zzg/gatling
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
gatling/smb.c
T
Zack Zatkin-Gold ae656d352b initial revision
2016-05-04 00:26:27 -04:00

1647 lines
49 KiB
C
Raw Permalink Blame History

#define _FILE_OFFSET_BITS 64
#define _BSD_SOURCE
#include "gatling.h"
#ifdef SUPPORT_SMB
#include "byte.h"
#include "rangecheck.h"
#include "str.h"
#include <sys/types.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>
#include <assert.h>
#include <time.h>
#include <sys/time.h>
#include <iconv.h>
#include <sys/statvfs.h>
#include <fnmatch.h>
#include <dirent.h>
#include <ctype.h>
#include <stdio.h>
#include "havealloca.h"
/* very offensive, I know. The idea is that gcc evaluates this at
* compile time if buf and x are const char. So I'm using this instead
* of counting the offsets manually, so you don't have to count anything
* if you want to follow the code and see what it does. */
#define OFS16(buf,x) \
((sizeof(buf)>0+1 && buf[0]==x[0] && buf[0+1]==x[1])?0: \
((sizeof(buf)>1+1 && buf[1]==x[0] && buf[1+1]==x[1])?1: \
((sizeof(buf)>2+1 && buf[2]==x[0] && buf[2+1]==x[1])?2: \
((sizeof(buf)>3+1 && buf[3]==x[0] && buf[3+1]==x[1])?3: \
((sizeof(buf)>4+1 && buf[4]==x[0] && buf[4+1]==x[1])?4: \
((sizeof(buf)>5+1 && buf[5]==x[0] && buf[5+1]==x[1])?5: \
((sizeof(buf)>6+1 && buf[6]==x[0] && buf[6+1]==x[1])?6: \
((sizeof(buf)>7+1 && buf[7]==x[0] && buf[7+1]==x[1])?7: \
((sizeof(buf)>8+1 && buf[8]==x[0] && buf[8+1]==x[1])?8: \
((sizeof(buf)>9+1 && buf[9]==x[0] && buf[9+1]==x[1])?9: \
((sizeof(buf)>10+1 && buf[10]==x[0] && buf[10+1]==x[1])?10: \
((sizeof(buf)>11+1 && buf[11]==x[0] && buf[11+1]==x[1])?11: \
((sizeof(buf)>12+1 && buf[12]==x[0] && buf[12+1]==x[1])?12: \
((sizeof(buf)>13+1 && buf[13]==x[0] && buf[13+1]==x[1])?13: \
((sizeof(buf)>14+1 && buf[14]==x[0] && buf[14+1]==x[1])?14: \
((sizeof(buf)>15+1 && buf[15]==x[0] && buf[15+1]==x[1])?15: \
((sizeof(buf)>16+1 && buf[16]==x[0] && buf[16+1]==x[1])?16: \
((sizeof(buf)>17+1 && buf[17]==x[0] && buf[17+1]==x[1])?17: \
((sizeof(buf)>18+1 && buf[18]==x[0] && buf[18+1]==x[1])?18: \
((sizeof(buf)>19+1 && buf[19]==x[0] && buf[19+1]==x[1])?19: \
((sizeof(buf)>20+1 && buf[20]==x[0] && buf[20+1]==x[1])?20: \
((sizeof(buf)>21+1 && buf[21]==x[0] && buf[21+1]==x[1])?21: \
((sizeof(buf)>22+1 && buf[22]==x[0] && buf[22+1]==x[1])?22: \
((sizeof(buf)>23+1 && buf[23]==x[0] && buf[23+1]==x[1])?23: \
((sizeof(buf)>24+1 && buf[24]==x[0] && buf[24+1]==x[1])?24: \
((sizeof(buf)>25+1 && buf[25]==x[0] && buf[25+1]==x[1])?25: \
((sizeof(buf)>26+1 && buf[26]==x[0] && buf[26+1]==x[1])?26: \
((sizeof(buf)>27+1 && buf[27]==x[0] && buf[27+1]==x[1])?27: \
((sizeof(buf)>28+1 && buf[28]==x[0] && buf[28+1]==x[1])?28: \
((sizeof(buf)>29+1 && buf[29]==x[0] && buf[29+1]==x[1])?29: \
((sizeof(buf)>30+1 && buf[30]==x[0] && buf[30+1]==x[1])?30: \
((sizeof(buf)>31+1 && buf[31]==x[0] && buf[31+1]==x[1])?31: \
((sizeof(buf)>32+1 && buf[32]==x[0] && buf[32+1]==x[1])?32: \
((sizeof(buf)>33+1 && buf[33]==x[0] && buf[33+1]==x[1])?33: \
((sizeof(buf)>34+1 && buf[34]==x[0] && buf[34+1]==x[1])?34: \
((sizeof(buf)>35+1 && buf[35]==x[0] && buf[35+1]==x[1])?35: \
((sizeof(buf)>36+1 && buf[36]==x[0] && buf[36+1]==x[1])?36: \
((sizeof(buf)>37+1 && buf[37]==x[0] && buf[37+1]==x[1])?37: \
((sizeof(buf)>38+1 && buf[38]==x[0] && buf[38+1]==x[1])?38: \
((sizeof(buf)>39+1 && buf[39]==x[0] && buf[39+1]==x[1])?39: \
((sizeof(buf)>40+1 && buf[40]==x[0] && buf[40+1]==x[1])?40: \
((sizeof(buf)>41+1 && buf[41]==x[0] && buf[41+1]==x[1])?41: \
((sizeof(buf)>42+1 && buf[42]==x[0] && buf[42+1]==x[1])?42: \
((sizeof(buf)>43+1 && buf[43]==x[0] && buf[43+1]==x[1])?43: \
((sizeof(buf)>44+1 && buf[44]==x[0] && buf[44+1]==x[1])?44: \
((sizeof(buf)>45+1 && buf[45]==x[0] && buf[45+1]==x[1])?45: \
((sizeof(buf)>46+1 && buf[46]==x[0] && buf[46+1]==x[1])?46: \
((sizeof(buf)>47+1 && buf[47]==x[0] && buf[47+1]==x[1])?47: \
((sizeof(buf)>48+1 && buf[48]==x[0] && buf[48+1]==x[1])?48: \
((sizeof(buf)>49+1 && buf[49]==x[0] && buf[49+1]==x[1])?49: \
((sizeof(buf)>50+1 && buf[50]==x[0] && buf[50+1]==x[1])?50: \
((sizeof(buf)>51+1 && buf[51]==x[0] && buf[51+1]==x[1])?51: \
((sizeof(buf)>52+1 && buf[52]==x[0] && buf[52+1]==x[1])?52: \
((sizeof(buf)>53+1 && buf[53]==x[0] && buf[53+1]==x[1])?53: \
((sizeof(buf)>54+1 && buf[54]==x[0] && buf[54+1]==x[1])?54: \
((sizeof(buf)>55+1 && buf[55]==x[0] && buf[55+1]==x[1])?55: \
((sizeof(buf)>56+1 && buf[56]==x[0] && buf[56+1]==x[1])?56: \
((sizeof(buf)>57+1 && buf[57]==x[0] && buf[57+1]==x[1])?57: \
((sizeof(buf)>58+1 && buf[58]==x[0] && buf[58+1]==x[1])?58: \
((sizeof(buf)>59+1 && buf[59]==x[0] && buf[59+1]==x[1])?59: \
((sizeof(buf)>60+1 && buf[60]==x[0] && buf[60+1]==x[1])?60: \
((sizeof(buf)>61+1 && buf[61]==x[0] && buf[61+1]==x[1])?61: \
((sizeof(buf)>62+1 && buf[62]==x[0] && buf[62+1]==x[1])?62: \
((sizeof(buf)>63+1 && buf[63]==x[0] && buf[63+1]==x[1])?63: \
((sizeof(buf)>64+1 && buf[64]==x[0] && buf[64+1]==x[1])?64: \
((sizeof(buf)>65+1 && buf[65]==x[0] && buf[65+1]==x[1])?65: \
((sizeof(buf)>66+1 && buf[66]==x[0] && buf[66+1]==x[1])?66: \
((sizeof(buf)>67+1 && buf[67]==x[0] && buf[67+1]==x[1])?67: \
((sizeof(buf)>68+1 && buf[68]==x[0] && buf[68+1]==x[1])?68: \
((sizeof(buf)>69+1 && buf[69]==x[0] && buf[69+1]==x[1])?69: \
((sizeof(buf)>70+1 && buf[70]==x[0] && buf[70+1]==x[1])?70: \
((sizeof(buf)>71+1 && buf[71]==x[0] && buf[71+1]==x[1])?71: \
((sizeof(buf)>72+1 && buf[72]==x[0] && buf[72+1]==x[1])?72: \
((sizeof(buf)>73+1 && buf[73]==x[0] && buf[73+1]==x[1])?73: \
((sizeof(buf)>74+1 && buf[74]==x[0] && buf[74+1]==x[1])?74: \
((sizeof(buf)>75+1 && buf[75]==x[0] && buf[75+1]==x[1])?75: \
((sizeof(buf)>76+1 && buf[76]==x[0] && buf[76+1]==x[1])?76: \
((sizeof(buf)>77+1 && buf[77]==x[0] && buf[77+1]==x[1])?77: \
((sizeof(buf)>78+1 && buf[78]==x[0] && buf[78+1]==x[1])?78: \
((sizeof(buf)>79+1 && buf[79]==x[0] && buf[79+1]==x[1])?79: \
-1))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
#if 0
_
___ _ __ ___ | |__
/ __| '_ ` _ \| '_ \
\__ \ | | | | | |_) |
|___/_| |_| |_|_.__/
#endif
#if 0
struct smbheader {
unsigned char protocol[4]; /* '\xffSMB' */
unsigned char command; /* command code */
unsigned long status;
unsigned char flags;
unsigned short flags2;
union {
unsigned short pad[6];
struct {
unsigned short pidhigh;
unsigned char securitysignature[8];
} extra;
};
unsigned char reserved[2];
unsigned short tid; /* tree identifier */
unsigned short pid; /* caller's process id */
unsigned short uid; /* user id */
unsigned short mid; /* multiplex id */
/* first:
unsigned char wordcount; // count of parameter words
unsigned short parameterwords[1];
*/
/* then:
unsigned short bytecount;
unsigned char buf[bytecount];
*/
};
#endif
static int globmatch_int(const char* pattern,const char* string,const char* ldot) {
while (*pattern) {
switch (*pattern) {
case '?':
if (!*string) return *pattern==0;
break;
case '<':
if (string>ldot)
return 0;
case '*':
/* pattern="*.x" and string=".x"? */
if (globmatch_int(pattern+1,string,ldot)) return 1;
/* pattern="*.x" and string="a.x"? */
if (*string==0) return 0;
++string;
continue;
default:
if (tolower(*string) != tolower(*pattern)) return 0;
if (!*string) return 1;
}
++pattern;
++string;
}
return *string==0;
}
static int globmatch(const char* pattern,const char* string) {
const char* ldot=strrchr(string,'.');
if (!ldot) ldot=string+strlen(string);
return globmatch_int(pattern,string,ldot);
}
static int hasandx(unsigned char code) {
return !strchr("\x04\x72\x71\x2b\x32\x80\xa0\x23",code);
}
static const size_t netbiosheadersize=4;
static const size_t smbheadersize=32;
struct smb_response {
char* buf;
size_t allocated,used,andxtypeofs;
};
#ifdef DEBUG
static void hexdump(char* buf,size_t len) {
size_t i,j;
char y[17];
y[16]=0;
// printf("sending:\n");
for (i=j=0; i<len; ++i) {
if (j==16) j=0;
y[j]=buf[i];
if (y[j]<' ' || y[j]==0x7f) y[j]='.';
++j;
printf("%02x",(unsigned char)(buf[i]));
switch (i%16) {
case 15: printf(" %s\n",y); break;
case 7: putchar(' '); // fallthrough
default: putchar(' '); break;
}
}
y[j]=0;
if (j<16)
printf("%*s%s\n",(int)((17-j)*3)-1,"",y);
}
#endif
static int init_smb_response(struct smb_response* sr,unsigned char* in_response_to,size_t size) {
if (size<200) size=200;
sr->buf=malloc(sr->allocated=size);
if (!sr->buf) return -1;
sr->used=netbiosheadersize+smbheadersize;
uint32_pack_big(sr->buf,32); // size field in NMB header
byte_copy(sr->buf+netbiosheadersize,smbheadersize-8,
"\xffSMB" // magic
"x" // smb command, filled in later; ofs 4
"\x00\x00\x00\x00" // STATUS_SUCCESS
"\x80" // Flags: response+case sensitive
"\x41\xc0" // Flags2: unicode+long names allowed
"\x00\x00" // Process ID High: 0
"\x00\x00\x00\x00\x00\x00\x00\x00" // Signature
"\x00\x00" // Reserved
); // TID, PID, UID, MID; ofs 24
sr->buf[netbiosheadersize+4]=in_response_to[4];
uint16_pack(sr->buf+netbiosheadersize+24,uint16_read((char*)in_response_to+24));
uint16_pack(sr->buf+netbiosheadersize+26,uint16_read((char*)in_response_to+26));
uint16_pack(sr->buf+netbiosheadersize+28,0);
uint16_pack(sr->buf+netbiosheadersize+30,uint16_read((char*)in_response_to+30));
sr->andxtypeofs=netbiosheadersize+4;
return 0;
}
static int add_smb_response(struct smb_response* sr,const char* buf,size_t size,unsigned char type) {
if (sr->allocated+size<size) return -1; // check int overflow
if (sr->used+size>sr->allocated) {
size_t n=sr->allocated+size;
void* x;
n=((n-1)|0xfff)+1; // round up to multiple of 0x1000
if (!n) return -1; // check int overflow
x=realloc(sr->buf,n);
if (!x) return -1;
sr->buf=x;
sr->allocated=n;
}
sr->buf[sr->andxtypeofs]=type;
if (sr->andxtypeofs!=netbiosheadersize+4)
uint16_pack(sr->buf+sr->andxtypeofs+2,sr->used-netbiosheadersize);
byte_copy(sr->buf+sr->used,size,buf);
sr->andxtypeofs=sr->used+1;
sr->used+=size;
if (sr->used%2)
sr->buf[++sr->used]=0;
uint32_pack_big(sr->buf,sr->used-4); // update netbios size field
return 0;
}
static char* add_smb_response2(struct smb_response* sr,const char* buf,size_t size,unsigned char type) {
size_t i=sr->used;
if (add_smb_response(sr,buf,size,type)==-1) return 0;
return sr->buf+i;
}
static void set_smb_error(struct smb_response* sr,uint32_t error,unsigned char req) {
add_smb_response(sr,"\x00\x00",3,req);
assert(sr->allocated>=0x20);
uint32_pack(sr->buf+4+5,error);
}
static int validate_smb_packet(unsigned char* pkt,unsigned long len) {
/* we actually received len bytes from the wire, so pkt+len does not
* overflow; we got len bytes, because the netbios header said there
* were that many bytes in the packet. */
unsigned char* x;
/* demand that we have at least a full smbheader and wordcount */
if (len>=smbheadersize+1 &&
byte_equal(pkt,4,"\xffSMB")) { /* signature needs to be there */
x=(unsigned char*)pkt+smbheadersize;
if (x[0] > 100)
return -1;
/* see that x + sizeof(word_count) + word_count*2 +
* sizeof(byte_count) is inside the packet */
if (!range_arrayinbuf(pkt,len,x+3,*x,2))
return -1;
/* now we know the word count is ok, but is the byte count? */
{
size_t bytecountofs=1+*x*2;
size_t bytecount;
bytecount=uint16_read((const char*)x+bytecountofs);
if (bytecount>len || x+bytecountofs+2+bytecount>pkt+len) return -1;
}
if (!hasandx(pkt[4])) return 0;
for (;;) {
size_t bytecount;
/* see that x + sizeof(word_count) + word_count*2 +
* sizeof(byte_count) is inside the packet */
if (!range_arrayinbuf(pkt,len,x+3,*x,2))
return -1;
/* we know that the byte count is within the packet */
/* read it and check whether it's ok, too */
bytecount=uint16_read((const char*)x+1+*x*2);
if (!range_arrayinbuf(pkt,len,x+3+bytecount,*x,2))
return -1;
if (x[1]==0xff) return 0;
{
uint16_t next=uint16_read((char*)x+3);
if (pkt+next < x+1+x[0]*2+2+bytecount) return -1; /* can't point backwards */
x=pkt+next;
}
if (!range_bufinbuf(pkt,len,(char*)x,5))
return -1;
}
} else
return -1;
return 0;
}
static int smb_handle_SessionSetupAndX(unsigned char* pkt,unsigned long len,struct smb_response* sr) {
const char nr[]=
"\x03" // Word Count 3
"\xff" // AndXCommand
"\x00" // Reserved
"xx" // AndXOffset; ofs 3
"\x01\x00" // Action: logged in as GUEST
"xx" // Byte Count; ofs 7
"\x00" // bizarre padding byte
"U\x00n\x00i\x00x\x00\x00\x00" // "Unix"
"G\x00""a\x00t\x00l\x00i\x00n\x00g\x00 \x00";
size_t i,payloadlen;
char* x;
if (len<2*13 || pkt[0] != 13) return -1; /* word count for this message is always 13 */
payloadlen=sizeof("Unix_" RELEASE)*2 + wglen16 + 1;
if (!(x=add_smb_response2(sr,nr,8+payloadlen,0x73))) return -1;
uint16_pack(x+3,sr->used+2*3+payloadlen);
uint16_pack(x+7,payloadlen);
/* should be zero filled already so we only write the even bytes */
for (i=0; i<sizeof(RELEASE)-sizeof("Gatling ")+1; ++i) {
x[8+2+(sizeof("Unix_Gatling")+i)*2]=VERSION[i];
x[8+2+(sizeof("Unix_Gatling")+i)*2+1]=0;
}
byte_copy(x+8+2+(sizeof("Unix_Gatling")+i)*2,wglen16+2,workgroup_utf16);
return 0;
}
static struct timezone tz;
static void uint64_pack_ntdate(char* dest,time_t date) {
uint64_pack(dest,10000000ll * (date + 11644473600ll));
}
static int smb_handle_negotiate_request(unsigned char* c,size_t len,struct smb_response* sr) {
size_t i,j,k;
int ack;
const char nr[2*17+100*2]=
"\x11" // word count 17
"xx" // dialect index; ofs 1
"\x02" // security mode, for NT: plaintext passwords XOR unicode
#if 0
"\x02\x00" // Max Mpx Count 2
"\x01\x00" // Max VCs 1
#else
"\x10\x00" // Max Mpx Count 16
"\x10\x00" // Max VCs 16
#endif
"\x04\x41\x00\x00" // Max Buffer Size (16644, like XP)
"\x00\x00\x01\x00" // Max Raw Buffer (65536, like XP)
"\x01\x02\x03\x04" // Session Key
"\x5e\x40\x00\x00" // Capabilities, the bare minimum
"xxxxxxxx" // system time; ofs 24
"xx" // server time zone; ofs 32
"\x00" // key len
"xx" // byte count; ofs 35
; // workgroup name; ofs 37
char* x;
if (len<3) return -1;
j=uint16_read((char*)c+1);
if (len<3+j) return -1;
ack=-1;
for (k=0,i=3; i<3+j; ++k) {
if (c[i]!=2) return -1;
if (str_equal((char*)c+i+1,"NT LM 0.12")) { ack=k; break; }
i+=2+str_len((char*)c+i+1);
}
if (ack==-1) return -1; // wrong dialect
if (!(x=add_smb_response2(sr,nr,38+wglen16,0x72))) return -1;
uint16_pack(x+1,ack);
{
struct timeval t;
unsigned long long ntdate;
gettimeofday(&t,&tz);
ntdate=10000000ll * ( t.tv_sec + 11644473600ll ) + t.tv_usec * 10ll;
uint32_pack(x+24,ntdate&0xffffffff);
uint32_pack(x+24+4,ntdate>>32);
uint16_pack(x+32,tz.tz_minuteswest);
}
uint16_pack(x+35,wglen16);
byte_copy(x+37,wglen16,workgroup_utf16);
return 0;
}
static int smb_handle_TreeConnectAndX(unsigned char* c,size_t len,struct smb_response* sr) {
const char nr[]=
"\x03" // Word Count 3
"\xff" // AndXCommand
"\x00" // Reserved
"\x38\x00" // AndXOffset; ofs 3
"\x00\x00" // Optional Support: none
"\x0d\x00" // Byte Count; ofs 7
"A:\x00" // "Service", this is what Samba puts there
"e\x00x\x00t\x00""3\x00\x00\x00"; // "Native Filesystem"
if (len<2*4 || c[0] != 4) return -1; /* word count for this message is always 4 */
return add_smb_response(sr,nr,9+13,0x75);
}
static int smb_handle_echo(unsigned char* c,size_t len,struct smb_response* sr) {
uint16 nmemb,membsize;
char* buf;
size_t i;
if (len<2*1 || c[0] != 1) return -1; /* word count for this message is always 1 */
nmemb=uint16_read((char*)c+1);
membsize=uint16_read((char*)c+3);
if (nmemb*membsize>1024) return -1;
buf=alloca(nmemb*membsize+3);
buf[0]=0;
uint16_pack(buf+1,nmemb*membsize);
for (i=0; i<nmemb; ++i)
byte_copy(buf+3+i*membsize,membsize,c+5);
return add_smb_response(sr,buf,nmemb*membsize+3,0x2b);
}
static int smb_handle_TreeDisconnect(unsigned char* c,size_t len,struct smb_response* sr) {
if (len<3 || c[0]!=0 || c[1]!=0 || c[2]!=0) return -1; /* word count for this message is always 0 */
return add_smb_response(sr,(char*)c,3,0x71);
}
iconv_t wc2utf8;
iconv_t utf82wc2;
enum {
STATUS_INVALID_HANDLE=0xC0000008,
ERROR_NO_MEMORY=0xc0000017,
ERROR_ACCESS_DENIED=0xC0000022,
STATUS_OBJECT_NAME_INVALID=0xC0000033,
ERROR_OBJECT_NAME_NOT_FOUND=0xc0000034,
ERROR_NOT_SUPPORTED=0xc00000bb,
ERROR_NETWORK_ACCESS_DENIED=0xc00000ca,
STATUS_TOO_MANY_OPENED_FILES=0xC000011F,
};
enum smb_open_todo {
WANT_OPEN,
WANT_STAT,
WANT_CHDIR,
};
/* ssize is the size in bytes, including L'\0' */
/* returns number of converted chars in dest, including \0, or 0 on error */
static size_t utf16tolatin1(char* dest,size_t dsize,uint16_t* src,size_t ssize) {
size_t i;
size_t max=dsize;
if (ssize/2<max) max=ssize/2;
for (i=0; i<max; ++i) {
uint16_t x=uint16_read((char*)&src[i]);
if (x>0xff) return 0;
dest[i]=x;
}
if (i==dsize) return 0;
dest[i]=0;
return i+1;
}
static size_t utf16toutf8(char* dest,size_t dsize,uint16_t* src,size_t ssize) {
size_t X,Y;
char* x,* y;
x=(char*)src;
y=dest;
X=ssize;
Y=dsize?dsize-1:dsize; // the -1 makes sure we have a 0 byte at the end
memset(dest,0,dsize);
if (iconv(wc2utf8,&x,&X,&y,&Y)) return 0;
return dsize-Y;
}
static size_t utf8toutf16(char* dest,size_t dsize,const char* src) {
/* src is a filename, so it might be either latin1 or utf8.
try to parse it as utf8, but if we fail on a char, we assume it's latin1 */
size_t c;
char* orig=dest;
while (*src) {
if ((src[0]&0x80)==0) {
c=src[0];
++src;
} else if ((src[0]&0xe0)==0xc0 && (src[1]&0xc0)==0x80) {
c=((src[0]&0x1f) << 6) + (src[1]&0x3f);
src+=2;
} else if ((src[0]&0xf0)==0xe0 && (src[1]&0xc0)==0x80 && (src[2]&0xc0)==0x80) {
c=((src[0]&0xf) << 12) + ((src[1]&0x3f) << 6) + (src[2]&0x3f);
src+=3;
} else {
/* we don't support longer UTF-8 sequences because you'd need more
* than the 16 bits Windows has for them. */
c=(unsigned char)src[0];
++src;
}
if (dsize<2) return 0;
dest[0]=c&0xff;
dest[1]=(c>>8);
dest+=2;
dsize-=2;
}
return dest-orig;
}
static int smb_open(struct http_data* h,unsigned short* remotefilename,size_t fnlen,struct stat* ss,enum smb_open_todo todo) {
char localfilename[1024];
int64 fd;
size_t i,j;
char* x;
if (ip_vhost(h)==-1 || fnlen/2>sizeof(localfilename))
return -1;
fd=-1;
for (j=0; fd==-1 && j<2; ++j) {
if (j==0) {
/* first try latin1 */
if (utf16tolatin1(localfilename,sizeof(localfilename),remotefilename,fnlen)==0)
continue;
} else {
if (utf16toutf8(localfilename,sizeof(localfilename),remotefilename,fnlen)==0)
break;
}
#if 0
{
const char* what[] = {"OPEN","STAT","CHDIR"};
printf("trying \"%s\" for %s\n",localfilename,what[todo]);
}
#endif
for (i=0; localfilename[i]; ++i) {
if (localfilename[i]=='\\')
localfilename[i]='/';
}
x=(char*)localfilename;
while ((x=strstr(x,"/.")))
x[1]=':';
x=(char*)localfilename;
while (*x=='/') ++x;
if (todo==WANT_STAT) {
if (*x==0) x=".";
if (stat(x,ss)==0) {
fd=0;
break;
}
} else if (todo==WANT_OPEN) {
if (*x==0) x=".";
if (open_for_reading(&fd,x,ss))
break;
} else if (todo==WANT_CHDIR) {
if (!*x || chdir(x)==0) {
fd=0;
break;
}
}
}
return fd;
}
static int smb_handle_OpenAndX(struct http_data* h,unsigned char* c,size_t len,uint32_t pid,struct smb_response* sr) {
static const char nr[34]=
"\x0f" // word count 15
"\xff" // AndXCommand
"\x00" // Reserved
"w1" // AndXOffset; ofs 3
"w2" // FID; ofs 5
"\x00\x00" // file attributes; normal file
"u1__" // ctime; ofs 9
"u2__" // file size; ofs 13
"\x00\x00" // granted access: read, compatibility mode, caching permitted
"\x00\x00" // file type: disk file or directory
"\x00\x00" // ipc state
"\x01\x00" // action: file existed and was opened
"\x00\x00\x00\x00" // server FID (?!?)
"\x00\x00" // reserved
"\x00\x00" // byte count 0
;
if (len<2*15 || c[0]!=15) return -1;
/* see if it is an open for reading */
if ((c[7]&7) || ((c[17]&3)!=1)) {
/* we only support read access */
// printf("non-read-access requested: %x %x!\n",c[7],c[17]);
set_smb_error(sr,ERROR_ACCESS_DENIED,0x2d);
return 0;
}
/* now look at file name */
{
size_t fnlen=uint16_read((char*)c+31);
uint16_t* remotefilename=(uint16_t*)(c+34);
struct stat ss;
struct handle* hdl;
int fd;
char* x;
if (fnlen%2) --fnlen;
if (fnlen>2046 || ((uintptr_t)remotefilename%2)) return -1;
hdl=alloc_handle(&h->h);
if (!hdl) {
// printf("could not open file handle!");
set_smb_error(sr,STATUS_TOO_MANY_OPENED_FILES,0x2d);
return 0;
}
fd=smb_open(h,remotefilename,fnlen,&ss,WANT_OPEN);
if (fd==-1) {
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0x2d);
close_handle(hdl);
return 0;
}
hdl->fd=fd;
hdl->pid=pid;
hdl->size=ss.st_size;
hdl->cur=0;
hdl->filename=malloc(fnlen+2);
if (hdl->filename) {
memcpy(hdl->filename+1,remotefilename,fnlen);
hdl->filename[0]=fnlen;
}
{
size_t oldlen=sr->used;
if (!(x=add_smb_response2(sr,nr,15*2+3,0x2d))) return -1;
uint16_pack(x+OFS16(nr,"w1"),oldlen+15*2+3);
}
uint16_pack(x+OFS16(nr,"w2"),hdl->handle);
uint32_pack(x+OFS16(nr,"u1"),ss.st_mtime);
uint32_pack(x+OFS16(nr,"u2"),ss.st_size);
}
return 0;
}
static int smb_handle_CreateAndX(struct http_data* h,const unsigned char* c,size_t len,uint32_t pid,struct smb_response* sr) {
static const char template[]=
"\x22" // word count 34
"\xff\x00" // AndX: no further commands, reserved
"w1" // AndXOffset
"\x00" // No oplock granted
"w2" // FID
"\x01\x00\x00\x00" // Create Action: 1 == The file existed and was opened
"q0______" // ctime
"q1______" // atime
"q2______" // mtime
"q3______" // mtime
"d1__" // attributes; 0x10 == directory, 0x1 == read only
"q4______" // allocation size
"q5______" // end of file (0)
"w3" // file type (0 = file or directory)
"w4" // IPC state (lower 8 bits == link count?)
"\x00" // 0 = file, 1 = directory
"\x00\x00"; // byte count 0
if (len<2*24 || c[0]!=24) return -1;
/* now look at file name */
{
size_t fnlen=uint16_read((char*)c+6);
uint16_t* remotefilename=(uint16_t*)(c+0x34);
struct stat ss;
struct handle* hdl;
int fd;
// filename cannot be bigger than byte count says the total payload is
if (uint16_read((char*)c+0x31)<fnlen) return -1;
if (fnlen%2) --fnlen;
if (fnlen>2046 || ((uintptr_t)remotefilename%2)) return -1;
if (fnlen==14 && !memcmp(remotefilename,"\\\x00s\x00r\x00v\x00s\x00v\x00""c\x00",14)) {
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0xa2);
return 0;
}
/* see if it is an open for reading */
if ((c[16]&7)!=1) {
/* we only support read access */
// printf("non-read-access requested: %x!\n",uint32_read(c+16));
set_smb_error(sr,ERROR_ACCESS_DENIED,0xa2);
return 0;
}
hdl=alloc_handle(&h->h);
if (!hdl) {
// printf("could not open file handle!");
set_smb_error(sr,STATUS_TOO_MANY_OPENED_FILES,0xa2);
return 0;
}
fd=smb_open(h,remotefilename,fnlen,&ss,WANT_OPEN);
if (fd==-1) {
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0xa2);
close_handle(hdl);
return 0;
}
hdl->fd=fd;
hdl->pid=pid;
hdl->size=ss.st_size;
hdl->cur=0;
hdl->filename=malloc(fnlen+2);
if (hdl->filename) {
memcpy(hdl->filename+1,remotefilename,fnlen);
hdl->filename[0]=fnlen;
}
{
char* c=add_smb_response2(sr,template,1+2*34+2,0xa2);
struct stat ss;
if (!c) return -1;
int isdir;
fstat(hdl->fd,&ss);
isdir=S_ISDIR(ss.st_mode);
uint16_pack(c+OFS16(template,"w1"),sr->used);
uint16_pack(c+OFS16(template,"w2"),hdl->handle);
uint64_pack_ntdate(c+OFS16(template,"q0"),ss.st_ctime);
uint64_pack_ntdate(c+OFS16(template,"q1"),ss.st_atime);
uint64_pack_ntdate(c+OFS16(template,"q2"),ss.st_mtime);
uint64_pack_ntdate(c+OFS16(template,"q3"),ss.st_mtime);
uint32_pack(c+OFS16(template,"d1"),isdir?0x11:0x1);
uint64_pack(c+OFS16(template,"q4"),0x100000); // that's what Samba says
uint64_pack(c+OFS16(template,"q5"),ss.st_size); // end of file
uint16_pack(c+OFS16(template,"w3"),0);
uint16_pack(c+OFS16(template,"w4"),ss.st_nlink>255?255:ss.st_nlink);
if (isdir)
c[OFS16(template,"w4")+2]=1;
}
return 0;
}
}
static uint32_t mymax(uint32_t a,uint32_t b) {
return a>b?a:b;
}
static int smb_handle_ReadAndX(struct http_data* h,unsigned char* c,size_t len,uint32_t pid,struct smb_response* sr) {
static const char nr[]=
"\x0c" // word count 12
"\xff" // AndXCommand
"\x00" // Reserved
"w0" // AndXOffset; ofs 3
"w1" // Remaining; ofs 5
"\x00\x00" // data compaction mode
"\x00\x00" // reserved
"w2" // data length low; ofs 11
"w3" // data offset; ofs 13
"\x00\x00\x00\x00" // data length high (*64k)
"\x00\x00\x00\x00\x00\x00" // reserved
"w4" // byte count; ofs 24
;
uint16_t handle;
uint16_t count;
#if 0
uint32_t relofs;
#endif
struct handle* hdl;
char* x;
size_t oldused;
if (len<2*10 || (c[0]!=10 && c[0]!=12)) return -1;
handle=uint16_read((char*)c+5);
if (!(hdl=deref_handle(&h->h,handle))) {
set_smb_error(sr,STATUS_INVALID_HANDLE,0x2e);
return 0;
}
hdl->cur=uint32_read((char*)c+7);
if (c[0]==12)
hdl->cur |= ((unsigned long long)uint32_read((char*)c+21))<<32;
#if 0
relofs=uint32_read((char*)c+7);
printf("cur %llu, size %llu, relofs %ld -> ",hdl->cur,hdl->size,relofs);
if (relofs<0) {
if (hdl->cur<-relofs) hdl->cur=0; else hdl->cur+=relofs;
} else if (hdl->cur+relofs<hdl->size)
hdl->cur+=relofs;
else
hdl->cur=hdl->size;
printf("%llu\n",hdl->cur);
#endif
if (uint32_read((char*)c+15))
count=64000;
else
count=mymax(uint16_read((char*)c+13),uint16_read((char*)c+11));
if (count>65500) count=65500;
#if 0
printf("read: %i bytes from ofs %llu (file has %llu bytes)\n",count,hdl->cur,hdl->size);
#endif
if (hdl->cur>hdl->size)
count=0;
else
if (count>hdl->size-hdl->cur) count=hdl->size-hdl->cur;
oldused=sr->used;
if (!(x=add_smb_response2(sr,nr,12*2+3,0x2e))) {
return -1;
}
uint16_pack(x+OFS16(nr,"w0"),0); // no andx for read
{
off_t rem=hdl->size-hdl->cur-count;
uint16_pack(x+OFS16(nr,"w1"),rem>0xffff?0xffff:rem);
}
uint16_pack(x+OFS16(nr,"w2"),count);
uint16_pack(x+OFS16(nr,"w3"),oldused+12*2);
uint16_pack(x+OFS16(nr,"w4"),count);
#ifdef DEBUG
hexdump(sr->buf,sr->used);
#endif
uint32_pack_big(sr->buf,sr->used-4+count); // update netbios size field
iob_addbuf_free(&h->iob,sr->buf,sr->used);
iob_addfile(&h->iob,hdl->fd,hdl->cur,count);
hdl->cur+=count;
return 0;
}
static int smb_handle_Trans(unsigned char* c,size_t len,struct smb_response* sr) {
/* windows 7 calls this when trying to copy a file via cmd.exe copy */
/* samba replies STATUS_NOT_SUPPORTED. works for me. */
#if 0
if (len<0x34 || c[0]!=23) return -1;
if (uint16_read(c+0x25)!=2) return -1; /* not ioctl */
#endif
/* we don't really care what ioctl they were trying to call */
/* always return the same canned answer */
set_smb_error(sr,ERROR_NOT_SUPPORTED,0xa0);
return 0;
}
static int smb_handle_Trans2(struct http_data* h,unsigned char* c,size_t len,uint32_t pid,struct smb_response* sr) {
uint16_t subcommand;
uint16_t paramofs,paramcount;
uint16_t dataofs;
uint16_t loi=0;
struct handle* hdl;
struct stat ss;
uint32_t attr;
uint16_t* filename=0;
uint16_t fnlen=0;
if (len<2*15 || c[0]!=15) return -1;
subcommand=uint16_read((char*)c+29);
paramofs=uint16_read((char*)c+21);
paramcount=uint16_read((char*)c+19);
dataofs=uint16_read((char*)c+25);
/* Do some general validation of the offsets and data counts */
/* Accept crap in the offsets if the counts are zero */
{
size_t datacount=uint16_read((char*)c+23);
if ((paramcount && !range_bufinbuf(c+c[0]*2,len-c[0]*2,c-smbheadersize+paramofs,paramcount)) ||
(datacount && !range_bufinbuf(c+c[0]*2,len-c[0]*2,c-smbheadersize+dataofs,datacount)))
return -1;
if (dataofs > len+smbheadersize) return -1;
if (datacount && paramofs+paramcount > dataofs) return -1;
}
if (subcommand==7 || // QUERY_FILE_INFO
subcommand==5 || // QUERY_PATH_INFO
subcommand==3) { // QUERY_FS_INFO
if (subcommand==7) {
// QUERY_FILE_INFO
if (paramcount<4) return -1;
if (!(hdl=deref_handle(&h->h,uint16_read((char*)c-smbheadersize+paramofs)))) {
set_smb_error(sr,STATUS_INVALID_HANDLE,0x32);
return 0;
}
if (fstat(hdl->fd,&ss)==-1)
goto filenotfound;
if (hdl->filename) {
fnlen=hdl->filename[0];
filename=hdl->filename+1;
if (fnlen && filename[fnlen-1]==0 && filename[fnlen-2]==0) fnlen-=2;
}
loi=uint16_read((char*)c-smbheadersize+paramofs+2);
} else if (subcommand==5) {
// QUERY_PATH_INFO
filename=(uint16_t*)(c-smbheadersize+paramofs+6);
if ((uintptr_t)filename % 2)
goto filenotfound;
if (paramcount<8) return -1;
fnlen=paramcount-6;
if (smb_open(h,filename,fnlen,&ss,WANT_STAT)==-1)
goto filenotfound;
loi=uint16_read((char*)c-smbheadersize+paramofs);
} else if (subcommand==3) {
// QUERY_FS_INFO
loi=uint16_read((char*)c-smbheadersize+paramofs);
if (loi==0x102)
return add_smb_response(sr,
"\x0a\x00\x00\x18\x00\x00\x00\x00\x00\x38"
"\x00\x00\x00\x18\x00\x38\x00\x00\x00\x00"
"\x00\x19\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\xde\xc0\xfe\xfe\x06\x00\x00\x00"
"\x00\x00\x66\x00\x74\x00\x70\x00",48,0x32);
else if (loi==0x103) {
/* UINT64 TotalAllocationUnits
* UINT64 AvailableAllocationUnits
* UINT32 SectorsPerAllocationUnit
* UINT32 BytesPerSector */
static const char tmpl[]=
"\x0a\x00\x00\x18\x00\x00\x00\x00\x00\x38"
"\x00\x00\x00\x18\x00\x38\x00\x00\x00\x00"
"\x00\x19\x00";
size_t len=sizeof(tmpl)+8+8+4+4;
char* buf=alloca(len);
char* x=buf+sizeof(tmpl);
struct statvfs sv;
memcpy(buf,tmpl,sizeof(tmpl));
if (fstatvfs(origdir,&sv)==-1) {
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0x32);
return 0;
}
uint64_pack(x,sv.f_blocks);
uint64_pack(x+8,sv.f_bavail);
uint32_pack(x+8+8,sv.f_frsize);
uint32_pack(x+8+8+4,512);
return add_smb_response(sr,buf,len,0x32);
} else if (loi==0x105)
return add_smb_response(sr,
"\x0a\x00\x00\x12\x00\x00\x00\x00\x00\x38"
"\x00\x00\x00\x12\x00\x38\x00\x00\x00\x00"
"\x00\x13\x00\x00\x46\x00\x08\x00\xff\x00"
"\x00\x00\x08\x00\x00\x00p\x00u\x00"
"b\x00\x00\x00",43,0x32);
else goto filenotfound;
} else {
filenotfound:
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0x32);
return 0;
}
if (S_ISDIR(ss.st_mode))
attr=0x10; // directory
else
attr=0x80; // plain file
switch (loi) {
case 0x101: // SMB_QUERY_FILE_BASIC
case 0x102: // SMB_QUERY_FILE_STANDARD
case 0x103: // Query File EA Info
{
char* buf;
size_t datacount=(loi==0x101?4*8+4:2*8+4+2); // 4x8 for dates, 4 for file attributes, 4 extra
if (loi==0x103) datacount=4;
buf=alloca(20+100+datacount);
byte_copy(buf,21,
"\x0a" // word count
"\x02\x00" // total parameter count
"xx" // total data count; ofs 3
"\x00\x00" // reserved
"\x02\x00" // parameter count
"xx" // parameter offset; ofs 9
"\x00\x00" // parameter displacement
"xx" // data count (same as total data count); ofs 13
"xx" // data offset; ofs 15
"\x00\x00" // data displacement
"\x00" // setup count
"\x00"); // reserved
uint16_pack(buf+3,datacount);
uint16_pack(buf+9,sr->used-4+24);
uint16_pack(buf+13,datacount);
uint16_pack(buf+15,sr->used+24);
uint16_pack(buf+21,datacount);
buf[23]=0;
uint16_pack(buf+24,0); // ea error offset
uint16_pack(buf+26,0); // padding
if (loi==0x101) {
uint64_pack_ntdate(buf+28,ss.st_ctime);
uint64_pack_ntdate(buf+28+8,ss.st_atime);
uint64_pack_ntdate(buf+28+8+8,ss.st_mtime);
uint64_pack_ntdate(buf+28+8+8+8,ss.st_mtime);
uint32_pack(buf+60,attr); // normal file
uint32_pack(buf+64,0);
} else if (loi==0x102) {
uint16_pack(buf+21,datacount+5);
uint64_pack(buf+28,(unsigned long long)ss.st_blocks*512);
uint64_pack(buf+28+8,ss.st_size);
uint32_pack(buf+28+8+8,ss.st_nlink);
buf[28+8+8+4]=0;
buf[28+8+8+4+1]=S_ISDIR(ss.st_mode)?1:0;
} else if (loi==0x103) {
uint32_pack(buf+28,0); // EA List Length 0
}
return add_smb_response(sr,buf,60+datacount,0x32);
}
case 0x0107: // SMB_QUERY_FILE_ALL_INFO
{
char* buf;
size_t datacount=72+fnlen;
buf=alloca(20+100+datacount);
byte_copy(buf,21,
"\x0a" // word count
"\x02\x00" // total parameter count
"xx" // total data count; ofs 3
"\x00\x00" // reserved
"\x02\x00" // parameter count
"xx" // parameter offset; ofs 9
"\x00\x00" // parameter displacement
"xx" // data count (same as total data count); ofs 13
"xx" // data offset; ofs 15
"\x00\x00" // data displacement
"\x00" // setup count
"\x00"); // reserved
uint16_pack(buf+3,datacount);
uint16_pack(buf+9,sr->used-4+24);
uint16_pack(buf+13,datacount);
uint16_pack(buf+15,sr->used+24);
uint16_pack(buf+21,datacount);
buf[23]=0;
uint16_pack(buf+24,0); // ea error offset
uint16_pack(buf+26,0); // padding
uint64_pack_ntdate(buf+28,ss.st_ctime);
uint64_pack_ntdate(buf+28+8,ss.st_atime);
uint64_pack_ntdate(buf+28+8+8,ss.st_mtime);
uint64_pack_ntdate(buf+28+8+8+8,ss.st_mtime);
uint32_pack(buf+60,attr); // normal file
uint64_pack(buf+68,(unsigned long long)ss.st_blocks*512);
uint64_pack(buf+76,ss.st_size);
uint32_pack(buf+84,ss.st_nlink);
byte_zero(buf+88,8);
uint32_pack(buf+96,fnlen);
if (fnlen)
byte_copy(buf+100,fnlen,filename);
return add_smb_response(sr,buf,28+datacount,0x32);
}
default:
set_smb_error(sr,ERROR_ACCESS_DENIED,0x32);
return 0;
}
} else if (subcommand==1 || // FIND_FIRST2
subcommand==2) { // FIND_NEXT2
size_t i,l,rl=0;
size_t maxdatacount,sizeperrecord=0;
char* globlatin1,* globutf8;
uint16_t attr;
uint16_t* resume;
DIR* d;
#if 0
if (subcommand==1)
printf("Incoming FIND_FIRST2!\n");
else
printf("Incoming FIND_NEXT2!\n");
#endif
if (sr->used>16*1024) {
outofmemory:
set_smb_error(sr,ERROR_NO_MEMORY,0x32);
return 0;
}
if (paramcount<18)
return -1; // need at least six chars for "/*" in unicode
maxdatacount=uint16_read((char*)c+7);
attr=uint16_read((char*)c-smbheadersize+paramofs);
if (subcommand==1)
loi=uint16_read((char*)c-smbheadersize+paramofs+6);
else
loi=uint16_read((char*)c-smbheadersize+paramofs+4);
if (loi!=0x104 && loi!=0x102) {
set_smb_error(sr,ERROR_NOT_SUPPORTED,0x32);
return 0;
}
if (loi==0x104)
sizeperrecord=0x5e;
else if (loi==0x102)
sizeperrecord=0x44;
if (subcommand==1) {
h->smbattrs=attr;
filename=(uint16*)(c-smbheadersize+paramofs+12);
l=(paramcount-12)/2;
if ((h->ftppath=malloc(l+l+4))) {
memcpy(h->ftppath+2,filename,l+l+2);
((uint16*)h->ftppath)[0]=l;
#if 0
{
size_t i;
printf("storing ftppath \"");
for (i=0; i<l; ++i)
printf("%c",h->ftppath[i]);
printf("\"\n");
}
#endif
}
resume=0;
} else {
attr=h->smbattrs;
resume=(uint16*)(c-smbheadersize+paramofs+12);
rl=paramcount-12;
/* validate the resume filename */
if ((uintptr_t)resume % 2)
goto filenotfound;
if (resume[rl-1])
goto filenotfound; // want null terminated filename
for (i=0; i<rl; ++i)
if (uint16_read((char*)&resume[i])=='\\' || uint16_read((char*)&resume[i])=='/') {
// printf("resume filename contains %c!\n",resume[i]);
goto filenotfound; // resume filename cannot contain \ or /
}
if (!h->ftppath) {
// printf("h->ftppath is NULL!\n");
goto filenotfound;
}
filename=(uint16*)(h->ftppath);
l=filename[0];
#if 0
{
size_t i;
printf("retrieved ftppath \"");
for (i=0; i<l; ++i)
printf("%c",filename[i]);
printf("\", resume at \"");
for (i=0; i<rl; ++i)
printf("%c",resume[i]);
printf("\"\n");
}
#endif
++filename;
}
{
/* we want to minimize copies, so we realloc enough space into the
* smb buffer right from the start. */
char* tmp=realloc(sr->buf,sr->used+maxdatacount+100);
if (!tmp) goto outofmemory;
sr->buf=tmp;
}
sr->allocated=sr->used+maxdatacount+100;
if ((uintptr_t)filename % 2)
goto filenotfound;
if (l==0 || filename[l-1])
return -1; // want null terminated filename
if (uint16_read((char*)&filename[l-1])=='\\' || uint16_read((char*)&filename[l-1])=='/')
goto filenotfound; // can't glob if filename ends in \ or /
if (uint16_read((char*)&(filename[0]))!='\\')
goto filenotfound;
for (i=0; i+2<l; ++i)
if (uint16_read((char*)&filename[i])<0x1f) {
set_smb_error(sr,STATUS_OBJECT_NAME_INVALID,0x32);
return 0;
}
for (i=l; i>0; --i)
if (uint16_read((char*)&filename[i])=='\\') {
filename[i]=0;
break;
}
fnlen=i*2;
if (smb_open(h,filename+1,fnlen,0,WANT_CHDIR)==-1)
goto filenotfound;
filename+=i+1; l-=i;
globlatin1=alloca(l+1);
#if 0
{
int j;
printf("convert \"");
for (j=0; filename[j]; ++j)
printf("%c",filename[j]);
printf("\" (source size: %d, dest size %d)\n",(l+1)*2,l+1);
}
#endif
if (utf16tolatin1(globlatin1,l+1,filename,(l+1)*2)) {
globlatin1=0;
// puts("could not convert glob expression to latin1!");
} // else
// printf("glob expression \"%s\"\n",globlatin1);
globutf8=alloca((l+1)*3);
if (utf16toutf8(globutf8,(l+1)*3,filename,(l+1)*3)) {
globutf8=0;
// puts("could not convert glob expression to utf-8!");
}
if (globlatin1 && globutf8 && !strcmp(globutf8,globlatin1)) globutf8=0;
if (!globlatin1 && !globutf8)
goto filenotfound;
d=opendir(".");
if (d) {
struct dirent* de;
struct stat ss;
size_t actualnamelen;
size_t searchcount=0;
char* cur=0,* max=0,* base=0,* trans2=0,* smbhdr,* last=0;
smbhdr=sr->buf+4;
while ((de=readdir(d))) {
#ifdef DT_DIR
if (de->d_type!=DT_DIR && de->d_type!=DT_REG && de->d_type!=DT_LNK) continue;
if (de->d_type==DT_DIR && !(attr&0x10)) continue;
#else
if (lstat(de->d_name,&ss)) continue;
if (!S_ISDIR(ss.st_mode) && !S_ISREG(ss.st_mode) && !S_ISLNK(ss.st_mode)) continue;
if (S_ISDIR(ss.st_mode) && !(attr&0x10)) continue;
#endif
if (de->d_name[0]=='.') continue;
if (de->d_name[0]==':') de->d_name[0]='.';
// if (globlatin1)
// printf("matching %s vs %s\n",globlatin1,de->d_name);
// if (globutf8)
// printf("matching %s vs %s\n",globutf8,de->d_name);
if ((globlatin1 && globmatch(globlatin1,de->d_name)) ||
(globutf8 && globmatch(globutf8,de->d_name))) {
#ifndef DT_DIR
if (S_ISLNK(ss.st_mode))
#endif
if (stat(de->d_name,&ss)==-1) continue;
// printf("globbed ok: %s\n",de->d_name);
if (!base) {
trans2=sr->buf+sr->used;
add_smb_response(sr,
"\x0a" // word count
"\x0a\x00" // total param count
"xx" // total data count; ofs 3
"\x00\x00" // reserved
"\x0a\x00" // param count
"xx" // param ofs; ofs 9
"\x00\x00" // param displacement (?!)
"xx" // data count; ofs 13
"xx" // data offset; ofs 15
"\x00\x00" // data displacement
"\x00" // setup count
"\x00" // reserved
"xx" // byte count; ofs 21
"\x00" // padding
// FIND_FIRST2 Parameters
"\x01\x00" // search id 1
"\x01\x00" // search count (?!?); ofs 26
"\x01\x00" // end of search; ofs 28
"\x00\x00" // ea error offset
"xx" // last name offset; ofs 32
"\x00\x00" // padding
// FIND_FIRST2 Data
,36,0x32);
if (subcommand==2) {
trans2[1]=8; // total param count
trans2[7]=8; // param count
memcpy(trans2+24,
// FIND_NEXT2 Parameters
"\x01\x00" // search count (?!?); ofs 24
"\x01\x00" // end of search; ofs 26
"\x00\x00" // ea error offset
"xx" // last name offset; ofs 30
// FIND_NEXT2 Data
,8);
sr->used-=4;
}
cur=base=sr->buf+sr->used;
max=sr->buf+sr->allocated;
}
if (max-cur < 100+0x60 +strlen(de->d_name)*2 ||
!(actualnamelen=utf8toutf16(cur+sizeperrecord,max-cur-sizeperrecord,de->d_name))) {
// not enough space! abort! abort!
if (subcommand==1)
trans2[28]=0;
else
trans2[26]=0;
// printf("not enough space!\n");
break;
}
/* if this is a FIND_NEXT and we have not reached the resume
* filename yet, resume is not NULL. */
if (resume) {
#if 0
printf("actualnamelen=%u rl=%u cur+sizeperrecord=\"",actualnamelen,rl);
{
size_t i;
char a[6];
uint32_t ch;
for (i=0; i<actualnamelen; i+=2) {
ch=uint16_read(cur+sizeperrecord+i);
a[fmt_utf8(a,ch)]=0;
printf("%s",a);
}
printf("\" resume=\"");
for (i=0; i<rl; i++) {
ch=uint16_read((char*)(resume+i));
a[fmt_utf8(a,ch)]=0;
printf("%s",a);
}
printf("\"\n");
}
#endif
if (actualnamelen+2==rl && byte_equal(cur+sizeperrecord,actualnamelen,resume))
resume=0;
continue;
}
last=cur;
if (loi==0x104 || loi==0x102) {
size_t padlen=sizeperrecord +actualnamelen;
if (padlen%4) padlen+=2;
uint32_pack(cur,padlen);
cur+=4;
uint32_pack(cur,0); cur+=4; // "file index", samba sets this to 0
uint64_pack_ntdate(cur,ss.st_ctime); cur+=8;
uint64_pack_ntdate(cur,ss.st_atime); cur+=8;
uint64_pack_ntdate(cur,ss.st_mtime); cur+=8;
uint64_pack_ntdate(cur,ss.st_mtime); cur+=8;
uint64_pack(cur,ss.st_size); cur+=8;
uint64_pack(cur,512*ss.st_blocks); cur+=8;
uint32_pack(cur,S_ISDIR(ss.st_mode)?0x10:0x80); cur+=4;
uint32_pack(cur,actualnamelen); cur+=4;
uint32_pack(cur,0); cur+=4; // ea list length
if (loi==0x104) {
cur[0]=0; // short file name len
cur[1]=0; // reserved
cur+=2;
byte_zero(cur,24); // the short name
cur+=24+actualnamelen;
} else {
cur+=actualnamelen;
}
if ((uintptr_t)cur%4) cur+=2;
++searchcount;
sr->used=cur-sr->buf;
assert(sr->used<sr->allocated);
}
}
}
closedir(d);
filename[-1]='\\';
if (!searchcount) {
if (subcommand==1) goto filenotfound;
}
if (trans2) {
uint16_pack(trans2+3,cur-base);
uint16_pack(trans2+9,trans2+20-sr->buf);
uint16_pack(trans2+13,cur-base);
uint16_pack(trans2+15,base-smbhdr);
if (subcommand==1) {
uint16_pack(trans2+21,cur-base+13);
uint16_pack(trans2+26,searchcount); // search count...!?
uint16_pack(trans2+32,last-base);
} else {
uint16_pack(trans2+21,cur-base+11);
uint16_pack(trans2+24,searchcount); // search count...!?
uint16_pack(trans2+30,last-base);
}
}
uint32_pack_big(sr->buf,sr->used-4);
// printf("sr->used = %u\n",sr->used);
return 0;
}
goto filenotfound;
} else
return -1;
}
static int smb_handle_close2(unsigned char* c,size_t len,struct smb_response* sr) {
return add_smb_response(sr,"\x00\x00\x00",3,0x52);
}
static int smb_handle_Close(struct http_data* h,unsigned char* c,size_t len,struct smb_response* sr) {
struct handle* hdl;
if (len<2*3 || c[0]!=3) return -1;
if (!(hdl=deref_handle(&h->h,uint16_read((char*)c+1)))) {
set_smb_error(sr,STATUS_INVALID_HANDLE,0x4);
return 0;
}
close_handle(hdl);
return add_smb_response(sr,"\x00\x00\x00",3,0x4);
}
static void fmt_dostime(char* d,time_t t) {
struct tm lt;
localtime_r(&t,&lt);
/* date + time as 16-bit values */
uint16_pack(d,lt.tm_mday + ((lt.tm_mon+1)<<5) + ((lt.tm_year-80)<<9));
uint16_pack(d+2,(lt.tm_sec/2) + (lt.tm_min<<5) + (lt.tm_hour<<11));
}
static int smb_handle_Query_Information2(struct http_data* h,unsigned char* c,size_t len,struct smb_response* sr) {
struct handle* hdl;
struct stat ss;
char buf[100];
if (len<2 || c[0]!=1) return -1;
if (!(hdl=deref_handle(&h->h,uint16_read((char*)c+1)))) {
set_smb_error(sr,STATUS_INVALID_HANDLE,0x23);
return 0;
}
if (fstat(hdl->fd,&ss)==-1) {
/* can't happen */
set_smb_error(sr,ERROR_OBJECT_NAME_NOT_FOUND,0x23);
return 0;
}
buf[0]=12; /* word count */
/* ctime, atime, mtime, size, allocation size, attributes (2), byte count */
fmt_dostime(buf+1,ss.st_ctime);
fmt_dostime(buf+1+4,ss.st_atime);
fmt_dostime(buf+1+4+4,ss.st_mtime);
uint32_pack(buf+1+4+4+4,ss.st_size);
uint32_pack(buf+1+4+4+4+4,ss.st_blocks*512);
buf[1+4+4+4+4+4]=1+(S_ISDIR(ss.st_mode)?0x10:0); /* the 1 is for read-only */
buf[1+4+4+4+4+4+1]=0;
buf[1+4+4+4+4+4+2]=0;
buf[1+4+4+4+4+4+3]=0;
return add_smb_response(sr,buf,1+4+4+4+4+4+5,0x23);
}
static int smb_handle_QueryDiskInfo(unsigned char* c,size_t len,struct smb_response* sr) {
struct statvfs sv;
char buf[13];
unsigned long long l,k;
size_t i;
if (len<3 || c[0]!=0) return -1;
if (fstatvfs(origdir,&sv)==-1) {
set_smb_error(sr,ERROR_ACCESS_DENIED,0x80);
return 0;
}
l=(unsigned long long)sv.f_blocks*sv.f_bsize;
k=(unsigned long long)sv.f_bavail*sv.f_bsize;
for (i=0; l>0xffff; ++i) l>>=1;
buf[0]=5;
/* ok, this protocol sucks royally; it works in clusters, and you can
* only express total and free space in clusters, AND you only have 16
* bits. */
if (i>30) {
i=30;
uint16_pack(buf+1,0xffff);
if ((k>>i)>0xffff)
uint16_pack(buf+7,0xffff);
else
uint16_pack(buf+7,k>>i);
} else {
uint16_pack(buf+1,l);
uint16_pack(buf+7,k>>i);
if (i<9+15) {
uint16_pack(buf+5,1<<9);
uint16_pack(buf+3,(i<9)?1:(1<<(i-9)));
} else {
uint16_pack(buf+5,1<<15);
uint16_pack(buf+3,1<<(i-15));
}
}
uint32_pack(buf+9,0);
return add_smb_response(sr,buf,13,0x80);
}
int smbresponse(struct http_data* h,int64 s) {
unsigned char* c=array_start(&h->r);
unsigned char* smbheader;
size_t len,cur;
struct smb_response sr;
unsigned char andxtype;
++rps1;
h->keepalive=0;
/* is it SMB? */
if ((size_t)array_bytes(&h->r)<4+smbheadersize)
/* uh, what does an error look like? */
/* dunno, samba doesn't say anything, it just ignores the packet. */
/* if it's good enough for samba, it's good enough for me. */
return 0;
len=uint32_read_big((char*)c)&0xffffff;
if (len<smbheadersize) {
// printf("netbios len (%u) < smbheadersize (%u)\n",len,smbheadersize);
return 0;
}
// hexdump(c,len+netbiosheadersize);
if (validate_smb_packet(c+netbiosheadersize,len)==-1) {
// printf("invalid smb packet!\n");
// hexdump(c,len+netbiosheadersize);
// validate_smb_packet(c+netbiosheadersize,len);
return -1;
}
/* is it a request? Discard replies. */
if (c[13]&0x80) return 0;
init_smb_response(&sr,c+netbiosheadersize,len);
c+=netbiosheadersize;
smbheader=c;
/* loop over AndX crap */
andxtype=c[4];
for (cur=smbheadersize; cur<len && andxtype!=0xff; ) {
/* what kind of request is it? */
switch (andxtype) {
case 0x04:
/* Close Request */
if (smb_handle_Close(h,c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x10:
/* Check Directory Request */
break;
case 0x23:
/* Query Information2 */
if (smb_handle_Query_Information2(h,c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x2b:
if (smb_handle_echo(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x2d:
/* Open AndX Request */
if (smb_handle_OpenAndX(h,c+cur,len-cur,uint16_read((char*)smbheader+0x1a),&sr)==-1)
goto kaputt;
break;
case 0x2e:
/* Read AndX Request */
if (smb_handle_ReadAndX(h,c+cur,len-cur,uint16_read((char*)smbheader+0x1a),&sr)==-1)
goto kaputt;
goto added;
case 0x32:
/* Trans2 Request; hopefully QUERY_FILE_INFO */
if (smb_handle_Trans2(h,c+cur,len-cur,uint16_read((char*)smbheader+0x1a),&sr)==-1)
goto kaputt;
break;
case 0x52:
/* Find Close2 */
if (smb_handle_close2(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x71:
/* Tree Disconnect Request */
if (smb_handle_TreeDisconnect(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x72:
/* protocol negotiation request */
if (smb_handle_negotiate_request(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x73:
/* Session Setup AndX Request */
if (smb_handle_SessionSetupAndX(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x75:
/* Tree Connect AndX Request */
if (smb_handle_TreeConnectAndX(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0x80:
if (smb_handle_QueryDiskInfo(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0xa0:
if (smb_handle_Trans(c+cur,len-cur,&sr)==-1)
goto kaputt;
break;
case 0xa2:
if (smb_handle_CreateAndX(h,c+cur,len-cur,uint16_read((char*)smbheader+0x1a),&sr)==-1)
goto kaputt;
break;
default:
set_smb_error(&sr,ERROR_NOT_SUPPORTED,andxtype);
}
if (!hasandx(andxtype)) break;
andxtype=c[cur+1];
if (andxtype==0xff) break;
if (cur+5>len)
goto kaputt;
else {
size_t next=uint16_read((char*)smbheader+cur+3);
if (next<=cur || next>len)
goto kaputt;
cur=next;
}
}
#ifdef DEBUG
hexdump(sr.buf,sr.used);
#endif
iob_addbuf_free(&h->iob,sr.buf,sr.used);
added:
io_dontwantread(s);
io_wantwrite(s);
h->keepalive=1;
return 0;
kaputt:
free(sr.buf);
return -1;
}
#endif /* SUPPORT_SMB */
Reference in New Issue View Git Blame Copy Permalink