source3/torture/scanner.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    SMB torture tester - scanning functions
   4    Copyright (C) Andrew Tridgell 2001
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/filesys.h"
  22 #include "torture/proto.h"
  23
  24 #define VERBOSE 0
  25 #define OP_MIN 0
  26 #define OP_MAX 20
  27
  28 #define DATA_SIZE 1024
  29 #define PARAM_SIZE 1024
  30
  31 /****************************************************************************
  32 look for a partial hit
  33 ****************************************************************************/
  34 static void trans2_check_hit(const char *format, int op, int level, NTSTATUS status)
  35 {
  36         if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
  37             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
  38             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
  39             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
  40             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
  41                 return;
  42         }
  43 #if VERBOSE
  44         printf("possible %s hit op=%3d level=%5d status=%s\n",
  45                format, op, level, nt_errstr(status));
  46 #endif
  47 }
  48
  49 /****************************************************************************
  50 check for existance of a trans2 call
  51 ****************************************************************************/
  52 static NTSTATUS try_trans2(struct cli_state *cli,
  53                          int op,
  54                          uint8_t *param, uint8_t *data,
  55                          uint32_t param_len, uint32_t data_len,
  56                          uint32_t *rparam_len, uint32_t *rdata_len)
  57 {
  58         uint16_t setup[1];
  59         uint8_t *rparam=NULL, *rdata=NULL;
  60         NTSTATUS status;
  61
  62         SSVAL(setup+0, 0, op);
  63
  64         status = cli_trans(talloc_tos(), cli, SMBtrans2,
  65                            NULL, -1, /* name, fid */
  66                            op, 0,
  67                            NULL, 0, 0, /* setup */
  68                            param, param_len, 2,
  69                            data, data_len, cli->max_xmit,
  70                            NULL,                /* recv_flags2 */
  71                            NULL, 0, NULL,       /* rsetup */
  72                            &rparam, 0, rparam_len,
  73                            &rdata, 0, rdata_len);
  74
  75         TALLOC_FREE(rdata);
  76         TALLOC_FREE(rparam);
  77
  78         return status;
  79 }
  80
  81
  82 static NTSTATUS try_trans2_len(struct cli_state *cli,
  83                              const char *format,
  84                              int op, int level,
  85                              uint8_t *param, uint8_t *data,
  86                              uint32_t param_len, uint32_t *data_len,
  87                              uint32_t *rparam_len, uint32_t *rdata_len)
  88 {
  89         NTSTATUS ret=NT_STATUS_OK;
  90
  91         ret = try_trans2(cli, op, param, data, param_len,
  92                          DATA_SIZE, rparam_len, rdata_len);
  93 #if VERBOSE
  94         printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
  95 #endif
  96         if (!NT_STATUS_IS_OK(ret)) return ret;
  97
  98         *data_len = 0;
  99         while (*data_len < DATA_SIZE) {
 100                 ret = try_trans2(cli, op, param, data, param_len,
 101                                  *data_len, rparam_len, rdata_len);
 102                 if (NT_STATUS_IS_OK(ret)) break;
 103                 *data_len += 2;
 104         }
 105         if (NT_STATUS_IS_OK(ret)) {
 106                 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
 107                        format, level, *data_len, *rparam_len, *rdata_len);
 108         } else {
 109                 trans2_check_hit(format, op, level, ret);
 110         }
 111         return ret;
 112 }
 113
 114 /****************************************************************************
 115 check for existance of a trans2 call
 116 ****************************************************************************/
 117 static bool scan_trans2(struct cli_state *cli, int op, int level,
 118                         int fnum, int dnum, const char *fname)
 119 {
 120         uint32_t data_len = 0;
 121         uint32_t param_len = 0;
 122         uint32_t rparam_len, rdata_len;
 123         uint8_t param[PARAM_SIZE], data[DATA_SIZE];
 124         NTSTATUS status;
 125
 126         memset(data, 0, sizeof(data));
 127         data_len = 4;
 128
 129         /* try with a info level only */
 130         param_len = 2;
 131         SSVAL(param, 0, level);
 132         status = try_trans2_len(cli, "void", op, level, param, data, param_len, &data_len,
 133                             &rparam_len, &rdata_len);
 134         if (NT_STATUS_IS_OK(status)) return True;
 135
 136         /* try with a file descriptor */
 137         param_len = 6;
 138         SSVAL(param, 0, fnum);
 139         SSVAL(param, 2, level);
 140         SSVAL(param, 4, 0);
 141         status = try_trans2_len(cli, "fnum", op, level, param, data, param_len, &data_len,
 142                                 &rparam_len, &rdata_len);
 143         if (NT_STATUS_IS_OK(status)) return True;
 144
 145
 146         /* try with a notify style */
 147         param_len = 6;
 148         SSVAL(param, 0, dnum);
 149         SSVAL(param, 2, dnum);
 150         SSVAL(param, 4, level);
 151         status = try_trans2_len(cli, "notify", op, level, param, data, param_len, &data_len,
 152                                 &rparam_len, &rdata_len);
 153         if (NT_STATUS_IS_OK(status)) return True;
 154
 155         /* try with a file name */
 156         param_len = 6;
 157         SSVAL(param, 0, level);
 158         SSVAL(param, 2, 0);
 159         SSVAL(param, 4, 0);
 160         param_len += clistr_push(cli, &param[6], fname, -1, STR_TERMINATE);
 161
 162         status = try_trans2_len(cli, "fname", op, level, param, data, param_len, &data_len,
 163                                 &rparam_len, &rdata_len);
 164         if (NT_STATUS_IS_OK(status)) return True;
 165
 166         /* try with a new file name */
 167         param_len = 6;
 168         SSVAL(param, 0, level);
 169         SSVAL(param, 2, 0);
 170         SSVAL(param, 4, 0);
 171         param_len += clistr_push(cli, &param[6], "\\newfile.dat", -1, STR_TERMINATE);
 172
 173         status = try_trans2_len(cli, "newfile", op, level, param, data, param_len, &data_len,
 174                                 &rparam_len, &rdata_len);
 175         cli_unlink(cli, "\\newfile.dat", aSYSTEM | aHIDDEN);
 176         cli_rmdir(cli, "\\newfile.dat");
 177         if (NT_STATUS_IS_OK(status)) return True;
 178
 179         /* try dfs style  */
 180         cli_mkdir(cli, "\\testdir");
 181         param_len = 2;
 182         SSVAL(param, 0, level);
 183         param_len += clistr_push(cli, &param[2], "\\testdir", -1, STR_TERMINATE);
 184
 185         status = try_trans2_len(cli, "dfs", op, level, param, data, param_len, &data_len,
 186                                 &rparam_len, &rdata_len);
 187         cli_rmdir(cli, "\\testdir");
 188         if (NT_STATUS_IS_OK(status)) return True;
 189
 190         return False;
 191 }
 192
 193
 194 bool torture_trans2_scan(int dummy)
 195 {
 196         static struct cli_state *cli;
 197         int op, level;
 198         const char *fname = "\\scanner.dat";
 199         uint16_t fnum, dnum;
 200
 201         printf("starting trans2 scan test\n");
 202
 203         if (!torture_open_connection(&cli, 0)) {
 204                 return False;
 205         }
 206
 207         if (!NT_STATUS_IS_OK(cli_open(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
 208                          DENY_NONE, &fnum))) {
 209                 printf("open of %s failed\n", fname);
 210                 return false;
 211         }
 212         if (!NT_STATUS_IS_OK(cli_open(cli, "\\", O_RDONLY, DENY_NONE, &dnum))) {
 213                 printf("open of \\ failed\n");
 214                 return false;
 215         }
 216
 217         for (op=OP_MIN; op<=OP_MAX; op++) {
 218                 printf("Scanning op=%d\n", op);
 219                 for (level = 0; level <= 50; level++) {
 220                         scan_trans2(cli, op, level, fnum, dnum, fname);
 221                 }
 222
 223                 for (level = 0x100; level <= 0x130; level++) {
 224                         scan_trans2(cli, op, level, fnum, dnum, fname);
 225                 }
 226
 227                 for (level = 1000; level < 1050; level++) {
 228                         scan_trans2(cli, op, level, fnum, dnum, fname);
 229                 }
 230         }
 231
 232         torture_close_connection(cli);
 233
 234         printf("trans2 scan finished\n");
 235         return True;
 236 }
 237
 238
 239
 240
 241 /****************************************************************************
 242 look for a partial hit
 243 ****************************************************************************/
 244 static void nttrans_check_hit(const char *format, int op, int level, NTSTATUS status)
 245 {
 246         if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
 247             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
 248             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
 249             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
 250             NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
 251                 return;
 252         }
 253 #if VERBOSE
 254                 printf("possible %s hit op=%3d level=%5d status=%s\n",
 255                        format, op, level, nt_errstr(status));
 256 #endif
 257 }
 258
 259 /****************************************************************************
 260 check for existance of a nttrans call
 261 ****************************************************************************/
 262 static NTSTATUS try_nttrans(struct cli_state *cli,
 263                             int op,
 264                             uint8_t *param, uint8_t *data,
 265                             int32_t param_len, uint32_t data_len,
 266                             uint32_t *rparam_len,
 267                             uint32_t *rdata_len)
 268 {
 269         uint8_t *rparam=NULL, *rdata=NULL;
 270         NTSTATUS status;
 271
 272         status = cli_trans(talloc_tos(), cli, SMBnttrans,
 273                            NULL, -1, /* name, fid */
 274                            op, 0,
 275                            NULL, 0, 0, /* setup */
 276                            param, param_len, 2,
 277                            data, data_len, cli->max_xmit,
 278                            NULL,                /* recv_flags2 */
 279                            NULL, 0, NULL,       /* rsetup */
 280                            &rparam, 0, rparam_len,
 281                            &rdata, 0, rdata_len);
 282         SAFE_FREE(rdata);
 283         SAFE_FREE(rparam);
 284
 285         return status;
 286 }
 287
 288
 289 static NTSTATUS try_nttrans_len(struct cli_state *cli,
 290                              const char *format,
 291                              int op, int level,
 292                              uint8_t *param, uint8_t *data,
 293                              int param_len, uint32_t *data_len,
 294                              uint32_t *rparam_len, uint32_t *rdata_len)
 295 {
 296         NTSTATUS ret=NT_STATUS_OK;
 297
 298         ret = try_nttrans(cli, op, param, data, param_len,
 299                          DATA_SIZE, rparam_len, rdata_len);
 300 #if VERBOSE
 301         printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
 302 #endif
 303         if (!NT_STATUS_IS_OK(ret)) return ret;
 304
 305         *data_len = 0;
 306         while (*data_len < DATA_SIZE) {
 307                 ret = try_nttrans(cli, op, param, data, param_len,
 308                                  *data_len, rparam_len, rdata_len);
 309                 if (NT_STATUS_IS_OK(ret)) break;
 310                 *data_len += 2;
 311         }
 312         if (NT_STATUS_IS_OK(ret)) {
 313                 printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
 314                        format, level, *data_len, *rparam_len, *rdata_len);
 315         } else {
 316                 nttrans_check_hit(format, op, level, ret);
 317         }
 318         return ret;
 319 }
 320
 321 /****************************************************************************
 322 check for existance of a nttrans call
 323 ****************************************************************************/
 324 static bool scan_nttrans(struct cli_state *cli, int op, int level,
 325                         int fnum, int dnum, const char *fname)
 326 {
 327         uint32_t data_len = 0;
 328         uint32_t param_len = 0;
 329         uint32_t rparam_len, rdata_len;
 330         uint8_t param[PARAM_SIZE], data[DATA_SIZE];
 331         NTSTATUS status;
 332
 333         memset(data, 0, sizeof(data));
 334         data_len = 4;
 335
 336         /* try with a info level only */
 337         param_len = 2;
 338         SSVAL(param, 0, level);
 339         status = try_nttrans_len(cli, "void", op, level, param, data, param_len, &data_len,
 340                             &rparam_len, &rdata_len);
 341         if (NT_STATUS_IS_OK(status)) return True;
 342
 343         /* try with a file descriptor */
 344         param_len = 6;
 345         SSVAL(param, 0, fnum);
 346         SSVAL(param, 2, level);
 347         SSVAL(param, 4, 0);
 348         status = try_nttrans_len(cli, "fnum", op, level, param, data, param_len, &data_len,
 349                                 &rparam_len, &rdata_len);
 350         if (NT_STATUS_IS_OK(status)) return True;
 351
 352
 353         /* try with a notify style */
 354         param_len = 6;
 355         SSVAL(param, 0, dnum);
 356         SSVAL(param, 2, dnum);
 357         SSVAL(param, 4, level);
 358         status = try_nttrans_len(cli, "notify", op, level, param, data, param_len, &data_len,
 359                                 &rparam_len, &rdata_len);
 360         if (NT_STATUS_IS_OK(status)) return True;
 361
 362         /* try with a file name */
 363         param_len = 6;
 364         SSVAL(param, 0, level);
 365         SSVAL(param, 2, 0);
 366         SSVAL(param, 4, 0);
 367         param_len += clistr_push(cli, &param[6], fname, -1, STR_TERMINATE);
 368
 369         status = try_nttrans_len(cli, "fname", op, level, param, data, param_len, &data_len,
 370                                 &rparam_len, &rdata_len);
 371         if (NT_STATUS_IS_OK(status)) return True;
 372
 373         /* try with a new file name */
 374         param_len = 6;
 375         SSVAL(param, 0, level);
 376         SSVAL(param, 2, 0);
 377         SSVAL(param, 4, 0);
 378         param_len += clistr_push(cli, &param[6], "\\newfile.dat", -1, STR_TERMINATE);
 379
 380         status = try_nttrans_len(cli, "newfile", op, level, param, data, param_len, &data_len,
 381                                 &rparam_len, &rdata_len);
 382         cli_unlink(cli, "\\newfile.dat", aSYSTEM | aHIDDEN);
 383         cli_rmdir(cli, "\\newfile.dat");
 384         if (NT_STATUS_IS_OK(status)) return True;
 385
 386         /* try dfs style  */
 387         cli_mkdir(cli, "\\testdir");
 388         param_len = 2;
 389         SSVAL(param, 0, level);
 390         param_len += clistr_push(cli, &param[2], "\\testdir", -1, STR_TERMINATE);
 391
 392         status = try_nttrans_len(cli, "dfs", op, level, param, data, param_len, &data_len,
 393                                 &rparam_len, &rdata_len);
 394         cli_rmdir(cli, "\\testdir");
 395         if (NT_STATUS_IS_OK(status)) return True;
 396
 397         return False;
 398 }
 399
 400
 401 bool torture_nttrans_scan(int dummy)
 402 {
 403         static struct cli_state *cli;
 404         int op, level;
 405         const char *fname = "\\scanner.dat";
 406         uint16_t fnum, dnum;
 407
 408         printf("starting nttrans scan test\n");
 409
 410         if (!torture_open_connection(&cli, 0)) {
 411                 return False;
 412         }
 413
 414         cli_open(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
 415                          DENY_NONE, &fnum);
 416         cli_open(cli, "\\", O_RDONLY, DENY_NONE, &dnum);
 417
 418         for (op=OP_MIN; op<=OP_MAX; op++) {
 419                 printf("Scanning op=%d\n", op);
 420                 for (level = 0; level <= 50; level++) {
 421                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 422                 }
 423
 424                 for (level = 0x100; level <= 0x130; level++) {
 425                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 426                 }
 427
 428                 for (level = 1000; level < 1050; level++) {
 429                         scan_nttrans(cli, op, level, fnum, dnum, fname);
 430                 }
 431         }
 432
 433         torture_close_connection(cli);
 434
 435         printf("nttrans scan finished\n");
 436         return True;
 437 }