diff options
Diffstat (limited to '')
| -rw-r--r-- | source4/torture/basic/scanner.c | 623 |
1 files changed, 623 insertions, 0 deletions
diff --git a/source4/torture/basic/scanner.c b/source4/torture/basic/scanner.c new file mode 100644 index 0000000..144b7d0 --- /dev/null +++ b/source4/torture/basic/scanner.c @@ -0,0 +1,623 @@ +/* + Unix SMB/CIFS implementation. + SMB torture tester - scanning functions + Copyright (C) Andrew Tridgell 2001 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#include "includes.h" +#include "libcli/libcli.h" +#include "torture/util.h" +#include "libcli/raw/raw_proto.h" +#include "system/filesys.h" +#include "param/param.h" +#include "torture/basic/proto.h" + +#define VERBOSE 0 +#define OP_MIN 0 +#define OP_MAX 100 +#define PARAM_SIZE 1024 + +/**************************************************************************** +look for a partial hit +****************************************************************************/ +static void trans2_check_hit(const char *format, int op, int level, NTSTATUS status) +{ + if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || + NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL) || + NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) { + return; + } +#if VERBOSE + printf("possible %s hit op=%3d level=%5d status=%s\n", + format, op, level, nt_errstr(status)); +#endif +} + +/**************************************************************************** +check for existence of a trans2 call +****************************************************************************/ +static NTSTATUS try_trans2(struct smbcli_state *cli, + int op, + uint8_t *param, uint8_t *data, + int param_len, int data_len, + int *rparam_len, int *rdata_len) +{ + NTSTATUS status; + struct smb_trans2 t2; + uint16_t setup = op; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_init("try_trans2"); + + t2.in.max_param = UINT16_MAX; + t2.in.max_data = UINT16_MAX; + t2.in.max_setup = 10; + t2.in.flags = 0; + t2.in.timeout = 0; + t2.in.setup_count = 1; + t2.in.setup = &setup; + t2.in.params.data = param; + t2.in.params.length = param_len; + t2.in.data.data = data; + t2.in.data.length = data_len; + + status = smb_raw_trans2(cli->tree, mem_ctx, &t2); + + *rparam_len = t2.out.params.length; + *rdata_len = t2.out.data.length; + + talloc_free(mem_ctx); + + return status; +} + + +static NTSTATUS try_trans2_len(struct smbcli_state *cli, + const char *format, + int op, int level, + uint8_t *param, uint8_t *data, + int param_len, int *data_len, + int *rparam_len, int *rdata_len) +{ + NTSTATUS ret=NT_STATUS_OK; + + ret = try_trans2(cli, op, param, data, param_len, + PARAM_SIZE, rparam_len, rdata_len); +#if VERBOSE + printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret)); +#endif + if (!NT_STATUS_IS_OK(ret)) return ret; + + *data_len = 0; + while (*data_len < PARAM_SIZE) { + ret = try_trans2(cli, op, param, data, param_len, + *data_len, rparam_len, rdata_len); + if (NT_STATUS_IS_OK(ret)) break; + *data_len += 2; + } + if (NT_STATUS_IS_OK(ret)) { + printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n", + format, level, *data_len, *rparam_len, *rdata_len); + } else { + trans2_check_hit(format, op, level, ret); + } + return ret; +} + + +/**************************************************************************** +check whether a trans2 opnum exists at all +****************************************************************************/ +static bool trans2_op_exists(struct smbcli_state *cli, int op) +{ + int data_len = PARAM_SIZE; + int param_len = PARAM_SIZE; + int rparam_len, rdata_len; + uint8_t *param, *data; + NTSTATUS status1, status2; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_init("trans2_op_exists"); + + /* try with a info level only */ + + param = talloc_array(mem_ctx, uint8_t, param_len); + data = talloc_array(mem_ctx, uint8_t, data_len); + + memset(param, 0xFF, param_len); + memset(data, 0xFF, data_len); + + status1 = try_trans2(cli, 0xFFFF, param, data, param_len, data_len, + &rparam_len, &rdata_len); + + status2 = try_trans2(cli, op, param, data, param_len, data_len, + &rparam_len, &rdata_len); + + if (NT_STATUS_EQUAL(status1, status2)) { + talloc_free(mem_ctx); + return false; + } + + printf("Found op %d (status=%s)\n", op, nt_errstr(status2)); + + talloc_free(mem_ctx); + return true; +} + +/**************************************************************************** +check for existence of a trans2 call +****************************************************************************/ +static bool scan_trans2( + struct smbcli_state *cli, int op, int level, + int fnum, int dnum, int qfnum, const char *fname) +{ + int data_len = 0; + int param_len = 0; + int rparam_len, rdata_len; + uint8_t *param, *data; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_init("scan_trans2"); + + data = talloc_array(mem_ctx, uint8_t, PARAM_SIZE); + param = talloc_array(mem_ctx, uint8_t, PARAM_SIZE); + + memset(data, 0, PARAM_SIZE); + data_len = 4; + + /* try with a info level only */ + param_len = 2; + SSVAL(param, 0, level); + status = try_trans2_len(cli, "void", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a file descriptor */ + param_len = 6; + SSVAL(param, 0, fnum); + SSVAL(param, 2, level); + SSVAL(param, 4, 0); + status = try_trans2_len(cli, "fnum", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a quota file descriptor */ + param_len = 6; + SSVAL(param, 0, qfnum); + SSVAL(param, 2, level); + SSVAL(param, 4, 0); + status = try_trans2_len(cli, "qfnum", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a notify style */ + param_len = 6; + SSVAL(param, 0, dnum); + SSVAL(param, 2, dnum); + SSVAL(param, 4, level); + status = try_trans2_len(cli, "notify", op, level, param, data, + param_len, &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a file name */ + param_len = 6; + SSVAL(param, 0, level); + SSVAL(param, 2, 0); + SSVAL(param, 4, 0); + param_len += push_string( + ¶m[6], fname, PARAM_SIZE-7, + STR_TERMINATE|STR_UNICODE); + + status = try_trans2_len(cli, "fname", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a new file name */ + param_len = 6; + SSVAL(param, 0, level); + SSVAL(param, 2, 0); + SSVAL(param, 4, 0); + param_len += push_string( + ¶m[6], "\\newfile.dat", PARAM_SIZE-7, + STR_TERMINATE|STR_UNICODE); + + status = try_trans2_len(cli, "newfile", op, level, param, data, + param_len, &data_len, &rparam_len, &rdata_len); + smbcli_unlink(cli->tree, "\\newfile.dat"); + smbcli_rmdir(cli->tree, "\\newfile.dat"); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try dfs style */ + smbcli_mkdir(cli->tree, "\\testdir"); + param_len = 2; + SSVAL(param, 0, level); + param_len += push_string( + ¶m[2], "\\testdir", PARAM_SIZE-3, + STR_TERMINATE|STR_UNICODE); + + status = try_trans2_len(cli, "dfs", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + smbcli_rmdir(cli->tree, "\\testdir"); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + talloc_free(mem_ctx); + return false; +} + +bool torture_trans2_scan(struct torture_context *torture, + struct smbcli_state *cli) +{ + int op, level; + const char *fname = "\\scanner.dat"; + int fnum, dnum, qfnum; + + fnum = smbcli_open(cli->tree, fname, O_RDWR | O_CREAT | O_TRUNC, DENY_NONE); + if (fnum == -1) { + printf("file open failed - %s\n", smbcli_errstr(cli->tree)); + } + dnum = smbcli_nt_create_full(cli->tree, "\\", + 0, + SEC_RIGHTS_FILE_READ, + FILE_ATTRIBUTE_NORMAL, + NTCREATEX_SHARE_ACCESS_READ | NTCREATEX_SHARE_ACCESS_WRITE, + NTCREATEX_DISP_OPEN, + NTCREATEX_OPTIONS_DIRECTORY, 0); + if (dnum == -1) { + printf("directory open failed - %s\n", smbcli_errstr(cli->tree)); + } + qfnum = smbcli_nt_create_full(cli->tree, "\\$Extend\\$Quota:$Q:$INDEX_ALLOCATION", + NTCREATEX_FLAGS_EXTENDED, + SEC_FLAG_MAXIMUM_ALLOWED, + 0, + NTCREATEX_SHARE_ACCESS_READ|NTCREATEX_SHARE_ACCESS_WRITE, + NTCREATEX_DISP_OPEN, + 0, 0); + if (qfnum == -1) { + printf("quota open failed - %s\n", smbcli_errstr(cli->tree)); + } + + for (op=OP_MIN; op<=OP_MAX; op++) { + + if (!trans2_op_exists(cli, op)) { + continue; + } + + for (level = 0; level <= 50; level++) { + scan_trans2(cli, op, level, fnum, dnum, qfnum, fname); + } + + for (level = 0x100; level <= 0x130; level++) { + scan_trans2(cli, op, level, fnum, dnum, qfnum, fname); + } + + for (level = 1000; level < 1050; level++) { + scan_trans2(cli, op, level, fnum, dnum, qfnum, fname); + } + } + + return true; +} + + + + +/**************************************************************************** +look for a partial hit +****************************************************************************/ +static void nttrans_check_hit(const char *format, int op, int level, NTSTATUS status) +{ + if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED) || + NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) || + NT_STATUS_EQUAL(status, NT_STATUS_UNSUCCESSFUL) || + NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)) { + return; + } +#if VERBOSE + printf("possible %s hit op=%3d level=%5d status=%s\n", + format, op, level, nt_errstr(status)); +#endif +} + +/**************************************************************************** +check for existence of a nttrans call +****************************************************************************/ +static NTSTATUS try_nttrans(struct smbcli_state *cli, + int op, + uint8_t *param, uint8_t *data, + int param_len, int data_len, + int *rparam_len, int *rdata_len) +{ + struct smb_nttrans parms; + DATA_BLOB ntparam_blob, ntdata_blob; + TALLOC_CTX *mem_ctx; + NTSTATUS status; + + mem_ctx = talloc_init("try_nttrans"); + + ntparam_blob.length = param_len; + ntparam_blob.data = param; + ntdata_blob.length = data_len; + ntdata_blob.data = data; + + parms.in.max_param = UINT32_MAX; + parms.in.max_data = UINT32_MAX; + parms.in.max_setup = 0; + parms.in.setup_count = 0; + parms.in.function = op; + parms.in.params = ntparam_blob; + parms.in.data = ntdata_blob; + + status = smb_raw_nttrans(cli->tree, mem_ctx, &parms); + + if (NT_STATUS_IS_ERR(status)) { + DEBUG(1,("Failed to send NT_TRANS\n")); + talloc_free(mem_ctx); + return status; + } + *rparam_len = parms.out.params.length; + *rdata_len = parms.out.data.length; + + talloc_free(mem_ctx); + + return status; +} + + +static NTSTATUS try_nttrans_len(struct smbcli_state *cli, + const char *format, + int op, int level, + uint8_t *param, uint8_t *data, + int param_len, int *data_len, + int *rparam_len, int *rdata_len) +{ + NTSTATUS ret=NT_STATUS_OK; + + ret = try_nttrans(cli, op, param, data, param_len, + PARAM_SIZE, rparam_len, rdata_len); +#if VERBOSE + printf("op=%d level=%d ret=%s\n", op, level, nt_errstr(ret)); +#endif + if (!NT_STATUS_IS_OK(ret)) return ret; + + *data_len = 0; + while (*data_len < PARAM_SIZE) { + ret = try_nttrans(cli, op, param, data, param_len, + *data_len, rparam_len, rdata_len); + if (NT_STATUS_IS_OK(ret)) break; + *data_len += 2; + } + if (NT_STATUS_IS_OK(ret)) { + printf("found %s level=%d data_len=%d rparam_len=%d rdata_len=%d\n", + format, level, *data_len, *rparam_len, *rdata_len); + } else { + nttrans_check_hit(format, op, level, ret); + } + return ret; +} + +/**************************************************************************** +check for existence of a nttrans call +****************************************************************************/ +static bool scan_nttrans(struct smbcli_state *cli, int op, int level, + int fnum, int dnum, const char *fname) +{ + int data_len = 0; + int param_len = 0; + int rparam_len, rdata_len; + uint8_t *param, *data; + NTSTATUS status; + TALLOC_CTX *mem_ctx; + + mem_ctx = talloc_init("scan_nttrans"); + + param = talloc_array(mem_ctx, uint8_t, PARAM_SIZE); + data = talloc_array(mem_ctx, uint8_t, PARAM_SIZE); + memset(data, 0, PARAM_SIZE); + data_len = 4; + + /* try with a info level only */ + param_len = 2; + SSVAL(param, 0, level); + status = try_nttrans_len(cli, "void", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a file descriptor */ + param_len = 6; + SSVAL(param, 0, fnum); + SSVAL(param, 2, level); + SSVAL(param, 4, 0); + status = try_nttrans_len(cli, "fnum", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a notify style */ + param_len = 6; + SSVAL(param, 0, dnum); + SSVAL(param, 2, dnum); + SSVAL(param, 4, level); + status = try_nttrans_len(cli, "notify", op, level, param, data, + param_len, &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a file name */ + param_len = 6; + SSVAL(param, 0, level); + SSVAL(param, 2, 0); + SSVAL(param, 4, 0); + param_len += push_string( + ¶m[6], fname, PARAM_SIZE, + STR_TERMINATE | STR_UNICODE); + + status = try_nttrans_len(cli, "fname", op, level, param, data, + param_len, &data_len, &rparam_len, &rdata_len); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try with a new file name */ + param_len = 6; + SSVAL(param, 0, level); + SSVAL(param, 2, 0); + SSVAL(param, 4, 0); + param_len += push_string( + ¶m[6], "\\newfile.dat", PARAM_SIZE, + STR_TERMINATE | STR_UNICODE); + + status = try_nttrans_len(cli, "newfile", op, level, param, data, + param_len, &data_len, &rparam_len, &rdata_len); + smbcli_unlink(cli->tree, "\\newfile.dat"); + smbcli_rmdir(cli->tree, "\\newfile.dat"); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + /* try dfs style */ + smbcli_mkdir(cli->tree, "\\testdir"); + param_len = 2; + SSVAL(param, 0, level); + param_len += push_string(¶m[2], "\\testdir", PARAM_SIZE, + STR_TERMINATE | STR_UNICODE); + + status = try_nttrans_len(cli, "dfs", op, level, param, data, param_len, + &data_len, &rparam_len, &rdata_len); + smbcli_rmdir(cli->tree, "\\testdir"); + if (NT_STATUS_IS_OK(status)) { + talloc_free(mem_ctx); + return true; + } + + talloc_free(mem_ctx); + return false; +} + + +bool torture_nttrans_scan(struct torture_context *torture, + struct smbcli_state *cli) +{ + int op, level; + const char *fname = "\\scanner.dat"; + int fnum, dnum; + + fnum = smbcli_open(cli->tree, fname, O_RDWR | O_CREAT | O_TRUNC, + DENY_NONE); + dnum = smbcli_open(cli->tree, "\\", O_RDONLY, DENY_NONE); + + for (op=OP_MIN; op<=OP_MAX; op++) { + printf("Scanning op=%d\n", op); + for (level = 0; level <= 50; level++) { + scan_nttrans(cli, op, level, fnum, dnum, fname); + } + + for (level = 0x100; level <= 0x130; level++) { + scan_nttrans(cli, op, level, fnum, dnum, fname); + } + + for (level = 1000; level < 1050; level++) { + scan_nttrans(cli, op, level, fnum, dnum, fname); + } + } + + printf("nttrans scan finished\n"); + return true; +} + + +/* scan for valid base SMB requests */ +bool torture_smb_scan(struct torture_context *torture) +{ + static struct smbcli_state *cli; + int op; + struct smbcli_request *req; + NTSTATUS status; + + for (op=0x0;op<=0xFF;op++) { + if (op == SMBreadbraw) continue; + + if (!torture_open_connection(&cli, torture, 0)) { + return false; + } + + req = smbcli_request_setup(cli->tree, op, 0, 0); + + if (!smbcli_request_send(req)) { + smbcli_request_destroy(req); + break; + } + + usleep(10000); + smbcli_transport_process(cli->transport); + if (req->state > SMBCLI_REQUEST_RECV) { + status = smbcli_request_simple_recv(req); + printf("op=0x%x status=%s\n", op, nt_errstr(status)); + torture_close_connection(cli); + continue; + } + + sleep(1); + smbcli_transport_process(cli->transport); + if (req->state > SMBCLI_REQUEST_RECV) { + status = smbcli_request_simple_recv(req); + printf("op=0x%x status=%s\n", op, nt_errstr(status)); + } else { + printf("op=0x%x no reply\n", op); + smbcli_request_destroy(req); + continue; /* don't attempt close! */ + } + + torture_close_connection(cli); + } + + + printf("smb scan finished\n"); + return true; +} |