Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : SMB torture tester - scanning functions
4 : Copyright (C) Andrew Tridgell 2001
5 :
6 : This program is free software; you can redistribute it and/or modify
7 : it under the terms of the GNU General Public License as published by
8 : the Free Software Foundation; either version 3 of the License, or
9 : (at your option) any later version.
10 :
11 : This program is distributed in the hope that it will be useful,
12 : but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : GNU General Public License for more details.
15 :
16 : You should have received a copy of the GNU General Public License
17 : along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "system/filesys.h"
22 : #include "torture/proto.h"
23 : #include "libsmb/libsmb.h"
24 : #include "../libcli/smb/smbXcli_base.h"
25 :
26 : #define VERBOSE 0
27 : #define OP_MIN 0
28 : #define OP_MAX 20
29 :
30 : #define DATA_SIZE 1024
31 : #define PARAM_SIZE 1024
32 :
33 : /****************************************************************************
34 : look for a partial hit
35 : ****************************************************************************/
36 0 : static void trans2_check_hit(const char *format, int op, int level, NTSTATUS status)
37 : {
38 0 : if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
39 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
40 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
41 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
42 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
43 0 : return;
44 : }
45 : #if VERBOSE
46 : printf("possible %s hit op=%3d level=%5d status=%s\n",
47 : format, op, level, nt_errstr(status));
48 : #endif
49 : }
50 :
51 : /****************************************************************************
52 : check for existence of a trans2 call
53 : ****************************************************************************/
54 0 : static NTSTATUS try_trans2(struct cli_state *cli,
55 : int op,
56 : uint8_t *param, uint8_t *data,
57 : uint32_t param_len, uint32_t data_len,
58 : uint32_t *rparam_len, uint32_t *rdata_len)
59 : {
60 0 : uint16_t setup[1];
61 0 : uint8_t *rparam=NULL, *rdata=NULL;
62 0 : NTSTATUS status;
63 :
64 0 : SSVAL(setup+0, 0, op);
65 :
66 0 : status = cli_trans(talloc_tos(), cli, SMBtrans2,
67 : NULL, -1, /* name, fid */
68 : op, 0,
69 : NULL, 0, 0, /* setup */
70 : param, param_len, 2,
71 : data, data_len, CLI_BUFFER_SIZE,
72 : NULL, /* recv_flags2 */
73 : NULL, 0, NULL, /* rsetup */
74 : &rparam, 0, rparam_len,
75 : &rdata, 0, rdata_len);
76 :
77 0 : TALLOC_FREE(rdata);
78 0 : TALLOC_FREE(rparam);
79 :
80 0 : return status;
81 : }
82 :
83 :
84 0 : static NTSTATUS try_trans2_len(struct cli_state *cli,
85 : const char *format,
86 : int op, int level,
87 : uint8_t *param, uint8_t *data,
88 : uint32_t param_len, uint32_t *data_len,
89 : uint32_t *rparam_len, uint32_t *rdata_len)
90 : {
91 0 : NTSTATUS ret=NT_STATUS_OK;
92 :
93 0 : ret = try_trans2(cli, op, param, data, param_len,
94 : DATA_SIZE, rparam_len, rdata_len);
95 : #if VERBOSE
96 : printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
97 : #endif
98 0 : if (!NT_STATUS_IS_OK(ret)) return ret;
99 :
100 0 : *data_len = 0;
101 0 : while (*data_len < DATA_SIZE) {
102 0 : ret = try_trans2(cli, op, param, data, param_len,
103 : *data_len, rparam_len, rdata_len);
104 0 : if (NT_STATUS_IS_OK(ret)) break;
105 0 : *data_len += 2;
106 : }
107 0 : if (NT_STATUS_IS_OK(ret)) {
108 0 : printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
109 : format, level, *data_len, *rparam_len, *rdata_len);
110 : } else {
111 0 : trans2_check_hit(format, op, level, ret);
112 : }
113 0 : return ret;
114 : }
115 :
116 : /****************************************************************************
117 : check for existence of a trans2 call
118 : ****************************************************************************/
119 0 : static bool scan_trans2(struct cli_state *cli, int op, int level,
120 : int fnum, int dnum, const char *fname)
121 : {
122 0 : uint32_t data_len = 0;
123 0 : uint32_t param_len = 0;
124 0 : uint32_t rparam_len, rdata_len;
125 0 : uint8_t *param = NULL;
126 0 : uint8_t data[DATA_SIZE];
127 0 : const char *newfname;
128 0 : const char *dname;
129 0 : NTSTATUS status;
130 :
131 0 : memset(data, 0, sizeof(data));
132 0 : data_len = 4;
133 :
134 : /* try with a info level only */
135 0 : TALLOC_FREE(param);
136 0 : param = talloc_array(talloc_tos(), uint8_t, 2);
137 0 : if (param == NULL) return True;
138 :
139 0 : SSVAL(param, 0, level);
140 :
141 0 : param_len = talloc_get_size(param);
142 0 : status = try_trans2_len(cli, "void", op, level, param, data, param_len, &data_len,
143 : &rparam_len, &rdata_len);
144 0 : if (NT_STATUS_IS_OK(status)) return True;
145 :
146 : /* try with a file descriptor */
147 0 : TALLOC_FREE(param);
148 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
149 0 : if (param == NULL) return True;
150 :
151 0 : SSVAL(param, 0, fnum);
152 0 : SSVAL(param, 2, level);
153 0 : SSVAL(param, 4, 0);
154 :
155 0 : param_len = talloc_get_size(param);
156 0 : status = try_trans2_len(cli, "fnum", op, level, param, data, param_len, &data_len,
157 : &rparam_len, &rdata_len);
158 0 : if (NT_STATUS_IS_OK(status)) return True;
159 :
160 :
161 : /* try with a notify style */
162 0 : TALLOC_FREE(param);
163 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
164 0 : if (param == NULL) return True;
165 :
166 0 : SSVAL(param, 0, dnum);
167 0 : SSVAL(param, 2, dnum);
168 0 : SSVAL(param, 4, level);
169 :
170 0 : param_len = talloc_get_size(param);
171 0 : status = try_trans2_len(cli, "notify", op, level, param, data, param_len, &data_len,
172 : &rparam_len, &rdata_len);
173 0 : if (NT_STATUS_IS_OK(status)) return True;
174 :
175 : /* try with a file name */
176 0 : TALLOC_FREE(param);
177 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
178 0 : if (param == NULL) return True;
179 :
180 0 : SSVAL(param, 0, level);
181 0 : SSVAL(param, 2, 0);
182 0 : SSVAL(param, 4, 0);
183 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
184 0 : fname, strlen(fname)+1, NULL);
185 0 : if (param == NULL) return True;
186 :
187 0 : param_len = talloc_get_size(param);
188 0 : status = try_trans2_len(cli, "fname", op, level, param, data, param_len, &data_len,
189 : &rparam_len, &rdata_len);
190 0 : if (NT_STATUS_IS_OK(status)) return True;
191 :
192 : /* try with a new file name */
193 0 : newfname = "\\newfile.dat";
194 0 : TALLOC_FREE(param);
195 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
196 0 : if (param == NULL) return True;
197 :
198 0 : SSVAL(param, 0, level);
199 0 : SSVAL(param, 2, 0);
200 0 : SSVAL(param, 4, 0);
201 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
202 0 : newfname, strlen(newfname)+1, NULL);
203 0 : if (param == NULL) return True;
204 :
205 0 : param_len = talloc_get_size(param);
206 0 : status = try_trans2_len(cli, "newfile", op, level, param, data, param_len, &data_len,
207 : &rparam_len, &rdata_len);
208 0 : cli_unlink(cli, newfname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
209 0 : cli_rmdir(cli, newfname);
210 0 : if (NT_STATUS_IS_OK(status)) return True;
211 :
212 : /* try dfs style */
213 0 : dname = "\\testdir";
214 0 : cli_mkdir(cli, dname);
215 0 : TALLOC_FREE(param);
216 0 : param = talloc_array(talloc_tos(), uint8_t, 2);
217 0 : if (param == NULL) return True;
218 :
219 0 : SSVAL(param, 0, level);
220 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
221 0 : dname, strlen(dname)+1, NULL);
222 0 : if (param == NULL) return True;
223 :
224 0 : param_len = talloc_get_size(param);
225 0 : status = try_trans2_len(cli, "dfs", op, level, param, data, param_len, &data_len,
226 : &rparam_len, &rdata_len);
227 0 : cli_rmdir(cli, dname);
228 0 : if (NT_STATUS_IS_OK(status)) return True;
229 :
230 0 : return False;
231 : }
232 :
233 :
234 0 : bool torture_trans2_scan(int dummy)
235 : {
236 0 : static struct cli_state *cli;
237 0 : int op, level;
238 0 : const char *fname = "\\scanner.dat";
239 0 : uint16_t fnum, dnum;
240 :
241 0 : printf("starting trans2 scan test\n");
242 :
243 0 : if (!torture_open_connection(&cli, 0)) {
244 0 : return False;
245 : }
246 :
247 0 : if (!NT_STATUS_IS_OK(cli_openx(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
248 : DENY_NONE, &fnum))) {
249 0 : printf("open of %s failed\n", fname);
250 0 : return false;
251 : }
252 0 : if (!NT_STATUS_IS_OK(cli_openx(cli, "\\", O_RDONLY, DENY_NONE, &dnum))) {
253 0 : printf("open of \\ failed\n");
254 0 : return false;
255 : }
256 :
257 0 : for (op=OP_MIN; op<=OP_MAX; op++) {
258 0 : printf("Scanning op=%d\n", op);
259 0 : for (level = 0; level <= 50; level++) {
260 0 : scan_trans2(cli, op, level, fnum, dnum, fname);
261 : }
262 :
263 0 : for (level = 0x100; level <= 0x130; level++) {
264 0 : scan_trans2(cli, op, level, fnum, dnum, fname);
265 : }
266 :
267 0 : for (level = 1000; level < 1050; level++) {
268 0 : scan_trans2(cli, op, level, fnum, dnum, fname);
269 : }
270 : }
271 :
272 0 : torture_close_connection(cli);
273 :
274 0 : printf("trans2 scan finished\n");
275 0 : return True;
276 : }
277 :
278 :
279 :
280 :
281 : /****************************************************************************
282 : look for a partial hit
283 : ****************************************************************************/
284 0 : static void nttrans_check_hit(const char *format, int op, int level, NTSTATUS status)
285 : {
286 0 : if (NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_LEVEL) ||
287 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_IMPLEMENTED) ||
288 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_NOT_SUPPORTED) ||
289 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_UNSUCCESSFUL) ||
290 0 : NT_STATUS_V(status) == NT_STATUS_V(NT_STATUS_INVALID_INFO_CLASS)) {
291 0 : return;
292 : }
293 : #if VERBOSE
294 : printf("possible %s hit op=%3d level=%5d status=%s\n",
295 : format, op, level, nt_errstr(status));
296 : #endif
297 : }
298 :
299 : /****************************************************************************
300 : check for existence of a nttrans call
301 : ****************************************************************************/
302 0 : static NTSTATUS try_nttrans(struct cli_state *cli,
303 : int op,
304 : uint8_t *param, uint8_t *data,
305 : int32_t param_len, uint32_t data_len,
306 : uint32_t *rparam_len,
307 : uint32_t *rdata_len)
308 : {
309 0 : uint8_t *rparam=NULL, *rdata=NULL;
310 0 : NTSTATUS status;
311 :
312 0 : status = cli_trans(talloc_tos(), cli, SMBnttrans,
313 : NULL, -1, /* name, fid */
314 : op, 0,
315 : NULL, 0, 0, /* setup */
316 : param, param_len, 2,
317 : data, data_len, CLI_BUFFER_SIZE,
318 : NULL, /* recv_flags2 */
319 : NULL, 0, NULL, /* rsetup */
320 : &rparam, 0, rparam_len,
321 : &rdata, 0, rdata_len);
322 0 : SAFE_FREE(rdata);
323 0 : SAFE_FREE(rparam);
324 :
325 0 : return status;
326 : }
327 :
328 :
329 0 : static NTSTATUS try_nttrans_len(struct cli_state *cli,
330 : const char *format,
331 : int op, int level,
332 : uint8_t *param, uint8_t *data,
333 : int param_len, uint32_t *data_len,
334 : uint32_t *rparam_len, uint32_t *rdata_len)
335 : {
336 0 : NTSTATUS ret=NT_STATUS_OK;
337 :
338 0 : ret = try_nttrans(cli, op, param, data, param_len,
339 : DATA_SIZE, rparam_len, rdata_len);
340 : #if VERBOSE
341 : printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
342 : #endif
343 0 : if (!NT_STATUS_IS_OK(ret)) return ret;
344 :
345 0 : *data_len = 0;
346 0 : while (*data_len < DATA_SIZE) {
347 0 : ret = try_nttrans(cli, op, param, data, param_len,
348 : *data_len, rparam_len, rdata_len);
349 0 : if (NT_STATUS_IS_OK(ret)) break;
350 0 : *data_len += 2;
351 : }
352 0 : if (NT_STATUS_IS_OK(ret)) {
353 0 : printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
354 : format, level, *data_len, *rparam_len, *rdata_len);
355 : } else {
356 0 : nttrans_check_hit(format, op, level, ret);
357 : }
358 0 : return ret;
359 : }
360 :
361 : /****************************************************************************
362 : check for existence of a nttrans call
363 : ****************************************************************************/
364 0 : static bool scan_nttrans(struct cli_state *cli, int op, int level,
365 : int fnum, int dnum, const char *fname)
366 : {
367 0 : uint32_t data_len = 0;
368 0 : uint32_t param_len = 0;
369 0 : uint32_t rparam_len, rdata_len;
370 0 : uint8_t *param = NULL;
371 0 : uint8_t data[DATA_SIZE];
372 0 : NTSTATUS status;
373 0 : const char *newfname;
374 0 : const char *dname;
375 :
376 0 : memset(data, 0, sizeof(data));
377 0 : data_len = 4;
378 :
379 : /* try with a info level only */
380 0 : TALLOC_FREE(param);
381 0 : param = talloc_array(talloc_tos(), uint8_t, 2);
382 0 : if (param == NULL) return True;
383 :
384 0 : SSVAL(param, 0, level);
385 :
386 0 : param_len = talloc_get_size(param);
387 0 : status = try_nttrans_len(cli, "void", op, level, param, data, param_len, &data_len,
388 : &rparam_len, &rdata_len);
389 0 : if (NT_STATUS_IS_OK(status)) return True;
390 :
391 : /* try with a file descriptor */
392 0 : TALLOC_FREE(param);
393 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
394 0 : if (param == NULL) return True;
395 :
396 0 : SSVAL(param, 0, fnum);
397 0 : SSVAL(param, 2, level);
398 0 : SSVAL(param, 4, 0);
399 :
400 0 : param_len = talloc_get_size(param);
401 0 : status = try_nttrans_len(cli, "fnum", op, level, param, data, param_len, &data_len,
402 : &rparam_len, &rdata_len);
403 0 : if (NT_STATUS_IS_OK(status)) return True;
404 :
405 :
406 : /* try with a notify style */
407 0 : TALLOC_FREE(param);
408 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
409 0 : if (param == NULL) return True;
410 :
411 0 : SSVAL(param, 0, dnum);
412 0 : SSVAL(param, 2, dnum);
413 0 : SSVAL(param, 4, level);
414 :
415 0 : param_len = talloc_get_size(param);
416 0 : status = try_nttrans_len(cli, "notify", op, level, param, data, param_len, &data_len,
417 : &rparam_len, &rdata_len);
418 0 : if (NT_STATUS_IS_OK(status)) return True;
419 :
420 : /* try with a file name */
421 0 : TALLOC_FREE(param);
422 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
423 0 : if (param == NULL) return True;
424 :
425 0 : SSVAL(param, 0, level);
426 0 : SSVAL(param, 2, 0);
427 0 : SSVAL(param, 4, 0);
428 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
429 0 : fname, strlen(fname)+1, NULL);
430 0 : if (param == NULL) return True;
431 :
432 0 : param_len = talloc_get_size(param);
433 0 : status = try_nttrans_len(cli, "fname", op, level, param, data, param_len, &data_len,
434 : &rparam_len, &rdata_len);
435 0 : if (NT_STATUS_IS_OK(status)) return True;
436 :
437 : /* try with a new file name */
438 0 : newfname = "\\newfile.dat";
439 0 : TALLOC_FREE(param);
440 0 : param = talloc_array(talloc_tos(), uint8_t, 6);
441 0 : if (param == NULL) return True;
442 :
443 0 : SSVAL(param, 0, level);
444 0 : SSVAL(param, 2, 0);
445 0 : SSVAL(param, 4, 0);
446 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
447 0 : newfname, strlen(newfname)+1, NULL);
448 0 : if (param == NULL) return True;
449 :
450 0 : param_len = talloc_get_size(param);
451 0 : status = try_nttrans_len(cli, "newfile", op, level, param, data, param_len, &data_len,
452 : &rparam_len, &rdata_len);
453 0 : cli_unlink(cli, newfname, FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_HIDDEN);
454 0 : cli_rmdir(cli, newfname);
455 0 : if (NT_STATUS_IS_OK(status)) return True;
456 :
457 : /* try dfs style */
458 0 : dname = "\\testdir";
459 0 : cli_mkdir(cli, dname);
460 0 : TALLOC_FREE(param);
461 0 : param = talloc_array(talloc_tos(), uint8_t, 2);
462 0 : if (param == NULL) return True;
463 :
464 0 : SSVAL(param, 0, level);
465 0 : param = trans2_bytes_push_str(param, smbXcli_conn_use_unicode(cli->conn),
466 0 : dname, strlen(dname)+1, NULL);
467 0 : if (param == NULL) return True;
468 :
469 0 : param_len = talloc_get_size(param);
470 0 : status = try_nttrans_len(cli, "dfs", op, level, param, data, param_len, &data_len,
471 : &rparam_len, &rdata_len);
472 0 : cli_rmdir(cli, dname);
473 0 : if (NT_STATUS_IS_OK(status)) return True;
474 :
475 0 : return False;
476 : }
477 :
478 :
479 0 : bool torture_nttrans_scan(int dummy)
480 : {
481 0 : static struct cli_state *cli;
482 0 : int op, level;
483 0 : const char *fname = "\\scanner.dat";
484 0 : uint16_t fnum, dnum;
485 :
486 0 : printf("starting nttrans scan test\n");
487 :
488 0 : if (!torture_open_connection(&cli, 0)) {
489 0 : return False;
490 : }
491 :
492 0 : cli_openx(cli, fname, O_RDWR | O_CREAT | O_TRUNC,
493 : DENY_NONE, &fnum);
494 0 : cli_openx(cli, "\\", O_RDONLY, DENY_NONE, &dnum);
495 :
496 0 : for (op=OP_MIN; op<=OP_MAX; op++) {
497 0 : printf("Scanning op=%d\n", op);
498 0 : for (level = 0; level <= 50; level++) {
499 0 : scan_nttrans(cli, op, level, fnum, dnum, fname);
500 : }
501 :
502 0 : for (level = 0x100; level <= 0x130; level++) {
503 0 : scan_nttrans(cli, op, level, fnum, dnum, fname);
504 : }
505 :
506 0 : for (level = 1000; level < 1050; level++) {
507 0 : scan_nttrans(cli, op, level, fnum, dnum, fname);
508 : }
509 : }
510 :
511 0 : torture_close_connection(cli);
512 :
513 0 : printf("nttrans scan finished\n");
514 0 : return True;
515 : }
|
