source: trunk/server/libcli/nbt/nbtname.c@ 1040

Last change on this file since 1040 was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 17.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 manipulate nbt name structures
5
6 Copyright (C) Andrew Tridgell 2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22/*
23 see rfc1002 for the detailed format of compressed names
24*/
25
26#include "includes.h"
27#include "librpc/gen_ndr/ndr_nbt.h"
28#include "librpc/gen_ndr/ndr_misc.h"
29#include "system/locale.h"
30#include "lib/util/util_net.h"
31
32/* don't allow an unlimited number of name components */
33#define MAX_COMPONENTS 10
34
35/**
36 print a nbt string
37*/
38_PUBLIC_ void ndr_print_nbt_string(struct ndr_print *ndr, const char *name, const char *s)
39{
40 ndr_print_string(ndr, name, s);
41}
42
43/*
44 pull one component of a nbt_string
45*/
46static enum ndr_err_code ndr_pull_component(struct ndr_pull *ndr,
47 uint8_t **component,
48 uint32_t *offset,
49 uint32_t *max_offset)
50{
51 uint8_t len;
52 unsigned int loops = 0;
53 while (loops < 5) {
54 if (*offset >= ndr->data_size) {
55 return ndr_pull_error(ndr, NDR_ERR_STRING,
56 "BAD NBT NAME component");
57 }
58 len = ndr->data[*offset];
59 if (len == 0) {
60 *offset += 1;
61 *max_offset = MAX(*max_offset, *offset);
62 *component = NULL;
63 return NDR_ERR_SUCCESS;
64 }
65 if ((len & 0xC0) == 0xC0) {
66 /* its a label pointer */
67 if (1 + *offset >= ndr->data_size) {
68 return ndr_pull_error(ndr, NDR_ERR_STRING,
69 "BAD NBT NAME component");
70 }
71 *max_offset = MAX(*max_offset, *offset + 2);
72 *offset = ((len&0x3F)<<8) | ndr->data[1 + *offset];
73 *max_offset = MAX(*max_offset, *offset);
74 loops++;
75 continue;
76 }
77 if ((len & 0xC0) != 0) {
78 /* its a reserved length field */
79 return ndr_pull_error(ndr, NDR_ERR_STRING,
80 "BAD NBT NAME component");
81 }
82 if (*offset + len + 2 > ndr->data_size) {
83 return ndr_pull_error(ndr, NDR_ERR_STRING,
84 "BAD NBT NAME component");
85 }
86 *component = (uint8_t*)talloc_strndup(
87 ndr->current_mem_ctx,
88 (const char *)&ndr->data[1 + *offset], len);
89 NDR_ERR_HAVE_NO_MEMORY(*component);
90 *offset += len + 1;
91 *max_offset = MAX(*max_offset, *offset);
92 return NDR_ERR_SUCCESS;
93 }
94
95 /* too many pointers */
96 return ndr_pull_error(ndr, NDR_ERR_STRING, "BAD NBT NAME component");
97}
98
99/**
100 pull a nbt_string from the wire
101*/
102_PUBLIC_ enum ndr_err_code ndr_pull_nbt_string(struct ndr_pull *ndr, int ndr_flags, const char **s)
103{
104 uint32_t offset = ndr->offset;
105 uint32_t max_offset = offset;
106 unsigned num_components;
107 char *name;
108
109 if (!(ndr_flags & NDR_SCALARS)) {
110 return NDR_ERR_SUCCESS;
111 }
112
113 name = NULL;
114
115 /* break up name into a list of components */
116 for (num_components=0;num_components<MAX_COMPONENTS;num_components++) {
117 uint8_t *component = NULL;
118 NDR_CHECK(ndr_pull_component(ndr, &component, &offset, &max_offset));
119 if (component == NULL) break;
120 if (name) {
121 name = talloc_asprintf_append_buffer(name, ".%s", component);
122 NDR_ERR_HAVE_NO_MEMORY(name);
123 } else {
124 name = (char *)component;
125 }
126 }
127 if (num_components == MAX_COMPONENTS) {
128 return ndr_pull_error(ndr, NDR_ERR_STRING,
129 "BAD NBT NAME too many components");
130 }
131 if (num_components == 0) {
132 name = talloc_strdup(ndr->current_mem_ctx, "");
133 NDR_ERR_HAVE_NO_MEMORY(name);
134 }
135
136 (*s) = name;
137 ndr->offset = max_offset;
138
139 return NDR_ERR_SUCCESS;
140}
141
142/**
143 push a nbt string to the wire
144*/
145_PUBLIC_ enum ndr_err_code ndr_push_nbt_string(struct ndr_push *ndr, int ndr_flags, const char *s)
146{
147 if (!(ndr_flags & NDR_SCALARS)) {
148 return NDR_ERR_SUCCESS;
149 }
150
151 while (s && *s) {
152 enum ndr_err_code ndr_err;
153 char *compname;
154 size_t complen;
155 uint32_t offset;
156
157 /* see if we have pushed the remaing string allready,
158 * if so we use a label pointer to this string
159 */
160 ndr_err = ndr_token_retrieve_cmp_fn(&ndr->nbt_string_list, s, &offset, (comparison_fn_t)strcmp, false);
161 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
162 uint8_t b[2];
163
164 if (offset > 0x3FFF) {
165 return ndr_push_error(ndr, NDR_ERR_STRING,
166 "offset for nbt string label pointer %u[%08X] > 0x00003FFF",
167 offset, offset);
168 }
169
170 b[0] = 0xC0 | (offset>>8);
171 b[1] = (offset & 0xFF);
172
173 return ndr_push_bytes(ndr, b, 2);
174 }
175
176 complen = strcspn(s, ".");
177
178 /* we need to make sure the length fits into 6 bytes */
179 if (complen > 0x3F) {
180 return ndr_push_error(ndr, NDR_ERR_STRING,
181 "component length %u[%08X] > 0x0000003F",
182 (unsigned)complen, (unsigned)complen);
183 }
184
185 compname = talloc_asprintf(ndr, "%c%*.*s",
186 (unsigned char)complen,
187 (unsigned char)complen,
188 (unsigned char)complen, s);
189 NDR_ERR_HAVE_NO_MEMORY(compname);
190
191 /* remember the current componemt + the rest of the string
192 * so it can be reused later
193 */
194 NDR_CHECK(ndr_token_store(ndr, &ndr->nbt_string_list, s, ndr->offset));
195
196 /* push just this component into the blob */
197 NDR_CHECK(ndr_push_bytes(ndr, (const uint8_t *)compname, complen+1));
198 talloc_free(compname);
199
200 s += complen;
201 if (*s == '.') s++;
202 }
203
204 /* if we reach the end of the string and have pushed the last component
205 * without using a label pointer, we need to terminate the string
206 */
207 return ndr_push_bytes(ndr, (const uint8_t *)"", 1);
208}
209
210
211/*
212 decompress a 'compressed' name component
213 */
214static bool decompress_name(char *name, enum nbt_name_type *type)
215{
216 int i;
217 for (i=0;name[2*i];i++) {
218 uint8_t c1 = name[2*i];
219 uint8_t c2 = name[1+(2*i)];
220 if (c1 < 'A' || c1 > 'P' ||
221 c2 < 'A' || c2 > 'P') {
222 return false;
223 }
224 name[i] = ((c1-'A')<<4) | (c2-'A');
225 }
226 name[i] = 0;
227 if (i == 16) {
228 *type = (enum nbt_name_type)(name[15]);
229 name[15] = 0;
230 i--;
231 } else {
232 *type = NBT_NAME_CLIENT;
233 }
234
235 /* trim trailing spaces */
236 for (;i>0 && name[i-1]==' ';i--) {
237 name[i-1] = 0;
238 }
239
240 return true;
241}
242
243
244/*
245 compress a name component
246 */
247static uint8_t *compress_name(TALLOC_CTX *mem_ctx,
248 const uint8_t *name, enum nbt_name_type type)
249{
250 uint8_t *cname;
251 int i;
252 uint8_t pad_char;
253
254 if (strlen((const char *)name) > 15) {
255 return NULL;
256 }
257
258 cname = talloc_array(mem_ctx, uint8_t, 33);
259 if (cname == NULL) return NULL;
260
261 for (i=0;name[i];i++) {
262 cname[2*i] = 'A' + (name[i]>>4);
263 cname[1+2*i] = 'A' + (name[i]&0xF);
264 }
265 if (strcmp((const char *)name, "*") == 0) {
266 pad_char = 0;
267 } else {
268 pad_char = ' ';
269 }
270 for (;i<15;i++) {
271 cname[2*i] = 'A' + (pad_char>>4);
272 cname[1+2*i] = 'A' + (pad_char&0xF);
273 }
274
275 pad_char = type;
276 cname[2*i] = 'A' + (pad_char>>4);
277 cname[1+2*i] = 'A' + (pad_char&0xF);
278
279 cname[32] = 0;
280 return cname;
281}
282
283
284/**
285 pull a nbt name from the wire
286*/
287_PUBLIC_ enum ndr_err_code ndr_pull_nbt_name(struct ndr_pull *ndr, int ndr_flags, struct nbt_name *r)
288{
289 uint8_t *scope;
290 char *cname;
291 const char *s;
292 bool ok;
293
294 if (!(ndr_flags & NDR_SCALARS)) {
295 return NDR_ERR_SUCCESS;
296 }
297
298 NDR_CHECK(ndr_pull_nbt_string(ndr, ndr_flags, &s));
299
300 scope = (uint8_t *)strchr(s, '.');
301 if (scope) {
302 *scope = 0;
303 r->scope = talloc_strdup(ndr->current_mem_ctx, (const char *)&scope[1]);
304 NDR_ERR_HAVE_NO_MEMORY(r->scope);
305 } else {
306 r->scope = NULL;
307 }
308
309 cname = discard_const_p(char, s);
310
311 /* the first component is limited to 16 bytes in the DOS charset,
312 which is 32 in the 'compressed' form */
313 if (strlen(cname) > 32) {
314 return ndr_pull_error(ndr, NDR_ERR_STRING,
315 "NBT NAME cname > 32");
316 }
317
318 /* decompress the first component */
319 ok = decompress_name(cname, &r->type);
320 if (!ok) {
321 return ndr_pull_error(ndr, NDR_ERR_STRING,
322 "NBT NAME failed to decompress");
323 }
324
325 r->name = talloc_strdup(ndr->current_mem_ctx, cname);
326 NDR_ERR_HAVE_NO_MEMORY(r->name);
327
328 talloc_free(cname);
329
330 return NDR_ERR_SUCCESS;
331}
332
333/**
334 push a nbt name to the wire
335*/
336_PUBLIC_ enum ndr_err_code ndr_push_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
337{
338 uint8_t *cname, *fullname;
339 enum ndr_err_code ndr_err;
340
341 if (!(ndr_flags & NDR_SCALARS)) {
342 return NDR_ERR_SUCCESS;
343 }
344
345 if (strlen(r->name) > 15) {
346 return ndr_push_error(ndr, NDR_ERR_STRING,
347 "nbt_name longer as 15 chars: %s",
348 r->name);
349 }
350
351 cname = compress_name(ndr, (const uint8_t *)r->name, r->type);
352 NDR_ERR_HAVE_NO_MEMORY(cname);
353
354 if (r->scope) {
355 fullname = (uint8_t *)talloc_asprintf(ndr, "%s.%s", cname, r->scope);
356 NDR_ERR_HAVE_NO_MEMORY(fullname);
357 talloc_free(cname);
358 } else {
359 fullname = cname;
360 }
361
362 ndr_err = ndr_push_nbt_string(ndr, ndr_flags, (const char *)fullname);
363
364 return ndr_err;
365}
366
367
368/**
369 copy a nbt name structure
370*/
371_PUBLIC_ NTSTATUS nbt_name_dup(TALLOC_CTX *mem_ctx, struct nbt_name *name, struct nbt_name *newname)
372{
373 *newname = *name;
374 newname->name = talloc_strdup(mem_ctx, newname->name);
375 NT_STATUS_HAVE_NO_MEMORY(newname->name);
376 newname->scope = talloc_strdup(mem_ctx, newname->scope);
377 if (name->scope) {
378 NT_STATUS_HAVE_NO_MEMORY(newname->scope);
379 }
380 return NT_STATUS_OK;
381}
382
383/**
384 push a nbt name into a blob
385*/
386_PUBLIC_ NTSTATUS nbt_name_to_blob(TALLOC_CTX *mem_ctx, DATA_BLOB *blob, struct nbt_name *name)
387{
388 enum ndr_err_code ndr_err;
389
390 ndr_err = ndr_push_struct_blob(blob, mem_ctx, name, (ndr_push_flags_fn_t)ndr_push_nbt_name);
391 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
392 return ndr_map_error2ntstatus(ndr_err);
393 }
394
395 return NT_STATUS_OK;
396}
397
398/**
399 pull a nbt name from a blob
400*/
401_PUBLIC_ NTSTATUS nbt_name_from_blob(TALLOC_CTX *mem_ctx, const DATA_BLOB *blob, struct nbt_name *name)
402{
403 enum ndr_err_code ndr_err;
404
405 ndr_err = ndr_pull_struct_blob(blob, mem_ctx, name,
406 (ndr_pull_flags_fn_t)ndr_pull_nbt_name);
407 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
408 return ndr_map_error2ntstatus(ndr_err);
409 }
410
411 return NT_STATUS_OK;
412}
413
414
415/**
416 choose a name to use when calling a server in a NBT session request.
417 we use heuristics to see if the name we have been given is a IP
418 address, or a too-long name. If it is then use *SMBSERVER, or a
419 truncated name
420*/
421_PUBLIC_ void nbt_choose_called_name(TALLOC_CTX *mem_ctx,
422 struct nbt_name *n, const char *name, int type)
423{
424 n->scope = NULL;
425 n->type = type;
426
427 if ((name == NULL) || is_ipaddress(name)) {
428 n->name = "*SMBSERVER";
429 return;
430 }
431 if (strlen(name) > 15) {
432 const char *p = strchr(name, '.');
433 char *s;
434 if (p - name > 15) {
435 n->name = "*SMBSERVER";
436 return;
437 }
438 s = talloc_strndup(mem_ctx, name, PTR_DIFF(p, name));
439 n->name = talloc_strdup_upper(mem_ctx, s);
440 return;
441 }
442
443 n->name = talloc_strdup_upper(mem_ctx, name);
444}
445
446
447/*
448 escape a string into a form containing only a small set of characters,
449 the rest is hex encoded. This is similar to URL encoding
450*/
451static const char *nbt_hex_encode(TALLOC_CTX *mem_ctx, const char *s)
452{
453 int i, len;
454 char *ret;
455 const char *valid_chars = "_-.$@ ";
456#define NBT_CHAR_ALLOW(c) (isalnum((unsigned char)c) || strchr(valid_chars, c))
457
458 for (len=i=0;s[i];i++,len++) {
459 if (!NBT_CHAR_ALLOW(s[i])) {
460 len += 2;
461 }
462 }
463
464 ret = talloc_array(mem_ctx, char, len+1);
465 if (ret == NULL) return NULL;
466
467 for (len=i=0;s[i];i++) {
468 if (NBT_CHAR_ALLOW(s[i])) {
469 ret[len++] = s[i];
470 } else {
471 snprintf(&ret[len], 4, "%%%02x", (unsigned char)s[i]);
472 len += 3;
473 }
474 }
475 ret[len] = 0;
476
477 return ret;
478}
479
480
481/**
482 form a string for a NBT name
483*/
484_PUBLIC_ char *nbt_name_string(TALLOC_CTX *mem_ctx, const struct nbt_name *name)
485{
486 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
487 char *ret;
488 if (name->scope) {
489 ret = talloc_asprintf(mem_ctx, "%s<%02x>-%s",
490 nbt_hex_encode(tmp_ctx, name->name),
491 name->type,
492 nbt_hex_encode(tmp_ctx, name->scope));
493 } else {
494 ret = talloc_asprintf(mem_ctx, "%s<%02x>",
495 nbt_hex_encode(tmp_ctx, name->name),
496 name->type);
497 }
498 talloc_free(tmp_ctx);
499 return ret;
500}
501
502/**
503 pull a nbt name, WINS Replication uses another on wire format for nbt name
504*/
505_PUBLIC_ enum ndr_err_code ndr_pull_wrepl_nbt_name(struct ndr_pull *ndr, int ndr_flags, const struct nbt_name **_r)
506{
507 struct nbt_name *r;
508 uint8_t *namebuf;
509 uint32_t namebuf_len;
510
511 if (!(ndr_flags & NDR_SCALARS)) {
512 return NDR_ERR_SUCCESS;
513 }
514
515 NDR_CHECK(ndr_pull_align(ndr, 4));
516 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &namebuf_len));
517 if (namebuf_len < 1 || namebuf_len > 255) {
518 return ndr_pull_error(ndr, NDR_ERR_ALLOC, "value out of range");
519 }
520 NDR_PULL_ALLOC_N(ndr, namebuf, namebuf_len);
521 NDR_CHECK(ndr_pull_array_uint8(ndr, NDR_SCALARS, namebuf, namebuf_len));
522
523 if ((namebuf_len % 4) == 0) {
524 /*
525 * [MS-WINSRA] — v20091104 was wrong
526 * regarding section "2.2.10.1 Name Record"
527 *
528 * If the name buffer is already 4 byte aligned
529 * Windows (at least 2003 SP1 and 2008) add 4 extra
530 * bytes. This can happen when the name has a scope.
531 */
532 uint32_t pad;
533 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &pad));
534 }
535
536 NDR_PULL_ALLOC(ndr, r);
537
538 /* oh wow, what a nasty bug in windows ... */
539 if (namebuf[0] == 0x1b && namebuf_len >= 16) {
540 namebuf[0] = namebuf[15];
541 namebuf[15] = 0x1b;
542 }
543
544 if (namebuf_len < 17) {
545 r->type = 0x00;
546
547 r->name = talloc_strndup(r, (char *)namebuf, namebuf_len);
548 if (!r->name) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
549
550 r->scope= NULL;
551
552 talloc_free(namebuf);
553 *_r = r;
554 return NDR_ERR_SUCCESS;
555 }
556
557 r->type = namebuf[15];
558
559 namebuf[15] = '\0';
560 trim_string((char *)namebuf, NULL, " ");
561 r->name = talloc_strdup(r, (char *)namebuf);
562 if (!r->name) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
563
564 if (namebuf_len > 17) {
565 r->scope = talloc_strndup(r, (char *)(namebuf+16), namebuf_len-17);
566 if (!r->scope) return ndr_pull_error(ndr, NDR_ERR_ALLOC, "out of memory");
567 } else {
568 r->scope = NULL;
569 }
570
571 talloc_free(namebuf);
572 *_r = r;
573 return NDR_ERR_SUCCESS;
574}
575
576/**
577 push a nbt name, WINS Replication uses another on wire format for nbt name
578*/
579_PUBLIC_ enum ndr_err_code ndr_push_wrepl_nbt_name(struct ndr_push *ndr, int ndr_flags, const struct nbt_name *r)
580{
581 uint8_t *namebuf;
582 uint32_t namebuf_len;
583 uint32_t _name_len;
584 uint32_t scope_len = 0;
585
586 if (r == NULL) {
587 return ndr_push_error(ndr, NDR_ERR_INVALID_POINTER,
588 "wrepl_nbt_name NULL pointer");
589 }
590
591 if (!(ndr_flags & NDR_SCALARS)) {
592 return NDR_ERR_SUCCESS;
593 }
594
595 _name_len = strlen(r->name);
596 if (_name_len > 15) {
597 return ndr_push_error(ndr, NDR_ERR_STRING,
598 "wrepl_nbt_name longer as 15 chars: %s",
599 r->name);
600 }
601
602 if (r->scope) {
603 scope_len = strlen(r->scope);
604 }
605 if (scope_len > 238) {
606 return ndr_push_error(ndr, NDR_ERR_STRING,
607 "wrepl_nbt_name scope longer as 238 chars: %s",
608 r->scope);
609 }
610
611 namebuf = (uint8_t *)talloc_asprintf(ndr, "%-15s%c%s",
612 r->name, 'X',
613 (r->scope?r->scope:""));
614 if (!namebuf) return ndr_push_error(ndr, NDR_ERR_ALLOC, "out of memory");
615
616 namebuf_len = strlen((char *)namebuf) + 1;
617
618 /*
619 * we need to set the type here, and use a place-holder in the talloc_asprintf()
620 * as the type can be 0x00, and then the namebuf_len = strlen(namebuf); would give wrong results
621 */
622 namebuf[15] = r->type;
623
624 /* oh wow, what a nasty bug in windows ... */
625 if (r->type == 0x1b) {
626 namebuf[15] = namebuf[0];
627 namebuf[0] = 0x1b;
628 }
629
630 NDR_CHECK(ndr_push_align(ndr, 4));
631 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, namebuf_len));
632 NDR_CHECK(ndr_push_array_uint8(ndr, NDR_SCALARS, namebuf, namebuf_len));
633
634 if ((namebuf_len % 4) == 0) {
635 /*
636 * [MS-WINSRA] — v20091104 was wrong
637 * regarding section "2.2.10.1 Name Record"
638 *
639 * If the name buffer is already 4 byte aligned
640 * Windows (at least 2003 SP1 and 2008) add 4 extra
641 * bytes. This can happen when the name has a scope.
642 */
643 NDR_CHECK(ndr_push_zero(ndr, 4));
644 }
645
646 talloc_free(namebuf);
647 return NDR_ERR_SUCCESS;
648}
649
650_PUBLIC_ void ndr_print_wrepl_nbt_name(struct ndr_print *ndr, const char *name, const struct nbt_name *r)
651{
652 char *s = nbt_name_string(ndr, r);
653 ndr_print_string(ndr, name, s);
654 talloc_free(s);
655}
656
657_PUBLIC_ enum ndr_err_code ndr_push_nbt_res_rec(struct ndr_push *ndr, int ndr_flags, const struct nbt_res_rec *r)
658{
659 {
660 uint32_t _flags_save_STRUCT = ndr->flags;
661 ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX);
662 if (ndr_flags & NDR_SCALARS) {
663 NDR_CHECK(ndr_push_align(ndr, 4));
664 NDR_CHECK(ndr_push_nbt_name(ndr, NDR_SCALARS, &r->name));
665 NDR_CHECK(ndr_push_nbt_qtype(ndr, NDR_SCALARS, r->rr_type));
666 NDR_CHECK(ndr_push_nbt_qclass(ndr, NDR_SCALARS, r->rr_class));
667 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, r->ttl));
668 NDR_CHECK(ndr_push_set_switch_value(ndr, &r->rdata, ((((r->rr_type) == NBT_QTYPE_NETBIOS) && ((r->rdata).data.length == 2))?0:r->rr_type)));
669 NDR_CHECK(ndr_push_nbt_rdata(ndr, NDR_SCALARS, &r->rdata));
670 }
671 if (ndr_flags & NDR_BUFFERS) {
672 }
673 ndr->flags = _flags_save_STRUCT;
674 }
675 return NDR_ERR_SUCCESS;
676}
Note: See TracBrowser for help on using the repository browser.