SMBServer.SMB1.cs 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352
  1. /* Copyright (C) 2014-2017 Tal Aloni <tal.aloni.il@gmail.com>. All rights reserved.
  2. *
  3. * You can redistribute this program and/or modify it under the terms of
  4. * the GNU Lesser Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. */
  7. using System;
  8. using System.Collections.Generic;
  9. using SMBLibrary.NetBios;
  10. using SMBLibrary.Server.SMB1;
  11. using SMBLibrary.SMB1;
  12. using Utilities;
  13. namespace SMBLibrary.Server
  14. {
  15. public partial class SMBServer
  16. {
  17. public void ProcessSMB1Message(SMB1Message message, SMB1ConnectionState state)
  18. {
  19. SMB1Message reply = new SMB1Message();
  20. PrepareResponseHeader(reply, message);
  21. List<SMB1Command> sendQueue = new List<SMB1Command>();
  22. foreach (SMB1Command command in message.Commands)
  23. {
  24. SMB1Command response = ProcessSMB1Command(reply.Header, command, state, sendQueue);
  25. if (response != null)
  26. {
  27. reply.Commands.Add(response);
  28. }
  29. if (reply.Header.Status != NTStatus.STATUS_SUCCESS)
  30. {
  31. break;
  32. }
  33. }
  34. if (reply.Commands.Count > 0)
  35. {
  36. TrySendMessage(state, reply);
  37. foreach (SMB1Command command in sendQueue)
  38. {
  39. SMB1Message secondaryReply = new SMB1Message();
  40. secondaryReply.Header = reply.Header;
  41. secondaryReply.Commands.Add(command);
  42. TrySendMessage(state, secondaryReply);
  43. }
  44. }
  45. }
  46. /// <summary>
  47. /// May return null
  48. /// </summary>
  49. public SMB1Command ProcessSMB1Command(SMB1Header header, SMB1Command command, SMB1ConnectionState state, List<SMB1Command> sendQueue)
  50. {
  51. if (command is NegotiateRequest)
  52. {
  53. NegotiateRequest request = (NegotiateRequest)command;
  54. if (request.Dialects.Contains(SMBServer.NTLanManagerDialect))
  55. {
  56. if (EnableExtendedSecurity && header.ExtendedSecurityFlag)
  57. {
  58. return NegotiateHelper.GetNegotiateResponseExtended(request, m_serverGuid);
  59. }
  60. else
  61. {
  62. byte[] serverChallenge = m_users.GenerateServerChallenge();
  63. return NegotiateHelper.GetNegotiateResponse(header, request, serverChallenge);
  64. }
  65. }
  66. else
  67. {
  68. return new NegotiateResponseNotSupported();
  69. }
  70. }
  71. else if (command is SessionSetupAndXRequest)
  72. {
  73. SessionSetupAndXRequest request = (SessionSetupAndXRequest)command;
  74. state.MaxBufferSize = request.MaxBufferSize;
  75. return SessionSetupHelper.GetSessionSetupResponse(header, request, m_users, state);
  76. }
  77. else if (command is SessionSetupAndXRequestExtended)
  78. {
  79. SessionSetupAndXRequestExtended request = (SessionSetupAndXRequestExtended)command;
  80. state.MaxBufferSize = request.MaxBufferSize;
  81. return SessionSetupHelper.GetSessionSetupResponseExtended(header, request, m_users, state);
  82. }
  83. else if (command is EchoRequest)
  84. {
  85. return ServerResponseHelper.GetEchoResponse((EchoRequest)command, sendQueue);
  86. }
  87. else if (state.IsAuthenticated(header.UID))
  88. {
  89. if (command is TreeConnectAndXRequest)
  90. {
  91. TreeConnectAndXRequest request = (TreeConnectAndXRequest)command;
  92. return TreeConnectHelper.GetTreeConnectResponse(header, request, state, m_shares);
  93. }
  94. else if (command is LogoffAndXRequest)
  95. {
  96. return new LogoffAndXResponse();
  97. }
  98. else if (state.IsTreeConnected(header.TID))
  99. {
  100. string rootPath = state.GetConnectedTreePath(header.TID);
  101. ISMBShare share;
  102. if (state.IsIPC(header.TID))
  103. {
  104. share = m_services;
  105. }
  106. else
  107. {
  108. share = m_shares.GetShareFromRelativePath(rootPath);
  109. }
  110. if (command is CreateDirectoryRequest)
  111. {
  112. if (!(share is FileSystemShare))
  113. {
  114. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  115. return new ErrorResponse(command.CommandName);
  116. }
  117. CreateDirectoryRequest request = (CreateDirectoryRequest)command;
  118. return FileSystemResponseHelper.GetCreateDirectoryResponse(header, request, (FileSystemShare)share, state);
  119. }
  120. else if (command is DeleteDirectoryRequest)
  121. {
  122. if (!(share is FileSystemShare))
  123. {
  124. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  125. return new ErrorResponse(command.CommandName);
  126. }
  127. DeleteDirectoryRequest request = (DeleteDirectoryRequest)command;
  128. return FileSystemResponseHelper.GetDeleteDirectoryResponse(header, request, (FileSystemShare)share, state);
  129. }
  130. else if (command is CloseRequest)
  131. {
  132. CloseRequest request = (CloseRequest)command;
  133. return ServerResponseHelper.GetCloseResponse(header, request, share, state);
  134. }
  135. else if (command is FlushRequest)
  136. {
  137. return new FlushResponse();
  138. }
  139. else if (command is DeleteRequest)
  140. {
  141. if (!(share is FileSystemShare))
  142. {
  143. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  144. return new ErrorResponse(command.CommandName);
  145. }
  146. DeleteRequest request = (DeleteRequest)command;
  147. return FileSystemResponseHelper.GetDeleteResponse(header, request, (FileSystemShare)share, state);
  148. }
  149. else if (command is RenameRequest)
  150. {
  151. if (!(share is FileSystemShare))
  152. {
  153. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  154. return new ErrorResponse(command.CommandName);
  155. }
  156. RenameRequest request = (RenameRequest)command;
  157. return FileSystemResponseHelper.GetRenameResponse(header, request, (FileSystemShare)share, state);
  158. }
  159. else if (command is QueryInformationRequest)
  160. {
  161. if (!(share is FileSystemShare))
  162. {
  163. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  164. return new ErrorResponse(command.CommandName);
  165. }
  166. QueryInformationRequest request = (QueryInformationRequest)command;
  167. return FileSystemResponseHelper.GetQueryInformationResponse(header, request, (FileSystemShare)share);
  168. }
  169. else if (command is SetInformationRequest)
  170. {
  171. if (!(share is FileSystemShare))
  172. {
  173. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  174. return new ErrorResponse(command.CommandName);
  175. }
  176. SetInformationRequest request = (SetInformationRequest)command;
  177. return FileSystemResponseHelper.GetSetInformationResponse(header, request, (FileSystemShare)share, state);
  178. }
  179. else if (command is ReadRequest)
  180. {
  181. ReadRequest request = (ReadRequest)command;
  182. return ReadWriteResponseHelper.GetReadResponse(header, request, share, state);
  183. }
  184. else if (command is WriteRequest)
  185. {
  186. string userName = state.GetConnectedUserName(header.UID);
  187. if (share is FileSystemShare && !((FileSystemShare)share).HasWriteAccess(userName))
  188. {
  189. header.Status = NTStatus.STATUS_ACCESS_DENIED;
  190. return new ErrorResponse(command.CommandName);
  191. }
  192. WriteRequest request = (WriteRequest)command;
  193. return ReadWriteResponseHelper.GetWriteResponse(header, request, share, state);
  194. }
  195. else if (command is CheckDirectoryRequest)
  196. {
  197. if (!(share is FileSystemShare))
  198. {
  199. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  200. return new ErrorResponse(command.CommandName);
  201. }
  202. CheckDirectoryRequest request = (CheckDirectoryRequest)command;
  203. return FileSystemResponseHelper.GetCheckDirectoryResponse(header, request, (FileSystemShare)share);
  204. }
  205. else if (command is WriteRawRequest)
  206. {
  207. // [MS-CIFS] 3.3.5.26 - Receiving an SMB_COM_WRITE_RAW Request:
  208. // the server MUST verify that the Server.Capabilities include CAP_RAW_MODE,
  209. // If an error is detected [..] the Write Raw operation MUST fail and
  210. // the server MUST return a Final Server Response [..] with the Count field set to zero.
  211. return new WriteRawFinalResponse();
  212. }
  213. else if (command is SetInformation2Request)
  214. {
  215. if (!(share is FileSystemShare))
  216. {
  217. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  218. return new ErrorResponse(command.CommandName);
  219. }
  220. SetInformation2Request request = (SetInformation2Request)command;
  221. return FileSystemResponseHelper.GetSetInformation2Response(header, request, (FileSystemShare)share, state);
  222. }
  223. else if (command is LockingAndXRequest)
  224. {
  225. header.Status = NTStatus.STATUS_ACCESS_DENIED;
  226. return new ErrorResponse(CommandName.SMB_COM_LOCKING_ANDX);
  227. }
  228. else if (command is OpenAndXRequest)
  229. {
  230. OpenAndXRequest request = (OpenAndXRequest)command;
  231. return OpenAndXHelper.GetOpenAndXResponse(header, request, share, state);
  232. }
  233. else if (command is ReadAndXRequest)
  234. {
  235. ReadAndXRequest request = (ReadAndXRequest)command;
  236. return ReadWriteResponseHelper.GetReadResponse(header, request, share, state);
  237. }
  238. else if (command is WriteAndXRequest)
  239. {
  240. string userName = state.GetConnectedUserName(header.UID);
  241. if (share is FileSystemShare && !((FileSystemShare)share).HasWriteAccess(userName))
  242. {
  243. header.Status = NTStatus.STATUS_ACCESS_DENIED;
  244. return new ErrorResponse(command.CommandName);
  245. }
  246. WriteAndXRequest request = (WriteAndXRequest)command;
  247. return ReadWriteResponseHelper.GetWriteResponse(header, request, share, state);
  248. }
  249. else if (command is FindClose2Request)
  250. {
  251. return ServerResponseHelper.GetFindClose2Request(header, (FindClose2Request)command, state);
  252. }
  253. else if (command is TreeDisconnectRequest)
  254. {
  255. TreeDisconnectRequest request = (TreeDisconnectRequest)command;
  256. return TreeConnectHelper.GetTreeDisconnectResponse(header, request, state);
  257. }
  258. else if (command is TransactionRequest) // Both TransactionRequest and Transaction2Request
  259. {
  260. TransactionRequest request = (TransactionRequest)command;
  261. try
  262. {
  263. return TransactionHelper.GetTransactionResponse(header, request, share, state, sendQueue);
  264. }
  265. catch (UnsupportedInformationLevelException)
  266. {
  267. header.Status = NTStatus.STATUS_INVALID_PARAMETER;
  268. return new ErrorResponse(command.CommandName);
  269. }
  270. }
  271. else if (command is TransactionSecondaryRequest) // Both TransactionSecondaryRequest and Transaction2SecondaryRequest
  272. {
  273. TransactionSecondaryRequest request = (TransactionSecondaryRequest)command;
  274. try
  275. {
  276. return TransactionHelper.GetTransactionResponse(header, request, share, state, sendQueue);
  277. }
  278. catch (UnsupportedInformationLevelException)
  279. {
  280. header.Status = NTStatus.STATUS_INVALID_PARAMETER;
  281. return new ErrorResponse(command.CommandName);
  282. }
  283. }
  284. else if (command is NTTransactRequest)
  285. {
  286. NTTransactRequest request = (NTTransactRequest)command;
  287. return NTTransactHelper.GetNTTransactResponse(header, request, share, state, sendQueue);
  288. }
  289. else if (command is NTTransactSecondaryRequest)
  290. {
  291. NTTransactSecondaryRequest request = (NTTransactSecondaryRequest)command;
  292. return NTTransactHelper.GetNTTransactResponse(header, request, share, state, sendQueue);
  293. }
  294. else if (command is NTCreateAndXRequest)
  295. {
  296. NTCreateAndXRequest request = (NTCreateAndXRequest)command;
  297. return NTCreateHelper.GetNTCreateResponse(header, request, share, state);
  298. }
  299. }
  300. else
  301. {
  302. header.Status = NTStatus.STATUS_SMB_BAD_TID;
  303. return new ErrorResponse(command.CommandName);
  304. }
  305. }
  306. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  307. return new ErrorResponse(command.CommandName);
  308. }
  309. public static void TrySendMessage(SMB1ConnectionState state, SMB1Message response)
  310. {
  311. SessionMessagePacket packet = new SessionMessagePacket();
  312. packet.Trailer = response.GetBytes();
  313. TrySendPacket(state, packet);
  314. state.LogToServer(Severity.Verbose, "Response sent: {0} Commands, First Command: {1}, Packet length: {2}", response.Commands.Count, response.Commands[0].CommandName.ToString(), packet.Length);
  315. }
  316. private static void PrepareResponseHeader(SMB1Message response, SMB1Message request)
  317. {
  318. response.Header.Status = NTStatus.STATUS_SUCCESS;
  319. response.Header.Flags = HeaderFlags.CaseInsensitive | HeaderFlags.CanonicalizedPaths | HeaderFlags.Reply;
  320. response.Header.Flags2 = HeaderFlags2.NTStatusCode;
  321. if ((request.Header.Flags2 & HeaderFlags2.LongNamesAllowed) > 0)
  322. {
  323. response.Header.Flags2 |= HeaderFlags2.LongNamesAllowed | HeaderFlags2.LongNameUsed;
  324. }
  325. if ((request.Header.Flags2 & HeaderFlags2.ExtendedAttributes) > 0)
  326. {
  327. response.Header.Flags2 |= HeaderFlags2.ExtendedAttributes;
  328. }
  329. if ((request.Header.Flags2 & HeaderFlags2.ExtendedSecurity) > 0)
  330. {
  331. response.Header.Flags2 |= HeaderFlags2.ExtendedSecurity;
  332. }
  333. if ((request.Header.Flags2 & HeaderFlags2.Unicode) > 0)
  334. {
  335. response.Header.Flags2 |= HeaderFlags2.Unicode;
  336. }
  337. response.Header.MID = request.Header.MID;
  338. response.Header.PID = request.Header.PID;
  339. response.Header.UID = request.Header.UID;
  340. response.Header.TID = request.Header.TID;
  341. }
  342. }
  343. }