1 | /*
|
---|
2 | Unix SMB/CIFS implementation.
|
---|
3 | SMB torture tester
|
---|
4 | Copyright (C) Andrew Tridgell 2003
|
---|
5 | Copyright (C) Jelmer Vernooij 2006
|
---|
6 |
|
---|
7 | This program is free software; you can redistribute it and/or modify
|
---|
8 | it under the terms of the GNU General Public License as published by
|
---|
9 | the Free Software Foundation; either version 3 of the License, or
|
---|
10 | (at your option) any later version.
|
---|
11 |
|
---|
12 | This program is distributed in the hope that it will be useful,
|
---|
13 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
14 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
15 | GNU General Public License for more details.
|
---|
16 |
|
---|
17 | You should have received a copy of the GNU General Public License
|
---|
18 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
19 | */
|
---|
20 |
|
---|
21 | #include "includes.h"
|
---|
22 | #if (_SAMBA_BUILD_ >= 4)
|
---|
23 | #include "lib/cmdline/popt_common.h"
|
---|
24 | #include "system/filesys.h"
|
---|
25 | #include "system/locale.h"
|
---|
26 | #include "librpc/rpc/dcerpc.h"
|
---|
27 | #include "librpc/rpc/dcerpc_table.h"
|
---|
28 | #endif
|
---|
29 |
|
---|
30 | static const struct ndr_interface_call *find_function(
|
---|
31 | const struct ndr_interface_table *p,
|
---|
32 | const char *function)
|
---|
33 | {
|
---|
34 | int i;
|
---|
35 | if (isdigit(function[0])) {
|
---|
36 | i = strtol(function, NULL, 0);
|
---|
37 | return &p->calls[i];
|
---|
38 | }
|
---|
39 | for (i=0;i<p->num_calls;i++) {
|
---|
40 | if (strcmp(p->calls[i].name, function) == 0) {
|
---|
41 | break;
|
---|
42 | }
|
---|
43 | }
|
---|
44 | if (i == p->num_calls) {
|
---|
45 | printf("Function '%s' not found\n", function);
|
---|
46 | exit(1);
|
---|
47 | }
|
---|
48 | return &p->calls[i];
|
---|
49 | }
|
---|
50 |
|
---|
51 | #if (_SAMBA_BUILD_ >= 4)
|
---|
52 |
|
---|
53 | static void show_pipes(void)
|
---|
54 | {
|
---|
55 | const struct ndr_interface_list *l;
|
---|
56 | printf("\nYou must specify a pipe\n");
|
---|
57 | printf("known pipes are:\n");
|
---|
58 | for (l=librpc_dcerpc_pipes();l;l=l->next) {
|
---|
59 | if(l->table->helpstring) {
|
---|
60 | printf("\t%s - %s\n", l->table->name, l->table->helpstring);
|
---|
61 | } else {
|
---|
62 | printf("\t%s\n", l->table->name);
|
---|
63 | }
|
---|
64 | }
|
---|
65 | exit(1);
|
---|
66 | }
|
---|
67 |
|
---|
68 | #endif
|
---|
69 |
|
---|
70 | static void show_functions(const struct ndr_interface_table *p)
|
---|
71 | {
|
---|
72 | int i;
|
---|
73 | printf("\nYou must specify a function\n");
|
---|
74 | printf("known functions on '%s' are:\n", p->name);
|
---|
75 | for (i=0;i<p->num_calls;i++) {
|
---|
76 | printf("\t0x%02x (%2d) %s\n", i, i, p->calls[i].name);
|
---|
77 | }
|
---|
78 | exit(1);
|
---|
79 | }
|
---|
80 |
|
---|
81 | static char *stdin_load(TALLOC_CTX *mem_ctx, size_t *size)
|
---|
82 | {
|
---|
83 | int num_read, total_len = 0;
|
---|
84 | char buf[255];
|
---|
85 | char *result = NULL;
|
---|
86 |
|
---|
87 | while((num_read = read(STDIN_FILENO, buf, 255)) > 0) {
|
---|
88 |
|
---|
89 | if (result) {
|
---|
90 | result = (char *) talloc_realloc(
|
---|
91 | mem_ctx, result, char *, total_len + num_read);
|
---|
92 | } else {
|
---|
93 | result = (char *) talloc_size(mem_ctx, num_read);
|
---|
94 | }
|
---|
95 |
|
---|
96 | memcpy(result + total_len, buf, num_read);
|
---|
97 |
|
---|
98 | total_len += num_read;
|
---|
99 | }
|
---|
100 |
|
---|
101 | if (size)
|
---|
102 | *size = total_len;
|
---|
103 |
|
---|
104 | return result;
|
---|
105 | }
|
---|
106 |
|
---|
107 | static const struct ndr_interface_table *load_iface_from_plugin(const char *plugin, const char *pipe_name)
|
---|
108 | {
|
---|
109 | const struct ndr_interface_table *p;
|
---|
110 | void *handle;
|
---|
111 | char *symbol;
|
---|
112 |
|
---|
113 | handle = dlopen(plugin, RTLD_NOW);
|
---|
114 | if (handle == NULL) {
|
---|
115 | printf("%s: Unable to open: %s\n", plugin, dlerror());
|
---|
116 | return NULL;
|
---|
117 | }
|
---|
118 |
|
---|
119 | symbol = talloc_asprintf(NULL, "ndr_table_%s", pipe_name);
|
---|
120 | p = (const struct ndr_interface_table *)dlsym(handle, symbol);
|
---|
121 |
|
---|
122 | if (!p) {
|
---|
123 | printf("%s: Unable to find DCE/RPC interface table for '%s': %s\n", plugin, pipe_name, dlerror());
|
---|
124 | talloc_free(symbol);
|
---|
125 | return NULL;
|
---|
126 | }
|
---|
127 |
|
---|
128 | talloc_free(symbol);
|
---|
129 |
|
---|
130 | return p;
|
---|
131 | }
|
---|
132 |
|
---|
133 | int main(int argc, const char *argv[])
|
---|
134 | {
|
---|
135 | const struct ndr_interface_table *p = NULL;
|
---|
136 | const struct ndr_interface_call *f;
|
---|
137 | const char *pipe_name, *function, *inout, *filename;
|
---|
138 | uint8_t *data;
|
---|
139 | size_t size;
|
---|
140 | DATA_BLOB blob;
|
---|
141 | struct ndr_pull *ndr_pull;
|
---|
142 | struct ndr_print *ndr_print;
|
---|
143 | TALLOC_CTX *mem_ctx;
|
---|
144 | int flags;
|
---|
145 | poptContext pc;
|
---|
146 | NTSTATUS status;
|
---|
147 | enum ndr_err_code ndr_err;
|
---|
148 | void *st;
|
---|
149 | void *v_st;
|
---|
150 | const char *ctx_filename = NULL;
|
---|
151 | const char *plugin = NULL;
|
---|
152 | bool validate = false;
|
---|
153 | bool dumpdata = false;
|
---|
154 | int opt;
|
---|
155 | enum {OPT_CONTEXT_FILE=1000, OPT_VALIDATE, OPT_DUMP_DATA, OPT_LOAD_DSO};
|
---|
156 | struct poptOption long_options[] = {
|
---|
157 | POPT_AUTOHELP
|
---|
158 | {"context-file", 'c', POPT_ARG_STRING, NULL, OPT_CONTEXT_FILE, "In-filename to parse first", "CTX-FILE" },
|
---|
159 | {"validate", 0, POPT_ARG_NONE, NULL, OPT_VALIDATE, "try to validate the data", NULL },
|
---|
160 | {"dump-data", 0, POPT_ARG_NONE, NULL, OPT_DUMP_DATA, "dump the hex data", NULL },
|
---|
161 | {"load-dso", 'l', POPT_ARG_STRING, NULL, OPT_LOAD_DSO, "load from shared object file", NULL },
|
---|
162 | POPT_COMMON_SAMBA
|
---|
163 | POPT_COMMON_VERSION
|
---|
164 | { NULL }
|
---|
165 | };
|
---|
166 |
|
---|
167 | #if (_SAMBA_BUILD_ >= 4)
|
---|
168 | ndr_table_init();
|
---|
169 | #else
|
---|
170 | /* Initialise samba stuff */
|
---|
171 | load_case_tables();
|
---|
172 |
|
---|
173 | setlinebuf(stdout);
|
---|
174 |
|
---|
175 | dbf = x_stderr;
|
---|
176 |
|
---|
177 | setup_logging(argv[0],True);
|
---|
178 | #endif
|
---|
179 |
|
---|
180 | pc = poptGetContext("ndrdump", argc, argv, long_options, 0);
|
---|
181 |
|
---|
182 | poptSetOtherOptionHelp(
|
---|
183 | pc, "<pipe|uuid> <function> <inout> [<filename>]");
|
---|
184 |
|
---|
185 | while ((opt = poptGetNextOpt(pc)) != -1) {
|
---|
186 | switch (opt) {
|
---|
187 | case OPT_CONTEXT_FILE:
|
---|
188 | ctx_filename = poptGetOptArg(pc);
|
---|
189 | break;
|
---|
190 | case OPT_VALIDATE:
|
---|
191 | validate = true;
|
---|
192 | break;
|
---|
193 | case OPT_DUMP_DATA:
|
---|
194 | dumpdata = true;
|
---|
195 | break;
|
---|
196 | case OPT_LOAD_DSO:
|
---|
197 | plugin = poptGetOptArg(pc);
|
---|
198 | break;
|
---|
199 | }
|
---|
200 | }
|
---|
201 |
|
---|
202 | pipe_name = poptGetArg(pc);
|
---|
203 |
|
---|
204 | if (!pipe_name) {
|
---|
205 | poptPrintUsage(pc, stderr, 0);
|
---|
206 | #if (_SAMBA_BUILD_ >= 4)
|
---|
207 | show_pipes();
|
---|
208 | #endif
|
---|
209 | exit(1);
|
---|
210 | }
|
---|
211 |
|
---|
212 | if (plugin != NULL) {
|
---|
213 | p = load_iface_from_plugin(plugin, pipe_name);
|
---|
214 | }
|
---|
215 | #if (_SAMBA_BUILD_ <= 3)
|
---|
216 | else {
|
---|
217 | fprintf(stderr, "Only loading from DSO's supported in Samba 3\n");
|
---|
218 | exit(1);
|
---|
219 | }
|
---|
220 | #else
|
---|
221 | if (!p) {
|
---|
222 | p = idl_iface_by_name(pipe_name);
|
---|
223 | }
|
---|
224 |
|
---|
225 | if (!p) {
|
---|
226 | struct GUID uuid;
|
---|
227 |
|
---|
228 | status = GUID_from_string(pipe_name, &uuid);
|
---|
229 |
|
---|
230 | if (NT_STATUS_IS_OK(status)) {
|
---|
231 | p = idl_iface_by_uuid(&uuid);
|
---|
232 | }
|
---|
233 | }
|
---|
234 | #endif
|
---|
235 |
|
---|
236 | if (!p) {
|
---|
237 | printf("Unknown pipe or UUID '%s'\n", pipe_name);
|
---|
238 | exit(1);
|
---|
239 | }
|
---|
240 |
|
---|
241 | function = poptGetArg(pc);
|
---|
242 | inout = poptGetArg(pc);
|
---|
243 | filename = poptGetArg(pc);
|
---|
244 |
|
---|
245 | if (!function || !inout) {
|
---|
246 | poptPrintUsage(pc, stderr, 0);
|
---|
247 | show_functions(p);
|
---|
248 | exit(1);
|
---|
249 | }
|
---|
250 |
|
---|
251 | if (strcmp(inout, "in") == 0 ||
|
---|
252 | strcmp(inout, "request") == 0) {
|
---|
253 | flags = NDR_IN;
|
---|
254 | } else if (strcmp(inout, "out") == 0 ||
|
---|
255 | strcmp(inout, "response") == 0) {
|
---|
256 | flags = NDR_OUT;
|
---|
257 | } else {
|
---|
258 | printf("Bad inout value '%s'\n", inout);
|
---|
259 | exit(1);
|
---|
260 | }
|
---|
261 |
|
---|
262 | f = find_function(p, function);
|
---|
263 |
|
---|
264 | mem_ctx = talloc_init("ndrdump");
|
---|
265 |
|
---|
266 | st = talloc_zero_size(mem_ctx, f->struct_size);
|
---|
267 | if (!st) {
|
---|
268 | printf("Unable to allocate %d bytes\n", (int)f->struct_size);
|
---|
269 | exit(1);
|
---|
270 | }
|
---|
271 |
|
---|
272 | v_st = talloc_zero_size(mem_ctx, f->struct_size);
|
---|
273 | if (!v_st) {
|
---|
274 | printf("Unable to allocate %d bytes\n", (int)f->struct_size);
|
---|
275 | exit(1);
|
---|
276 | }
|
---|
277 |
|
---|
278 | if (ctx_filename) {
|
---|
279 | if (flags == NDR_IN) {
|
---|
280 | printf("Context file can only be used for \"out\" packages\n");
|
---|
281 | exit(1);
|
---|
282 | }
|
---|
283 |
|
---|
284 | #if (_SAMBA_BUILD_ >= 4)
|
---|
285 | data = (uint8_t *)file_load(ctx_filename, &size, mem_ctx);
|
---|
286 | #else
|
---|
287 | data = (uint8_t *)file_load(ctx_filename, &size, 0);
|
---|
288 | #endif
|
---|
289 | if (!data) {
|
---|
290 | perror(ctx_filename);
|
---|
291 | exit(1);
|
---|
292 | }
|
---|
293 |
|
---|
294 | blob.data = data;
|
---|
295 | blob.length = size;
|
---|
296 |
|
---|
297 | ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
|
---|
298 | ndr_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
|
---|
299 |
|
---|
300 | ndr_err = f->ndr_pull(ndr_pull, NDR_IN, st);
|
---|
301 |
|
---|
302 | if (ndr_pull->offset != ndr_pull->data_size) {
|
---|
303 | printf("WARNING! %d unread bytes while parsing context file\n", ndr_pull->data_size - ndr_pull->offset);
|
---|
304 | }
|
---|
305 |
|
---|
306 | if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
---|
307 | status = ndr_map_error2ntstatus(ndr_err);
|
---|
308 | printf("pull for context file returned %s\n", nt_errstr(status));
|
---|
309 | exit(1);
|
---|
310 | }
|
---|
311 | memcpy(v_st, st, f->struct_size);
|
---|
312 | }
|
---|
313 |
|
---|
314 | if (filename)
|
---|
315 | #if (_SAMBA_BUILD_ >= 4)
|
---|
316 | data = (uint8_t *)file_load(filename, &size, mem_ctx);
|
---|
317 | #else
|
---|
318 | data = (uint8_t *)file_load(filename, &size, 0);
|
---|
319 | #endif
|
---|
320 | else
|
---|
321 | data = (uint8_t *)stdin_load(mem_ctx, &size);
|
---|
322 |
|
---|
323 | if (!data) {
|
---|
324 | if (filename)
|
---|
325 | perror(filename);
|
---|
326 | else
|
---|
327 | perror("stdin");
|
---|
328 | exit(1);
|
---|
329 | }
|
---|
330 |
|
---|
331 | blob.data = data;
|
---|
332 | blob.length = size;
|
---|
333 |
|
---|
334 | ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
|
---|
335 | ndr_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
|
---|
336 |
|
---|
337 | ndr_err = f->ndr_pull(ndr_pull, flags, st);
|
---|
338 | status = ndr_map_error2ntstatus(ndr_err);
|
---|
339 |
|
---|
340 | printf("pull returned %s\n", nt_errstr(status));
|
---|
341 |
|
---|
342 | if (ndr_pull->offset != ndr_pull->data_size) {
|
---|
343 | printf("WARNING! %d unread bytes\n", ndr_pull->data_size - ndr_pull->offset);
|
---|
344 | dump_data(0, ndr_pull->data+ndr_pull->offset, ndr_pull->data_size - ndr_pull->offset);
|
---|
345 | }
|
---|
346 |
|
---|
347 | if (dumpdata) {
|
---|
348 | printf("%d bytes consumed\n", ndr_pull->offset);
|
---|
349 | dump_data(0, blob.data, blob.length);
|
---|
350 | }
|
---|
351 |
|
---|
352 | ndr_print = talloc_zero(mem_ctx, struct ndr_print);
|
---|
353 | ndr_print->print = ndr_print_debug_helper;
|
---|
354 | ndr_print->depth = 1;
|
---|
355 | f->ndr_print(ndr_print, function, flags, st);
|
---|
356 |
|
---|
357 | if (!NT_STATUS_IS_OK(status)) {
|
---|
358 | printf("dump FAILED\n");
|
---|
359 | exit(1);
|
---|
360 | }
|
---|
361 |
|
---|
362 | if (validate) {
|
---|
363 | DATA_BLOB v_blob;
|
---|
364 | struct ndr_push *ndr_v_push;
|
---|
365 | struct ndr_pull *ndr_v_pull;
|
---|
366 | struct ndr_print *ndr_v_print;
|
---|
367 | uint32_t i;
|
---|
368 | uint8_t byte_a, byte_b;
|
---|
369 | bool differ;
|
---|
370 |
|
---|
371 | ndr_v_push = ndr_push_init_ctx(mem_ctx);
|
---|
372 |
|
---|
373 | ndr_err = f->ndr_push(ndr_v_push, flags, st);
|
---|
374 | status = ndr_map_error2ntstatus(ndr_err);
|
---|
375 | printf("push returned %s\n", nt_errstr(status));
|
---|
376 | if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
---|
377 | printf("validate push FAILED\n");
|
---|
378 | exit(1);
|
---|
379 | }
|
---|
380 |
|
---|
381 | v_blob = ndr_push_blob(ndr_v_push);
|
---|
382 |
|
---|
383 | if (dumpdata) {
|
---|
384 | printf("%ld bytes generated (validate)\n", (long)v_blob.length);
|
---|
385 | dump_data(0, v_blob.data, v_blob.length);
|
---|
386 | }
|
---|
387 |
|
---|
388 | ndr_v_pull = ndr_pull_init_blob(&v_blob, mem_ctx);
|
---|
389 | ndr_v_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
|
---|
390 |
|
---|
391 | ndr_err = f->ndr_pull(ndr_v_pull, flags, v_st);
|
---|
392 | status = ndr_map_error2ntstatus(ndr_err);
|
---|
393 | printf("pull returned %s\n", nt_errstr(status));
|
---|
394 | if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
---|
395 | printf("validate pull FAILED\n");
|
---|
396 | exit(1);
|
---|
397 | }
|
---|
398 |
|
---|
399 |
|
---|
400 | if (ndr_v_pull->offset != ndr_v_pull->data_size) {
|
---|
401 | printf("WARNING! %d unread bytes in validation\n", ndr_v_pull->data_size - ndr_v_pull->offset);
|
---|
402 | dump_data(0, ndr_v_pull->data+ndr_v_pull->offset, ndr_v_pull->data_size - ndr_v_pull->offset);
|
---|
403 | }
|
---|
404 |
|
---|
405 | ndr_v_print = talloc_zero(mem_ctx, struct ndr_print);
|
---|
406 | ndr_v_print->print = ndr_print_debug_helper;
|
---|
407 | ndr_v_print->depth = 1;
|
---|
408 | f->ndr_print(ndr_v_print, function, flags, v_st);
|
---|
409 |
|
---|
410 | if (blob.length != v_blob.length) {
|
---|
411 | printf("WARNING! orig bytes:%u validated pushed "
|
---|
412 | "bytes:%u\n", (unsigned int)blob.length,
|
---|
413 | (unsigned int)v_blob.length);
|
---|
414 | }
|
---|
415 |
|
---|
416 | if (ndr_pull->offset != ndr_v_pull->offset) {
|
---|
417 | printf("WARNING! orig pulled bytes:%u validated pulled bytes:%u\n", ndr_pull->offset, ndr_v_pull->offset);
|
---|
418 | }
|
---|
419 |
|
---|
420 | differ = false;
|
---|
421 | byte_a = 0x00;
|
---|
422 | byte_b = 0x00;
|
---|
423 | for (i=0; i < blob.length; i++) {
|
---|
424 | byte_a = blob.data[i];
|
---|
425 |
|
---|
426 | if (i == v_blob.length) {
|
---|
427 | byte_b = 0x00;
|
---|
428 | differ = true;
|
---|
429 | break;
|
---|
430 | }
|
---|
431 |
|
---|
432 | byte_b = v_blob.data[i];
|
---|
433 |
|
---|
434 | if (byte_a != byte_b) {
|
---|
435 | differ = true;
|
---|
436 | break;
|
---|
437 | }
|
---|
438 | }
|
---|
439 | if (differ) {
|
---|
440 | printf("WARNING! orig and validated differ at byte 0x%02X (%u)\n", i, i);
|
---|
441 | printf("WARNING! orig byte[0x%02X] = 0x%02X validated byte[0x%02X] = 0x%02X\n",
|
---|
442 | i, byte_a, i, byte_b);
|
---|
443 | }
|
---|
444 | }
|
---|
445 |
|
---|
446 | printf("dump OK\n");
|
---|
447 |
|
---|
448 | talloc_free(mem_ctx);
|
---|
449 |
|
---|
450 | poptFreeContext(pc);
|
---|
451 |
|
---|
452 | return 0;
|
---|
453 | }
|
---|