2 Unix SMB/CIFS implementation.
4 dcerpc over SMB transport
6 Copyright (C) Tim Potter 2003
7 Copyright (C) Andrew Tridgell 2003
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/composite/composite.h"
26 #include "librpc/rpc/dcerpc.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/rpc/rpc_common.h"
30 /* transport private information used by SMB pipe transport */
33 struct smbcli_tree
*tree
;
34 const char *server_name
;
40 tell the dcerpc layer that the transport is dead
42 static void pipe_dead(struct dcecli_connection
*c
, NTSTATUS status
)
44 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
52 if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL
, status
)) {
53 status
= NT_STATUS_UNEXPECTED_NETWORK_ERROR
;
56 if (NT_STATUS_EQUAL(NT_STATUS_OK
, status
)) {
57 status
= NT_STATUS_END_OF_FILE
;
60 if (c
->transport
.recv_data
) {
61 c
->transport
.recv_data(c
, NULL
, status
);
67 this holds the state of an in-flight call
69 struct smb_read_state
{
70 struct dcecli_connection
*c
;
71 struct smbcli_request
*req
;
78 called when a read request has completed
80 static void smb_read_callback(struct smbcli_request
*req
)
82 struct dcecli_connection
*c
;
83 struct smb_private
*smb
;
84 struct smb_read_state
*state
;
89 state
= talloc_get_type(req
->async
.private_data
, struct smb_read_state
);
90 smb
= talloc_get_type(state
->c
->transport
.private_data
, struct smb_private
);
94 status
= smb_raw_read_recv(state
->req
, io
);
95 if (NT_STATUS_IS_ERR(status
)) {
101 state
->received
+= io
->readx
.out
.nread
;
103 if (state
->received
< 16) {
104 DEBUG(0,("dcerpc_smb: short packet (length %d) in read callback!\n",
105 (int)state
->received
));
107 pipe_dead(c
, NT_STATUS_INFO_LENGTH_MISMATCH
);
111 frag_length
= dcerpc_get_frag_length(&state
->data
);
113 if (frag_length
<= state
->received
) {
114 DATA_BLOB data
= state
->data
;
115 data
.length
= state
->received
;
116 talloc_steal(state
->c
, data
.data
);
118 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
122 /* initiate another read request, as we only got part of a fragment */
123 state
->data
.data
= talloc_realloc(state
, state
->data
.data
, uint8_t, frag_length
);
125 io
->readx
.in
.mincnt
= MIN(state
->c
->srv_max_xmit_frag
,
126 frag_length
- state
->received
);
127 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
128 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
130 state
->req
= smb_raw_read_send(smb
->tree
, io
);
131 if (state
->req
== NULL
) {
133 pipe_dead(c
, NT_STATUS_NO_MEMORY
);
137 state
->req
->async
.fn
= smb_read_callback
;
138 state
->req
->async
.private_data
= state
;
142 trigger a read request from the server, possibly with some initial
143 data in the read buffer
145 static NTSTATUS
send_read_request_continue(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
147 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
149 struct smb_read_state
*state
;
150 struct smbcli_request
*req
;
152 state
= talloc(smb
, struct smb_read_state
);
154 return NT_STATUS_NO_MEMORY
;
160 state
->data
= data_blob_talloc(state
, NULL
, 0x2000);
162 uint32_t frag_length
= blob
->length
>=16?
163 dcerpc_get_frag_length(blob
):0x2000;
164 state
->received
= blob
->length
;
165 state
->data
= data_blob_talloc(state
, NULL
, frag_length
);
166 if (!state
->data
.data
) {
168 return NT_STATUS_NO_MEMORY
;
170 memcpy(state
->data
.data
, blob
->data
, blob
->length
);
173 state
->io
= talloc(state
, union smb_read
);
176 io
->generic
.level
= RAW_READ_READX
;
177 io
->readx
.in
.file
.fnum
= smb
->fnum
;
178 io
->readx
.in
.mincnt
= state
->data
.length
- state
->received
;
179 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
180 io
->readx
.in
.offset
= 0;
181 io
->readx
.in
.remaining
= 0;
182 io
->readx
.in
.read_for_execute
= false;
183 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
184 req
= smb_raw_read_send(smb
->tree
, io
);
186 return NT_STATUS_NO_MEMORY
;
189 req
->async
.fn
= smb_read_callback
;
190 req
->async
.private_data
= state
;
199 trigger a read request from the server
201 static NTSTATUS
send_read_request(struct dcecli_connection
*c
)
203 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
206 return NT_STATUS_CONNECTION_DISCONNECTED
;
209 return send_read_request_continue(c
, NULL
);
213 this holds the state of an in-flight trans call
215 struct smb_trans_state
{
216 struct dcecli_connection
*c
;
217 struct smbcli_request
*req
;
218 struct smb_trans2
*trans
;
222 called when a trans request has completed
224 static void smb_trans_callback(struct smbcli_request
*req
)
226 struct smb_trans_state
*state
= (struct smb_trans_state
*)req
->async
.private_data
;
227 struct dcecli_connection
*c
= state
->c
;
230 status
= smb_raw_trans_recv(req
, state
, state
->trans
);
232 if (NT_STATUS_IS_ERR(status
)) {
233 pipe_dead(c
, status
);
237 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
238 DATA_BLOB data
= state
->trans
->out
.data
;
239 talloc_steal(c
, data
.data
);
241 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
245 /* there is more to receive - setup a readx */
246 send_read_request_continue(c
, &state
->trans
->out
.data
);
251 send a SMBtrans style request
253 static NTSTATUS
smb_send_trans_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
255 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
256 struct smb_trans2
*trans
;
258 struct smb_trans_state
*state
;
261 state
= talloc(c
, struct smb_trans_state
);
263 return NT_STATUS_NO_MEMORY
;
267 state
->trans
= talloc(state
, struct smb_trans2
);
268 trans
= state
->trans
;
270 trans
->in
.data
= *blob
;
271 trans
->in
.params
= data_blob(NULL
, 0);
273 setup
[0] = TRANSACT_DCERPCCMD
;
274 setup
[1] = smb
->fnum
;
276 if (c
->srv_max_xmit_frag
> 0) {
277 max_data
= MIN(UINT16_MAX
, c
->srv_max_xmit_frag
);
279 max_data
= UINT16_MAX
;
282 trans
->in
.max_param
= 0;
283 trans
->in
.max_data
= max_data
;
284 trans
->in
.max_setup
= 0;
285 trans
->in
.setup_count
= 2;
287 trans
->in
.timeout
= 0;
288 trans
->in
.setup
= setup
;
289 trans
->in
.trans_name
= "\\PIPE\\";
291 state
->req
= smb_raw_trans_send(smb
->tree
, trans
);
292 if (state
->req
== NULL
) {
294 return NT_STATUS_NO_MEMORY
;
297 state
->req
->async
.fn
= smb_trans_callback
;
298 state
->req
->async
.private_data
= state
;
300 talloc_steal(state
, state
->req
);
306 called when a write request has completed
308 static void smb_write_callback(struct smbcli_request
*req
)
310 struct dcecli_connection
*c
= (struct dcecli_connection
*)req
->async
.private_data
;
312 if (!NT_STATUS_IS_OK(req
->status
)) {
313 DEBUG(0,("dcerpc_smb: write callback error\n"));
314 pipe_dead(c
, req
->status
);
317 smbcli_request_destroy(req
);
321 send a packet to the server
323 static NTSTATUS
smb_send_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
,
326 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
328 struct smbcli_request
*req
;
330 if (!smb
|| smb
->dead
) {
331 return NT_STATUS_CONNECTION_DISCONNECTED
;
335 return smb_send_trans_request(c
, blob
);
338 io
.generic
.level
= RAW_WRITE_WRITEX
;
339 io
.writex
.in
.file
.fnum
= smb
->fnum
;
340 io
.writex
.in
.offset
= 0;
341 io
.writex
.in
.wmode
= PIPE_START_MESSAGE
;
342 io
.writex
.in
.remaining
= blob
->length
;
343 io
.writex
.in
.count
= blob
->length
;
344 io
.writex
.in
.data
= blob
->data
;
346 /* we must not timeout at the smb level for rpc requests, as otherwise
347 signing/sealing can be messed up */
348 smb
->tree
->session
->transport
->options
.request_timeout
= 0;
350 req
= smb_raw_write_send(smb
->tree
, &io
);
352 return NT_STATUS_NO_MEMORY
;
355 req
->async
.fn
= smb_write_callback
;
356 req
->async
.private_data
= c
;
359 send_read_request(c
);
366 static void free_request(struct smbcli_request
*req
)
372 shutdown SMB pipe connection
374 static NTSTATUS
smb_shutdown_pipe(struct dcecli_connection
*c
, NTSTATUS status
)
376 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
378 struct smbcli_request
*req
;
380 /* maybe we're still starting up */
381 if (!smb
) return status
;
383 io
.close
.level
= RAW_CLOSE_CLOSE
;
384 io
.close
.in
.file
.fnum
= smb
->fnum
;
385 io
.close
.in
.write_time
= 0;
386 req
= smb_raw_close_send(smb
->tree
, &io
);
388 /* we don't care if this fails, so just free it if it succeeds */
389 req
->async
.fn
= free_request
;
393 c
->transport
.private_data
= NULL
;
399 return SMB server name (called name)
401 static const char *smb_peer_name(struct dcecli_connection
*c
)
403 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
404 if (smb
== NULL
) return "";
405 return smb
->server_name
;
409 return remote name we make the actual connection (good for kerberos)
411 static const char *smb_target_hostname(struct dcecli_connection
*c
)
413 struct smb_private
*smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
414 if (smb
== NULL
) return "";
415 return smb
->tree
->session
->transport
->socket
->hostname
;
419 fetch the user session key
421 static NTSTATUS
smb_session_key(struct dcecli_connection
*c
, DATA_BLOB
*session_key
)
423 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
425 if (smb
== NULL
) return NT_STATUS_CONNECTION_DISCONNECTED
;
426 if (smb
->tree
->session
->user_session_key
.data
) {
427 *session_key
= smb
->tree
->session
->user_session_key
;
430 return NT_STATUS_NO_USER_SESSION_KEY
;
433 struct pipe_open_smb_state
{
434 union smb_open
*open
;
435 struct dcecli_connection
*c
;
436 struct smbcli_tree
*tree
;
437 struct composite_context
*ctx
;
440 static void pipe_open_recv(struct smbcli_request
*req
);
442 struct composite_context
*dcerpc_pipe_open_smb_send(struct dcerpc_pipe
*p
,
443 struct smbcli_tree
*tree
,
444 const char *pipe_name
)
446 struct composite_context
*ctx
;
447 struct pipe_open_smb_state
*state
;
448 struct smbcli_request
*req
;
449 struct dcecli_connection
*c
= p
->conn
;
451 /* if we don't have a binding on this pipe yet, then create one */
452 if (p
->binding
== NULL
) {
455 SMB_ASSERT(tree
->session
->transport
->socket
->hostname
!= NULL
);
456 s
= talloc_asprintf(p
, "ncacn_np:%s", tree
->session
->transport
->socket
->hostname
);
457 if (s
== NULL
) return NULL
;
458 status
= dcerpc_parse_binding(p
, s
, &p
->binding
);
460 if (!NT_STATUS_IS_OK(status
)) {
465 ctx
= composite_create(c
, c
->event_ctx
);
466 if (ctx
== NULL
) return NULL
;
468 state
= talloc(ctx
, struct pipe_open_smb_state
);
469 if (composite_nomem(state
, ctx
)) return ctx
;
470 ctx
->private_data
= state
;
476 state
->open
= talloc(state
, union smb_open
);
477 if (composite_nomem(state
->open
, ctx
)) return ctx
;
479 state
->open
->ntcreatex
.level
= RAW_OPEN_NTCREATEX
;
480 state
->open
->ntcreatex
.in
.flags
= 0;
481 state
->open
->ntcreatex
.in
.root_fid
.fnum
= 0;
482 state
->open
->ntcreatex
.in
.access_mask
=
483 SEC_STD_READ_CONTROL
|
484 SEC_FILE_WRITE_ATTRIBUTE
|
488 state
->open
->ntcreatex
.in
.file_attr
= 0;
489 state
->open
->ntcreatex
.in
.alloc_size
= 0;
490 state
->open
->ntcreatex
.in
.share_access
=
491 NTCREATEX_SHARE_ACCESS_READ
|
492 NTCREATEX_SHARE_ACCESS_WRITE
;
493 state
->open
->ntcreatex
.in
.open_disposition
= NTCREATEX_DISP_OPEN
;
494 state
->open
->ntcreatex
.in
.create_options
= 0;
495 state
->open
->ntcreatex
.in
.impersonation
=
496 NTCREATEX_IMPERSONATION_IMPERSONATION
;
497 state
->open
->ntcreatex
.in
.security_flags
= 0;
499 if ((strncasecmp(pipe_name
, "/pipe/", 6) == 0) ||
500 (strncasecmp(pipe_name
, "\\pipe\\", 6) == 0)) {
503 state
->open
->ntcreatex
.in
.fname
=
504 (pipe_name
[0] == '\\') ?
505 talloc_strdup(state
->open
, pipe_name
) :
506 talloc_asprintf(state
->open
, "\\%s", pipe_name
);
507 if (composite_nomem(state
->open
->ntcreatex
.in
.fname
, ctx
)) return ctx
;
509 req
= smb_raw_open_send(tree
, state
->open
);
510 composite_continue_smb(ctx
, req
, pipe_open_recv
, state
);
514 static void pipe_open_recv(struct smbcli_request
*req
)
516 struct pipe_open_smb_state
*state
= talloc_get_type(req
->async
.private_data
,
517 struct pipe_open_smb_state
);
518 struct composite_context
*ctx
= state
->ctx
;
519 struct dcecli_connection
*c
= state
->c
;
520 struct smb_private
*smb
;
522 ctx
->status
= smb_raw_open_recv(req
, state
, state
->open
);
523 if (!composite_is_ok(ctx
)) return;
526 fill in the transport methods
528 c
->transport
.transport
= NCACN_NP
;
529 c
->transport
.private_data
= NULL
;
530 c
->transport
.shutdown_pipe
= smb_shutdown_pipe
;
531 c
->transport
.peer_name
= smb_peer_name
;
532 c
->transport
.target_hostname
= smb_target_hostname
;
534 c
->transport
.send_request
= smb_send_request
;
535 c
->transport
.send_read
= send_read_request
;
536 c
->transport
.recv_data
= NULL
;
538 /* Over-ride the default session key with the SMB session key */
539 c
->security_state
.session_key
= smb_session_key
;
541 smb
= talloc(c
, struct smb_private
);
542 if (composite_nomem(smb
, ctx
)) return;
544 smb
->fnum
= state
->open
->ntcreatex
.out
.file
.fnum
;
545 smb
->tree
= talloc_reference(smb
, state
->tree
);
546 smb
->server_name
= strupper_talloc(smb
,
547 state
->tree
->session
->transport
->called
.name
);
548 if (composite_nomem(smb
->server_name
, ctx
)) return;
551 c
->transport
.private_data
= smb
;
556 NTSTATUS
dcerpc_pipe_open_smb_recv(struct composite_context
*c
)
558 NTSTATUS status
= composite_wait(c
);
563 _PUBLIC_ NTSTATUS
dcerpc_pipe_open_smb(struct dcerpc_pipe
*p
,
564 struct smbcli_tree
*tree
,
565 const char *pipe_name
)
567 struct composite_context
*ctx
= dcerpc_pipe_open_smb_send(p
, tree
,
569 return dcerpc_pipe_open_smb_recv(ctx
);
573 return the SMB tree used for a dcerpc over SMB pipe
575 _PUBLIC_
struct smbcli_tree
*dcerpc_smb_tree(struct dcecli_connection
*c
)
577 struct smb_private
*smb
;
579 if (c
->transport
.transport
!= NCACN_NP
) return NULL
;
581 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
582 if (!smb
) return NULL
;
588 return the SMB fnum used for a dcerpc over SMB pipe (hack for torture operations)
590 _PUBLIC_
uint16_t dcerpc_smb_fnum(struct dcecli_connection
*c
)
592 struct smb_private
*smb
;
594 if (c
->transport
.transport
!= NCACN_NP
) return 0;
596 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);