source4/torture/rpc/autoidl.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    auto-idl scanner
   5
   6    Copyright (C) Andrew Tridgell 2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
  24 #include "librpc/ndr/ndr_table.h"
  25 #include "torture/rpc/torture_rpc.h"
  26
  27
  28 #if 1
  29 /*
  30   get a DRSUAPI policy handle
  31 */
  32 static bool get_policy_handle(struct dcerpc_binding_handle *b,
  33                               TALLOC_CTX *mem_ctx,
  34                               struct policy_handle *handle)
  35 {
  36         NTSTATUS status;
  37         struct drsuapi_DsBind r;
  38
  39         ZERO_STRUCT(r);
  40         r.out.bind_handle = handle;
  41
  42         status = dcerpc_drsuapi_DsBind_r(b, mem_ctx, &r);
  43         if (!NT_STATUS_IS_OK(status)) {
  44                 printf("drsuapi_DsBind failed - %s\n", nt_errstr(status));
  45                 return false;
  46         }
  47
  48         return true;
  49 }
  50 #else
  51 /*
  52   get a SAMR handle
  53 */
  54 static bool get_policy_handle(struct dcerpc_binding_handle *b,
  55                               TALLOC_CTX *mem_ctx,
  56                               struct policy_handle *handle)
  57 {
  58         NTSTATUS status;
  59         struct samr_Connect r;
  60
  61         r.in.system_name = 0;
  62         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  63         r.out.connect_handle = handle;
  64
  65         status = dcerpc_samr_Connect_r(b, mem_ctx, &r);
  66         if (!NT_STATUS_IS_OK(status)) {
  67                 printf("samr_Connect failed - %s\n", nt_errstr(status));
  68                 return false;
  69         }
  70
  71         return true;
  72 }
  73 #endif
  74
  75 static void fill_blob_handle(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
  76                              struct policy_handle *handle)
  77 {
  78         DATA_BLOB b2;
  79
  80         if (blob->length < 20) {
  81                 return;
  82         }
  83
  84         ndr_push_struct_blob(&b2, mem_ctx, handle, (ndr_push_flags_fn_t)ndr_push_policy_handle);
  85
  86         memcpy(blob->data, b2.data, 20);
  87 }
  88
  89 static void reopen(struct torture_context *tctx,
  90                    struct dcerpc_pipe **p,
  91                    const struct ndr_interface_table *iface)
  92 {
  93         NTSTATUS status;
  94
  95         talloc_free(*p);
  96
  97         status = torture_rpc_connection(tctx, p, iface);
  98         if (!NT_STATUS_IS_OK(status)) {
  99                 printf("Failed to reopen '%s' - %s\n", iface->name, nt_errstr(status));
 100                 exit(1);
 101         }
 102 }
 103
 104 static void print_depth(int depth)
 105 {
 106         int i;
 107         for (i=0;i<depth;i++) {
 108                 printf("    ");
 109         }
 110 }
 111
 112 static void test_ptr_scan(struct torture_context *tctx, const struct ndr_interface_table *iface,
 113                           int opnum, DATA_BLOB *base_in, int min_ofs, int max_ofs, int depth);
 114
 115 static void try_expand(struct torture_context *tctx, const struct ndr_interface_table *iface,
 116                        int opnum, DATA_BLOB *base_in, int insert_ofs, int depth)
 117 {
 118         DATA_BLOB stub_in, stub_out;
 119         int n;
 120         NTSTATUS status;
 121         struct dcerpc_pipe *p = NULL;
 122
 123         reopen(tctx, &p, iface);
 124
 125         /* work out how much to expand to get a non fault */
 126         for (n=0;n<2000;n++) {
 127                 uint32_t out_flags = 0;
 128
 129                 stub_in = data_blob(NULL, base_in->length + n);
 130                 data_blob_clear(&stub_in);
 131                 memcpy(stub_in.data, base_in->data, insert_ofs);
 132                 memcpy(stub_in.data+insert_ofs+n, base_in->data+insert_ofs, base_in->length-insert_ofs);
 133
 134                 status = dcerpc_binding_handle_raw_call(p->binding_handle,
 135                                                         NULL, opnum,
 136                                                         0, /* in_flags */
 137                                                         stub_in.data,
 138                                                         stub_in.length,
 139                                                         tctx,
 140                                                         &stub_out.data,
 141                                                         &stub_out.length,
 142                                                         &out_flags);
 143                 if (NT_STATUS_IS_OK(status)) {
 144                         print_depth(depth);
 145                         printf("expand by %d gives %s\n", n, nt_errstr(status));
 146                         if (n >= 4) {
 147                                 test_ptr_scan(tctx, iface, opnum, &stub_in,
 148                                               insert_ofs, insert_ofs+n, depth+1);
 149                         }
 150                         return;
 151                 } else {
 152 #if 0
 153                         print_depth(depth);
 154                         printf("expand by %d gives fault %s\n", n, nt_errstr(status));
 155 #endif
 156                 }
 157                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 158                         reopen(tctx, &p, iface);
 159                 }
 160         }
 161
 162         talloc_free(p);
 163 }
 164
 165
 166 static void test_ptr_scan(struct torture_context *tctx, const struct ndr_interface_table *iface,
 167                           int opnum, DATA_BLOB *base_in, int min_ofs, int max_ofs, int depth)
 168 {
 169         DATA_BLOB stub_in, stub_out;
 170         int ofs;
 171         NTSTATUS status;
 172         struct dcerpc_pipe *p = NULL;
 173
 174         reopen(tctx, &p, iface);
 175
 176         stub_in = data_blob(NULL, base_in->length);
 177         memcpy(stub_in.data, base_in->data, base_in->length);
 178
 179         /* work out which elements are pointers */
 180         for (ofs=min_ofs;ofs<=max_ofs-4;ofs+=4) {
 181                 uint32_t out_flags = 0;
 182
 183                 SIVAL(stub_in.data, ofs, 1);
 184
 185                 status = dcerpc_binding_handle_raw_call(p->binding_handle,
 186                                                         NULL, opnum,
 187                                                         0, /* in_flags */
 188                                                         stub_in.data,
 189                                                         stub_in.length,
 190                                                         tctx,
 191                                                         &stub_out.data,
 192                                                         &stub_out.length,
 193                                                         &out_flags);
 194
 195                 if (!NT_STATUS_IS_OK(status)) {
 196                         print_depth(depth);
 197                         printf("possible ptr at ofs %d - fault %s\n",
 198                                ofs-min_ofs, nt_errstr(status));
 199                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 200                                 reopen(tctx, &p, iface);
 201                         }
 202                         if (depth == 0) {
 203                                 try_expand(tctx, iface, opnum, &stub_in, ofs+4, depth+1);
 204                         } else {
 205                                 try_expand(tctx, iface, opnum, &stub_in, max_ofs, depth+1);
 206                         }
 207                         SIVAL(stub_in.data, ofs, 0);
 208                         continue;
 209                 }
 210                 SIVAL(stub_in.data, ofs, 0);
 211         }
 212
 213         talloc_free(p);
 214 }
 215
 216
 217 static void test_scan_call(struct torture_context *tctx, const struct ndr_interface_table *iface, int opnum)
 218 {
 219         DATA_BLOB stub_in, stub_out;
 220         int i;
 221         NTSTATUS status;
 222         struct dcerpc_pipe *p = NULL;
 223         struct policy_handle handle;
 224
 225         reopen(tctx, &p, iface);
 226
 227         get_policy_handle(p->binding_handle, tctx, &handle);
 228
 229         /* work out the minimum amount of input data */
 230         for (i=0;i<2000;i++) {
 231                 uint32_t out_flags = 0;
 232
 233                 stub_in = data_blob(NULL, i);
 234                 data_blob_clear(&stub_in);
 235
 236                 status = dcerpc_binding_handle_raw_call(p->binding_handle,
 237                                                         NULL, opnum,
 238                                                         0, /* in_flags */
 239                                                         stub_in.data,
 240                                                         stub_in.length,
 241                                                         tctx,
 242                                                         &stub_out.data,
 243                                                         &stub_out.length,
 244                                                         &out_flags);
 245
 246                 if (NT_STATUS_IS_OK(status)) {
 247                         printf("opnum %d   min_input %d - output %d\n",
 248                                opnum, (int)stub_in.length, (int)stub_out.length);
 249                         dump_data(0, stub_out.data, stub_out.length);
 250                         talloc_free(p);
 251                         test_ptr_scan(tctx, iface, opnum, &stub_in, 0, stub_in.length, 0);
 252                         return;
 253                 }
 254
 255                 fill_blob_handle(&stub_in, tctx, &handle);
 256
 257                 status = dcerpc_binding_handle_raw_call(p->binding_handle,
 258                                                         NULL, opnum,
 259                                                         0, /* in_flags */
 260                                                         stub_in.data,
 261                                                         stub_in.length,
 262                                                         tctx,
 263                                                         &stub_out.data,
 264                                                         &stub_out.length,
 265                                                         &out_flags);
 266
 267                 if (NT_STATUS_IS_OK(status)) {
 268                         printf("opnum %d   min_input %d - output %d (with handle)\n",
 269                                opnum, (int)stub_in.length, (int)stub_out.length);
 270                         dump_data(0, stub_out.data, stub_out.length);
 271                         talloc_free(p);
 272                         test_ptr_scan(tctx, iface, opnum, &stub_in, 0, stub_in.length, 0);
 273                         return;
 274                 }
 275
 276                 if (!NT_STATUS_IS_OK(status)) {
 277                         printf("opnum %d  size %d fault %s\n", opnum, i, nt_errstr(status));
 278                         if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
 279                                 reopen(tctx, &p, iface);
 280                         }
 281                         continue;
 282                 }
 283
 284                 printf("opnum %d  size %d error %s\n", opnum, i, nt_errstr(status));
 285         }
 286
 287         printf("opnum %d minimum not found!?\n", opnum);
 288         talloc_free(p);
 289 }
 290
 291
 292 static void test_auto_scan(struct torture_context *tctx, const struct ndr_interface_table *iface)
 293 {
 294         test_scan_call(tctx, iface, 2);
 295 }
 296
 297 bool torture_rpc_autoidl(struct torture_context *torture)
 298 {
 299         const struct ndr_interface_table *iface;
 300
 301         iface = ndr_table_by_name("drsuapi");
 302         if (!iface) {
 303                 printf("Unknown interface!\n");
 304                 return false;
 305         }
 306
 307         printf("\nProbing pipe '%s'\n", iface->name);
 308
 309         test_auto_scan(torture, iface);
 310
 311         return true;
 312 }