2
Unix SMB/CIFS implementation.
3
NBT netbios library routines
4
Copyright (C) Andrew Tridgell 1994-1998
5
Copyright (C) Jeremy Allison 2007
7
This program is free software; you can redistribute it and/or modify
8
it under the terms of the GNU General Public License as published by
9
the Free Software Foundation; either version 3 of the License, or
10
(at your option) any later version.
12
This program is distributed in the hope that it will be useful,
13
but WITHOUT ANY WARRANTY; without even the implied warranty of
14
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
GNU General Public License for more details.
17
You should have received a copy of the GNU General Public License
18
along with this program. If not, see <http://www.gnu.org/licenses/>.
24
static const struct opcode_names {
25
const char *nmb_opcode_name;
27
} nmb_header_opcode_names[] = {
33
{"Refresh(altcode)", 9 },
34
{"Multi-homed Registration", 15 },
38
/****************************************************************************
39
Lookup a nmb opcode name.
40
****************************************************************************/
42
static const char *lookup_opcode_name( int opcode )
44
const struct opcode_names *op_namep;
47
for(i = 0; nmb_header_opcode_names[i].nmb_opcode_name != 0; i++) {
48
op_namep = &nmb_header_opcode_names[i];
49
if(opcode == op_namep->opcode)
50
return op_namep->nmb_opcode_name;
52
return "<unknown opcode>";
55
/****************************************************************************
56
Print out a res_rec structure.
57
****************************************************************************/
59
static void debug_nmb_res_rec(struct res_rec *res, const char *hdr)
63
DEBUGADD( 4, ( " %s: nmb_name=%s rr_type=%d rr_class=%d ttl=%d\n",
65
nmb_namestr(&res->rr_name),
70
if( res->rdlength == 0 || res->rdata == NULL )
73
for (i = 0; i < res->rdlength; i+= MAX_NETBIOSNAME_LEN) {
74
DEBUGADD(4, (" %s %3x char ", hdr, i));
76
for (j = 0; j < MAX_NETBIOSNAME_LEN; j++) {
77
unsigned char x = res->rdata[i+j];
78
if (x < 32 || x > 127)
81
if (i+j >= res->rdlength)
83
DEBUGADD(4, ("%c", x));
86
DEBUGADD(4, (" hex "));
88
for (j = 0; j < MAX_NETBIOSNAME_LEN; j++) {
89
if (i+j >= res->rdlength)
91
DEBUGADD(4, ("%02X", (unsigned char)res->rdata[i+j]));
98
/****************************************************************************
100
****************************************************************************/
102
void debug_nmb_packet(struct packet_struct *p)
104
struct nmb_packet *nmb = &p->packet.nmb;
106
if( DEBUGLVL( 4 ) ) {
107
dbgtext( "nmb packet from %s(%d) header: id=%d "
108
"opcode=%s(%d) response=%s\n",
109
inet_ntoa(p->ip), p->port,
110
nmb->header.name_trn_id,
111
lookup_opcode_name(nmb->header.opcode),
113
BOOLSTR(nmb->header.response) );
114
dbgtext( " header: flags: bcast=%s rec_avail=%s "
115
"rec_des=%s trunc=%s auth=%s\n",
116
BOOLSTR(nmb->header.nm_flags.bcast),
117
BOOLSTR(nmb->header.nm_flags.recursion_available),
118
BOOLSTR(nmb->header.nm_flags.recursion_desired),
119
BOOLSTR(nmb->header.nm_flags.trunc),
120
BOOLSTR(nmb->header.nm_flags.authoritative) );
121
dbgtext( " header: rcode=%d qdcount=%d ancount=%d "
122
"nscount=%d arcount=%d\n",
127
nmb->header.arcount );
130
if (nmb->header.qdcount) {
131
DEBUGADD( 4, ( " question: q_name=%s q_type=%d q_class=%d\n",
132
nmb_namestr(&nmb->question.question_name),
133
nmb->question.question_type,
134
nmb->question.question_class) );
137
if (nmb->answers && nmb->header.ancount) {
138
debug_nmb_res_rec(nmb->answers,"answers");
140
if (nmb->nsrecs && nmb->header.nscount) {
141
debug_nmb_res_rec(nmb->nsrecs,"nsrecs");
143
if (nmb->additional && nmb->header.arcount) {
144
debug_nmb_res_rec(nmb->additional,"additional");
148
/*******************************************************************
149
Handle "compressed" name pointers.
150
******************************************************************/
152
static bool handle_name_ptrs(unsigned char *ubuf,int *offset,int length,
153
bool *got_pointer,int *ret)
157
while ((ubuf[*offset] & 0xC0) == 0xC0) {
161
(*offset) = ((ubuf[*offset] & ~0xC0)<<8) | ubuf[(*offset)+1];
162
if (loop_count++ == 10 ||
163
(*offset) < 0 || (*offset)>(length-2)) {
170
/*******************************************************************
171
Parse a nmb name from "compressed" format to something readable
172
return the space taken by the name, or 0 if the name is invalid
173
******************************************************************/
175
static int parse_nmb_name(char *inbuf,int ofs,int length, struct nmb_name *name)
178
unsigned char *ubuf = (unsigned char *)inbuf;
180
bool got_pointer=False;
184
if (length - offset < 2)
187
/* handle initial name pointers */
188
if (!handle_name_ptrs(ubuf,&offset,length,&got_pointer,&ret))
195
if ((m & 0xC0) || offset+m+2 > length)
198
memset((char *)name,'\0',sizeof(*name));
200
/* the "compressed" part */
206
c1 = ubuf[offset++]-'A';
207
c2 = ubuf[offset++]-'A';
208
if ((c1 & 0xF0) || (c2 & 0xF0) || (n > sizeof(name->name)-1))
210
name->name[n++] = (c1<<4) | c2;
215
if (n==MAX_NETBIOSNAME_LEN) {
216
/* parse out the name type, its always
217
* in the 16th byte of the name */
218
name->name_type = ((unsigned char)name->name[15]) & 0xff;
220
/* remove trailing spaces */
223
while (n && name->name[n]==' ')
227
/* now the domain parts (if any) */
229
while (ubuf[offset]) {
230
/* we can have pointers within the domain part as well */
231
if (!handle_name_ptrs(ubuf,&offset,length,&got_pointer,&ret))
236
* Don't allow null domain parts.
243
name->scope[n++] = '.';
244
if (m+2+offset>length || n+m+1>sizeof(name->scope))
248
name->scope[n++] = (char)ubuf[offset++];
251
* Watch for malicious loops.
253
if (loop_count++ == 10)
256
name->scope[n++] = 0;
261
/****************************************************************************
262
Put a netbios name, padding(s) and a name type into a 16 character buffer.
263
name is already in DOS charset.
264
[15 bytes name + padding][1 byte name type].
265
****************************************************************************/
267
void put_name(char *dest, const char *name, int pad, unsigned int name_type)
269
size_t len = strlen(name);
271
memcpy(dest, name, (len < MAX_NETBIOSNAME_LEN) ?
272
len : MAX_NETBIOSNAME_LEN - 1);
273
if (len < MAX_NETBIOSNAME_LEN - 1) {
274
memset(dest + len, pad, MAX_NETBIOSNAME_LEN - 1 - len);
276
dest[MAX_NETBIOSNAME_LEN - 1] = name_type;
279
/*******************************************************************
280
Put a compressed nmb name into a buffer. Return the length of the
283
Compressed names are really weird. The "compression" doubles the
284
size. The idea is that it also means that compressed names conform
285
to the doman name system. See RFC1002.
287
If buf == NULL this is a length calculation.
288
******************************************************************/
290
static int put_nmb_name(char *buf,int offset,struct nmb_name *name)
296
if (strcmp(name->name,"*") == 0) {
297
/* special case for wildcard name */
298
put_name(buf1, "*", '\0', name->name_type);
300
put_name(buf1, name->name, ' ', name->name_type);
309
for (m=0;m<MAX_NETBIOSNAME_LEN;m++) {
311
buf[offset+1+2*m] = 'A' + ((buf1[m]>>4)&0xF);
312
buf[offset+2+2*m] = 'A' + (buf1[m]&0xF);
321
if (name->scope[0]) {
322
/* XXXX this scope handling needs testing */
323
ret += strlen(name->scope) + 1;
325
safe_strcpy(&buf[offset+1],name->scope,
326
sizeof(name->scope));
329
while ((p = strchr_m(p,'.'))) {
330
buf[offset] = PTR_DIFF(p,&buf[offset+1]);
331
offset += (buf[offset] + 1);
334
buf[offset] = strlen(&buf[offset+1]);
341
/*******************************************************************
342
Useful for debugging messages.
343
******************************************************************/
345
char *nmb_namestr(const struct nmb_name *n)
350
pull_ascii_fstring(name, n->name);
352
result = talloc_asprintf(talloc_tos(), "%s<%02x>", name,
355
result = talloc_asprintf(talloc_tos(), "%s<%02x>.%s", name,
356
n->name_type, n->scope);
358
SMB_ASSERT(result != NULL);
362
/*******************************************************************
363
Allocate and parse some resource records.
364
******************************************************************/
366
static bool parse_alloc_res_rec(char *inbuf,int *offset,int length,
367
struct res_rec **recs, int count)
371
*recs = SMB_MALLOC_ARRAY(struct res_rec, count);
375
memset((char *)*recs,'\0',sizeof(**recs)*count);
377
for (i=0;i<count;i++) {
378
int l = parse_nmb_name(inbuf,*offset,length,
379
&(*recs)[i].rr_name);
381
if (!l || (*offset)+10 > length) {
385
(*recs)[i].rr_type = RSVAL(inbuf,(*offset));
386
(*recs)[i].rr_class = RSVAL(inbuf,(*offset)+2);
387
(*recs)[i].ttl = RIVAL(inbuf,(*offset)+4);
388
(*recs)[i].rdlength = RSVAL(inbuf,(*offset)+8);
390
if ((*recs)[i].rdlength>sizeof((*recs)[i].rdata) ||
391
(*offset)+(*recs)[i].rdlength > length) {
395
memcpy((*recs)[i].rdata,inbuf+(*offset),(*recs)[i].rdlength);
396
(*offset) += (*recs)[i].rdlength;
401
/*******************************************************************
402
Put a resource record into a packet.
403
If buf == NULL this is a length calculation.
404
******************************************************************/
406
static int put_res_rec(char *buf,int offset,struct res_rec *recs,int count)
411
for (i=0;i<count;i++) {
412
int l = put_nmb_name(buf,offset,&recs[i].rr_name);
416
RSSVAL(buf,offset,recs[i].rr_type);
417
RSSVAL(buf,offset+2,recs[i].rr_class);
418
RSIVAL(buf,offset+4,recs[i].ttl);
419
RSSVAL(buf,offset+8,recs[i].rdlength);
420
memcpy(buf+offset+10,recs[i].rdata,recs[i].rdlength);
422
offset += 10+recs[i].rdlength;
423
ret += 10+recs[i].rdlength;
429
/*******************************************************************
430
Put a compressed name pointer record into a packet.
431
If buf == NULL this is a length calculation.
432
******************************************************************/
434
static int put_compressed_name_ptr(unsigned char *buf,
441
buf[offset] = (0xC0 | ((ptr_offset >> 8) & 0xFF));
442
buf[offset+1] = (ptr_offset & 0xFF);
447
RSSVAL(buf,offset,rec->rr_type);
448
RSSVAL(buf,offset+2,rec->rr_class);
449
RSIVAL(buf,offset+4,rec->ttl);
450
RSSVAL(buf,offset+8,rec->rdlength);
451
memcpy(buf+offset+10,rec->rdata,rec->rdlength);
453
offset += 10+rec->rdlength;
454
ret += 10+rec->rdlength;
459
/*******************************************************************
460
Parse a dgram packet. Return False if the packet can't be parsed
461
or is invalid for some reason, True otherwise.
463
This is documented in section 4.4.1 of RFC1002.
464
******************************************************************/
466
static bool parse_dgram(char *inbuf,int length,struct dgram_packet *dgram)
471
memset((char *)dgram,'\0',sizeof(*dgram));
476
dgram->header.msg_type = CVAL(inbuf,0);
477
flags = CVAL(inbuf,1);
478
dgram->header.flags.node_type = (enum node_type)((flags>>2)&3);
480
dgram->header.flags.more = True;
482
dgram->header.flags.first = True;
483
dgram->header.dgm_id = RSVAL(inbuf,2);
484
putip((char *)&dgram->header.source_ip,inbuf+4);
485
dgram->header.source_port = RSVAL(inbuf,8);
486
dgram->header.dgm_length = RSVAL(inbuf,10);
487
dgram->header.packet_offset = RSVAL(inbuf,12);
491
if (dgram->header.msg_type == 0x10 ||
492
dgram->header.msg_type == 0x11 ||
493
dgram->header.msg_type == 0x12) {
494
offset += parse_nmb_name(inbuf,offset,length,
495
&dgram->source_name);
496
offset += parse_nmb_name(inbuf,offset,length,
500
if (offset >= length || (length-offset > sizeof(dgram->data)))
503
dgram->datasize = length-offset;
504
memcpy(dgram->data,inbuf+offset,dgram->datasize);
506
/* Paranioa. Ensure the last 2 bytes in the dgram buffer are
507
zero. This should be true anyway, just enforce it for
508
paranioa sake. JRA. */
509
SMB_ASSERT(dgram->datasize <= (sizeof(dgram->data)-2));
510
memset(&dgram->data[sizeof(dgram->data)-2], '\0', 2);
515
/*******************************************************************
516
Parse a nmb packet. Return False if the packet can't be parsed
517
or is invalid for some reason, True otherwise.
518
******************************************************************/
520
static bool parse_nmb(char *inbuf,int length,struct nmb_packet *nmb)
524
memset((char *)nmb,'\0',sizeof(*nmb));
529
/* parse the header */
530
nmb->header.name_trn_id = RSVAL(inbuf,0);
532
DEBUG(10,("parse_nmb: packet id = %d\n", nmb->header.name_trn_id));
534
nmb->header.opcode = (CVAL(inbuf,2) >> 3) & 0xF;
535
nmb->header.response = ((CVAL(inbuf,2)>>7)&1)?True:False;
536
nm_flags = ((CVAL(inbuf,2) & 0x7) << 4) + (CVAL(inbuf,3)>>4);
537
nmb->header.nm_flags.bcast = (nm_flags&1)?True:False;
538
nmb->header.nm_flags.recursion_available = (nm_flags&8)?True:False;
539
nmb->header.nm_flags.recursion_desired = (nm_flags&0x10)?True:False;
540
nmb->header.nm_flags.trunc = (nm_flags&0x20)?True:False;
541
nmb->header.nm_flags.authoritative = (nm_flags&0x40)?True:False;
542
nmb->header.rcode = CVAL(inbuf,3) & 0xF;
543
nmb->header.qdcount = RSVAL(inbuf,4);
544
nmb->header.ancount = RSVAL(inbuf,6);
545
nmb->header.nscount = RSVAL(inbuf,8);
546
nmb->header.arcount = RSVAL(inbuf,10);
548
if (nmb->header.qdcount) {
549
offset = parse_nmb_name(inbuf,12,length,
550
&nmb->question.question_name);
554
if (length - (12+offset) < 4)
556
nmb->question.question_type = RSVAL(inbuf,12+offset);
557
nmb->question.question_class = RSVAL(inbuf,12+offset+2);
564
/* and any resource records */
565
if (nmb->header.ancount &&
566
!parse_alloc_res_rec(inbuf,&offset,length,&nmb->answers,
567
nmb->header.ancount))
570
if (nmb->header.nscount &&
571
!parse_alloc_res_rec(inbuf,&offset,length,&nmb->nsrecs,
572
nmb->header.nscount))
575
if (nmb->header.arcount &&
576
!parse_alloc_res_rec(inbuf,&offset,length,
577
&nmb->additional, nmb->header.arcount))
583
/*******************************************************************
584
'Copy constructor' for an nmb packet.
585
******************************************************************/
587
static struct packet_struct *copy_nmb_packet(struct packet_struct *packet)
589
struct nmb_packet *nmb;
590
struct nmb_packet *copy_nmb;
591
struct packet_struct *pkt_copy;
593
if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL) {
594
DEBUG(0,("copy_nmb_packet: malloc fail.\n"));
598
/* Structure copy of entire thing. */
602
/* Ensure this copy is not locked. */
603
pkt_copy->locked = False;
604
pkt_copy->recv_fd = -1;
605
pkt_copy->send_fd = -1;
607
/* Ensure this copy has no resource records. */
608
nmb = &packet->packet.nmb;
609
copy_nmb = &pkt_copy->packet.nmb;
611
copy_nmb->answers = NULL;
612
copy_nmb->nsrecs = NULL;
613
copy_nmb->additional = NULL;
615
/* Now copy any resource records. */
618
if((copy_nmb->answers = SMB_MALLOC_ARRAY(
619
struct res_rec,nmb->header.ancount)) == NULL)
621
memcpy((char *)copy_nmb->answers, (char *)nmb->answers,
622
nmb->header.ancount * sizeof(struct res_rec));
625
if((copy_nmb->nsrecs = SMB_MALLOC_ARRAY(
626
struct res_rec, nmb->header.nscount)) == NULL)
628
memcpy((char *)copy_nmb->nsrecs, (char *)nmb->nsrecs,
629
nmb->header.nscount * sizeof(struct res_rec));
631
if (nmb->additional) {
632
if((copy_nmb->additional = SMB_MALLOC_ARRAY(
633
struct res_rec, nmb->header.arcount)) == NULL)
635
memcpy((char *)copy_nmb->additional, (char *)nmb->additional,
636
nmb->header.arcount * sizeof(struct res_rec));
643
SAFE_FREE(copy_nmb->answers);
644
SAFE_FREE(copy_nmb->nsrecs);
645
SAFE_FREE(copy_nmb->additional);
648
DEBUG(0,("copy_nmb_packet: malloc fail in resource records.\n"));
652
/*******************************************************************
653
'Copy constructor' for a dgram packet.
654
******************************************************************/
656
static struct packet_struct *copy_dgram_packet(struct packet_struct *packet)
658
struct packet_struct *pkt_copy;
660
if(( pkt_copy = SMB_MALLOC_P(struct packet_struct)) == NULL) {
661
DEBUG(0,("copy_dgram_packet: malloc fail.\n"));
665
/* Structure copy of entire thing. */
669
/* Ensure this copy is not locked. */
670
pkt_copy->locked = False;
671
pkt_copy->recv_fd = -1;
672
pkt_copy->send_fd = -1;
674
/* There are no additional pointers in a dgram packet,
679
/*******************************************************************
680
'Copy constructor' for a generic packet.
681
******************************************************************/
683
struct packet_struct *copy_packet(struct packet_struct *packet)
685
if(packet->packet_type == NMB_PACKET)
686
return copy_nmb_packet(packet);
687
else if (packet->packet_type == DGRAM_PACKET)
688
return copy_dgram_packet(packet);
692
/*******************************************************************
693
Free up any resources associated with an nmb packet.
694
******************************************************************/
696
static void free_nmb_packet(struct nmb_packet *nmb)
698
SAFE_FREE(nmb->answers);
699
SAFE_FREE(nmb->nsrecs);
700
SAFE_FREE(nmb->additional);
703
/*******************************************************************
704
Free up any resources associated with a dgram packet.
705
******************************************************************/
707
static void free_dgram_packet(struct dgram_packet *nmb)
709
/* We have nothing to do for a dgram packet. */
712
/*******************************************************************
713
Free up any resources associated with a packet.
714
******************************************************************/
716
void free_packet(struct packet_struct *packet)
720
if (packet->packet_type == NMB_PACKET)
721
free_nmb_packet(&packet->packet.nmb);
722
else if (packet->packet_type == DGRAM_PACKET)
723
free_dgram_packet(&packet->packet.dgram);
724
ZERO_STRUCTPN(packet);
728
/*******************************************************************
729
Parse a packet buffer into a packet structure.
730
******************************************************************/
732
struct packet_struct *parse_packet(char *buf,int length,
733
enum packet_type packet_type,
737
struct packet_struct *p;
740
p = SMB_MALLOC_P(struct packet_struct);
744
ZERO_STRUCTP(p); /* initialize for possible padding */
751
p->timestamp = time(NULL);
752
p->packet_type = packet_type;
754
switch (packet_type) {
756
ok = parse_nmb(buf,length,&p->packet.nmb);
760
ok = parse_dgram(buf,length,&p->packet.dgram);
772
/*******************************************************************
773
Read a packet from a socket and parse it, returning a packet ready
774
to be used or put on the queue. This assumes a UDP socket.
775
******************************************************************/
777
struct packet_struct *read_packet(int fd,enum packet_type packet_type)
779
struct packet_struct *packet;
780
struct sockaddr_storage sa;
781
struct sockaddr_in *si = (struct sockaddr_in *)&sa;
782
char buf[MAX_DGRAM_SIZE];
785
length = read_udp_v4_socket(fd,buf,sizeof(buf),&sa);
786
if (length < MIN_DGRAM_SIZE || sa.ss_family != AF_INET) {
790
packet = parse_packet(buf,
794
ntohs(si->sin_port));
798
packet->recv_fd = fd;
799
packet->send_fd = -1;
801
DEBUG(5,("Received a packet of len %d from (%s) port %d\n",
802
length, inet_ntoa(packet->ip), packet->port ) );
807
/*******************************************************************
808
Send a udp packet on a already open socket.
809
******************************************************************/
811
static bool send_udp(int fd,char *buf,int len,struct in_addr ip,int port)
815
struct sockaddr_in sock_out;
817
/* set the address and port */
818
memset((char *)&sock_out,'\0',sizeof(sock_out));
819
putip((char *)&sock_out.sin_addr,(char *)&ip);
820
sock_out.sin_port = htons( port );
821
sock_out.sin_family = AF_INET;
823
DEBUG( 5, ( "Sending a packet of len %d to (%s) on port %d\n",
824
len, inet_ntoa(ip), port ) );
827
* Patch to fix asynch error notifications from Linux kernel.
830
for (i = 0; i < 5; i++) {
831
ret = (sendto(fd,buf,len,0,(struct sockaddr *)&sock_out,
832
sizeof(sock_out)) >= 0);
833
if (ret || errno != ECONNREFUSED)
838
DEBUG(0,("Packet send failed to %s(%d) ERRNO=%s\n",
839
inet_ntoa(ip),port,strerror(errno)));
844
/*******************************************************************
845
Build a dgram packet ready for sending.
846
If buf == NULL this is a length calculation.
847
******************************************************************/
849
static int build_dgram(char *buf, size_t len, struct dgram_packet *dgram)
851
unsigned char *ubuf = (unsigned char *)buf;
854
/* put in the header */
856
ubuf[0] = dgram->header.msg_type;
857
ubuf[1] = (((int)dgram->header.flags.node_type)<<2);
858
if (dgram->header.flags.more)
860
if (dgram->header.flags.first)
862
RSSVAL(ubuf,2,dgram->header.dgm_id);
863
putip(ubuf+4,(char *)&dgram->header.source_ip);
864
RSSVAL(ubuf,8,dgram->header.source_port);
865
RSSVAL(ubuf,12,dgram->header.packet_offset);
870
if (dgram->header.msg_type == 0x10 ||
871
dgram->header.msg_type == 0x11 ||
872
dgram->header.msg_type == 0x12) {
873
offset += put_nmb_name((char *)ubuf,offset,&dgram->source_name);
874
offset += put_nmb_name((char *)ubuf,offset,&dgram->dest_name);
878
memcpy(ubuf+offset,dgram->data,dgram->datasize);
880
offset += dgram->datasize;
882
/* automatically set the dgm_length
883
* NOTE: RFC1002 says the dgm_length does *not*
884
* include the fourteen-byte header. crh
886
dgram->header.dgm_length = (offset - 14);
888
RSSVAL(ubuf,10,dgram->header.dgm_length);
894
/*******************************************************************
896
*******************************************************************/
898
void make_nmb_name( struct nmb_name *n, const char *name, int type)
901
memset( (char *)n, '\0', sizeof(struct nmb_name) );
902
fstrcpy(unix_name, name);
903
strupper_m(unix_name);
904
push_ascii(n->name, unix_name, sizeof(n->name), STR_TERMINATE);
905
n->name_type = (unsigned int)type & 0xFF;
906
push_ascii(n->scope, global_scope(), 64, STR_TERMINATE);
909
/*******************************************************************
910
Compare two nmb names
911
******************************************************************/
913
bool nmb_name_equal(struct nmb_name *n1, struct nmb_name *n2)
915
return ((n1->name_type == n2->name_type) &&
916
strequal(n1->name ,n2->name ) &&
917
strequal(n1->scope,n2->scope));
920
/*******************************************************************
921
Build a nmb packet ready for sending.
922
If buf == NULL this is a length calculation.
923
******************************************************************/
925
static int build_nmb(char *buf, size_t len, struct nmb_packet *nmb)
927
unsigned char *ubuf = (unsigned char *)buf;
930
if (len && len < 12) {
934
/* put in the header */
936
RSSVAL(ubuf,offset,nmb->header.name_trn_id);
937
ubuf[offset+2] = (nmb->header.opcode & 0xF) << 3;
938
if (nmb->header.response)
939
ubuf[offset+2] |= (1<<7);
940
if (nmb->header.nm_flags.authoritative &&
941
nmb->header.response)
942
ubuf[offset+2] |= 0x4;
943
if (nmb->header.nm_flags.trunc)
944
ubuf[offset+2] |= 0x2;
945
if (nmb->header.nm_flags.recursion_desired)
946
ubuf[offset+2] |= 0x1;
947
if (nmb->header.nm_flags.recursion_available &&
948
nmb->header.response)
949
ubuf[offset+3] |= 0x80;
950
if (nmb->header.nm_flags.bcast)
951
ubuf[offset+3] |= 0x10;
952
ubuf[offset+3] |= (nmb->header.rcode & 0xF);
954
RSSVAL(ubuf,offset+4,nmb->header.qdcount);
955
RSSVAL(ubuf,offset+6,nmb->header.ancount);
956
RSSVAL(ubuf,offset+8,nmb->header.nscount);
957
RSSVAL(ubuf,offset+10,nmb->header.arcount);
961
if (nmb->header.qdcount) {
962
/* XXXX this doesn't handle a qdcount of > 1 */
965
int extra = put_nmb_name(NULL,offset,
966
&nmb->question.question_name);
967
if (offset + extra > len) {
971
offset += put_nmb_name((char *)ubuf,offset,
972
&nmb->question.question_name);
974
RSSVAL(ubuf,offset,nmb->question.question_type);
975
RSSVAL(ubuf,offset+2,nmb->question.question_class);
980
if (nmb->header.ancount) {
983
int extra = put_res_rec(NULL,offset,nmb->answers,
984
nmb->header.ancount);
985
if (offset + extra > len) {
989
offset += put_res_rec((char *)ubuf,offset,nmb->answers,
990
nmb->header.ancount);
993
if (nmb->header.nscount) {
996
int extra = put_res_rec(NULL,offset,nmb->nsrecs,
997
nmb->header.nscount);
998
if (offset + extra > len) {
1002
offset += put_res_rec((char *)ubuf,offset,nmb->nsrecs,
1003
nmb->header.nscount);
1007
* The spec says we must put compressed name pointers
1008
* in the following outgoing packets :
1009
* NAME_REGISTRATION_REQUEST, NAME_REFRESH_REQUEST,
1010
* NAME_RELEASE_REQUEST.
1013
if((nmb->header.response == False) &&
1014
((nmb->header.opcode == NMB_NAME_REG_OPCODE) ||
1015
(nmb->header.opcode == NMB_NAME_RELEASE_OPCODE) ||
1016
(nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_8) ||
1017
(nmb->header.opcode == NMB_NAME_REFRESH_OPCODE_9) ||
1018
(nmb->header.opcode == NMB_NAME_MULTIHOMED_REG_OPCODE)) &&
1019
(nmb->header.arcount == 1)) {
1023
int extra = put_compressed_name_ptr(NULL,offset,
1024
nmb->additional,12);
1025
if (offset + extra > len) {
1029
offset += put_compressed_name_ptr(ubuf,offset,
1030
nmb->additional,12);
1031
} else if (nmb->header.arcount) {
1034
int extra = put_res_rec(NULL,offset,nmb->additional,
1035
nmb->header.arcount);
1036
if (offset + extra > len) {
1040
offset += put_res_rec((char *)ubuf,offset,nmb->additional,
1041
nmb->header.arcount);
1046
/*******************************************************************
1048
******************************************************************/
1050
int build_packet(char *buf, size_t buflen, struct packet_struct *p)
1054
switch (p->packet_type) {
1056
len = build_nmb(buf,buflen,&p->packet.nmb);
1060
len = build_dgram(buf,buflen,&p->packet.dgram);
1067
/*******************************************************************
1068
Send a packet_struct.
1069
******************************************************************/
1071
bool send_packet(struct packet_struct *p)
1076
memset(buf,'\0',sizeof(buf));
1078
len = build_packet(buf, sizeof(buf), p);
1083
return(send_udp(p->send_fd,buf,len,p->ip,p->port));
1086
/****************************************************************************
1087
Receive a packet with timeout on a open UDP filedescriptor.
1088
The timeout is in milliseconds
1089
***************************************************************************/
1091
struct packet_struct *receive_packet(int fd,enum packet_type type,int t)
1094
struct timeval timeout;
1099
timeout.tv_sec = t/1000;
1100
timeout.tv_usec = 1000*(t%1000);
1102
if ((ret = sys_select_intr(fd+1,&fds,NULL,NULL,&timeout)) == -1) {
1103
/* errno should be EBADF or EINVAL. */
1104
DEBUG(0,("select returned -1, errno = %s (%d)\n",
1105
strerror(errno), errno));
1109
if (ret == 0) /* timeout */
1112
if (FD_ISSET(fd,&fds))
1113
return(read_packet(fd,type));
1118
/****************************************************************************
1119
Receive a UDP/137 packet either via UDP or from the unexpected packet
1120
queue. The packet must be a reply packet and have the specified trn_id.
1121
The timeout is in milliseconds.
1122
***************************************************************************/
1124
struct packet_struct *receive_nmb_packet(int fd, int t, int trn_id)
1126
struct packet_struct *p;
1128
p = receive_packet(fd, NMB_PACKET, t);
1130
if (p && p->packet.nmb.header.response &&
1131
p->packet.nmb.header.name_trn_id == trn_id) {
1137
/* try the unexpected packet queue */
1138
return receive_unexpected(NMB_PACKET, trn_id, NULL);
1141
/****************************************************************************
1142
Receive a UDP/138 packet either via UDP or from the unexpected packet
1143
queue. The packet must be a reply packet and have the specified mailslot name
1144
The timeout is in milliseconds.
1145
***************************************************************************/
1147
struct packet_struct *receive_dgram_packet(int fd, int t,
1148
const char *mailslot_name)
1150
struct packet_struct *p;
1152
p = receive_packet(fd, DGRAM_PACKET, t);
1154
if (p && match_mailslot_name(p, mailslot_name)) {
1160
/* try the unexpected packet queue */
1161
return receive_unexpected(DGRAM_PACKET, 0, mailslot_name);
1164
/****************************************************************************
1165
See if a datagram has the right mailslot name.
1166
***************************************************************************/
1168
bool match_mailslot_name(struct packet_struct *p, const char *mailslot_name)
1170
struct dgram_packet *dgram = &p->packet.dgram;
1173
buf = &dgram->data[0];
1178
if (memcmp(buf, mailslot_name, strlen(mailslot_name)+1) == 0) {
1185
/****************************************************************************
1186
Return the number of bits that match between two len character buffers
1187
***************************************************************************/
1189
int matching_len_bits(unsigned char *p1, unsigned char *p2, size_t len)
1193
for (i=0; i<len; i++) {
1202
for (j=0; j<8; j++) {
1203
if ((p1[i] & (1<<(7-j))) != (p2[i] & (1<<(7-j))))
1211
static unsigned char sort_ip[4];
1213
/****************************************************************************
1214
Compare two query reply records.
1215
***************************************************************************/
1217
static int name_query_comp(unsigned char *p1, unsigned char *p2)
1219
return matching_len_bits(p2+2, sort_ip, 4) -
1220
matching_len_bits(p1+2, sort_ip, 4);
1223
/****************************************************************************
1224
Sort a set of 6 byte name query response records so that the IPs that
1225
have the most leading bits in common with the specified address come first.
1226
***************************************************************************/
1228
void sort_query_replies(char *data, int n, struct in_addr ip)
1233
putip(sort_ip, (char *)&ip);
1235
qsort(data, n, 6, QSORT_CAST name_query_comp);
1238
/****************************************************************************
1239
Interpret the weird netbios "name" into a unix fstring. Return the name type.
1240
Returns -1 on error.
1241
****************************************************************************/
1243
static int name_interpret(unsigned char *buf, size_t buf_len,
1244
unsigned char *in, fstring name)
1246
unsigned char *end_ptr = buf + buf_len;
1250
unsigned char *out = (unsigned char *)out_string;
1254
if (in >= end_ptr) {
1264
if (&in[1] >= end_ptr) {
1267
if (in[0] < 'A' || in[0] > 'P' || in[1] < 'A' || in[1] > 'P') {
1271
*out = ((in[0]-'A')<<4) + (in[1]-'A');
1274
if (PTR_DIFF(out,out_string) >= sizeof(fstring)) {
1281
pull_ascii_fstring(name, out_string);
1286
/****************************************************************************
1287
Mangle a name into netbios format.
1288
Note: <Out> must be (33 + strlen(scope) + 2) bytes long, at minimum.
1289
****************************************************************************/
1291
char *name_mangle(TALLOC_CTX *mem_ctx, char *In, char name_type)
1299
result = talloc_array(mem_ctx, char, 33 + strlen(global_scope()) + 2);
1300
if (result == NULL) {
1305
/* Safely copy the input string, In, into buf[]. */
1306
if (strcmp(In,"*") == 0)
1307
put_name(buf, "*", '\0', 0x00);
1309
/* We use an fstring here as mb dos names can expend x3 when
1314
pull_ascii_fstring(buf_unix, In);
1315
strupper_m(buf_unix);
1317
push_ascii_nstring(buf_dos, buf_unix);
1318
put_name(buf, buf_dos, ' ', name_type);
1321
/* Place the length of the first field into the output buffer. */
1325
/* Now convert the name to the rfc1001/1002 format. */
1326
for( i = 0; i < MAX_NETBIOSNAME_LEN; i++ ) {
1327
p[i*2] = ( (buf[i] >> 4) & 0x000F ) + 'A';
1328
p[(i*2)+1] = (buf[i] & 0x000F) + 'A';
1333
/* Add the scope string. */
1334
for( i = 0, len = 0; *(global_scope()) != '\0'; i++, len++ ) {
1335
switch( (global_scope())[i] ) {
1347
p[len+1] = (global_scope())[i];
1355
/****************************************************************************
1356
Find a pointer to a netbios name.
1357
****************************************************************************/
1359
static unsigned char *name_ptr(unsigned char *buf, size_t buf_len, unsigned int ofs)
1361
unsigned char c = 0;
1363
if (ofs > buf_len || buf_len < 1) {
1367
c = *(unsigned char *)(buf+ofs);
1368
if ((c & 0xC0) == 0xC0) {
1371
if (ofs > buf_len - 1) {
1374
l = RSVAL(buf, ofs) & 0x3FFF;
1378
DEBUG(5,("name ptr to pos %d from %d is %s\n",l,ofs,buf+l));
1385
/****************************************************************************
1386
Extract a netbios name from a buf (into a unix string) return name type.
1387
Returns -1 on error.
1388
****************************************************************************/
1390
int name_extract(unsigned char *buf, size_t buf_len, unsigned int ofs, fstring name)
1392
unsigned char *p = name_ptr(buf,buf_len,ofs);
1398
return(name_interpret(buf,buf_len,p,name));
1401
/****************************************************************************
1402
Return the total storage length of a mangled name.
1403
Returns -1 on error.
1404
****************************************************************************/
1406
int name_len(unsigned char *s1, size_t buf_len)
1408
/* NOTE: this argument _must_ be unsigned */
1409
unsigned char *s = (unsigned char *)s1;
1415
/* If the two high bits of the byte are set, return 2. */
1416
if (0xC0 == (*s & 0xC0)) {
1423
/* Add up the length bytes. */
1424
for (len = 1; (*s); s += (*s) + 1) {
1426
if (len > buf_len) {
added
removed
.pc/security-CVE-2011-0719.patch/source3/libsmb/nmblib.c
