/* parse a trans2 search response. Return the number of bytes consumed return 0 for success with end of list return -1 for a parse error */ static int parse_trans2_search(struct smbcli_tree *tree, TALLOC_CTX *mem_ctx, enum smb_search_data_level level, uint16_t flags, DATA_BLOB *blob, union smb_search_data *data) { unsigned int len, ofs; uint32_t ea_size; DATA_BLOB eablob; NTSTATUS status; switch (level) { case RAW_SEARCH_DATA_GENERIC: case RAW_SEARCH_DATA_SEARCH: /* handled elsewhere */ return -1; case RAW_SEARCH_DATA_STANDARD: if (flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) { if (blob->length < 4) return -1; data->standard.resume_key = IVAL(blob->data, 0); blob->data += 4; blob->length -= 4; } if (blob->length < 24) return -1; data->standard.create_time = raw_pull_dos_date2(tree->session->transport, blob->data + 0); data->standard.access_time = raw_pull_dos_date2(tree->session->transport, blob->data + 4); data->standard.write_time = raw_pull_dos_date2(tree->session->transport, blob->data + 8); data->standard.size = IVAL(blob->data, 12); data->standard.alloc_size = IVAL(blob->data, 16); data->standard.attrib = SVAL(blob->data, 20); len = smbcli_blob_pull_string(tree->session, mem_ctx, blob, &data->standard.name, 22, 23, STR_LEN8BIT | STR_TERMINATE | STR_LEN_NOTERM); return len + 23; case RAW_SEARCH_DATA_EA_SIZE: if (flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) { if (blob->length < 4) return -1; data->ea_size.resume_key = IVAL(blob->data, 0); blob->data += 4; blob->length -= 4; } if (blob->length < 28) return -1; data->ea_size.create_time = raw_pull_dos_date2(tree->session->transport, blob->data + 0); data->ea_size.access_time = raw_pull_dos_date2(tree->session->transport, blob->data + 4); data->ea_size.write_time = raw_pull_dos_date2(tree->session->transport, blob->data + 8); data->ea_size.size = IVAL(blob->data, 12); data->ea_size.alloc_size = IVAL(blob->data, 16); data->ea_size.attrib = SVAL(blob->data, 20); data->ea_size.ea_size = IVAL(blob->data, 22); len = smbcli_blob_pull_string(tree->session, mem_ctx, blob, &data->ea_size.name, 26, 27, STR_LEN8BIT | STR_TERMINATE | STR_NOALIGN); return len + 27 + 1; case RAW_SEARCH_DATA_EA_LIST: if (flags & FLAG_TRANS2_FIND_REQUIRE_RESUME) { if (blob->length < 4) return -1; data->ea_list.resume_key = IVAL(blob->data, 0); blob->data += 4; blob->length -= 4; } if (blob->length < 28) return -1; data->ea_list.create_time = raw_pull_dos_date2(tree->session->transport, blob->data + 0); data->ea_list.access_time = raw_pull_dos_date2(tree->session->transport, blob->data + 4); data->ea_list.write_time = raw_pull_dos_date2(tree->session->transport, blob->data + 8); data->ea_list.size = IVAL(blob->data, 12); data->ea_list.alloc_size = IVAL(blob->data, 16); data->ea_list.attrib = SVAL(blob->data, 20); ea_size = IVAL(blob->data, 22); if (ea_size > 0xFFFF) { return -1; } eablob.data = blob->data + 22; eablob.length = ea_size; if (eablob.length > blob->length - 24) { return -1; } status = ea_pull_list(&eablob, mem_ctx, &data->ea_list.eas.num_eas, &data->ea_list.eas.eas); if (!NT_STATUS_IS_OK(status)) { return -1; } len = smbcli_blob_pull_string(tree->session, mem_ctx, blob, &data->ea_list.name, 22+ea_size, 23+ea_size, STR_LEN8BIT | STR_NOALIGN); return len + ea_size + 23 + 1; case RAW_SEARCH_DATA_UNIX_INFO: if (blob->length < 109) return -1; ofs = IVAL(blob->data, 0); data->unix_info.file_index = IVAL(blob->data, 4); data->unix_info.size = BVAL(blob->data, 8); data->unix_info.alloc_size = BVAL(blob->data, 16); data->unix_info.status_change_time = smbcli_pull_nttime(blob->data, 24); data->unix_info.access_time = smbcli_pull_nttime(blob->data, 32); data->unix_info.change_time = smbcli_pull_nttime(blob->data, 40); data->unix_info.uid = IVAL(blob->data, 48); data->unix_info.gid = IVAL(blob->data, 56); data->unix_info.file_type = IVAL(blob->data, 64); data->unix_info.dev_major = BVAL(blob->data, 68); data->unix_info.dev_minor = BVAL(blob->data, 76); data->unix_info.unique_id = BVAL(blob->data, 84); data->unix_info.permissions = IVAL(blob->data, 92); data->unix_info.nlink = IVAL(blob->data, 100); /* There is no length field for this name but we know it's null terminated. */ len = smbcli_blob_pull_unix_string(tree->session, mem_ctx, blob, &data->unix_info.name, 108, 0); if (ofs != 0 && ofs < 108+len) { return -1; } return ofs; case RAW_SEARCH_DATA_UNIX_INFO2: /* 8 - size of ofs + file_index * 116 - size of unix_info2 * 4 - size of name length * 2 - "." is the shortest name */ if (blob->length < (116 + 8 + 4 + 2)) { return -1; } ofs = IVAL(blob->data, 0); data->unix_info2.file_index = IVAL(blob->data, 4); data->unix_info2.end_of_file = BVAL(blob->data, 8); data->unix_info2.num_bytes = BVAL(blob->data, 16); data->unix_info2.status_change_time = smbcli_pull_nttime(blob->data, 24); data->unix_info2.access_time = smbcli_pull_nttime(blob->data, 32); data->unix_info2.change_time = smbcli_pull_nttime(blob->data, 40); data->unix_info2.uid = IVAL(blob->data, 48); data->unix_info2.gid = IVAL(blob->data, 56); data->unix_info2.file_type = IVAL(blob->data, 64); data->unix_info2.dev_major = BVAL(blob->data, 68); data->unix_info2.dev_minor = BVAL(blob->data, 76); data->unix_info2.unique_id = BVAL(blob->data, 84); data->unix_info2.permissions = IVAL(blob->data, 92); data->unix_info2.nlink = IVAL(blob->data, 100); data->unix_info2.create_time = smbcli_pull_nttime(blob->data, 108); data->unix_info2.file_flags = IVAL(blob->data, 116); data->unix_info2.flags_mask = IVAL(blob->data, 120); /* There is a 4 byte length field for this name. The length * does not include the NULL terminator. */ len = smbcli_blob_pull_string(tree->session, mem_ctx, blob, &data->unix_info2.name, 8 + 116, /* offset to length */ 8 + 116 + 4, /* offset to string */ 0); if (ofs != 0 && ofs < (8 + 116 + 4 + len)) { return -1; } return ofs; case RAW_SEARCH_DATA_DIRECTORY_INFO: case RAW_SEARCH_DATA_FULL_DIRECTORY_INFO: case RAW_SEARCH_DATA_NAME_INFO: case RAW_SEARCH_DATA_BOTH_DIRECTORY_INFO: case RAW_SEARCH_DATA_ID_FULL_DIRECTORY_INFO: case RAW_SEARCH_DATA_ID_BOTH_DIRECTORY_INFO: { unsigned int str_flags = STR_UNICODE; if (!(tree->session->transport->negotiate.capabilities & CAP_UNICODE)) { str_flags = STR_ASCII; } status = smb_raw_search_common(mem_ctx, level, blob, data, &ofs, str_flags); if (!NT_STATUS_IS_OK(status)) { return -1; } return ofs; } } /* invalid level */ return -1; }
/**************************************************************************** Query FSInfo raw interface (async recv) ****************************************************************************/ NTSTATUS smb_raw_fsinfo_recv(struct smbcli_request *req, TALLOC_CTX *mem_ctx, union smb_fsinfo *fsinfo) { DATA_BLOB blob; NTSTATUS status; struct smbcli_session *session = req?req->session:NULL; if (fsinfo->generic.level == RAW_QFS_DSKATTR) { return smb_raw_dskattr_recv(req, fsinfo); } status = smb_raw_qfsinfo_blob_recv(req, mem_ctx, &blob); if (!NT_STATUS_IS_OK(status)) { return status; } /* parse the results */ switch (fsinfo->generic.level) { case RAW_QFS_GENERIC: case RAW_QFS_DSKATTR: /* handled above */ break; case RAW_QFS_ALLOCATION: QFS_CHECK_SIZE(18); fsinfo->allocation.out.fs_id = IVAL(blob.data, 0); fsinfo->allocation.out.sectors_per_unit = IVAL(blob.data, 4); fsinfo->allocation.out.total_alloc_units = IVAL(blob.data, 8); fsinfo->allocation.out.avail_alloc_units = IVAL(blob.data, 12); fsinfo->allocation.out.bytes_per_sector = SVAL(blob.data, 16); break; case RAW_QFS_VOLUME: QFS_CHECK_MIN_SIZE(5); fsinfo->volume.out.serial_number = IVAL(blob.data, 0); smbcli_blob_pull_string(session, mem_ctx, &blob, &fsinfo->volume.out.volume_name, 4, 5, STR_LEN8BIT | STR_NOALIGN); break; case RAW_QFS_VOLUME_INFO: case RAW_QFS_VOLUME_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_VOLUME_INFORMATION, fsinfo); case RAW_QFS_SIZE_INFO: case RAW_QFS_SIZE_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_SIZE_INFORMATION, fsinfo); case RAW_QFS_DEVICE_INFO: case RAW_QFS_DEVICE_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_DEVICE_INFORMATION, fsinfo); case RAW_QFS_ATTRIBUTE_INFO: case RAW_QFS_ATTRIBUTE_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_ATTRIBUTE_INFORMATION, fsinfo); case RAW_QFS_UNIX_INFO: QFS_CHECK_SIZE(12); fsinfo->unix_info.out.major_version = SVAL(blob.data, 0); fsinfo->unix_info.out.minor_version = SVAL(blob.data, 2); fsinfo->unix_info.out.capability = SVAL(blob.data, 4); break; case RAW_QFS_QUOTA_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_QUOTA_INFORMATION, fsinfo); case RAW_QFS_FULL_SIZE_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_FULL_SIZE_INFORMATION, fsinfo); case RAW_QFS_OBJECTID_INFORMATION: return smb_raw_fsinfo_passthru_parse(blob, mem_ctx, RAW_QFS_OBJECTID_INFORMATION, fsinfo); } failed: return status; }
/* parse the wire search formats that are in common between SMB and SMB2 */ NTSTATUS smb_raw_search_common(TALLOC_CTX *mem_ctx, enum smb_search_data_level level, const DATA_BLOB *blob, union smb_search_data *data, unsigned int *next_ofs, unsigned int str_flags) { unsigned int len, blen; if (blob->length < 4) { return NT_STATUS_INFO_LENGTH_MISMATCH; } *next_ofs = IVAL(blob->data, 0); if (*next_ofs != 0) { blen = *next_ofs; } else { blen = blob->length; } switch (level) { case RAW_SEARCH_DATA_DIRECTORY_INFO: if (blen < 65) return NT_STATUS_INFO_LENGTH_MISMATCH; data->directory_info.file_index = IVAL(blob->data, 4); data->directory_info.create_time = smbcli_pull_nttime(blob->data, 8); data->directory_info.access_time = smbcli_pull_nttime(blob->data, 16); data->directory_info.write_time = smbcli_pull_nttime(blob->data, 24); data->directory_info.change_time = smbcli_pull_nttime(blob->data, 32); data->directory_info.size = BVAL(blob->data, 40); data->directory_info.alloc_size = BVAL(blob->data, 48); data->directory_info.attrib = IVAL(blob->data, 56); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->directory_info.name, 60, 64, str_flags); if (*next_ofs != 0 && *next_ofs < 64+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; case RAW_SEARCH_DATA_FULL_DIRECTORY_INFO: if (blen < 69) return NT_STATUS_INFO_LENGTH_MISMATCH; data->full_directory_info.file_index = IVAL(blob->data, 4); data->full_directory_info.create_time = smbcli_pull_nttime(blob->data, 8); data->full_directory_info.access_time = smbcli_pull_nttime(blob->data, 16); data->full_directory_info.write_time = smbcli_pull_nttime(blob->data, 24); data->full_directory_info.change_time = smbcli_pull_nttime(blob->data, 32); data->full_directory_info.size = BVAL(blob->data, 40); data->full_directory_info.alloc_size = BVAL(blob->data, 48); data->full_directory_info.attrib = IVAL(blob->data, 56); data->full_directory_info.ea_size = IVAL(blob->data, 64); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->full_directory_info.name, 60, 68, str_flags); if (*next_ofs != 0 && *next_ofs < 68+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; case RAW_SEARCH_DATA_NAME_INFO: if (blen < 13) return NT_STATUS_INFO_LENGTH_MISMATCH; data->name_info.file_index = IVAL(blob->data, 4); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->name_info.name, 8, 12, str_flags); if (*next_ofs != 0 && *next_ofs < 12+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; case RAW_SEARCH_DATA_BOTH_DIRECTORY_INFO: if (blen < 95) return NT_STATUS_INFO_LENGTH_MISMATCH; data->both_directory_info.file_index = IVAL(blob->data, 4); data->both_directory_info.create_time = smbcli_pull_nttime(blob->data, 8); data->both_directory_info.access_time = smbcli_pull_nttime(blob->data, 16); data->both_directory_info.write_time = smbcli_pull_nttime(blob->data, 24); data->both_directory_info.change_time = smbcli_pull_nttime(blob->data, 32); data->both_directory_info.size = BVAL(blob->data, 40); data->both_directory_info.alloc_size = BVAL(blob->data, 48); data->both_directory_info.attrib = IVAL(blob->data, 56); data->both_directory_info.ea_size = IVAL(blob->data, 64); smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->both_directory_info.short_name, 68, 70, STR_LEN8BIT | STR_UNICODE); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->both_directory_info.name, 60, 94, str_flags); if (*next_ofs != 0 && *next_ofs < 94+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; case RAW_SEARCH_DATA_ID_FULL_DIRECTORY_INFO: if (blen < 81) return NT_STATUS_INFO_LENGTH_MISMATCH; data->id_full_directory_info.file_index = IVAL(blob->data, 4); data->id_full_directory_info.create_time = smbcli_pull_nttime(blob->data, 8); data->id_full_directory_info.access_time = smbcli_pull_nttime(blob->data, 16); data->id_full_directory_info.write_time = smbcli_pull_nttime(blob->data, 24); data->id_full_directory_info.change_time = smbcli_pull_nttime(blob->data, 32); data->id_full_directory_info.size = BVAL(blob->data, 40); data->id_full_directory_info.alloc_size = BVAL(blob->data, 48); data->id_full_directory_info.attrib = IVAL(blob->data, 56); data->id_full_directory_info.ea_size = IVAL(blob->data, 64); data->id_full_directory_info.file_id = BVAL(blob->data, 72); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->id_full_directory_info.name, 60, 80, str_flags); if (*next_ofs != 0 && *next_ofs < 80+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; case RAW_SEARCH_DATA_ID_BOTH_DIRECTORY_INFO: if (blen < 105) return NT_STATUS_INFO_LENGTH_MISMATCH; data->id_both_directory_info.file_index = IVAL(blob->data, 4); data->id_both_directory_info.create_time = smbcli_pull_nttime(blob->data, 8); data->id_both_directory_info.access_time = smbcli_pull_nttime(blob->data, 16); data->id_both_directory_info.write_time = smbcli_pull_nttime(blob->data, 24); data->id_both_directory_info.change_time = smbcli_pull_nttime(blob->data, 32); data->id_both_directory_info.size = BVAL(blob->data, 40); data->id_both_directory_info.alloc_size = BVAL(blob->data, 48); data->id_both_directory_info.attrib = SVAL(blob->data, 56); data->id_both_directory_info.ea_size = IVAL(blob->data, 64); smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->id_both_directory_info.short_name, 68, 70, STR_LEN8BIT | STR_UNICODE); memcpy(data->id_both_directory_info.short_name_buf, blob->data + 70, 24); data->id_both_directory_info.file_id = BVAL(blob->data, 96); len = smbcli_blob_pull_string(NULL, mem_ctx, blob, &data->id_both_directory_info.name, 60, 104, str_flags); if (*next_ofs != 0 && *next_ofs < 104+len) { return NT_STATUS_INFO_LENGTH_MISMATCH; } return NT_STATUS_OK; default: break; } /* invalid level */ return NT_STATUS_INVALID_INFO_CLASS; }
/* parse the fsinfo 'passthru' level replies */ NTSTATUS smb_raw_fsinfo_passthru_parse(DATA_BLOB blob, TALLOC_CTX *mem_ctx, enum smb_fsinfo_level level, union smb_fsinfo *fsinfo) { NTSTATUS status = NT_STATUS_OK; int i; /* parse the results */ switch (level) { case RAW_QFS_VOLUME_INFORMATION: QFS_CHECK_MIN_SIZE(18); fsinfo->volume_info.out.create_time = smbcli_pull_nttime(blob.data, 0); fsinfo->volume_info.out.serial_number = IVAL(blob.data, 8); smbcli_blob_pull_string(NULL, mem_ctx, &blob, &fsinfo->volume_info.out.volume_name, 12, 18, STR_UNICODE); break; case RAW_QFS_SIZE_INFORMATION: QFS_CHECK_SIZE(24); fsinfo->size_info.out.total_alloc_units = BVAL(blob.data, 0); fsinfo->size_info.out.avail_alloc_units = BVAL(blob.data, 8); fsinfo->size_info.out.sectors_per_unit = IVAL(blob.data, 16); fsinfo->size_info.out.bytes_per_sector = IVAL(blob.data, 20); break; case RAW_QFS_DEVICE_INFORMATION: QFS_CHECK_SIZE(8); fsinfo->device_info.out.device_type = IVAL(blob.data, 0); fsinfo->device_info.out.characteristics = IVAL(blob.data, 4); break; case RAW_QFS_ATTRIBUTE_INFORMATION: QFS_CHECK_MIN_SIZE(12); fsinfo->attribute_info.out.fs_attr = IVAL(blob.data, 0); fsinfo->attribute_info.out.max_file_component_length = IVAL(blob.data, 4); smbcli_blob_pull_string(NULL, mem_ctx, &blob, &fsinfo->attribute_info.out.fs_type, 8, 12, STR_UNICODE); break; case RAW_QFS_QUOTA_INFORMATION: QFS_CHECK_SIZE(48); fsinfo->quota_information.out.unknown[0] = BVAL(blob.data, 0); fsinfo->quota_information.out.unknown[1] = BVAL(blob.data, 8); fsinfo->quota_information.out.unknown[2] = BVAL(blob.data, 16); fsinfo->quota_information.out.quota_soft = BVAL(blob.data, 24); fsinfo->quota_information.out.quota_hard = BVAL(blob.data, 32); fsinfo->quota_information.out.quota_flags = BVAL(blob.data, 40); break; case RAW_QFS_FULL_SIZE_INFORMATION: QFS_CHECK_SIZE(32); fsinfo->full_size_information.out.total_alloc_units = BVAL(blob.data, 0); fsinfo->full_size_information.out.call_avail_alloc_units = BVAL(blob.data, 8); fsinfo->full_size_information.out.actual_avail_alloc_units = BVAL(blob.data, 16); fsinfo->full_size_information.out.sectors_per_unit = IVAL(blob.data, 24); fsinfo->full_size_information.out.bytes_per_sector = IVAL(blob.data, 28); break; case RAW_QFS_OBJECTID_INFORMATION: QFS_CHECK_SIZE(64); status = ndr_pull_struct_blob(&blob, mem_ctx, &fsinfo->objectid_information.out.guid, (ndr_pull_flags_fn_t)ndr_pull_GUID); for (i=0;i<6;i++) { fsinfo->objectid_information.out.unknown[i] = BVAL(blob.data, 16 + i*8); } break; default: status = NT_STATUS_INVALID_INFO_CLASS; } failed: return status; }