
, DENY_NONE
, &dnum
);
417 for (op
=OP_MIN
; op
<=OP_MAX
; op
++) {
418 printf("Scanning op=%d\n", op
);
419 for (level
= 0; level
<= 50; level
++) {
420 scan_nttrans(cli
, op
, level
, fnum
, dnum
, fname
);
423 for (level
= 0x100; level
<= 0x130; level
++) {
424 scan_nttrans(cli
, op
, level
, fnum
, dnum
, fname
);
427 for (level
= 1000; level
< 1050; level
++) {
428 scan_nttrans(cli
, op
, level
, fnum
, dnum
, fname
);
432 torture_close_connection(cli
);
434 printf("nttrans scan finished\n");