1/* 2 Unix SMB/CIFS implementation. 3 4 SMB2 Create Context Blob handling 5 6 Copyright (C) Andrew Tridgell 2005 7 Copyright (C) Stefan Metzmacher 2008-2009 8 9 This program is free software; you can redistribute it and/or modify 10 it under the terms of the GNU General Public License as published by 11 the Free Software Foundation; either version 3 of the License, or 12 (at your option) any later version. 13 14 This program is distributed in the hope that it will be useful, 15 but WITHOUT ANY WARRANTY; without even the implied warranty of 16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 GNU General Public License for more details. 18 19 You should have received a copy of the GNU General Public License 20 along with this program. If not, see <http://www.gnu.org/licenses/>. 21*/ 22 23#include "includes.h" 24#include "../libcli/smb/smb_common.h" 25 26static size_t smb2_create_blob_padding(uint32_t offset, size_t n) 27{ 28 if ((offset & (n-1)) == 0) return 0; 29 return n - (offset & (n-1)); 30} 31 32/* 33 parse a set of SMB2 create blobs 34*/ 35NTSTATUS smb2_create_blob_parse(TALLOC_CTX *mem_ctx, const DATA_BLOB buffer, 36 struct smb2_create_blobs *blobs) 37{ 38 const uint8_t *data = buffer.data; 39 uint32_t remaining = buffer.length; 40 41 while (remaining > 0) { 42 uint32_t next; 43 uint32_t name_offset, name_length; 44 uint32_t reserved, data_offset; 45 uint32_t data_length; 46 char *tag; 47 DATA_BLOB b; 48 NTSTATUS status; 49 50 if (remaining < 16) { 51 return NT_STATUS_INVALID_PARAMETER; 52 } 53 next = IVAL(data, 0); 54 name_offset = SVAL(data, 4); 55 name_length = SVAL(data, 6); 56 reserved = SVAL(data, 8); 57 data_offset = SVAL(data, 10); 58 data_length = IVAL(data, 12); 59 60 if ((next & 0x7) != 0 || 61 next > remaining || 62 name_offset < 16 || 63 name_offset > remaining || 64 name_length != 4 || /* windows enforces this */ 65 name_offset + name_length > remaining || 66 data_offset < name_offset + name_length || 67 data_offset > remaining || 68 data_offset + (uint64_t)data_length > remaining) { 69 return NT_STATUS_INVALID_PARAMETER; 70 } 71 72 tag = talloc_strndup(mem_ctx, (const char *)data + name_offset, name_length); 73 if (tag == NULL) { 74 return NT_STATUS_NO_MEMORY; 75 } 76 77 b = data_blob_const(data+data_offset, data_length); 78 status = smb2_create_blob_add(mem_ctx, blobs, tag, b); 79 if (!NT_STATUS_IS_OK(status)) { 80 return status; 81 } 82 83 talloc_free(tag); 84 85 if (next == 0) break; 86 87 remaining -= next; 88 data += next; 89 90 if (remaining < 16) { 91 return NT_STATUS_INVALID_PARAMETER; 92 } 93 } 94 95 return NT_STATUS_OK; 96} 97 98 99/* 100 add a blob to a smb2_create attribute blob 101*/ 102static NTSTATUS smb2_create_blob_push_one(TALLOC_CTX *mem_ctx, DATA_BLOB *buffer, 103 const struct smb2_create_blob *blob, 104 bool last) 105{ 106 uint32_t ofs = buffer->length; 107 size_t tag_length = strlen(blob->tag); 108 uint8_t pad = smb2_create_blob_padding(blob->data.length+tag_length, 4); 109 110 if (!data_blob_realloc(mem_ctx, buffer, 111 buffer->length + 0x14 + tag_length + blob->data.length + pad)) 112 return NT_STATUS_NO_MEMORY; 113 114 if (last) { 115 SIVAL(buffer->data, ofs+0x00, 0); 116 } else { 117 SIVAL(buffer->data, ofs+0x00, 0x14 + tag_length + blob->data.length + pad); 118 } 119 SSVAL(buffer->data, ofs+0x04, 0x10); /* offset of tag */ 120 SIVAL(buffer->data, ofs+0x06, tag_length); /* tag length */ 121 SSVAL(buffer->data, ofs+0x0A, 0x14 + tag_length); /* offset of data */ 122 SIVAL(buffer->data, ofs+0x0C, blob->data.length); 123 memcpy(buffer->data+ofs+0x10, blob->tag, tag_length); 124 SIVAL(buffer->data, ofs+0x10+tag_length, 0); /* pad? */ 125 memcpy(buffer->data+ofs+0x14+tag_length, blob->data.data, blob->data.length); 126 memset(buffer->data+ofs+0x14+tag_length+blob->data.length, 0, pad); 127 128 return NT_STATUS_OK; 129} 130 131 132/* 133 create a buffer of a set of create blobs 134*/ 135NTSTATUS smb2_create_blob_push(TALLOC_CTX *mem_ctx, DATA_BLOB *buffer, 136 const struct smb2_create_blobs blobs) 137{ 138 int i; 139 NTSTATUS status; 140 141 *buffer = data_blob(NULL, 0); 142 for (i=0; i < blobs.num_blobs; i++) { 143 bool last = false; 144 const struct smb2_create_blob *c; 145 146 if ((i + 1) == blobs.num_blobs) { 147 last = true; 148 } 149 150 c = &blobs.blobs[i]; 151 status = smb2_create_blob_push_one(mem_ctx, buffer, c, last); 152 if (!NT_STATUS_IS_OK(status)) { 153 return status; 154 } 155 } 156 return NT_STATUS_OK; 157} 158 159 160NTSTATUS smb2_create_blob_add(TALLOC_CTX *mem_ctx, struct smb2_create_blobs *b, 161 const char *tag, DATA_BLOB data) 162{ 163 struct smb2_create_blob *array; 164 165 array = talloc_realloc(mem_ctx, b->blobs, 166 struct smb2_create_blob, 167 b->num_blobs + 1); 168 NT_STATUS_HAVE_NO_MEMORY(array); 169 b->blobs = array; 170 171 b->blobs[b->num_blobs].tag = talloc_strdup(b->blobs, tag); 172 NT_STATUS_HAVE_NO_MEMORY(b->blobs[b->num_blobs].tag); 173 174 if (data.data) { 175 b->blobs[b->num_blobs].data = data_blob_talloc(b->blobs, 176 data.data, 177 data.length); 178 NT_STATUS_HAVE_NO_MEMORY(b->blobs[b->num_blobs].data.data); 179 } else { 180 b->blobs[b->num_blobs].data = data_blob(NULL, 0); 181 } 182 183 b->num_blobs += 1; 184 185 return NT_STATUS_OK; 186} 187 188/* 189 * return the first blob with the given tag 190 */ 191struct smb2_create_blob *smb2_create_blob_find(const struct smb2_create_blobs *b, 192 const char *tag) 193{ 194 uint32_t i; 195 196 for (i=0; i < b->num_blobs; i++) { 197 if (strcmp(b->blobs[i].tag, tag) == 0) { 198 return &b->blobs[i]; 199 } 200 } 201 202 return NULL; 203} 204