2 Unix SMB/CIFS implementation.
4 dcerpc over SMB transport
6 Copyright (C) Tim Potter 2003
7 Copyright (C) Andrew Tridgell 2003
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/raw/libcliraw.h"
25 #include "libcli/composite/composite.h"
26 #include "librpc/rpc/dcerpc.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/rpc/rpc_common.h"
29 #include "../libcli/smb/smbXcli_base.h"
31 /* transport private information used by SMB pipe transport */
34 struct smbcli_tree
*tree
;
35 const char *server_name
;
41 tell the dcerpc layer that the transport is dead
43 static void pipe_dead(struct dcecli_connection
*c
, NTSTATUS status
)
45 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
53 if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL
, status
)) {
54 status
= NT_STATUS_UNEXPECTED_NETWORK_ERROR
;
57 if (NT_STATUS_EQUAL(NT_STATUS_OK
, status
)) {
58 status
= NT_STATUS_END_OF_FILE
;
61 if (c
->transport
.recv_data
) {
62 c
->transport
.recv_data(c
, NULL
, status
);
68 this holds the state of an in-flight call
70 struct smb_read_state
{
71 struct dcecli_connection
*c
;
72 struct smbcli_request
*req
;
79 called when a read request has completed
81 static void smb_read_callback(struct smbcli_request
*req
)
83 struct dcecli_connection
*c
;
84 struct smb_private
*smb
;
85 struct smb_read_state
*state
;
90 state
= talloc_get_type(req
->async
.private_data
, struct smb_read_state
);
91 smb
= talloc_get_type(state
->c
->transport
.private_data
, struct smb_private
);
95 status
= smb_raw_read_recv(state
->req
, io
);
96 if (NT_STATUS_IS_ERR(status
)) {
102 state
->received
+= io
->readx
.out
.nread
;
104 if (state
->received
< 16) {
105 DEBUG(0,("dcerpc_smb: short packet (length %d) in read callback!\n",
106 (int)state
->received
));
108 pipe_dead(c
, NT_STATUS_INFO_LENGTH_MISMATCH
);
112 frag_length
= dcerpc_get_frag_length(&state
->data
);
114 if (frag_length
<= state
->received
) {
115 DATA_BLOB data
= state
->data
;
116 data
.length
= state
->received
;
117 talloc_steal(state
->c
, data
.data
);
119 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
123 /* initiate another read request, as we only got part of a fragment */
124 state
->data
.data
= talloc_realloc(state
, state
->data
.data
, uint8_t, frag_length
);
126 io
->readx
.in
.mincnt
= MIN(state
->c
->srv_max_xmit_frag
,
127 frag_length
- state
->received
);
128 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
129 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
131 state
->req
= smb_raw_read_send(smb
->tree
, io
);
132 if (state
->req
== NULL
) {
134 pipe_dead(c
, NT_STATUS_NO_MEMORY
);
138 state
->req
->async
.fn
= smb_read_callback
;
139 state
->req
->async
.private_data
= state
;
143 trigger a read request from the server, possibly with some initial
144 data in the read buffer
146 static NTSTATUS
send_read_request_continue(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
148 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
150 struct smb_read_state
*state
;
151 struct smbcli_request
*req
;
153 state
= talloc(smb
, struct smb_read_state
);
155 return NT_STATUS_NO_MEMORY
;
161 state
->data
= data_blob_talloc(state
, NULL
, 0x2000);
163 uint32_t frag_length
= blob
->length
>=16?
164 dcerpc_get_frag_length(blob
):0x2000;
165 state
->received
= blob
->length
;
166 state
->data
= data_blob_talloc(state
, NULL
, frag_length
);
167 if (!state
->data
.data
) {
169 return NT_STATUS_NO_MEMORY
;
171 memcpy(state
->data
.data
, blob
->data
, blob
->length
);
174 state
->io
= talloc(state
, union smb_read
);
177 io
->generic
.level
= RAW_READ_READX
;
178 io
->readx
.in
.file
.fnum
= smb
->fnum
;
179 io
->readx
.in
.mincnt
= state
->data
.length
- state
->received
;
180 io
->readx
.in
.maxcnt
= io
->readx
.in
.mincnt
;
181 io
->readx
.in
.offset
= 0;
182 io
->readx
.in
.remaining
= 0;
183 io
->readx
.in
.read_for_execute
= false;
184 io
->readx
.out
.data
= state
->data
.data
+ state
->received
;
185 req
= smb_raw_read_send(smb
->tree
, io
);
187 return NT_STATUS_NO_MEMORY
;
190 req
->async
.fn
= smb_read_callback
;
191 req
->async
.private_data
= state
;
200 trigger a read request from the server
202 static NTSTATUS
send_read_request(struct dcecli_connection
*c
)
204 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
207 return NT_STATUS_CONNECTION_DISCONNECTED
;
210 return send_read_request_continue(c
, NULL
);
214 this holds the state of an in-flight trans call
216 struct smb_trans_state
{
217 struct dcecli_connection
*c
;
218 struct smbcli_request
*req
;
219 struct smb_trans2
*trans
;
223 called when a trans request has completed
225 static void smb_trans_callback(struct smbcli_request
*req
)
227 struct smb_trans_state
*state
= (struct smb_trans_state
*)req
->async
.private_data
;
228 struct dcecli_connection
*c
= state
->c
;
231 status
= smb_raw_trans_recv(req
, state
, state
->trans
);
233 if (NT_STATUS_IS_ERR(status
)) {
234 pipe_dead(c
, status
);
238 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
239 DATA_BLOB data
= state
->trans
->out
.data
;
240 talloc_steal(c
, data
.data
);
242 c
->transport
.recv_data(c
, &data
, NT_STATUS_OK
);
246 /* there is more to receive - setup a readx */
247 send_read_request_continue(c
, &state
->trans
->out
.data
);
252 send a SMBtrans style request
254 static NTSTATUS
smb_send_trans_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
)
256 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
257 struct smb_trans2
*trans
;
259 struct smb_trans_state
*state
;
262 state
= talloc(c
, struct smb_trans_state
);
264 return NT_STATUS_NO_MEMORY
;
268 state
->trans
= talloc(state
, struct smb_trans2
);
269 trans
= state
->trans
;
271 trans
->in
.data
= *blob
;
272 trans
->in
.params
= data_blob(NULL
, 0);
274 setup
[0] = TRANSACT_DCERPCCMD
;
275 setup
[1] = smb
->fnum
;
277 if (c
->srv_max_xmit_frag
> 0) {
278 max_data
= MIN(UINT16_MAX
, c
->srv_max_xmit_frag
);
280 max_data
= UINT16_MAX
;
283 trans
->in
.max_param
= 0;
284 trans
->in
.max_data
= max_data
;
285 trans
->in
.max_setup
= 0;
286 trans
->in
.setup_count
= 2;
288 trans
->in
.timeout
= 0;
289 trans
->in
.setup
= setup
;
290 trans
->in
.trans_name
= "\\PIPE\\";
292 state
->req
= smb_raw_trans_send(smb
->tree
, trans
);
293 if (state
->req
== NULL
) {
295 return NT_STATUS_NO_MEMORY
;
298 state
->req
->async
.fn
= smb_trans_callback
;
299 state
->req
->async
.private_data
= state
;
301 talloc_steal(state
, state
->req
);
307 called when a write request has completed
309 static void smb_write_callback(struct smbcli_request
*req
)
311 struct dcecli_connection
*c
= (struct dcecli_connection
*)req
->async
.private_data
;
316 io
.generic
.level
= RAW_WRITE_WRITEX
;
318 status
= smb_raw_write_recv(req
, &io
);
319 if (!NT_STATUS_IS_OK(status
)) {
320 DEBUG(0,("dcerpc_smb: write callback error: %s\n",
322 pipe_dead(c
, status
);
327 send a packet to the server
329 static NTSTATUS
smb_send_request(struct dcecli_connection
*c
, DATA_BLOB
*blob
,
332 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
334 struct smbcli_request
*req
;
336 if (!smb
|| smb
->dead
) {
337 return NT_STATUS_CONNECTION_DISCONNECTED
;
341 return smb_send_trans_request(c
, blob
);
344 io
.generic
.level
= RAW_WRITE_WRITEX
;
345 io
.writex
.in
.file
.fnum
= smb
->fnum
;
346 io
.writex
.in
.offset
= 0;
347 io
.writex
.in
.wmode
= PIPE_START_MESSAGE
;
348 io
.writex
.in
.remaining
= blob
->length
;
349 io
.writex
.in
.count
= blob
->length
;
350 io
.writex
.in
.data
= blob
->data
;
352 /* we must not timeout at the smb level for rpc requests, as otherwise
353 signing/sealing can be messed up */
354 smb
->tree
->session
->transport
->options
.request_timeout
= 0;
356 req
= smb_raw_write_send(smb
->tree
, &io
);
358 return NT_STATUS_NO_MEMORY
;
361 req
->async
.fn
= smb_write_callback
;
362 req
->async
.private_data
= c
;
365 send_read_request(c
);
372 static void free_request(struct smbcli_request
*req
)
378 shutdown SMB pipe connection
380 static NTSTATUS
smb_shutdown_pipe(struct dcecli_connection
*c
, NTSTATUS status
)
382 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
384 struct smbcli_request
*req
;
386 /* maybe we're still starting up */
387 if (!smb
) return status
;
389 io
.close
.level
= RAW_CLOSE_CLOSE
;
390 io
.close
.in
.file
.fnum
= smb
->fnum
;
391 io
.close
.in
.write_time
= 0;
392 req
= smb_raw_close_send(smb
->tree
, &io
);
394 /* we don't care if this fails, so just free it if it succeeds */
395 req
->async
.fn
= free_request
;
399 c
->transport
.private_data
= NULL
;
405 return SMB server name (called name)
407 static const char *smb_peer_name(struct dcecli_connection
*c
)
409 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
410 if (smb
== NULL
) return "";
411 return smb
->server_name
;
415 return remote name we make the actual connection (good for kerberos)
417 static const char *smb_target_hostname(struct dcecli_connection
*c
)
419 struct smb_private
*smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
420 if (smb
== NULL
) return "";
421 return smbXcli_conn_remote_name(smb
->tree
->session
->transport
->conn
);
425 fetch the user session key
427 static NTSTATUS
smb_session_key(struct dcecli_connection
*c
, DATA_BLOB
*session_key
)
429 struct smb_private
*smb
= (struct smb_private
*)c
->transport
.private_data
;
431 if (smb
== NULL
) return NT_STATUS_CONNECTION_DISCONNECTED
;
432 if (smb
->tree
->session
->user_session_key
.data
) {
433 *session_key
= smb
->tree
->session
->user_session_key
;
436 return NT_STATUS_NO_USER_SESSION_KEY
;
439 struct pipe_open_smb_state
{
440 union smb_open
*open
;
441 struct dcecli_connection
*c
;
442 struct smbcli_tree
*tree
;
443 struct composite_context
*ctx
;
446 static void pipe_open_recv(struct smbcli_request
*req
);
448 struct composite_context
*dcerpc_pipe_open_smb_send(struct dcerpc_pipe
*p
,
449 struct smbcli_tree
*tree
,
450 const char *pipe_name
)
452 struct composite_context
*ctx
;
453 struct pipe_open_smb_state
*state
;
454 struct smbcli_request
*req
;
455 struct dcecli_connection
*c
= p
->conn
;
457 /* if we don't have a binding on this pipe yet, then create one */
458 if (p
->binding
== NULL
) {
460 const char *r
= smbXcli_conn_remote_name(tree
->session
->transport
->conn
);
462 SMB_ASSERT(r
!= NULL
);
463 s
= talloc_asprintf(p
, "ncacn_np:%s", r
);
464 if (s
== NULL
) return NULL
;
465 status
= dcerpc_parse_binding(p
, s
, &p
->binding
);
467 if (!NT_STATUS_IS_OK(status
)) {
472 ctx
= composite_create(c
, c
->event_ctx
);
473 if (ctx
== NULL
) return NULL
;
475 state
= talloc(ctx
, struct pipe_open_smb_state
);
476 if (composite_nomem(state
, ctx
)) return ctx
;
477 ctx
->private_data
= state
;
483 state
->open
= talloc(state
, union smb_open
);
484 if (composite_nomem(state
->open
, ctx
)) return ctx
;
486 state
->open
->ntcreatex
.level
= RAW_OPEN_NTCREATEX
;
487 state
->open
->ntcreatex
.in
.flags
= 0;
488 state
->open
->ntcreatex
.in
.root_fid
.fnum
= 0;
489 state
->open
->ntcreatex
.in
.access_mask
=
490 SEC_STD_READ_CONTROL
|
491 SEC_FILE_WRITE_ATTRIBUTE
|
495 state
->open
->ntcreatex
.in
.file_attr
= 0;
496 state
->open
->ntcreatex
.in
.alloc_size
= 0;
497 state
->open
->ntcreatex
.in
.share_access
=
498 NTCREATEX_SHARE_ACCESS_READ
|
499 NTCREATEX_SHARE_ACCESS_WRITE
;
500 state
->open
->ntcreatex
.in
.open_disposition
= NTCREATEX_DISP_OPEN
;
501 state
->open
->ntcreatex
.in
.create_options
= 0;
502 state
->open
->ntcreatex
.in
.impersonation
=
503 NTCREATEX_IMPERSONATION_IMPERSONATION
;
504 state
->open
->ntcreatex
.in
.security_flags
= 0;
506 if ((strncasecmp(pipe_name
, "/pipe/", 6) == 0) ||
507 (strncasecmp(pipe_name
, "\\pipe\\", 6) == 0)) {
510 state
->open
->ntcreatex
.in
.fname
=
511 (pipe_name
[0] == '\\') ?
512 talloc_strdup(state
->open
, pipe_name
) :
513 talloc_asprintf(state
->open
, "\\%s", pipe_name
);
514 if (composite_nomem(state
->open
->ntcreatex
.in
.fname
, ctx
)) return ctx
;
516 req
= smb_raw_open_send(tree
, state
->open
);
517 composite_continue_smb(ctx
, req
, pipe_open_recv
, state
);
521 static void pipe_open_recv(struct smbcli_request
*req
)
523 struct pipe_open_smb_state
*state
= talloc_get_type(req
->async
.private_data
,
524 struct pipe_open_smb_state
);
525 struct composite_context
*ctx
= state
->ctx
;
526 struct dcecli_connection
*c
= state
->c
;
527 struct smb_private
*smb
;
529 ctx
->status
= smb_raw_open_recv(req
, state
, state
->open
);
530 if (!composite_is_ok(ctx
)) return;
533 fill in the transport methods
535 c
->transport
.transport
= NCACN_NP
;
536 c
->transport
.private_data
= NULL
;
537 c
->transport
.shutdown_pipe
= smb_shutdown_pipe
;
538 c
->transport
.peer_name
= smb_peer_name
;
539 c
->transport
.target_hostname
= smb_target_hostname
;
541 c
->transport
.send_request
= smb_send_request
;
542 c
->transport
.send_read
= send_read_request
;
543 c
->transport
.recv_data
= NULL
;
545 /* Over-ride the default session key with the SMB session key */
546 c
->security_state
.session_key
= smb_session_key
;
548 smb
= talloc(c
, struct smb_private
);
549 if (composite_nomem(smb
, ctx
)) return;
551 smb
->fnum
= state
->open
->ntcreatex
.out
.file
.fnum
;
552 smb
->tree
= talloc_reference(smb
, state
->tree
);
553 smb
->server_name
= strupper_talloc(smb
,
554 smbXcli_conn_remote_name(state
->tree
->session
->transport
->conn
));
555 if (composite_nomem(smb
->server_name
, ctx
)) return;
558 c
->transport
.private_data
= smb
;
563 NTSTATUS
dcerpc_pipe_open_smb_recv(struct composite_context
*c
)
565 NTSTATUS status
= composite_wait(c
);
570 _PUBLIC_ NTSTATUS
dcerpc_pipe_open_smb(struct dcerpc_pipe
*p
,
571 struct smbcli_tree
*tree
,
572 const char *pipe_name
)
574 struct composite_context
*ctx
= dcerpc_pipe_open_smb_send(p
, tree
,
576 return dcerpc_pipe_open_smb_recv(ctx
);
580 return the SMB tree used for a dcerpc over SMB pipe
582 _PUBLIC_
struct smbcli_tree
*dcerpc_smb_tree(struct dcecli_connection
*c
)
584 struct smb_private
*smb
;
586 if (c
->transport
.transport
!= NCACN_NP
) return NULL
;
588 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);
589 if (!smb
) return NULL
;
595 return the SMB fnum used for a dcerpc over SMB pipe (hack for torture operations)
597 _PUBLIC_
uint16_t dcerpc_smb_fnum(struct dcecli_connection
*c
)
599 struct smb_private
*smb
;
601 if (c
->transport
.transport
!= NCACN_NP
) return 0;
603 smb
= talloc_get_type(c
->transport
.private_data
, struct smb_private
);