diff options
-rw-r--r-- | source4/include/structs.h | 7 | ||||
-rw-r--r-- | source4/libcli/config.mk | 10 | ||||
-rw-r--r-- | source4/libcli/nbt/libnbt.h | 118 | ||||
-rw-r--r-- | source4/libcli/nbt/namequery.c | 277 | ||||
-rw-r--r-- | source4/libcli/nbt/nbtname.c | 285 | ||||
-rw-r--r-- | source4/libcli/nbt/nbtsocket.c | 347 | ||||
-rw-r--r-- | source4/librpc/config.mk | 9 | ||||
-rw-r--r-- | source4/librpc/idl/idl_types.h | 6 | ||||
-rw-r--r-- | source4/librpc/idl/nbt.idl | 166 | ||||
-rw-r--r-- | source4/librpc/ndr/libndr.h | 3 | ||||
-rw-r--r-- | source4/librpc/ndr/ndr.c | 21 | ||||
-rw-r--r-- | source4/librpc/ndr/ndr_basic.c | 34 |
12 files changed, 1269 insertions, 14 deletions
diff --git a/source4/include/structs.h b/source4/include/structs.h index 97449dc2b2..11519fd56e 100644 --- a/source4/include/structs.h +++ b/source4/include/structs.h @@ -143,3 +143,10 @@ struct smb_composite_loadfile; struct smb_composite_savefile; struct smb_composite_connect; struct smb_composite_sesssetup; + +struct nbt_name; +struct nbt_name_packet; +struct nbt_name_socket; +struct nbt_name_query; +struct nbt_name_status; + diff --git a/source4/libcli/config.mk b/source4/libcli/config.mk index 0c4ba5cef0..87866db66d 100644 --- a/source4/libcli/config.mk +++ b/source4/libcli/config.mk @@ -26,5 +26,13 @@ ADD_OBJ_FILES = \ libcli/composite/connect.o \ libcli/composite/sesssetup.o +[SUBSYSTEM::LIBCLI_NBT] +ADD_OBJ_FILES = \ + libcli/nbt/nbtname.o \ + libcli/nbt/nbtsocket.o \ + libcli/nbt/namequery.o +REQUIRED_SUBSYSTEMS = NDR_NBT + [SUBSYSTEM::LIBCLI] -REQUIRED_SUBSYSTEMS = LIBCLI_RAW LIBCLI_UTILS LIBCLI_AUTH LIBCLI_NMB LIBCLI_COMPOSITE +REQUIRED_SUBSYSTEMS = LIBCLI_RAW LIBCLI_UTILS LIBCLI_AUTH LIBCLI_NMB \ + LIBCLI_COMPOSITE LIBCLI_NBT diff --git a/source4/libcli/nbt/libnbt.h b/source4/libcli/nbt/libnbt.h new file mode 100644 index 0000000000..3658f1dd77 --- /dev/null +++ b/source4/libcli/nbt/libnbt.h @@ -0,0 +1,118 @@ +/* + Unix SMB/CIFS implementation. + + a raw async NBT library + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "librpc/gen_ndr/ndr_nbt.h" + +/* + possible states for pending requests +*/ +enum nbt_request_state {NBT_REQUEST_SEND, + NBT_REQUEST_WAIT, + NBT_REQUEST_DONE, + NBT_REQUEST_TIMEOUT, + NBT_REQUEST_ERROR}; + +/* + a nbt name request +*/ +struct nbt_name_request { + struct nbt_name_request *next, *prev; + + enum nbt_request_state state; + + NTSTATUS status; + + /* the socket this was on */ + struct nbt_name_socket *nbtsock; + + /* where to send the request */ + const char *dest_addr; + int dest_port; + + /* the timeout event */ + struct timed_event *te; + + struct nbt_name_packet *request; + + /* shall we allow multiple replies? */ + BOOL allow_multiple_replies; + + uint_t num_replies; + struct nbt_name_reply { + struct nbt_name_packet *packet; + const char *reply_addr; + int reply_port; + } *replies; +}; + + + +/* + context structure for operations on name queries +*/ +struct nbt_name_socket { + struct socket_context *sock; + struct event_context *event_ctx; + + /* a queue of requests pending to be sent */ + struct nbt_name_request *send_queue; + + /* the fd event */ + struct fd_event *fde; + + /* mapping from name_trn_id to pending event */ + struct idr_context *idr; + + /* how many requests are waiting for a reply */ + uint16_t num_pending; +}; + + +/* a simple name query */ +struct nbt_name_query { + struct { + struct nbt_name name; + const char *dest_addr; + BOOL broadcast; + BOOL wins_lookup; + int timeout; /* in seconds */ + } in; + struct { + const char *reply_from; + struct nbt_name name; + const char *reply_addr; + } out; +}; + +/* a simple name status query */ +struct nbt_name_status { + struct { + struct nbt_name name; + const char *dest_addr; + int timeout; /* in seconds */ + } in; + struct { + const char *reply_from; + struct nbt_name name; + struct nbt_rdata_status status; + } out; +}; diff --git a/source4/libcli/nbt/namequery.c b/source4/libcli/nbt/namequery.c new file mode 100644 index 0000000000..23a63ede11 --- /dev/null +++ b/source4/libcli/nbt/namequery.c @@ -0,0 +1,277 @@ +/* + Unix SMB/CIFS implementation. + + make nbt name query requests + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "libcli/nbt/libnbt.h" +#include "system/network.h" + +/* + send a nbt name query +*/ +struct nbt_name_request *nbt_name_query_send(struct nbt_name_socket *nbtsock, + struct nbt_name_query *io) +{ + struct nbt_name_request *req; + struct nbt_name_packet *packet; + + packet = talloc_zero(nbtsock, struct nbt_name_packet); + if (packet == NULL) return NULL; + + packet->qdcount = 1; + packet->operation = NBT_OPCODE_QUERY; + if (io->in.broadcast) { + packet->operation |= NBT_FLAG_BROADCAST; + } + if (io->in.wins_lookup) { + packet->operation |= NBT_FLAG_RECURSION_DESIRED; + } + + packet->questions = talloc_array(packet, struct nbt_name_question, 1); + if (packet->questions == NULL) goto failed; + + packet->questions[0].name = io->in.name; + packet->questions[0].question_type = NBT_QTYPE_NETBIOS; + packet->questions[0].question_class = NBT_QCLASS_IP; + + req = nbt_name_request_send(nbtsock, io->in.dest_addr, NBT_NAME_SERVICE_PORT, packet, + timeval_current_ofs(io->in.timeout, 0), False); + if (req == NULL) goto failed; + + talloc_steal(req, packet); + + return req; + +failed: + talloc_free(packet); + return NULL; +} + +/* + wait for a name query replu +*/ +NTSTATUS nbt_name_query_recv(struct nbt_name_request *req, + TALLOC_CTX *mem_ctx, struct nbt_name_query *io) +{ + NTSTATUS status; + struct nbt_name_packet *packet; + const char *addr; + struct in_addr in; + + status = nbt_name_request_recv(req); + if (!NT_STATUS_IS_OK(status) || + req->num_replies == 0) { + talloc_free(req); + return status; + } + + packet = req->replies[0].packet; + io->out.reply_from = talloc_steal(mem_ctx, req->replies[0].reply_addr); + + if (packet->ancount != 1 || + packet->answers[0].rr_type != NBT_QTYPE_NETBIOS || + packet->answers[0].rr_class != NBT_QCLASS_IP) { + talloc_free(req); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + io->out.name = packet->answers[0].name; + in.s_addr = htonl(packet->answers[0].rdata.netbios.ipaddr); + addr = inet_ntoa(in); + if (addr == NULL) { + talloc_free(req); + return NT_STATUS_NO_MEMORY; + } + io->out.reply_addr = talloc_strdup(mem_ctx, addr); + talloc_steal(mem_ctx, io->out.name.name); + talloc_steal(mem_ctx, io->out.name.scope); + + talloc_free(req); + + return NT_STATUS_OK; +} + +/* + wait for a name query replu +*/ +NTSTATUS nbt_name_query(struct nbt_name_socket *nbtsock, + TALLOC_CTX *mem_ctx, struct nbt_name_query *io) +{ + struct nbt_name_request *req = nbt_name_query_send(nbtsock, io); + return nbt_name_query_recv(req, mem_ctx, io); +} + + +/* + send a nbt name status +*/ +struct nbt_name_request *nbt_name_status_send(struct nbt_name_socket *nbtsock, + struct nbt_name_status *io) +{ + struct nbt_name_request *req; + struct nbt_name_packet *packet; + + packet = talloc_zero(nbtsock, struct nbt_name_packet); + if (packet == NULL) return NULL; + + packet->qdcount = 1; + packet->operation = NBT_OPCODE_QUERY; + + packet->questions = talloc_array(packet, struct nbt_name_question, 1); + if (packet->questions == NULL) goto failed; + + packet->questions[0].name = io->in.name; + packet->questions[0].question_type = NBT_QTYPE_STATUS; + packet->questions[0].question_class = NBT_QCLASS_IP; + + req = nbt_name_request_send(nbtsock, io->in.dest_addr, NBT_NAME_SERVICE_PORT, packet, + timeval_current_ofs(io->in.timeout, 0), False); + if (req == NULL) goto failed; + + talloc_steal(req, packet); + + return req; + +failed: + talloc_free(packet); + return NULL; +} + +/* + wait for a name status replu +*/ +NTSTATUS nbt_name_status_recv(struct nbt_name_request *req, + TALLOC_CTX *mem_ctx, struct nbt_name_status *io) +{ + NTSTATUS status; + struct nbt_name_packet *packet; + int i; + + status = nbt_name_request_recv(req); + if (!NT_STATUS_IS_OK(status) || + req->num_replies == 0) { + talloc_free(req); + return status; + } + + packet = req->replies[0].packet; + io->out.reply_from = talloc_steal(mem_ctx, req->replies[0].reply_addr); + + if (packet->ancount != 1 || + packet->answers[0].rr_type != NBT_QTYPE_STATUS || + packet->answers[0].rr_class != NBT_QCLASS_IP) { + talloc_free(req); + return NT_STATUS_INVALID_NETWORK_RESPONSE; + } + + io->out.name = packet->answers[0].name; + talloc_steal(mem_ctx, io->out.name.name); + talloc_steal(mem_ctx, io->out.name.scope); + + io->out.status = packet->answers[0].rdata.status; + talloc_steal(mem_ctx, io->out.status.names); + for (i=0;i<io->out.status.num_names;i++) { + talloc_steal(io->out.status.names, io->out.status.names[i].name); + } + + + talloc_free(req); + + return NT_STATUS_OK; +} + +/* + wait for a name status replu +*/ +NTSTATUS nbt_name_status(struct nbt_name_socket *nbtsock, + TALLOC_CTX *mem_ctx, struct nbt_name_status *io) +{ + struct nbt_name_request *req = nbt_name_status_send(nbtsock, io); + return nbt_name_status_recv(req, mem_ctx, io); +} + + +/* + some test functions - will be removed when nbt is hooked in everywhere +*/ +void test_name_status(const char *name, const char *addr) +{ + struct nbt_name_status io; + NTSTATUS status; + TALLOC_CTX *tmp_ctx = talloc_new(NULL); + struct nbt_name_socket *nbtsock; + int i; + + nbtsock = nbt_name_socket_init(tmp_ctx, NULL); + + io.in.name.name = name; + io.in.name.scope = NULL; + io.in.name.type = NBT_NAME_CLIENT; + io.in.dest_addr = addr; + io.in.timeout = 5; + + status = nbt_name_status(nbtsock, tmp_ctx, &io); + if (!NT_STATUS_IS_OK(status)) { + printf("status failed for %s - %s\n", name, nt_errstr(status)); + talloc_free(tmp_ctx); + exit(1); + return; + } + + printf("Received %d names for %s\n", io.out.status.num_names, io.out.name.name); + for (i=0;i<io.out.status.num_names;i++) { + printf("\t%s#%02x 0x%04x\n", + io.out.status.names[i].name, + io.out.status.names[i].type, + io.out.status.names[i].nb_flags); + } + talloc_free(tmp_ctx); +} + + +void test_name_query(const char *name) +{ + struct nbt_name_query io; + NTSTATUS status; + TALLOC_CTX *tmp_ctx = talloc_new(NULL); + struct nbt_name_socket *nbtsock; + + nbtsock = nbt_name_socket_init(tmp_ctx, NULL); + + io.in.name.name = name; + io.in.name.scope = NULL; + io.in.name.type = NBT_NAME_SERVER; + io.in.dest_addr = "255.255.255.255"; + io.in.broadcast = True; + io.in.wins_lookup = False; + io.in.timeout = 5; + + status = nbt_name_query(nbtsock, tmp_ctx, &io); + if (!NT_STATUS_IS_OK(status)) { + printf("query failed for %s - %s\n", name, nt_errstr(status)); + } else { + printf("response %s is at %s\n", io.out.name.name, io.out.reply_addr); + test_name_status("*", io.out.reply_addr); + } + + talloc_free(tmp_ctx); +} + diff --git a/source4/libcli/nbt/nbtname.c b/source4/libcli/nbt/nbtname.c new file mode 100644 index 0000000000..c2da1a0ab4 --- /dev/null +++ b/source4/libcli/nbt/nbtname.c @@ -0,0 +1,285 @@ +/* + Unix SMB/CIFS implementation. + + manipulate nbt name structures + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +/* + see rfc1002 for the detailed format of compressed names +*/ + +#include "includes.h" +#include "librpc/gen_ndr/ndr_nbt.h" + +/* don't allow an unlimited number of name components */ +#define MAX_COMPONENTS 10 + +/* + pull one component of a compressed name +*/ +static NTSTATUS ndr_pull_component(struct ndr_pull *ndr, uint8_t **component, + uint32_t *offset, uint32_t *max_offset) +{ + uint8_t len; + uint_t loops = 0; + while (loops < 5) { + if (*offset >= ndr->data_size) { + return NT_STATUS_BAD_NETWORK_NAME; + } + len = ndr->data[*offset]; + if (len == 0) { + *offset += 1; + *max_offset = MAX(*max_offset, *offset); + *component = NULL; + return NT_STATUS_OK; + } + if ((len & 0xC0) == 0xC0) { + /* its a label pointer */ + if (1 + *offset >= ndr->data_size) { + return NT_STATUS_BAD_NETWORK_NAME; + } + *offset = ((len&0x3F)<<8) | ndr->data[1 + *offset]; + *max_offset = MAX(*max_offset, *offset + 1); + loops++; + continue; + } + if ((len & 0xC0) != 0) { + /* its a reserved length field */ + return NT_STATUS_BAD_NETWORK_NAME; + } + if (*offset + len + 2 >= ndr->data_size) { + return NT_STATUS_BAD_NETWORK_NAME; + } + *component = (uint8_t*)talloc_strndup(ndr, &ndr->data[1 + *offset], len); + NT_STATUS_HAVE_NO_MEMORY(*component); + *offset += len + 1; + *max_offset = MAX(*max_offset, *offset); + return NT_STATUS_OK; + } + + /* too many pointers */ + return NT_STATUS_BAD_NETWORK_NAME; +} + +/* + decompress a 'compressed' name component + */ +static NTSTATUS decompress_name(char *name, enum nbt_name_type *type) +{ + int i; + for (i=0;name[2*i];i++) { + uint8_t c1 = name[2*i]; + uint8_t c2 = name[1+(2*i)]; + if (c1 < 'A' || c1 > 'P' || + c2 < 'A' || c2 > 'P') { + return NT_STATUS_BAD_NETWORK_NAME; + } + name[i] = ((c1-'A')<<4) | (c2-'A'); + } + name[i] = 0; + if (i == 16) { + *type = (enum nbt_name_type)(name[15]); + name[15] = 0; + i--; + } else { + *type = NBT_NAME_CLIENT; + } + + /* trim trailing spaces */ + for (;i>0 && name[i-1]==' ';i--) { + name[i-1] = 0; + } + + return NT_STATUS_OK; +} + + +/* + compress a name component + */ +static uint8_t *compress_name(TALLOC_CTX *mem_ctx, + uint8_t *name, enum nbt_name_type type) +{ + uint8_t *cname; + int i; + uint8_t pad_char; + + if (strlen(name) > 15) { + return NULL; + } + + cname = talloc_array(mem_ctx, uint8_t, 33); + if (cname == NULL) return NULL; + + for (i=0;name[i];i++) { + cname[2*i] = 'A' + (name[i]>>4); + cname[1+2*i] = 'A' + (name[i]&0xF); + } + if (name[0] == '*') { + pad_char = 0; + } else { + pad_char = ' '; + } + for (;i<15;i++) { + cname[2*i] = 'A' + (pad_char>>4); + cname[1+2*i] = 'A' + (pad_char&0xF); + } + + pad_char = type; + cname[2*i] = 'A' + (pad_char>>4); + cname[1+2*i] = 'A' + (pad_char&0xF); + + cname[32] = 0; + return cname; +} + +/* + pull a nbt name from the wire +*/ +NTSTATUS ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name *r) +{ + NTSTATUS status; + uint_t num_components; + uint32_t offset = ndr->offset; + uint32_t max_offset = offset; + uint8_t *components[MAX_COMPONENTS]; + int i; + ssize_t ret; + void *p; + uint8_t *scope; + + if (!(ndr_flags & NDR_SCALARS)) { + return NT_STATUS_OK; + } + + /* break up name into a list of components */ + for (num_components=0;num_components<MAX_COMPONENTS;num_components++) { + status = ndr_pull_component(ndr, &components[num_components], + &offset, &max_offset); + NT_STATUS_NOT_OK_RETURN(status); + if (components[num_components] == NULL) break; + } + if (num_components == MAX_COMPONENTS || + num_components == 0) { + return NT_STATUS_BAD_NETWORK_NAME; + } + + ndr->offset = max_offset; + + /* the first component is limited to 16 bytes in the DOS charset, + which is 32 in the 'compressed' form */ + if (strlen(components[0]) > 32) { + return NT_STATUS_BAD_NETWORK_NAME; + } + + /* decompress the first component */ + status = decompress_name(components[0], &r->type); + NT_STATUS_NOT_OK_RETURN(status); + + ret = convert_string_talloc(ndr, CH_DOS, CH_UNIX, components[0], + strlen(components[0])+1, &p); + if (ret <= 0) { + return NT_STATUS_BAD_NETWORK_NAME; + } + r->name = p; + + /* combine the remaining components into the scope */ + scope = components[1]; + for (i=2;i<num_components;i++) { + talloc_asprintf_append(scope, ".%s", components[i]); + } + + if (scope) { + ret = convert_string_talloc(ndr, CH_DOS, CH_UNIX, scope, + strlen(r->scope)+1, &p); + if (ret <= 0) { + return NT_STATUS_BAD_NETWORK_NAME; + } + r->scope = p; + } else { + r->scope = NULL; + } + + return NT_STATUS_OK; +} + +/* + push a nbt name to the wire +*/ +NTSTATUS ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, struct nbt_name *r) +{ + uint_t num_components; + uint8_t *components[MAX_COMPONENTS]; + void *ptr; + char *dname, *dscope=NULL, *p; + uint8_t *cname; + ssize_t ret; + int i; + + if (!(ndr_flags & NDR_SCALARS)) { + return NT_STATUS_OK; + } + + /* convert to DOS format */ + ret = convert_string_talloc(ndr, CH_UNIX, CH_DOS, r->name, + strlen(r->name)+1, &ptr); + if (ret <= 0) { + return NT_STATUS_BAD_NETWORK_NAME; + } + dname = strupper_talloc(ndr, ptr); + NT_STATUS_HAVE_NO_MEMORY(dname); + if (r->scope) { + ret = convert_string_talloc(ndr, CH_UNIX, CH_DOS, r->scope, + strlen(r->scope)+1, &ptr); + if (ret <= 0) { + return NT_STATUS_BAD_NETWORK_NAME; + } + dscope = strupper_talloc(ndr, ptr); + NT_STATUS_HAVE_NO_MEMORY(dscope); + } + + cname = compress_name(ndr, dname, r->type); + NT_STATUS_HAVE_NO_MEMORY(cname); + + /* form the base components */ + components[0] = cname; + num_components = 1; + + while (dscope && (p=strchr(dscope, '.')) && + num_components < MAX_COMPONENTS) { + *p = 0; + components[num_components] = dscope; + NT_STATUS_HAVE_NO_MEMORY(components[num_components]); + dscope = p+1; + num_components++; + } + if (num_components == MAX_COMPONENTS) { + return NT_STATUS_BAD_NETWORK_NAME; + } + + /* push the components */ + for (i=0;i<num_components;i++) { + uint8_t len = strlen(components[i]); + NDR_CHECK(ndr_push_uint8(ndr, len)); + NDR_CHECK(ndr_push_bytes(ndr, components[i], len)); + } + NDR_CHECK(ndr_push_uint8(ndr, 0)); + + return NT_STATUS_OK; +} diff --git a/source4/libcli/nbt/nbtsocket.c b/source4/libcli/nbt/nbtsocket.c new file mode 100644 index 0000000000..896ed68e98 --- /dev/null +++ b/source4/libcli/nbt/nbtsocket.c @@ -0,0 +1,347 @@ +/* + Unix SMB/CIFS implementation. + + low level socket handling for nbt requests + + Copyright (C) Andrew Tridgell 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "includes.h" +#include "events.h" +#include "dlinklist.h" +#include "libcli/nbt/libnbt.h" + +#define NBT_MAX_PACKET_SIZE 2048 +#define NBT_MAX_REPLIES 1000 + +/* + destroy a pending request +*/ +static int nbt_name_request_destructor(void *ptr) +{ + struct nbt_name_request *req = talloc_get_type(ptr, struct nbt_name_request); + + if (req->state == NBT_REQUEST_SEND) { + DLIST_REMOVE(req->nbtsock->send_queue, req); + } + if (req->state == NBT_REQUEST_WAIT) { + req->nbtsock->num_pending--; + } + if (req->request->name_trn_id != 0) { + idr_remove(req->nbtsock->idr, req->request->name_trn_id); + req->request->name_trn_id = 0; + } + if (req->te) { + event_remove_timed(req->nbtsock->event_ctx, req->te); + req->te = NULL; + } + if (req->nbtsock->send_queue == NULL) { + req->nbtsock->fde->flags &= ~EVENT_FD_WRITE; + } + if (req->nbtsock->num_pending == 0) { + req->nbtsock->fde->flags &= ~EVENT_FD_READ; + } + return 0; +} + + +/* + handle send events on a nbt name socket +*/ +static void nbt_name_socket_send(struct nbt_name_socket *nbtsock) +{ + struct nbt_name_request *req = nbtsock->send_queue; + TALLOC_CTX *tmp_ctx = talloc_new(req); + NTSTATUS status; + + while ((req = nbtsock->send_queue)) { + DATA_BLOB blob; + size_t len; + + if (DEBUGLVL(10)) { + DEBUG(10,("Sending nbt packet:\n")); + NDR_PRINT_DEBUG(nbt_name_packet, req->request); + } + + status = ndr_push_struct_blob(&blob, tmp_ctx, req->request, + (ndr_push_flags_fn_t) + ndr_push_nbt_name_packet); + if (!NT_STATUS_IS_OK(status)) goto failed; + + if (req->request->operation & NBT_FLAG_BROADCAST) { + socket_set_option(nbtsock->sock, "SO_BROADCAST", "1"); + } + + len = blob.length; + status = socket_sendto(nbtsock->sock, &blob, &len, 0, + req->dest_addr, req->dest_port); + if (NT_STATUS_IS_ERR(status)) goto failed; + + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return; + } + + DLIST_REMOVE(nbtsock->send_queue, req); + req->state = NBT_REQUEST_WAIT; + nbtsock->fde->flags |= EVENT_FD_READ; + nbtsock->num_pending++; + } + + nbtsock->fde->flags &= ~EVENT_FD_WRITE; + talloc_free(tmp_ctx); + return; + +failed: + DLIST_REMOVE(nbtsock->send_queue, req); + nbt_name_request_destructor(req); + req->status = status; + req->state = NBT_REQUEST_ERROR; + talloc_free(tmp_ctx); + return; +} + + +/* + handle recv events on a nbt name socket +*/ +static void nbt_name_socket_recv(struct nbt_name_socket *nbtsock) +{ + TALLOC_CTX *tmp_ctx = talloc_new(nbtsock); + NTSTATUS status; + const char *src_addr; + int src_port; + DATA_BLOB blob; + size_t nread; + struct nbt_name_packet *packet; + struct nbt_name_request *req; + + blob = data_blob_talloc(tmp_ctx, NULL, NBT_MAX_PACKET_SIZE); + if (blob.data == NULL) { + talloc_free(tmp_ctx); + return; + } + + status = socket_recvfrom(nbtsock->sock, blob.data, blob.length, &nread, 0, + &src_addr, &src_port); + if (!NT_STATUS_IS_OK(status)) { + talloc_free(tmp_ctx); + return; + } + talloc_steal(tmp_ctx, src_addr); + + packet = talloc(tmp_ctx, struct nbt_name_packet); + if (packet == NULL) { + talloc_free(tmp_ctx); + return; + } + + status = ndr_pull_struct_blob(&blob, packet, packet, + (ndr_pull_flags_fn_t)ndr_pull_nbt_name_packet); + if (!NT_STATUS_IS_OK(status)) { + DEBUG(2,("Failed to parse incoming NBT name packet - %s\n", + nt_errstr(status))); + talloc_free(tmp_ctx); + return; + } + + if (DEBUGLVL(10)) { + DEBUG(10,("Received nbt packet:\n")); + NDR_PRINT_DEBUG(nbt_name_packet, packet); + } + + if (!(packet->operation & NBT_FLAG_REPLY)) { + talloc_free(tmp_ctx); + return; + } + + /* find the matching request */ + req = idr_find(nbtsock->idr, packet->name_trn_id); + if (req == NULL) { + DEBUG(2,("Failed to match request for incoming name packet id 0x%04x\n", + packet->name_trn_id)); + talloc_free(tmp_ctx); + return; + } + + req->replies = talloc_realloc(req, req->replies, struct nbt_name_reply, req->num_replies+1); + if (req->replies == NULL) { + nbt_name_request_destructor(req); + req->state = NBT_REQUEST_DONE; + req->status = NT_STATUS_NO_MEMORY; + talloc_free(tmp_ctx); + return; + } + + req->replies[req->num_replies].reply_addr = talloc_steal(req, src_addr); + req->replies[req->num_replies].reply_port = src_port; + req->replies[req->num_replies].packet = talloc_steal(req, packet); + req->num_replies++; + + /* if we don't want multiple replies then we are done */ + if (!req->allow_multiple_replies || + req->num_replies == NBT_MAX_REPLIES) { + nbt_name_request_destructor(req); + req->state = NBT_REQUEST_DONE; + req->status = NT_STATUS_OK; + } + + talloc_free(tmp_ctx); +} + +/* + handle fd events on a nbt_name_socket +*/ +static void nbt_name_socket_handler(struct event_context *ev, struct fd_event *fde, + struct timeval t, uint16_t flags) +{ + struct nbt_name_socket *nbtsock = talloc_get_type(fde->private, + struct nbt_name_socket); + if (flags & EVENT_FD_WRITE) { + nbt_name_socket_send(nbtsock); + } else if (flags & EVENT_FD_READ) { + nbt_name_socket_recv(nbtsock); + } +} + + +/* + initialise a nbt_name_socket. The event_ctx is optional, if provided + then operations will use that event context +*/ +struct nbt_name_socket *nbt_name_socket_init(TALLOC_CTX *mem_ctx, + struct event_context *event_ctx) +{ + struct nbt_name_socket *nbtsock; + NTSTATUS status; + struct fd_event fde; + + nbtsock = talloc(mem_ctx, struct nbt_name_socket); + if (nbtsock == NULL) goto failed; + + if (event_ctx == NULL) { + nbtsock->event_ctx = event_context_init(nbtsock); + } else { + nbtsock->event_ctx = talloc_reference(nbtsock, event_ctx); + } + if (nbtsock->event_ctx == NULL) goto failed; + + status = socket_create("ip", SOCKET_TYPE_DGRAM, &nbtsock->sock, 0); + if (!NT_STATUS_IS_OK(status)) goto failed; + + talloc_steal(nbtsock, nbtsock->sock); + + nbtsock->idr = idr_init(nbtsock); + if (nbtsock->idr == NULL) goto failed; + + nbtsock->send_queue = NULL; + nbtsock->num_pending = 0; + + fde.fd = socket_get_fd(nbtsock->sock); + fde.flags = 0; + fde.handler = nbt_name_socket_handler; + fde.private = nbtsock; + nbtsock->fde = event_add_fd(nbtsock->event_ctx, &fde); + + return nbtsock; + +failed: + talloc_free(nbtsock); + return NULL; +} + +/* + handle a request timeout +*/ +static void nbt_name_socket_timeout(struct event_context *ev, struct timed_event *te, + struct timeval t) +{ + struct nbt_name_request *req = talloc_get_type(te->private, + struct nbt_name_request); + nbt_name_request_destructor(req); + req->state = NBT_REQUEST_TIMEOUT; + req->status = NT_STATUS_IO_TIMEOUT; +} + +/* + send off a nbt name request +*/ +struct nbt_name_request *nbt_name_request_send(struct nbt_name_socket *nbtsock, + const char *dest_addr, int dest_port, + struct nbt_name_packet *request, + struct timeval timeout, + BOOL allow_multiple_replies) +{ + struct nbt_name_request *req; + struct timed_event te; + int id; + + req = talloc_zero(nbtsock, struct nbt_name_request); + if (req == NULL) goto failed; + + req->nbtsock = nbtsock; + req->dest_addr = dest_addr; + req->dest_port = dest_port; + req->request = talloc_reference(req, request); + req->allow_multiple_replies = allow_multiple_replies; + req->state = NBT_REQUEST_SEND; + + if (req->request->name_trn_id == 0) { + req->request->name_trn_id = random() % UINT16_MAX; + } + + id = idr_get_new_above(req->nbtsock->idr, req, + req->request->name_trn_id, UINT16_MAX); + if (id == -1) { + id = idr_get_new_above(req->nbtsock->idr, req, 1+(random()%10000), + UINT16_MAX); + } + if (id == -1) goto failed; + + te.next_event = timeout; + te.handler = nbt_name_socket_timeout; + te.private = req; + req->te = event_add_timed(nbtsock->event_ctx, &te); + + talloc_set_destructor(req, nbt_name_request_destructor); + + DLIST_ADD_END(nbtsock->send_queue, req, struct nbt_name_request *); + + nbtsock->fde->flags |= EVENT_FD_WRITE; + + return req; + +failed: + talloc_free(req); + return NULL; +} + +/* + wait for a nbt request to complete +*/ +NTSTATUS nbt_name_request_recv(struct nbt_name_request *req) +{ + if (!req) return NT_STATUS_NO_MEMORY; + + while (req->state < NBT_REQUEST_DONE) { + if (event_loop_once(req->nbtsock->event_ctx) != 0) { + req->state = NBT_REQUEST_ERROR; + req->status = NT_STATUS_UNEXPECTED_NETWORK_ERROR; + } + } + return req->status; +} diff --git a/source4/librpc/config.mk b/source4/librpc/config.mk index 3fbd5dadbc..75582c2adc 100644 --- a/source4/librpc/config.mk +++ b/source4/librpc/config.mk @@ -287,6 +287,13 @@ INIT_OBJ_FILES = librpc/gen_ndr/ndr_schannel.o NOPROTO = YES REQUIRED_SUBSYSTEMS = LIBNDR +[SUBSYSTEM::NDR_NBT] +INIT_OBJ_FILES = librpc/gen_ndr/ndr_nbt.o +INIT_FUNCTION = dcerpc_nbt_init +NOPROTO = YES +REQUIRED_SUBSYSTEMS = LIBNDR + + [SUBSYSTEM::NDR_ALL] REQUIRED_SUBSYSTEMS = NDR_AUDIOSRV NDR_ECHO NDR_DCERPC NDR_EXCHANGE \ NDR_DSBACKUP NDR_EFS NDR_MISC NDR_LSA NDR_DFS NDR_DRSUAPI \ @@ -295,7 +302,7 @@ REQUIRED_SUBSYSTEMS = NDR_AUDIOSRV NDR_ECHO NDR_DCERPC NDR_EXCHANGE \ NDR_WINREG NDR_MGMT NDR_PROTECTED_STORAGE NDR_DCOM NDR_OXIDRESOLVER \ NDR_REMACT NDR_WZCSVC NDR_BROWSER NDR_W32TIME NDR_SCERPC NDR_NTSVCS \ NDR_NETLOGON NDR_TRKWKS NDR_KEYSVC NDR_KRB5PAC NDR_XATTR NDR_SCHANNEL \ - NDR_ROT NDR_DRSBLOBS NDR_SVCCTL LIB_SECURITY_NDR + NDR_ROT NDR_DRSBLOBS NDR_SVCCTL NDR_NBT LIB_SECURITY_NDR [SUBSYSTEM::RPC_NDR_ROT] ADD_OBJ_FILES = librpc/gen_ndr/ndr_rot_c.o diff --git a/source4/librpc/idl/idl_types.h b/source4/librpc/idl/idl_types.h index 9463fe0c47..1db778476c 100644 --- a/source4/librpc/idl/idl_types.h +++ b/source4/librpc/idl/idl_types.h @@ -6,6 +6,7 @@ #define STR_NULLTERM LIBNDR_FLAG_STR_NULLTERM #define STR_BYTESIZE LIBNDR_FLAG_STR_BYTESIZE #define STR_FIXLEN32 LIBNDR_FLAG_STR_FIXLEN32 +#define STR_FIXLEN15 LIBNDR_FLAG_STR_FIXLEN15 #define STR_CONFORMANT LIBNDR_FLAG_STR_CONFORMANT #define STR_CHARLEN LIBNDR_FLAG_STR_CHARLEN #define STR_UTF8 LIBNDR_FLAG_STR_UTF8 @@ -37,6 +38,11 @@ #define string32 [flag(STR_FIXLEN32)] string /* + fixed length 16 character ascii string +*/ +#define astring15 [flag(STR_ASCII|STR_FIXLEN15)] string + +/* an ascii string prefixed with [size] [offset] [length], all 32 bits null terminated */ diff --git a/source4/librpc/idl/nbt.idl b/source4/librpc/idl/nbt.idl new file mode 100644 index 0000000000..909ff502e8 --- /dev/null +++ b/source4/librpc/idl/nbt.idl @@ -0,0 +1,166 @@ +#include "idl_types.h" + +/* + IDL structures for NBT operations + + NBT is not traditionally encoded using IDL/NDR. This is a bit of an + experiment, and I may well switch us back to a more traditional + encoding if it doesn't work out +*/ + +interface nbt +{ + const int NBT_NAME_SERVICE_PORT = 137; + const int NBT_DGRAM_SERVICE_PORT = 138; + + typedef [bitmap16bit] bitmap { + NBT_RCODE = 0x000F, + NBT_FLAG_BROADCAST = 0x0010, + NBT_FLAG_RECURSION_AVAIL = 0x0080, + NBT_FLAG_RECURSION_DESIRED = 0x0100, + NBT_FLAG_TRUNCATION = 0x0200, + NBT_FLAG_AUTHORITIVE = 0x0400, + NBT_OPCODE = 0x7800, + NBT_FLAG_REPLY = 0x8000 + } nbt_operation; + + /* the opcodes are in the operation field, masked with + NBT_OPCODE */ + const int NBT_OPCODE_QUERY = (0<<11); + const int NBT_OPCODE_REGISTER = (5<<11); + const int NBT_OPCODE_RELEASE = (6<<11); + const int NBT_OPCODE_WACK = (7<<11); + const int NBT_OPCODE_REFRESH = (8<<11); + + /* rcode values */ + typedef enum { + NBT_RCODE_FMT = 0x1, + NBT_RCODE_SVR = 0x2, + NBT_RCODE_NAM = 0x3, + NBT_RCODE_IMP = 0x4, + NBT_RCODE_RFS = 0x5, + NBT_RCODE_ACT = 0x6, + NBT_RCODE_CFT = 0x7 + } nbt_rcode; + + /* we support any 8bit name type, but by defining the common + ones here we get better debug displays */ + typedef [enum8bit] enum { + NBT_NAME_CLIENT = 0x00, + NBT_NAME_MS = 0x01, + NBT_NAME_USER = 0x03, + NBT_NAME_SERVER = 0x20, + NBT_NAME_PDC = 0x1B, + NBT_NAME_LOGON = 0x1C, + NBT_NAME_MASTER = 0x1D, + NBT_NAME_BROWSER = 0x1E + } nbt_name_type; + + /* the ndr parser for nbt_name is separately defined in + nbtname.c */ + typedef [nopull,nopush] struct { + string name; + string scope; + nbt_name_type type; + } nbt_name; + + typedef [enum16bit] enum { + NBT_QCLASS_IP = 0x01 + } nbt_qclass; + + typedef [enum16bit] enum { + NBT_QTYPE_ADDRESS = 0x0001, + NBT_QTYPE_NAMESERVICE = 0x0002, + NBT_QTYPE_NULL = 0x000A, + NBT_QTYPE_NETBIOS = 0x0020, + NBT_QTYPE_STATUS = 0x0021 + } nbt_qtype; + + typedef struct { + nbt_name name; + nbt_qtype question_type; + nbt_qclass question_class; + } nbt_name_question; + + typedef [bitmap16bit] bitmap { + NBT_NM_PERMANENT = 0x0200, + NBT_NM_ACTIVE = 0x0400, + NBT_NM_CONFLICT = 0x0800, + NBT_NM_DEREGISTER = 0x1000, + NBT_NM_OWNER_TYPE = 0x6000, + NBT_NM_GROUP = 0x8000 + } nb_flags; + + typedef struct { + nb_flags nb_flags; + uint32 ipaddr; + } nbt_rdata_netbios; + + + typedef struct { + uint8 unit_id[6]; + uint8 jumpers; + uint8 test_result; + uint16 version_number; + uint16 period_of_statistics; + uint16 number_of_crcs; + uint16 number_alignment_errors; + uint16 number_of_collisions; + uint16 number_send_aborts; + uint32 number_good_sends; + uint32 number_good_receives; + uint16 number_retransmits; + uint16 number_no_resource_conditions; + uint16 number_free_command_blocks; + uint16 total_number_command_blocks; + uint16 max_total_number_command_blocks; + uint16 number_pending_sessions; + uint16 max_number_pending_sessions; + uint16 max_total_sessions_possible; + uint16 session_data_packet_size; + } nbt_statistics; + + typedef struct { + astring15 name; + nbt_name_type type; + nb_flags nb_flags; + } nbt_status_name; + + typedef struct { + uint8 num_names; + nbt_status_name names[num_names]; + nbt_statistics statistics; + } nbt_rdata_status; + + typedef struct { + nbt_operation operation; + } nbt_rdata_wack; + + typedef [nodiscriminant] union { + [case(NBT_QTYPE_NETBIOS)] nbt_rdata_netbios netbios; + [case(NBT_QTYPE_STATUS)] nbt_rdata_status status; + [case(NBT_QTYPE_NULL)] nbt_rdata_wack wack; + } nbt_rdata; + + typedef [flag(LIBNDR_PRINT_ARRAY_HEX)] struct { + nbt_name name; + nbt_qtype rr_type; + nbt_qclass rr_class; + uint32 ttl; + [subcontext(2),switch_is(rr_type)] nbt_rdata rdata; + } nbt_res_rec; + + typedef [flag(NDR_NOALIGN|NDR_BIG_ENDIAN|NDR_PAHEX),public] struct { + uint16 name_trn_id; + nbt_operation operation; + uint16 qdcount; + uint16 ancount; + uint16 nscount; + uint16 arcount; + nbt_name_question questions[qdcount]; + nbt_res_rec answers[ancount]; + nbt_res_rec nsrecs[nscount]; + nbt_res_rec additional[arcount]; + [flag(NDR_REMAINING)] DATA_BLOB padding; + } nbt_name_packet; +} diff --git a/source4/librpc/ndr/libndr.h b/source4/librpc/ndr/libndr.h index 288e753cca..b5a5573448 100644 --- a/source4/librpc/ndr/libndr.h +++ b/source4/librpc/ndr/libndr.h @@ -102,7 +102,8 @@ struct ndr_print { #define LIBNDR_FLAG_STR_CONFORMANT (1<<10) #define LIBNDR_FLAG_STR_CHARLEN (1<<11) #define LIBNDR_FLAG_STR_UTF8 (1<<12) -#define LIBNDR_STRING_FLAGS (0x1FFC) +#define LIBNDR_FLAG_STR_FIXLEN15 (1<<13) +#define LIBNDR_STRING_FLAGS (0x3FFC) #define LIBNDR_FLAG_REF_ALLOC (1<<20) diff --git a/source4/librpc/ndr/ndr.c b/source4/librpc/ndr/ndr.c index 7cc832c68e..8a25e27cc1 100644 --- a/source4/librpc/ndr/ndr.c +++ b/source4/librpc/ndr/ndr.c @@ -883,3 +883,24 @@ size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t push) talloc_free(ndr); return ret; } + +/* + generic ndr_size_*() handler for unions +*/ +size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_push_union_fn_t push) +{ + struct ndr_push *ndr; + NTSTATUS status; + size_t ret; + + ndr = ndr_push_init_ctx(NULL); + if (!ndr) return 0; + ndr->flags |= flags; + status = push(ndr, NDR_SCALARS|NDR_BUFFERS, level, discard_const(p)); + if (!NT_STATUS_IS_OK(status)) { + return 0; + } + ret = ndr->offset; + talloc_free(ndr); + return ret; +} diff --git a/source4/librpc/ndr/ndr_basic.c b/source4/librpc/ndr/ndr_basic.c index 29a3009af6..6476f58764 100644 --- a/source4/librpc/ndr/ndr_basic.c +++ b/source4/librpc/ndr/ndr_basic.c @@ -718,8 +718,9 @@ NTSTATUS ndr_pull_string(struct ndr_pull *ndr, int ndr_flags, const char **s) *s = as; break; + case LIBNDR_FLAG_STR_FIXLEN15: case LIBNDR_FLAG_STR_FIXLEN32: - len1 = 32; + len1 = (flags & LIBNDR_FLAG_STR_FIXLEN32)?32:15; NDR_PULL_NEED_BYTES(ndr, len1*byte_mul); ret = convert_string_talloc(ndr, chset, CH_UNIX, ndr->data+ndr->offset, @@ -733,7 +734,6 @@ NTSTATUS ndr_pull_string(struct ndr_pull *ndr, int ndr_flags, const char **s) *s = as; break; - default: return ndr_pull_error(ndr, NDR_ERR_STRING, "Bad string flags 0x%x\n", ndr->flags & LIBNDR_STRING_FLAGS); @@ -748,7 +748,7 @@ NTSTATUS ndr_pull_string(struct ndr_pull *ndr, int ndr_flags, const char **s) */ NTSTATUS ndr_push_string(struct ndr_push *ndr, int ndr_flags, const char *s) { - ssize_t s_len, c_len; + ssize_t s_len, c_len, d_len; int ret; int chset = CH_UTF16; unsigned flags = ndr->flags; @@ -882,16 +882,18 @@ NTSTATUS ndr_push_string(struct ndr_push *ndr, int ndr_flags, const char *s) ndr->offset += c_len*byte_mul; break; + case LIBNDR_FLAG_STR_FIXLEN15: case LIBNDR_FLAG_STR_FIXLEN32: - NDR_PUSH_NEED_BYTES(ndr, byte_mul*32); + d_len = (flags & LIBNDR_FLAG_STR_FIXLEN32)?32:15; + NDR_PUSH_NEED_BYTES(ndr, byte_mul*d_len); ret = convert_string(CH_UNIX, chset, s, s_len + 1, - ndr->data+ndr->offset, byte_mul*32); + ndr->data+ndr->offset, byte_mul*d_len); if (ret == -1) { return ndr_push_error(ndr, NDR_ERR_CHARCNV, "Bad character conversion"); } - ndr->offset += byte_mul*32; + ndr->offset += byte_mul*d_len; break; default: @@ -915,6 +917,9 @@ size_t ndr_string_array_size(struct ndr_push *ndr, const char *s) if (flags & LIBNDR_FLAG_STR_FIXLEN32) { return 32; } + if (flags & LIBNDR_FLAG_STR_FIXLEN15) { + return 15; + } c_len = s?strlen_m(s):0; @@ -1029,11 +1034,18 @@ void ndr_print_enum(struct ndr_print *ndr, const char *name, const char *type, void ndr_print_bitmap_flag(struct ndr_print *ndr, size_t size, const char *flag_name, uint_t flag, uint_t value) { - /* size can be later used to print something like: - * ...1.... .........: FLAG1_NAME - * .....0.. .........: FLAG2_NAME - */ - ndr->print(ndr, "%s: %-25s", (flag & value)?"1":"0", flag_name); + /* this is an attempt to support multi-bit bitmap masks */ + value &= flag; + + while (!(flag & 1)) { + flag >>= 1; + value >>= 1; + } + if (flag == 1) { + ndr->print(ndr, " %d: %-25s", value, flag_name); + } else { + ndr->print(ndr, "0x%02x: %-25s (%d)", value, flag_name, value); + } } void ndr_print_uint8(struct ndr_print *ndr, const char *name, uint8_t v) |