scanner.c

samba最新软件

/* 
   Unix SMB/CIFS implementation.
   SMB torture tester - scanning functions
   Copyright (C) Andrew Tridgell 2001
   
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.
   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   
   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

#include "includes.h"
#include "torture/torture.h"
#include "libcli/libcli.h"
#include "torture/util.h"
#include "libcli/raw/libcliraw.h"
#include "libcli/raw/raw_proto.h"
#include "system/filesys.h"
#include "param/param.h"

#define VERBOSE 0
#define OP_MIN 0
#define OP_MAX 100
#define PARAM_SIZE 1024

/****************************************************************************
look for a partial hit
****************************************************************************/
static void trans2_check_hit(const char *format, int op, int level, NTSTATUS status)
{
	if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL) ||
	    NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) ||
	    NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
	    NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL) ||
	    NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) {
		return;
	}
#if VERBOSE
	printf("possible %s hit op=%3d level=%5d status=%s\n",
	       format, op, level, nt_errstr(status));
#endif
}

/****************************************************************************
check for existance of a trans2 call
****************************************************************************/
static NTSTATUS try_trans2(struct smbcli_state *cli, 
			   int op,
			   uint8_t *param, uint8_t *data,
			   int param_len, int data_len,
			   int *rparam_len, int *rdata_len)
{
	NTSTATUS status;
	struct smb_trans2 t2;
	uint16_t setup = op;
	TALLOC_CTX *mem_ctx;

	mem_ctx = talloc_init("try_trans2");

	t2.in.max_param = 64;
	t2.in.max_data = smb_raw_max_trans_data(cli->tree, 64);
	t2.in.max_setup = 10;
	t2.in.flags = 0;
	t2.in.timeout = 0;
	t2.in.setup_count = 1;
	t2.in.setup = &setup;
	t2.in.params.data = param;
	t2.in.params.length = param_len;
	t2.in.data.data = data;
	t2.in.data.length = data_len;

	status = smb_raw_trans2(cli->tree, mem_ctx, &t2);

	*rparam_len = t2.out.params.length;
	*rdata_len = t2.out.data.length;

	talloc_free(mem_ctx);

	return status;
}


static NTSTATUS try_trans2_len(struct smbcli_state *cli,
			     const char *format,
			     int op, int level,
			     uint8_t *param, uint8_t *data,
			     int param_len, int *data_len,
			     int *rparam_len, int *rdata_len)
{
	NTSTATUS ret=NT_STATUS_OK;

	ret = try_trans2(cli, op, param, data, param_len,
			 PARAM_SIZE, rparam_len, rdata_len);
#if VERBOSE
	printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret));
#endif
	if (!NT_STATUS_IS_OK(ret)) return ret;

	*data_len = 0;
	while (*data_len < PARAM_SIZE) {
		ret = try_trans2(cli, op, param, data, param_len,
				 *data_len, rparam_len, rdata_len);
		if (NT_STATUS_IS_OK(ret)) break;
		*data_len += 2;
	}
	if (NT_STATUS_IS_OK(ret)) {
		printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n",
		       format, level, *data_len, *rparam_len, *rdata_len);
	} else {
		trans2_check_hit(format, op, level, ret);
	}
	return ret;
}


/****************************************************************************
check whether a trans2 opnum exists at all
****************************************************************************/
static bool trans2_op_exists(struct smbcli_state *cli, int op)
{
	int data_len = PARAM_SIZE;
	int param_len = PARAM_SIZE;
	int rparam_len, rdata_len;
	uint8_t *param, *data;
	NTSTATUS status1, status2;
	TALLOC_CTX *mem_ctx;

	mem_ctx = talloc_init("trans2_op_exists");

	/* try with a info level only */

	param = talloc_array(mem_ctx, uint8_t, param_len);
	data  = talloc_array(mem_ctx, uint8_t, data_len);

	memset(param, 0xFF, param_len);
	memset(data, 0xFF, data_len);

	status1 = try_trans2(cli, 0xFFFF, param, data, param_len, data_len,
			     &rparam_len, &rdata_len);

	status2 = try_trans2(cli, op, param, data, param_len, data_len,
			     &rparam_len, &rdata_len);

	if (NT_STATUS_EQUAL(status1, status2)) {
		talloc_free(mem_ctx);
		return false;
	}

	printf("Found op %d (status=%s)\n", op, nt_errstr(status2));

	talloc_free(mem_ctx);
	return true;
}

/****************************************************************************
check for existance of a trans2 call
****************************************************************************/
static bool scan_trans2(struct smb_iconv_convenience *iconv_convenience, 
			struct smbcli_state *cli, int op, int level,
			int fnum, int dnum, int qfnum, const char *fname)
{
	int data_len = 0;
	int param_len = 0;
	int rparam_len, rdata_len;
	uint8_t *param, *data;
	NTSTATUS status;
	TALLOC_CTX *mem_ctx;

	mem_ctx = talloc_init("scan_trans2");

	data = talloc_array(mem_ctx, uint8_t, PARAM_SIZE);
	param = talloc_array(mem_ctx, uint8_t, PARAM_SIZE);

	memset(data, 0, PARAM_SIZE);
	data_len = 4;

	/* try with a info level only */
	param_len = 2;
	SSVAL(param, 0, level);
	status = try_trans2_len(cli, "void", op, level, param, data, param_len,
			&data_len, &rparam_len, &rdata_len);
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try with a file descriptor */
	param_len = 6;
	SSVAL(param, 0, fnum);
	SSVAL(param, 2, level);
	SSVAL(param, 4, 0);
	status = try_trans2_len(cli, "fnum", op, level, param, data, param_len,
			&data_len, &rparam_len, &rdata_len);
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try with a quota file descriptor */
	param_len = 6;
	SSVAL(param, 0, qfnum);
	SSVAL(param, 2, level);
	SSVAL(param, 4, 0);
	status = try_trans2_len(cli, "qfnum", op, level, param, data, param_len,
		       	&data_len, &rparam_len, &rdata_len);
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try with a notify style */
	param_len = 6;
	SSVAL(param, 0, dnum);
	SSVAL(param, 2, dnum);
	SSVAL(param, 4, level);
	status = try_trans2_len(cli, "notify", op, level, param, data,
			param_len, &data_len, &rparam_len, &rdata_len);
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try with a file name */
	param_len = 6;
	SSVAL(param, 0, level);
	SSVAL(param, 2, 0);
	SSVAL(param, 4, 0);
	param_len += push_string(iconv_convenience,
			&param[6], fname, PARAM_SIZE-7,
			STR_TERMINATE|STR_UNICODE);

	status = try_trans2_len(cli, "fname", op, level, param, data, param_len,
			&data_len, &rparam_len, &rdata_len);
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try with a new file name */
	param_len = 6;
	SSVAL(param, 0, level);
	SSVAL(param, 2, 0);
	SSVAL(param, 4, 0);
	param_len += push_string(iconv_convenience,
			&param[6], "\\newfile.dat", PARAM_SIZE-7,
			STR_TERMINATE|STR_UNICODE);

	status = try_trans2_len(cli, "newfile", op, level, param, data,
			param_len, &data_len, &rparam_len, &rdata_len);
	smbcli_unlink(cli->tree, "\\newfile.dat");
	smbcli_rmdir(cli->tree, "\\newfile.dat");
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	/* try dfs style  */
	smbcli_mkdir(cli->tree, "\\testdir");
	param_len = 2;
	SSVAL(param, 0, level);
	param_len += push_string(iconv_convenience,
			&param[2], "\\testdir", PARAM_SIZE-3,
			STR_TERMINATE|STR_UNICODE);

	status = try_trans2_len(cli, "dfs", op, level, param, data, param_len,
			&data_len, &rparam_len, &rdata_len);
	smbcli_rmdir(cli->tree, "\\testdir");
	if (NT_STATUS_IS_OK(status)) {
		talloc_free(mem_ctx);
		return true;
	}

	talloc_free(mem_ctx);
	return false;
}

bool torture_trans2_scan(struct torture_context *torture,
						 struct smbcli_state *cli)
{
	int op, level;
	const char *fname = "\\scanner.dat";
	int fnum, dnum, qfnum;

	fnum = smbcli_open(cli->tree, fname, O_RDWR | O_CREAT | O_TRUNC, DENY_NONE);
	if (fnum == -1) {
		printf("file open failed - %s\n", smbcli_errstr(cli->tree));
	}
	dnum = smbcli_nt_create_full(cli->tree, "\\", 
				     0, 
				     SEC_RIGHTS_FILE_READ, 
				     FILE_ATTRIBUTE_NORMAL,
				     NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE, 
				     NTCREATEX_DISP_OPEN, 
				     NTCREATEX_OPTIONS_DIRECTORY, 0);
	if (dnum == -1) {
		printf("directory open failed - %s\n", smbcli_errstr(cli->tree));
	}
	qfnum = smbcli_nt_create_full(cli->tree, "\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION", 
				   NTCREATEX_FLAGS_EXTENDED, 
				   SEC_FLAG_MAXIMUM_ALLOWED, 
				   0,
				   NTCREATEX_SHARE_ACCESS_READ|NTCREATEX_SHARE_ACCESS_WRITE, 
				   NTCREATEX_DISP_OPEN, 
				   0, 0);
	if (qfnum == -1) {
		printf("quota open failed - %s\n", smbcli_errstr(cli->tree));
	}