source3/rpcclient/cmd_spotlight.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    RPC Spotlight client
   4
   5    Copyright (C) Ralph Boehme 2018
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "rpcclient.h"
  23 #include "libsmb/libsmb.h"
  24 #include "../librpc/gen_ndr/ndr_mdssvc_c.h"
  25 #include "../rpc_server/mdssvc/mdssvc.h"
  26 #include "../rpc_server/mdssvc/dalloc.h"
  27 #include "../rpc_server/mdssvc/marshalling.h"
  28
  29 static NTSTATUS cmd_mdssvc_fetch_properties(
  30                         struct rpc_pipe_client *cli,
  31                         TALLOC_CTX *mem_ctx,
  32                         int argc, const char **argv)
  33 {
  34         struct dcerpc_binding_handle *b = cli->binding_handle;
  35         NTSTATUS status;
  36         uint32_t device_id = 0x2f000045;
  37         uint32_t unkn1 = 23;
  38         uint32_t unkn2 = 0;
  39         struct policy_handle share_handle;
  40         char share_path[1025] = { 0 };
  41         uint32_t mds_status;
  42         uint32_t flags;      /* server always returns 0x6b000001 ? */
  43         uint32_t unkn3;      /* server always returns 0 ? */
  44         struct mdssvc_blob request_blob;
  45         struct mdssvc_blob response_blob;
  46         ssize_t len;
  47         uint32_t max_fragment_size = 64 * 1024;
  48         DALLOC_CTX *d, *mds_reply;
  49         uint64_t *uint64var;
  50         sl_array_t *array1, *array2;
  51         uint32_t unkn4;
  52         int result;
  53         bool ok;
  54
  55         if (argc != 3) {
  56                 printf("Usage: %s SHARENAME MOUNTPATH\n", argv[0]);
  57                 return NT_STATUS_OK;
  58         }
  59
  60         status = dcerpc_mdssvc_open(b, mem_ctx,
  61                                     &device_id,
  62                                     &unkn1,
  63                                     &unkn2,
  64                                     argv[2],
  65                                     argv[1],
  66                                     share_path,
  67                                     &share_handle);
  68         if (!NT_STATUS_IS_OK(status)) {
  69                 goto done;
  70         }
  71
  72         status = dcerpc_mdssvc_unknown1(b, mem_ctx,
  73                                         &share_handle,
  74                                         0,
  75                                         device_id,
  76                                         unkn1,
  77                                         0,
  78                                         geteuid(),
  79                                         getegid(),
  80                                         &mds_status,
  81                                         &flags,
  82                                         &unkn3);
  83         if (!NT_STATUS_IS_OK(status)) {
  84                 goto done;
  85         }
  86
  87         d = dalloc_new(mem_ctx);
  88         if (d == NULL) {
  89                 status = NT_STATUS_NO_MEMORY;
  90                 goto done;
  91         }
  92
  93         mds_reply = dalloc_new(mem_ctx);
  94         if (mds_reply == NULL) {
  95                 status = NT_STATUS_NO_MEMORY;
  96                 goto done;
  97         }
  98
  99         array1 = dalloc_zero(d, sl_array_t);
 100         if (array1 == NULL) {
 101                 status = NT_STATUS_NO_MEMORY;
 102                 goto done;
 103         }
 104
 105         array2 = dalloc_zero(d, sl_array_t);
 106         if (array2 == NULL) {
 107                 status = NT_STATUS_NO_MEMORY;
 108                 goto done;
 109         }
 110
 111         result = dalloc_stradd(array2, "fetchPropertiesForContext:");
 112         if (result != 0) {
 113                 status = NT_STATUS_INTERNAL_ERROR;
 114                 goto done;
 115         }
 116         uint64var = talloc_zero_array(mem_ctx, uint64_t, 2);
 117         if (uint64var == NULL) {
 118                 status = NT_STATUS_NO_MEMORY;
 119                 goto done;
 120         }
 121         talloc_set_name(uint64var, "uint64_t *");
 122
 123         result = dalloc_add(array2, &uint64var[0], uint64_t *);
 124         if (result != 0) {
 125                 status = NT_STATUS_INTERNAL_ERROR;
 126                 goto done;
 127         }
 128
 129         result = dalloc_add(array1, array2, sl_array_t);
 130         if (result != 0) {
 131                 status = NT_STATUS_INTERNAL_ERROR;
 132                 goto done;
 133         }
 134         result = dalloc_add(d, array1, sl_array_t);
 135         if (result != 0) {
 136                 status = NT_STATUS_INTERNAL_ERROR;
 137                 goto done;
 138         }
 139
 140         request_blob.spotlight_blob = talloc_array(mem_ctx, uint8_t, max_fragment_size);
 141         if (request_blob.spotlight_blob == NULL) {
 142                 status = NT_STATUS_INTERNAL_ERROR;
 143                 goto done;
 144         }
 145         request_blob.size = max_fragment_size;
 146
 147         response_blob.spotlight_blob = talloc_array(mem_ctx, uint8_t, max_fragment_size);
 148         if (response_blob.spotlight_blob == NULL) {
 149                 status = NT_STATUS_INTERNAL_ERROR;
 150                 goto done;
 151         }
 152         response_blob.size = max_fragment_size;
 153
 154         len = sl_pack(d, (char *)request_blob.spotlight_blob, request_blob.size);
 155         if (len == -1) {
 156                 status = NT_STATUS_INTERNAL_ERROR;
 157                 goto done;
 158         }
 159         request_blob.length = len;
 160         request_blob.size = len;
 161
 162         status =  dcerpc_mdssvc_cmd(b, mem_ctx,
 163                                     &share_handle,
 164                                     0,
 165                                     device_id,
 166                                     23,
 167                                     0,
 168                                     0x6b000001,
 169                                     request_blob,
 170                                     0,
 171                                     max_fragment_size,
 172                                     1,
 173                                     max_fragment_size,
 174                                     0,
 175                                     0,
 176                                     &mds_status,
 177                                     &response_blob,
 178                                     &unkn4);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 goto done;
 181         }
 182
 183         ok = sl_unpack(mds_reply, (char *)response_blob.spotlight_blob,
 184                        response_blob.length);
 185         if (!ok) {
 186                 DEBUG(1, ("error unpacking Spotlight RPC blob\n"));
 187                 status = NT_STATUS_INTERNAL_ERROR;
 188                 goto done;
 189         }
 190
 191         DEBUG(0, ("%s", dalloc_dump(mds_reply, 0)));
 192
 193 done:
 194         return status;
 195 }
 196
 197 static NTSTATUS cmd_mdssvc_fetch_attributes(
 198                         struct rpc_pipe_client *cli,
 199                         TALLOC_CTX *mem_ctx,
 200                         int argc, const char **argv)
 201 {
 202         struct dcerpc_binding_handle *b = cli->binding_handle;
 203         NTSTATUS status;
 204         uint32_t device_id = 0x2f000045;
 205         uint32_t unkn1 = 23;
 206         uint32_t unkn2 = 0;
 207         struct policy_handle share_handle;
 208         char share_path[1025];
 209         uint32_t mds_status;
 210         uint32_t flags;      /* server always returns 0x6b000001 ? */
 211         uint32_t unkn3;      /* server always returns 0 ? */
 212         struct mdssvc_blob request_blob;
 213         struct mdssvc_blob response_blob;
 214         ssize_t len;
 215         uint32_t max_fragment_size = 64 * 1024;
 216         DALLOC_CTX *d, *mds_reply;
 217         uint64_t *uint64var;
 218         sl_array_t *array;
 219         sl_array_t *cmd_array;
 220         sl_array_t *attr_array;
 221         sl_cnids_t *cnids;
 222         uint64_t cnid;
 223         uint32_t unkn4;
 224         int result;
 225         bool ok;
 226
 227         if (argc != 4) {
 228                 printf("Usage: %s SHARENAME MOUNTPATH CNID\n", argv[0]);
 229                 return NT_STATUS_OK;
 230         }
 231
 232         ok = conv_str_u64(argv[3], &cnid);
 233         if (!ok) {
 234                 printf("Failed to parse: %s\n", argv[3]);
 235                 return NT_STATUS_INVALID_PARAMETER;
 236         }
 237
 238         status = dcerpc_mdssvc_open(b, mem_ctx,
 239                                     &device_id,
 240                                     &unkn1,
 241                                     &unkn2,
 242                                     argv[2],
 243                                     argv[1],
 244                                     share_path,
 245                                     &share_handle);
 246         if (!NT_STATUS_IS_OK(status)) {
 247                 goto done;
 248         }
 249
 250         status = dcerpc_mdssvc_unknown1(b, mem_ctx,
 251                                         &share_handle,
 252                                         0,
 253                                         device_id,
 254                                         unkn1,
 255                                         0,
 256                                         geteuid(),
 257                                         getegid(),
 258                                         &mds_status,
 259                                         &flags,
 260                                         &unkn3);
 261         if (!NT_STATUS_IS_OK(status)) {
 262                 goto done;
 263         }
 264
 265         d = dalloc_new(mem_ctx);
 266         if (d == NULL) {
 267                 status = NT_STATUS_NO_MEMORY;
 268                 goto done;
 269         }
 270
 271         array = dalloc_zero(d, sl_array_t);
 272         if (array == NULL) {
 273                 status = NT_STATUS_NO_MEMORY;
 274                 goto done;
 275         }
 276
 277         result = dalloc_add(d, array, sl_array_t);
 278         if (result != 0) {
 279                 status = NT_STATUS_INTERNAL_ERROR;
 280                 goto done;
 281         }
 282
 283         cmd_array = dalloc_zero(d, sl_array_t);
 284         if (cmd_array == NULL) {
 285                 status = NT_STATUS_NO_MEMORY;
 286                 goto done;
 287         }
 288
 289         result = dalloc_add(array, cmd_array, sl_array_t);
 290         if (result != 0) {
 291                 status = NT_STATUS_INTERNAL_ERROR;
 292                 goto done;
 293         }
 294
 295         result = dalloc_stradd(cmd_array,
 296                                "fetchAttributes:forOIDArray:context:");
 297         if (result != 0) {
 298                 status = NT_STATUS_INTERNAL_ERROR;
 299                 goto done;
 300         }
 301
 302         uint64var = talloc_zero_array(mem_ctx, uint64_t, 2);
 303         if (uint64var == NULL) {
 304                 status = NT_STATUS_NO_MEMORY;
 305                 goto done;
 306         }
 307         talloc_set_name(uint64var, "uint64_t *");
 308         uint64var[0] = 0x500a;
 309         uint64var[1] = 0;
 310
 311         result = dalloc_add(cmd_array, &uint64var[0], uint64_t *);
 312         if (result != 0) {
 313                 status = NT_STATUS_INTERNAL_ERROR;
 314                 goto done;
 315         }
 316
 317         attr_array = dalloc_zero(d, sl_array_t);
 318         if (attr_array == NULL) {
 319                 status = NT_STATUS_NO_MEMORY;
 320                 goto done;
 321         }
 322
 323         result = dalloc_add(array, attr_array, sl_array_t);
 324         if (result != 0) {
 325                 status = NT_STATUS_INTERNAL_ERROR;
 326                 goto done;
 327         }
 328
 329         result = dalloc_stradd(attr_array, "kMDItemPath");
 330         if (result != 0) {
 331                 status = NT_STATUS_INTERNAL_ERROR;
 332                 goto done;
 333         }
 334
 335         /* CNIDs */
 336         cnids = talloc_zero(array, sl_cnids_t);
 337         if (cnids == NULL) {
 338                 status = NT_STATUS_INTERNAL_ERROR;
 339                 goto done;
 340         }
 341         cnids->ca_cnids = dalloc_new(cnids);
 342         if (cnids->ca_cnids == NULL) {
 343                 status = NT_STATUS_INTERNAL_ERROR;
 344                 goto done;
 345         }
 346
 347         cnids->ca_unkn1 = 0xadd;
 348         cnids->ca_context = 0x6b000020;
 349
 350         result = dalloc_add_copy(cnids->ca_cnids, &cnid, uint64_t);
 351         if (result != 0) {
 352                 status = NT_STATUS_INTERNAL_ERROR;
 353                 goto done;
 354         }
 355
 356         result = dalloc_add(array, cnids, sl_cnids_t);
 357         if (result != 0) {
 358                 status = NT_STATUS_INTERNAL_ERROR;
 359                 goto done;
 360         }
 361
 362         request_blob.spotlight_blob = talloc_array(mem_ctx,
 363                                                    uint8_t,
 364                                                    max_fragment_size);
 365         if (request_blob.spotlight_blob == NULL) {
 366                 status = NT_STATUS_INTERNAL_ERROR;
 367                 goto done;
 368         }
 369         request_blob.size = max_fragment_size;
 370
 371         response_blob.spotlight_blob = talloc_array(mem_ctx,
 372                                                     uint8_t,
 373                                                     max_fragment_size);
 374         if (response_blob.spotlight_blob == NULL) {
 375                 status = NT_STATUS_INTERNAL_ERROR;
 376                 goto done;
 377         }
 378         response_blob.size = max_fragment_size;
 379
 380         len = sl_pack(d, (char *)request_blob.spotlight_blob, request_blob.size);
 381         if (len == -1) {
 382                 status = NT_STATUS_INTERNAL_ERROR;
 383                 goto done;
 384         }
 385         request_blob.length = len;
 386         request_blob.size = len;
 387
 388         status = dcerpc_mdssvc_cmd(b, mem_ctx,
 389                                    &share_handle,
 390                                    0,
 391                                    device_id,
 392                                    23,
 393                                    0,
 394                                    0x6b000001,
 395                                    request_blob,
 396                                    0,
 397                                    max_fragment_size,
 398                                    1,
 399                                    max_fragment_size,
 400                                    0,
 401                                    0,
 402                                    &mds_status,
 403                                    &response_blob,
 404                                    &unkn4);
 405         if (!NT_STATUS_IS_OK(status)) {
 406                 printf("dcerpc_mdssvc_cmd failed: %s\n", nt_errstr(status));
 407                 goto done;
 408         }
 409
 410         if (response_blob.length == 0) {
 411                 printf("mdssvc returned empty response\n");
 412                 status = NT_STATUS_RPC_PROTOCOL_ERROR;
 413                 goto done;
 414         }
 415
 416         mds_reply = dalloc_new(mem_ctx);
 417         if (mds_reply == NULL) {
 418                 status = NT_STATUS_NO_MEMORY;
 419                 goto done;
 420         }
 421
 422         ok = sl_unpack(mds_reply, (char *)response_blob.spotlight_blob,
 423                        response_blob.length);
 424         if (!ok) {
 425                 printf("Unpacking Spotlight RPC blob failed\n");
 426                 status = NT_STATUS_INTERNAL_ERROR;
 427                 goto done;
 428         }
 429
 430         printf("%s", dalloc_dump(mds_reply, 0));
 431
 432 done:
 433         return status;
 434 }
 435
 436 /* List of commands exported by this module */
 437
 438 struct cmd_set spotlight_commands[] = {
 439
 440         {
 441                 .name = "MDSSVC"
 442         },
 443         {
 444                 .name = "fetch_properties",
 445                 .returntype = RPC_RTYPE_NTSTATUS,
 446                 .ntfn = cmd_mdssvc_fetch_properties,
 447                 .table = &ndr_table_mdssvc,
 448                 .description = "Fetch connection properties",
 449                 .usage = "",
 450         },
 451         {
 452                 .name = "fetch_attributes",
 453                 .returntype = RPC_RTYPE_NTSTATUS,
 454                 .ntfn = cmd_mdssvc_fetch_attributes,
 455                 .table = &ndr_table_mdssvc,
 456                 .description = "Fetch attributes for a CNID",
 457                 .usage = "",
 458         },
 459         {0}
 460 };