2 Unix SMB/CIFS implementation.
4 SMB2 client request handling
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher 2005
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/smb2/smb2.h"
26 #include "../lib/util/dlinklist.h"
27 #include "lib/events/events.h"
28 #include "libcli/smb2/smb2_calls.h"
30 /* fill in the bufinfo */
31 void smb2_setup_bufinfo(struct smb2_request
*req
)
33 req
->in
.bufinfo
.mem_ctx
= req
;
34 req
->in
.bufinfo
.flags
= BUFINFO_FLAG_UNICODE
| BUFINFO_FLAG_SMB2
;
35 req
->in
.bufinfo
.align_base
= req
->in
.buffer
;
36 if (req
->in
.dynamic
) {
37 req
->in
.bufinfo
.data
= req
->in
.dynamic
;
38 req
->in
.bufinfo
.data_size
= req
->in
.body_size
- req
->in
.body_fixed
;
40 req
->in
.bufinfo
.data
= NULL
;
41 req
->in
.bufinfo
.data_size
= 0;
46 initialise a smb2 request
48 struct smb2_request
*smb2_request_init(struct smb2_transport
*transport
, uint16_t opcode
,
49 uint16_t body_fixed_size
, bool body_dynamic_present
,
50 uint32_t body_dynamic_size
)
52 struct smb2_request
*req
;
54 bool compound
= false;
56 if (body_dynamic_present
) {
57 if (body_dynamic_size
== 0) {
58 body_dynamic_size
= 1;
61 body_dynamic_size
= 0;
64 req
= talloc_zero(transport
, struct smb2_request
);
65 if (req
== NULL
) return NULL
;
67 req
->state
= SMB2_REQUEST_INIT
;
68 req
->transport
= transport
;
70 hdr_offset
= NBT_HDR_SIZE
;
72 req
->out
.size
= hdr_offset
+ SMB2_HDR_BODY
+ body_fixed_size
;
73 req
->out
.allocated
= req
->out
.size
+ body_dynamic_size
;
75 req
->out
.buffer
= talloc_realloc(req
, req
->out
.buffer
,
76 uint8_t, req
->out
.allocated
);
77 if (req
->out
.buffer
== NULL
) {
82 req
->out
.hdr
= req
->out
.buffer
+ hdr_offset
;
83 req
->out
.body
= req
->out
.hdr
+ SMB2_HDR_BODY
;
84 req
->out
.body_fixed
= body_fixed_size
;
85 req
->out
.body_size
= body_fixed_size
;
86 req
->out
.dynamic
= (body_dynamic_size
? req
->out
.body
+ body_fixed_size
: NULL
);
88 SIVAL(req
->out
.hdr
, 0, SMB2_MAGIC
);
89 SSVAL(req
->out
.hdr
, SMB2_HDR_LENGTH
, SMB2_HDR_BODY
);
90 SSVAL(req
->out
.hdr
, SMB2_HDR_CREDIT_CHARGE
, 0);
91 SIVAL(req
->out
.hdr
, SMB2_HDR_STATUS
, 0);
92 SSVAL(req
->out
.hdr
, SMB2_HDR_OPCODE
, opcode
);
93 SSVAL(req
->out
.hdr
, SMB2_HDR_CREDIT
, 0);
94 SIVAL(req
->out
.hdr
, SMB2_HDR_FLAGS
, 0);
95 SIVAL(req
->out
.hdr
, SMB2_HDR_NEXT_COMMAND
, 0);
96 SBVAL(req
->out
.hdr
, SMB2_HDR_MESSAGE_ID
, 0);
97 SIVAL(req
->out
.hdr
, SMB2_HDR_PID
, 0);
98 SIVAL(req
->out
.hdr
, SMB2_HDR_TID
, 0);
99 SBVAL(req
->out
.hdr
, SMB2_HDR_SESSION_ID
, 0);
100 memset(req
->out
.hdr
+SMB2_HDR_SIGNATURE
, 0, 16);
102 /* set the length of the fixed body part and +1 if there's a dynamic part also */
103 SSVAL(req
->out
.body
, 0, body_fixed_size
+ (body_dynamic_size
?1:0));
106 * if we have a dynamic part, make sure the first byte
107 * which is always be part of the packet is initialized
109 if (body_dynamic_size
&& !compound
) {
111 SCVAL(req
->out
.dynamic
, 0, 0);
118 initialise a smb2 request for tree operations
120 struct smb2_request
*smb2_request_init_tree(struct smb2_tree
*tree
, uint16_t opcode
,
121 uint16_t body_fixed_size
, bool body_dynamic_present
,
122 uint32_t body_dynamic_size
)
124 struct smb2_request
*req
= smb2_request_init(tree
->session
->transport
, opcode
,
125 body_fixed_size
, body_dynamic_present
,
127 if (req
== NULL
) return NULL
;
129 req
->session
= tree
->session
;
135 /* destroy a request structure and return final status */
136 NTSTATUS
smb2_request_destroy(struct smb2_request
*req
)
140 /* this is the error code we give the application for when a
141 _send() call fails completely */
142 if (!req
) return NT_STATUS_UNSUCCESSFUL
;
144 if (req
->state
== SMB2_REQUEST_ERROR
&&
145 NT_STATUS_IS_OK(req
->status
)) {
146 status
= NT_STATUS_INTERNAL_ERROR
;
148 status
= req
->status
;
156 receive a response to a packet
158 bool smb2_request_receive(struct smb2_request
*req
)
160 /* req can be NULL when a send has failed. This eliminates lots of NULL
161 checks in each module */
162 if (!req
) return false;
164 /* keep receiving packets until this one is replied to */
165 while (req
->state
<= SMB2_REQUEST_RECV
) {
166 if (tevent_loop_once(req
->transport
->ev
) != 0) {
171 return req
->state
== SMB2_REQUEST_DONE
;
174 /* Return true if the last packet was in error */
175 bool smb2_request_is_error(struct smb2_request
*req
)
177 return NT_STATUS_IS_ERR(req
->status
);
180 /* Return true if the last packet was OK */
181 bool smb2_request_is_ok(struct smb2_request
*req
)
183 return NT_STATUS_IS_OK(req
->status
);
187 check if a range in the reply body is out of bounds
189 bool smb2_oob(struct smb2_request_buffer
*buf
, const uint8_t *ptr
, size_t size
)
192 /* zero bytes is never out of range */
195 /* be careful with wraparound! */
196 if ((uintptr_t)ptr
< (uintptr_t)buf
->body
||
197 (uintptr_t)ptr
>= (uintptr_t)buf
->body
+ buf
->body_size
||
198 size
> buf
->body_size
||
199 (uintptr_t)ptr
+ size
> (uintptr_t)buf
->body
+ buf
->body_size
) {
205 size_t smb2_padding_size(uint32_t offset
, size_t n
)
207 if ((offset
& (n
-1)) == 0) return 0;
208 return n
- (offset
& (n
-1));
211 static size_t smb2_padding_fix(struct smb2_request_buffer
*buf
)
213 if (buf
->dynamic
== (buf
->body
+ buf
->body_fixed
)) {
214 if (buf
->dynamic
!= (buf
->buffer
+ buf
->size
)) {
222 grow a SMB2 buffer by the specified amount
224 NTSTATUS
smb2_grow_buffer(struct smb2_request_buffer
*buf
, size_t increase
)
229 uint32_t newsize
= buf
->size
+ increase
;
231 /* a packet size should be limited a bit */
232 if (newsize
>= 0x00FFFFFF) return NT_STATUS_MARSHALL_OVERFLOW
;
234 if (newsize
<= buf
->allocated
) return NT_STATUS_OK
;
236 hdr_ofs
= buf
->hdr
- buf
->buffer
;
237 dynamic_ofs
= buf
->dynamic
- buf
->buffer
;
239 buffer_ptr
= talloc_realloc(buf
, buf
->buffer
, uint8_t, newsize
);
240 NT_STATUS_HAVE_NO_MEMORY(buffer_ptr
);
242 buf
->buffer
= buffer_ptr
;
243 buf
->hdr
= buf
->buffer
+ hdr_ofs
;
244 buf
->body
= buf
->hdr
+ SMB2_HDR_BODY
;
245 buf
->dynamic
= buf
->buffer
+ dynamic_ofs
;
246 buf
->allocated
= newsize
;
252 pull a uint16_t ofs/ uint16_t length/blob triple from a data blob
253 the ptr points to the start of the offset/length pair
255 NTSTATUS
smb2_pull_o16s16_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
258 if (smb2_oob(buf
, ptr
, 4)) {
259 return NT_STATUS_INVALID_PARAMETER
;
264 *blob
= data_blob(NULL
, 0);
267 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
268 return NT_STATUS_INVALID_PARAMETER
;
270 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
271 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
276 push a uint16_t ofs/ uint16_t length/blob triple into a data blob
277 the ofs points to the start of the offset/length pair, and is relative
280 NTSTATUS
smb2_push_o16s16_blob(struct smb2_request_buffer
*buf
,
281 uint16_t ofs
, DATA_BLOB blob
)
285 size_t padding_length
;
287 uint8_t *ptr
= buf
->body
+ofs
;
289 if (buf
->dynamic
== NULL
) {
290 return NT_STATUS_INVALID_PARAMETER
;
293 /* we have only 16 bit for the size */
294 if (blob
.length
> 0xFFFF) {
295 return NT_STATUS_INVALID_PARAMETER
;
298 /* check if there're enough room for ofs and size */
299 if (smb2_oob(buf
, ptr
, 4)) {
300 return NT_STATUS_INVALID_PARAMETER
;
303 if (blob
.data
== NULL
) {
304 if (blob
.length
!= 0) {
305 return NT_STATUS_INTERNAL_ERROR
;
312 offset
= buf
->dynamic
- buf
->hdr
;
313 padding_length
= smb2_padding_size(offset
, 2);
314 offset
+= padding_length
;
315 padding_fix
= smb2_padding_fix(buf
);
317 SSVAL(ptr
, 0, offset
);
318 SSVAL(ptr
, 2, blob
.length
);
320 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
321 NT_STATUS_NOT_OK_RETURN(status
);
323 memset(buf
->dynamic
, 0, padding_length
);
324 buf
->dynamic
+= padding_length
;
326 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
327 buf
->dynamic
+= blob
.length
;
329 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
330 buf
->body_size
+= blob
.length
+ padding_length
;
337 push a uint16_t ofs/ uint32_t length/blob triple into a data blob
338 the ofs points to the start of the offset/length pair, and is relative
341 NTSTATUS
smb2_push_o16s32_blob(struct smb2_request_buffer
*buf
,
342 uint16_t ofs
, DATA_BLOB blob
)
346 size_t padding_length
;
348 uint8_t *ptr
= buf
->body
+ofs
;
350 if (buf
->dynamic
== NULL
) {
351 return NT_STATUS_INVALID_PARAMETER
;
354 /* check if there're enough room for ofs and size */
355 if (smb2_oob(buf
, ptr
, 6)) {
356 return NT_STATUS_INVALID_PARAMETER
;
359 if (blob
.data
== NULL
) {
360 if (blob
.length
!= 0) {
361 return NT_STATUS_INTERNAL_ERROR
;
368 offset
= buf
->dynamic
- buf
->hdr
;
369 padding_length
= smb2_padding_size(offset
, 2);
370 offset
+= padding_length
;
371 padding_fix
= smb2_padding_fix(buf
);
373 SSVAL(ptr
, 0, offset
);
374 SIVAL(ptr
, 2, blob
.length
);
376 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
377 NT_STATUS_NOT_OK_RETURN(status
);
379 memset(buf
->dynamic
, 0, padding_length
);
380 buf
->dynamic
+= padding_length
;
382 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
383 buf
->dynamic
+= blob
.length
;
385 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
386 buf
->body_size
+= blob
.length
+ padding_length
;
393 push a uint32_t ofs/ uint32_t length/blob triple into a data blob
394 the ofs points to the start of the offset/length pair, and is relative
397 NTSTATUS
smb2_push_o32s32_blob(struct smb2_request_buffer
*buf
,
398 uint32_t ofs
, DATA_BLOB blob
)
402 size_t padding_length
;
404 uint8_t *ptr
= buf
->body
+ofs
;
406 if (buf
->dynamic
== NULL
) {
407 return NT_STATUS_INVALID_PARAMETER
;
410 /* check if there're enough room for ofs and size */
411 if (smb2_oob(buf
, ptr
, 8)) {
412 return NT_STATUS_INVALID_PARAMETER
;
415 if (blob
.data
== NULL
) {
416 if (blob
.length
!= 0) {
417 return NT_STATUS_INTERNAL_ERROR
;
424 offset
= buf
->dynamic
- buf
->hdr
;
425 padding_length
= smb2_padding_size(offset
, 8);
426 offset
+= padding_length
;
427 padding_fix
= smb2_padding_fix(buf
);
429 SIVAL(ptr
, 0, offset
);
430 SIVAL(ptr
, 4, blob
.length
);
432 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
433 NT_STATUS_NOT_OK_RETURN(status
);
435 memset(buf
->dynamic
, 0, padding_length
);
436 buf
->dynamic
+= padding_length
;
438 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
439 buf
->dynamic
+= blob
.length
;
441 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
442 buf
->body_size
+= blob
.length
+ padding_length
;
449 push a uint32_t length/ uint32_t ofs/blob triple into a data blob
450 the ofs points to the start of the length/offset pair, and is relative
453 NTSTATUS
smb2_push_s32o32_blob(struct smb2_request_buffer
*buf
,
454 uint32_t ofs
, DATA_BLOB blob
)
458 size_t padding_length
;
460 uint8_t *ptr
= buf
->body
+ofs
;
462 if (buf
->dynamic
== NULL
) {
463 return NT_STATUS_INVALID_PARAMETER
;
466 /* check if there're enough room for ofs and size */
467 if (smb2_oob(buf
, ptr
, 8)) {
468 return NT_STATUS_INVALID_PARAMETER
;
471 if (blob
.data
== NULL
) {
472 if (blob
.length
!= 0) {
473 return NT_STATUS_INTERNAL_ERROR
;
480 offset
= buf
->dynamic
- buf
->hdr
;
481 padding_length
= smb2_padding_size(offset
, 8);
482 offset
+= padding_length
;
483 padding_fix
= smb2_padding_fix(buf
);
485 SIVAL(ptr
, 0, blob
.length
);
486 SIVAL(ptr
, 4, offset
);
488 status
= smb2_grow_buffer(buf
, blob
.length
+ padding_length
- padding_fix
);
489 NT_STATUS_NOT_OK_RETURN(status
);
491 memset(buf
->dynamic
, 0, padding_length
);
492 buf
->dynamic
+= padding_length
;
494 memcpy(buf
->dynamic
, blob
.data
, blob
.length
);
495 buf
->dynamic
+= blob
.length
;
497 buf
->size
+= blob
.length
+ padding_length
- padding_fix
;
498 buf
->body_size
+= blob
.length
+ padding_length
;
504 pull a uint16_t ofs/ uint32_t length/blob triple from a data blob
505 the ptr points to the start of the offset/length pair
507 NTSTATUS
smb2_pull_o16s32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
512 if (smb2_oob(buf
, ptr
, 6)) {
513 return NT_STATUS_INVALID_PARAMETER
;
518 *blob
= data_blob(NULL
, 0);
521 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
522 return NT_STATUS_INVALID_PARAMETER
;
524 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
525 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
530 pull a uint32_t ofs/ uint32_t length/blob triple from a data blob
531 the ptr points to the start of the offset/length pair
533 NTSTATUS
smb2_pull_o32s32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
536 if (smb2_oob(buf
, ptr
, 8)) {
537 return NT_STATUS_INVALID_PARAMETER
;
542 *blob
= data_blob(NULL
, 0);
545 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
546 return NT_STATUS_INVALID_PARAMETER
;
548 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
549 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
554 pull a uint16_t ofs/ uint32_t length/blob triple from a data blob
555 the ptr points to the start of the offset/length pair
557 In this varient the uint16_t is padded by an extra 2 bytes, making
558 the size aligned on 4 byte boundary
560 NTSTATUS
smb2_pull_o16As32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
563 if (smb2_oob(buf
, ptr
, 8)) {
564 return NT_STATUS_INVALID_PARAMETER
;
569 *blob
= data_blob(NULL
, 0);
572 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
573 return NT_STATUS_INVALID_PARAMETER
;
575 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
576 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
581 pull a uint32_t length/ uint32_t ofs/blob triple from a data blob
582 the ptr points to the start of the offset/length pair
584 NTSTATUS
smb2_pull_s32o32_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
587 if (smb2_oob(buf
, ptr
, 8)) {
588 return NT_STATUS_INVALID_PARAMETER
;
593 *blob
= data_blob(NULL
, 0);
596 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
597 return NT_STATUS_INVALID_PARAMETER
;
599 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
600 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
605 pull a uint32_t length/ uint16_t ofs/blob triple from a data blob
606 the ptr points to the start of the offset/length pair
608 NTSTATUS
smb2_pull_s32o16_blob(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
, uint8_t *ptr
, DATA_BLOB
*blob
)
611 if (smb2_oob(buf
, ptr
, 8)) {
612 return NT_STATUS_INVALID_PARAMETER
;
617 *blob
= data_blob(NULL
, 0);
620 if (smb2_oob(buf
, buf
->hdr
+ ofs
, size
)) {
621 return NT_STATUS_INVALID_PARAMETER
;
623 *blob
= data_blob_talloc(mem_ctx
, buf
->hdr
+ ofs
, size
);
624 NT_STATUS_HAVE_NO_MEMORY(blob
->data
);
629 pull a string in a uint16_t ofs/ uint16_t length/blob format
630 UTF-16 without termination
632 NTSTATUS
smb2_pull_o16s16_string(struct smb2_request_buffer
*buf
, TALLOC_CTX
*mem_ctx
,
633 uint8_t *ptr
, const char **str
)
638 size_t converted_size
= 0;
641 status
= smb2_pull_o16s16_blob(buf
, mem_ctx
, ptr
, &blob
);
642 NT_STATUS_NOT_OK_RETURN(status
);
644 if (blob
.data
== NULL
) {
649 if (blob
.length
== 0) {
651 s
= talloc_strdup(mem_ctx
, "");
652 NT_STATUS_HAVE_NO_MEMORY(s
);
657 ret
= convert_string_talloc(mem_ctx
, CH_UTF16
, CH_UNIX
,
658 blob
.data
, blob
.length
, &vstr
, &converted_size
);
659 data_blob_free(&blob
);
660 (*str
) = (char *)vstr
;
662 return NT_STATUS_ILLEGAL_CHARACTER
;
668 push a string in a uint16_t ofs/ uint16_t length/blob format
669 UTF-16 without termination
671 NTSTATUS
smb2_push_o16s16_string(struct smb2_request_buffer
*buf
,
672 uint16_t ofs
, const char *str
)
680 return smb2_push_o16s16_blob(buf
, ofs
, data_blob(NULL
, 0));
684 blob
.data
= discard_const_p(uint8_t, str
);
686 return smb2_push_o16s16_blob(buf
, ofs
, blob
);
689 ret
= convert_string_talloc(buf
->buffer
, CH_UNIX
, CH_UTF16
,
690 str
, strlen(str
), &ptr
, &blob
.length
);
692 return NT_STATUS_ILLEGAL_CHARACTER
;
694 blob
.data
= (uint8_t *)ptr
;
696 status
= smb2_push_o16s16_blob(buf
, ofs
, blob
);
697 data_blob_free(&blob
);
702 push a file handle into a buffer
704 void smb2_push_handle(uint8_t *data
, struct smb2_handle
*h
)
706 SBVAL(data
, 0, h
->data
[0]);
707 SBVAL(data
, 8, h
->data
[1]);
711 pull a file handle from a buffer
713 void smb2_pull_handle(uint8_t *ptr
, struct smb2_handle
*h
)
715 h
->data
[0] = BVAL(ptr
, 0);
716 h
->data
[1] = BVAL(ptr
, 8);