2 Unix SMB/CIFS implementation.
4 SMB2 client request handling
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/smb2/smb2.h"
26 #include "../lib/util/dlinklist.h"
27 #include "lib/events/events.h"
28 #include "libcli/smb2/smb2_calls.h"
30 /* fill in the bufinfo */
31 void smb2_setup_bufinfo(struct smb2_request
*req
)
33 req
->in
.bufinfo
.mem_ctx
= req
;
34 req
->in
.bufinfo
.flags
= BUFINFO_FLAG_UNICODE
| BUFINFO_FLAG_SMB2
;
35 req
->in
.bufinfo
.align_base
= req
->in
.buffer
;
36 if (req
->in
.dynamic
) {
37 req
->in
.bufinfo
.data
= req
->in
.dynamic
;
38 req
->in
.bufinfo
.data_size
= req
->in
.body_size
- req
->in
.body_fixed
;
40 req
->in
.bufinfo
.data
= NULL
;
41 req
->in
.bufinfo
.data_size
= 0;
46 initialise a smb2 request
48 struct smb2_request
*smb2_request_init(struct smb2_transport
*transport
, uint16_t opcode
,
49 uint16_t body_fixed_size
, bool body_dynamic_present
,
50 uint32_t body_dynamic_size
)
52 struct smb2_request
*req
;
54 bool compound
= false;
56 if (body_dynamic_present
) {
57 if (body_dynamic_size
== 0) {
58 body_dynamic_size
= 1;
61 body_dynamic_size
= 0;
64 req
= talloc_zero(transport
, struct smb2_request
);
65 if (req
== NULL
) return NULL
;
67 req
->state
= SMB2_REQUEST_INIT
;
68 req
->transport
= transport
;
70 hdr_offset
= NBT_HDR_SIZE
;
72 req
->out
.size
= hdr_offset
+ SMB2_HDR_BODY
+ body_fixed_size
;
73 req
->out
.allocated
= req
->out
.size
+ body_dynamic_size
;
75 req
->out
.buffer
= talloc_realloc(req
, req
->out
.buffer
,
76 uint8_t, req
->out
.allocated
);
77 if (req
->out
.buffer
== NULL
) {
82 req
->out
.hdr
= req
->out
.buffer
+ hdr_offset
;
83 req
->out
.body
= req
->out
.hdr
+ SMB2_HDR_BODY
;
84 req
->out
.body_fixed
= body_fixed_size
;
85 req
->out
.body_size
= body_fixed_size
;
86 req
->out
.dynamic
= (body_dynamic_size
? req
->out
.body
+ body_fixed_size
: NULL
);
88 SIVAL(req
->out
.hdr
, 0, SMB2_MAGIC
);
89 SSVAL(req
->out
.hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
90 SSVAL(req
->out
.hdr
, SMB2_HDR_CREDIT_CHARGE
, 0);
91 SIVAL(req
->out
.hdr
, SMB2_HDR_STATUS
, 0);
92 SSVAL(req
->out
.hdr
, SMB2_HDR_OPCODE
, opcode
);
93 SSVAL(req
->out
.hdr
, SMB2_HDR_CREDIT
, 0);
94 SIVAL(req
->out
.hdr
, SMB2_HDR_FLAGS
, 0);
95 SIVAL(req
->out
.hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
96 SBVAL(req
->out
.hdr
, SMB2_HDR_MESSAGE_ID
, 0);
97 SIVAL(req
->out
.hdr
, SMB2_HDR_PID
, 0);
98 SIVAL(req
->out
.hdr
, SMB2_HDR_TID
, 0);
99 SBVAL(req
->out
.hdr
, SMB2_HDR_SESSION_ID
, 0);
100 memset(req
->out
.hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
102 /* set the length of the fixed body part and +1 if there's a dynamic part also */
103 SSVAL(req
->out
.body
, 0, body_fixed_size
+ (body_dynamic_size
?1:0));
106 * if we have a dynamic part, make sure the first byte
107 * which is always be part of the packet is initialized
109 if (body_dynamic_size
&& !compound
) {
111 SCVAL(req
->out
.dynamic
, 0, 0);
118 initialise a smb2 request for tree operations
120 struct smb2_request
*smb2_request_init_tree(struct smb2_tree
*tree
, uint16_t opcode
,
121 uint16_t body_fixed_size
, bool body_dynamic_present
,
122 uint32_t body_dynamic_size
)
124 struct smb2_request
*req
= smb2_request_init(tree
->session
->transport
, opcode
,
125 body_fixed_size
, body_dynamic_present
,
127 if (req
== NULL
) return NULL
;
129 SIVAL(req
->out
.hdr
, SMB2_HDR_PID
, tree
->session
->pid
);
130 req
->session
= tree
->session
;
136 /* destroy a request structure and return final status */
137 NTSTATUS
smb2_request_destroy(struct smb2_request
*req
)
141 /* this is the error code we give the application for when a
142 _send() call fails completely */
143 if (!req
) return NT_STATUS_UNSUCCESSFUL
;
145 if (req
->state
== SMB2_REQUEST_ERROR
&&
146 NT_STATUS_IS_OK(req
->status
)) {
147 status
= NT_STATUS_INTERNAL_ERROR
;
149 status
= req
->status
;
157 receive a response to a packet
159 bool smb2_request_receive(struct smb2_request
*req
)
161 /* req can be NULL when a send has failed. This eliminates lots of NULL
162 checks in each module */
163 if (!req
) return false;
165 /* keep receiving packets until this one is replied to */
166 while (req
->state
<= SMB2_REQUEST_RECV
) {
167 if (tevent_loop_once(req
->transport
->ev
) != 0) {
172 return req
->state
== SMB2_REQUEST_DONE
;
175 /* Return true if the last packet was in error */
176 bool smb2_request_is_error(struct smb2_request
*req
)
178 return NT_STATUS_IS_ERR(req
->status
);
181 /* Return true if the last packet was OK */
182 bool smb2_request_is_ok(struct smb2_request
*req
)
184 return NT_STATUS_IS_OK(req
->status
);
188 check if a range in the reply body is out of bounds
190 bool smb2_oob(struct smb2_request_buffer
*buf
, const uint8_t *ptr
, size_t size
)
193 /* zero bytes is never out of range */
196 /* be careful with wraparound! */
197 if ((uintptr_t)ptr
< (uintptr_t)buf
->body
||
198 (uintptr_t)ptr
>= (uintptr_t)buf
->body
+ buf
->body_size
||
199 size
> buf
->body_size
||
200 (uintptr_t)ptr
+ size
> (uintptr_t)buf
->body
+ buf
->body_size
) {
206 size_t smb2_padding_size(uint32_t offset
, size_t n
)
208 if ((offset
& (n
-1)) == 0) return 0;
209 return n
- (offset
& (n
-1));
212 static size_t smb2_padding_fix(struct smb2_request_buffer
*buf
)
214 if (buf
->dynamic
== (buf
->body
+ buf
->body_fixed
)) {
215 if (buf
->dynamic
!= (buf
->buffer
+ buf
->size
)) {
223 grow a SMB2 buffer by the specified amount
225 NTSTATUS
smb2_grow_buffer(struct smb2_request_buffer
*buf
, size_t increase
)
230 uint32_t newsize
= buf
->size
+ increase
;
232 /* a packet size should be limited a bit */
233 if (newsize
>= 0x00FFFFFF) return NT_STATUS_MARSHALL_OVERFLOW
;
235 if (newsize
<= buf
->allocated
) return NT_STATUS_OK
;
237 hdr_ofs
= buf
->hdr
- buf
->buffer
;
238 dynamic_ofs
= buf
->dynamic
- buf
->buffer
;
240 buffer_ptr
= talloc_realloc(buf
, buf
->buffer
, uint8_t, newsize
);
241 NT_STATUS_HAVE_NO_MEMORY(buffer_ptr
);
243 buf
->buffer
= buffer_ptr
;
244 buf
->hdr
= buf
->buffer
+ hdr_ofs
;
245 buf
->body
= buf
->hdr
+ SMB2_HDR_BODY
;
246 buf
->dynamic
= buf
->buffer
+ dynamic_ofs
;
247 buf
->allocated
= newsize
;
253 pull a uint16_t ofs/ uint16_t length/blob triple from a data blob
254 the ptr points to the start of the offset/length pair
256 NTSTATUS
smb2_pull_o16s16_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
259 if (smb2_oob(buf
, ptr
, 4)) {
260 return NT_STATUS_INVALID_PARAMETER
;
265 *blob
= data_blob(NULL
, 0);
268 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
269 return NT_STATUS_INVALID_PARAMETER
;
271 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
272 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
277 push a uint16_t ofs/ uint16_t length/blob triple into a data blob
278 the ofs points to the start of the offset/length pair, and is relative
281 NTSTATUS
smb2_push_o16s16_blob(struct smb2_request_buffer
*buf
,
282 uint16_t ofs
, DATA_BLOB blob
)
286 size_t padding_length
;
288 uint8_t *ptr
= buf
->body
+ofs
;
290 if (buf
->dynamic
== NULL
) {
291 return NT_STATUS_INVALID_PARAMETER
;
294 /* we have only 16 bit for the size */
295 if (blob
.length
> 0xFFFF) {
296 return NT_STATUS_INVALID_PARAMETER
;
299 /* check if there're enough room for ofs and size */
300 if (smb2_oob(buf
, ptr
, 4)) {
301 return NT_STATUS_INVALID_PARAMETER
;
304 if (blob
.data
== NULL
) {
305 if (blob
.length
!= 0) {
306 return NT_STATUS_INTERNAL_ERROR
;
313 offset
= buf
->dynamic
- buf
->hdr
;
314 padding_length
= smb2_padding_size(offset
, 2);
315 offset
+= padding_length
;
316 padding_fix
= smb2_padding_fix(buf
);
318 SSVAL(ptr
, 0, offset
);
319 SSVAL(ptr
, 2, blob
.length
);
321 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
322 NT_STATUS_NOT_OK_RETURN(status
);
324 memset(buf
->dynamic
, 0, padding_length
);
325 buf
->dynamic
+= padding_length
;
327 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
328 buf
->dynamic
+= blob
.length
;
330 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
331 buf
->body_size
+= blob
.length
+ padding_length
;
338 push a uint16_t ofs/ uint32_t length/blob triple into a data blob
339 the ofs points to the start of the offset/length pair, and is relative
342 NTSTATUS
smb2_push_o16s32_blob(struct smb2_request_buffer
*buf
,
343 uint16_t ofs
, DATA_BLOB blob
)
347 size_t padding_length
;
349 uint8_t *ptr
= buf
->body
+ofs
;
351 if (buf
->dynamic
== NULL
) {
352 return NT_STATUS_INVALID_PARAMETER
;
355 /* check if there're enough room for ofs and size */
356 if (smb2_oob(buf
, ptr
, 6)) {
357 return NT_STATUS_INVALID_PARAMETER
;
360 if (blob
.data
== NULL
) {
361 if (blob
.length
!= 0) {
362 return NT_STATUS_INTERNAL_ERROR
;
369 offset
= buf
->dynamic
- buf
->hdr
;
370 padding_length
= smb2_padding_size(offset
, 2);
371 offset
+= padding_length
;
372 padding_fix
= smb2_padding_fix(buf
);
374 SSVAL(ptr
, 0, offset
);
375 SIVAL(ptr
, 2, blob
.length
);
377 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
378 NT_STATUS_NOT_OK_RETURN(status
);
380 memset(buf
->dynamic
, 0, padding_length
);
381 buf
->dynamic
+= padding_length
;
383 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
384 buf
->dynamic
+= blob
.length
;
386 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
387 buf
->body_size
+= blob
.length
+ padding_length
;
394 push a uint32_t ofs/ uint32_t length/blob triple into a data blob
395 the ofs points to the start of the offset/length pair, and is relative
398 NTSTATUS
smb2_push_o32s32_blob(struct smb2_request_buffer
*buf
,
399 uint32_t ofs
, DATA_BLOB blob
)
403 size_t padding_length
;
405 uint8_t *ptr
= buf
->body
+ofs
;
407 if (buf
->dynamic
== NULL
) {
408 return NT_STATUS_INVALID_PARAMETER
;
411 /* check if there're enough room for ofs and size */
412 if (smb2_oob(buf
, ptr
, 8)) {
413 return NT_STATUS_INVALID_PARAMETER
;
416 if (blob
.data
== NULL
) {
417 if (blob
.length
!= 0) {
418 return NT_STATUS_INTERNAL_ERROR
;
425 offset
= buf
->dynamic
- buf
->hdr
;
426 padding_length
= smb2_padding_size(offset
, 8);
427 offset
+= padding_length
;
428 padding_fix
= smb2_padding_fix(buf
);
430 SIVAL(ptr
, 0, offset
);
431 SIVAL(ptr
, 4, blob
.length
);
433 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
434 NT_STATUS_NOT_OK_RETURN(status
);
436 memset(buf
->dynamic
, 0, padding_length
);
437 buf
->dynamic
+= padding_length
;
439 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
440 buf
->dynamic
+= blob
.length
;
442 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
443 buf
->body_size
+= blob
.length
+ padding_length
;
450 push a uint32_t length/ uint32_t ofs/blob triple into a data blob
451 the ofs points to the start of the length/offset pair, and is relative
454 NTSTATUS
smb2_push_s32o32_blob(struct smb2_request_buffer
*buf
,
455 uint32_t ofs
, DATA_BLOB blob
)
459 size_t padding_length
;
461 uint8_t *ptr
= buf
->body
+ofs
;
463 if (buf
->dynamic
== NULL
) {
464 return NT_STATUS_INVALID_PARAMETER
;
467 /* check if there're enough room for ofs and size */
468 if (smb2_oob(buf
, ptr
, 8)) {
469 return NT_STATUS_INVALID_PARAMETER
;
472 if (blob
.data
== NULL
) {
473 if (blob
.length
!= 0) {
474 return NT_STATUS_INTERNAL_ERROR
;
481 offset
= buf
->dynamic
- buf
->hdr
;
482 padding_length
= smb2_padding_size(offset
, 8);
483 offset
+= padding_length
;
484 padding_fix
= smb2_padding_fix(buf
);
486 SIVAL(ptr
, 0, blob
.length
);
487 SIVAL(ptr
, 4, offset
);
489 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
490 NT_STATUS_NOT_OK_RETURN(status
);
492 memset(buf
->dynamic
, 0, padding_length
);
493 buf
->dynamic
+= padding_length
;
495 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
496 buf
->dynamic
+= blob
.length
;
498 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
499 buf
->body_size
+= blob
.length
+ padding_length
;
505 pull a uint16_t ofs/ uint32_t length/blob triple from a data blob
506 the ptr points to the start of the offset/length pair
508 NTSTATUS
smb2_pull_o16s32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
513 if (smb2_oob(buf
, ptr
, 6)) {
514 return NT_STATUS_INVALID_PARAMETER
;
519 *blob
= data_blob(NULL
, 0);
522 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
523 return NT_STATUS_INVALID_PARAMETER
;
525 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
526 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
531 pull a uint32_t ofs/ uint32_t length/blob triple from a data blob
532 the ptr points to the start of the offset/length pair
534 NTSTATUS
smb2_pull_o32s32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
537 if (smb2_oob(buf
, ptr
, 8)) {
538 return NT_STATUS_INVALID_PARAMETER
;
543 *blob
= data_blob(NULL
, 0);
546 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
547 return NT_STATUS_INVALID_PARAMETER
;
549 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
550 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
555 pull a uint16_t ofs/ uint32_t length/blob triple from a data blob
556 the ptr points to the start of the offset/length pair
558 In this varient the uint16_t is padded by an extra 2 bytes, making
559 the size aligned on 4 byte boundary
561 NTSTATUS
smb2_pull_o16As32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
564 if (smb2_oob(buf
, ptr
, 8)) {
565 return NT_STATUS_INVALID_PARAMETER
;
570 *blob
= data_blob(NULL
, 0);
573 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
574 return NT_STATUS_INVALID_PARAMETER
;
576 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
577 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
582 pull a uint32_t length/ uint32_t ofs/blob triple from a data blob
583 the ptr points to the start of the offset/length pair
585 NTSTATUS
smb2_pull_s32o32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
588 if (smb2_oob(buf
, ptr
, 8)) {
589 return NT_STATUS_INVALID_PARAMETER
;
594 *blob
= data_blob(NULL
, 0);
597 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
598 return NT_STATUS_INVALID_PARAMETER
;
600 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
601 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
606 pull a uint32_t length/ uint16_t ofs/blob triple from a data blob
607 the ptr points to the start of the offset/length pair
609 NTSTATUS
smb2_pull_s32o16_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
612 if (smb2_oob(buf
, ptr
, 8)) {
613 return NT_STATUS_INVALID_PARAMETER
;
618 *blob
= data_blob(NULL
, 0);
621 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
622 return NT_STATUS_INVALID_PARAMETER
;
624 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
625 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
630 pull a string in a uint16_t ofs/ uint16_t length/blob format
631 UTF-16 without termination
633 NTSTATUS
smb2_pull_o16s16_string(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
,
634 uint8_t *ptr
, const char **str
)
639 size_t converted_size
= 0;
642 status
= smb2_pull_o16s16_blob(buf
, mem_ctx
, ptr
, &blob
);
643 NT_STATUS_NOT_OK_RETURN(status
);
645 if (blob
.data
== NULL
) {
650 if (blob
.length
== 0) {
652 s
= talloc_strdup(mem_ctx
, "");
653 NT_STATUS_HAVE_NO_MEMORY(s
);
658 ret
= convert_string_talloc(mem_ctx
, CH_UTF16
, CH_UNIX
,
659 blob
.data
, blob
.length
, &vstr
, &converted_size
);
660 data_blob_free(&blob
);
661 (*str
) = (char *)vstr
;
663 return NT_STATUS_ILLEGAL_CHARACTER
;
669 push a string in a uint16_t ofs/ uint16_t length/blob format
670 UTF-16 without termination
672 NTSTATUS
smb2_push_o16s16_string(struct smb2_request_buffer
*buf
,
673 uint16_t ofs
, const char *str
)
681 return smb2_push_o16s16_blob(buf
, ofs
, data_blob(NULL
, 0));
685 blob
.data
= discard_const_p(uint8_t, str
);
687 return smb2_push_o16s16_blob(buf
, ofs
, blob
);
690 ret
= convert_string_talloc(buf
->buffer
, CH_UNIX
, CH_UTF16
,
691 str
, strlen(str
), &ptr
, &blob
.length
);
693 return NT_STATUS_ILLEGAL_CHARACTER
;
695 blob
.data
= (uint8_t *)ptr
;
697 status
= smb2_push_o16s16_blob(buf
, ofs
, blob
);
698 data_blob_free(&blob
);
703 push a file handle into a buffer
705 void smb2_push_handle(uint8_t *data
, struct smb2_handle
*h
)
707 SBVAL(data
, 0, h
->data
[0]);
708 SBVAL(data
, 8, h
->data
[1]);
712 pull a file handle from a buffer
714 void smb2_pull_handle(uint8_t *ptr
, struct smb2_handle
*h
)
716 h
->data
[0] = BVAL(ptr
, 0);
717 h
->data
[1] = BVAL(ptr
, 8);