SMBServer.SMB1.cs 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325
  1. /* Copyright (C) 2014-2017 Tal Aloni <tal.aloni.il@gmail.com>. All rights reserved.
  2. *
  3. * You can redistribute this program and/or modify it under the terms of
  4. * the GNU Lesser Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. */
  7. using System;
  8. using System.Collections.Generic;
  9. using SMBLibrary.NetBios;
  10. using SMBLibrary.Server.SMB1;
  11. using SMBLibrary.SMB1;
  12. using Utilities;
  13. namespace SMBLibrary.Server
  14. {
  15. public partial class SMBServer
  16. {
  17. public void ProcessSMB1Message(SMB1Message message, ref ConnectionState state)
  18. {
  19. SMB1Message reply = new SMB1Message();
  20. PrepareResponseHeader(reply, message);
  21. List<SMB1Command> sendQueue = new List<SMB1Command>();
  22. foreach (SMB1Command command in message.Commands)
  23. {
  24. SMB1Command response = ProcessSMB1Command(reply.Header, command, ref state, sendQueue);
  25. if (response != null)
  26. {
  27. reply.Commands.Add(response);
  28. }
  29. if (reply.Header.Status != NTStatus.STATUS_SUCCESS)
  30. {
  31. break;
  32. }
  33. }
  34. if (reply.Commands.Count > 0)
  35. {
  36. TrySendMessage(state, reply);
  37. foreach (SMB1Command command in sendQueue)
  38. {
  39. SMB1Message secondaryReply = new SMB1Message();
  40. secondaryReply.Header = reply.Header;
  41. secondaryReply.Commands.Add(command);
  42. TrySendMessage(state, secondaryReply);
  43. }
  44. }
  45. }
  46. /// <summary>
  47. /// May return null
  48. /// </summary>
  49. public SMB1Command ProcessSMB1Command(SMB1Header header, SMB1Command command, ref ConnectionState state, List<SMB1Command> sendQueue)
  50. {
  51. if (state.ServerDialect == SMBDialect.NotSet)
  52. {
  53. if (command is NegotiateRequest)
  54. {
  55. NegotiateRequest request = (NegotiateRequest)command;
  56. if (request.Dialects.Contains(SMBServer.NTLanManagerDialect))
  57. {
  58. state = new SMB1ConnectionState(state);
  59. state.ServerDialect = SMBDialect.NTLM012;
  60. if (EnableExtendedSecurity && header.ExtendedSecurityFlag)
  61. {
  62. return NegotiateHelper.GetNegotiateResponseExtended(request, m_serverGuid);
  63. }
  64. else
  65. {
  66. return NegotiateHelper.GetNegotiateResponse(header, request, m_securityProvider, state);
  67. }
  68. }
  69. else
  70. {
  71. return new NegotiateResponseNotSupported();
  72. }
  73. }
  74. else
  75. {
  76. // [MS-CIFS] An SMB_COM_NEGOTIATE exchange MUST be completed before any other SMB messages are sent to the server
  77. header.Status = NTStatus.STATUS_INVALID_SMB;
  78. return new ErrorResponse(command.CommandName);
  79. }
  80. }
  81. else if (command is NegotiateRequest)
  82. {
  83. // There MUST be only one SMB_COM_NEGOTIATE exchange per SMB connection.
  84. // Subsequent SMB_COM_NEGOTIATE requests received by the server MUST be rejected with error responses.
  85. header.Status = NTStatus.STATUS_INVALID_SMB;
  86. return new ErrorResponse(command.CommandName);
  87. }
  88. else
  89. {
  90. return ProcessSMB1Command(header, command, (SMB1ConnectionState)state, sendQueue);
  91. }
  92. }
  93. private SMB1Command ProcessSMB1Command(SMB1Header header, SMB1Command command, SMB1ConnectionState state, List<SMB1Command> sendQueue)
  94. {
  95. if (command is SessionSetupAndXRequest)
  96. {
  97. SessionSetupAndXRequest request = (SessionSetupAndXRequest)command;
  98. state.MaxBufferSize = request.MaxBufferSize;
  99. return SessionSetupHelper.GetSessionSetupResponse(header, request, m_securityProvider, state);
  100. }
  101. else if (command is SessionSetupAndXRequestExtended)
  102. {
  103. SessionSetupAndXRequestExtended request = (SessionSetupAndXRequestExtended)command;
  104. state.MaxBufferSize = request.MaxBufferSize;
  105. return SessionSetupHelper.GetSessionSetupResponseExtended(header, request, m_securityProvider, state);
  106. }
  107. else if (command is EchoRequest)
  108. {
  109. return ServerResponseHelper.GetEchoResponse((EchoRequest)command, sendQueue);
  110. }
  111. else
  112. {
  113. SMB1Session session = state.GetSession(header.UID);
  114. if (session == null)
  115. {
  116. header.Status = NTStatus.STATUS_USER_SESSION_DELETED;
  117. return new ErrorResponse(command.CommandName);
  118. }
  119. if (command is TreeConnectAndXRequest)
  120. {
  121. TreeConnectAndXRequest request = (TreeConnectAndXRequest)command;
  122. return TreeConnectHelper.GetTreeConnectResponse(header, request, state, m_services, m_shares);
  123. }
  124. else if (command is LogoffAndXRequest)
  125. {
  126. m_securityProvider.DeleteSecurityContext(ref session.SecurityContext.AuthenticationContext);
  127. state.RemoveSession(header.UID);
  128. return new LogoffAndXResponse();
  129. }
  130. else
  131. {
  132. ISMBShare share = session.GetConnectedTree(header.TID);
  133. if (share == null)
  134. {
  135. header.Status = NTStatus.STATUS_SMB_BAD_TID;
  136. return new ErrorResponse(command.CommandName);
  137. }
  138. if (command is CreateDirectoryRequest)
  139. {
  140. CreateDirectoryRequest request = (CreateDirectoryRequest)command;
  141. return FileStoreResponseHelper.GetCreateDirectoryResponse(header, request, share, state);
  142. }
  143. else if (command is DeleteDirectoryRequest)
  144. {
  145. DeleteDirectoryRequest request = (DeleteDirectoryRequest)command;
  146. return FileStoreResponseHelper.GetDeleteDirectoryResponse(header, request, share, state);
  147. }
  148. else if (command is CloseRequest)
  149. {
  150. CloseRequest request = (CloseRequest)command;
  151. return ServerResponseHelper.GetCloseResponse(header, request, share, state);
  152. }
  153. else if (command is FlushRequest)
  154. {
  155. return new FlushResponse();
  156. }
  157. else if (command is DeleteRequest)
  158. {
  159. DeleteRequest request = (DeleteRequest)command;
  160. return FileStoreResponseHelper.GetDeleteResponse(header, request, share, state);
  161. }
  162. else if (command is RenameRequest)
  163. {
  164. RenameRequest request = (RenameRequest)command;
  165. return FileStoreResponseHelper.GetRenameResponse(header, request, share, state);
  166. }
  167. else if (command is QueryInformationRequest)
  168. {
  169. QueryInformationRequest request = (QueryInformationRequest)command;
  170. return FileStoreResponseHelper.GetQueryInformationResponse(header, request, share, state);
  171. }
  172. else if (command is SetInformationRequest)
  173. {
  174. SetInformationRequest request = (SetInformationRequest)command;
  175. return FileStoreResponseHelper.GetSetInformationResponse(header, request, share, state);
  176. }
  177. else if (command is ReadRequest)
  178. {
  179. ReadRequest request = (ReadRequest)command;
  180. return ReadWriteResponseHelper.GetReadResponse(header, request, share, state);
  181. }
  182. else if (command is WriteRequest)
  183. {
  184. WriteRequest request = (WriteRequest)command;
  185. return ReadWriteResponseHelper.GetWriteResponse(header, request, share, state);
  186. }
  187. else if (command is CheckDirectoryRequest)
  188. {
  189. CheckDirectoryRequest request = (CheckDirectoryRequest)command;
  190. return FileStoreResponseHelper.GetCheckDirectoryResponse(header, request, share, state);
  191. }
  192. else if (command is WriteRawRequest)
  193. {
  194. // [MS-CIFS] 3.3.5.26 - Receiving an SMB_COM_WRITE_RAW Request:
  195. // the server MUST verify that the Server.Capabilities include CAP_RAW_MODE,
  196. // If an error is detected [..] the Write Raw operation MUST fail and
  197. // the server MUST return a Final Server Response [..] with the Count field set to zero.
  198. return new WriteRawFinalResponse();
  199. }
  200. else if (command is SetInformation2Request)
  201. {
  202. SetInformation2Request request = (SetInformation2Request)command;
  203. return FileStoreResponseHelper.GetSetInformation2Response(header, request, share, state);
  204. }
  205. else if (command is LockingAndXRequest)
  206. {
  207. header.Status = NTStatus.STATUS_ACCESS_DENIED;
  208. return new ErrorResponse(command.CommandName);
  209. }
  210. else if (command is OpenAndXRequest)
  211. {
  212. OpenAndXRequest request = (OpenAndXRequest)command;
  213. return OpenAndXHelper.GetOpenAndXResponse(header, request, share, state);
  214. }
  215. else if (command is ReadAndXRequest)
  216. {
  217. ReadAndXRequest request = (ReadAndXRequest)command;
  218. return ReadWriteResponseHelper.GetReadResponse(header, request, share, state);
  219. }
  220. else if (command is WriteAndXRequest)
  221. {
  222. WriteAndXRequest request = (WriteAndXRequest)command;
  223. return ReadWriteResponseHelper.GetWriteResponse(header, request, share, state);
  224. }
  225. else if (command is FindClose2Request)
  226. {
  227. return ServerResponseHelper.GetFindClose2Request(header, (FindClose2Request)command, state);
  228. }
  229. else if (command is TreeDisconnectRequest)
  230. {
  231. TreeDisconnectRequest request = (TreeDisconnectRequest)command;
  232. return TreeConnectHelper.GetTreeDisconnectResponse(header, request, state);
  233. }
  234. else if (command is TransactionRequest) // Both TransactionRequest and Transaction2Request
  235. {
  236. TransactionRequest request = (TransactionRequest)command;
  237. try
  238. {
  239. return TransactionHelper.GetTransactionResponse(header, request, share, state, sendQueue);
  240. }
  241. catch (UnsupportedInformationLevelException)
  242. {
  243. header.Status = NTStatus.STATUS_INVALID_PARAMETER;
  244. return new ErrorResponse(command.CommandName);
  245. }
  246. }
  247. else if (command is TransactionSecondaryRequest) // Both TransactionSecondaryRequest and Transaction2SecondaryRequest
  248. {
  249. TransactionSecondaryRequest request = (TransactionSecondaryRequest)command;
  250. try
  251. {
  252. return TransactionHelper.GetTransactionResponse(header, request, share, state, sendQueue);
  253. }
  254. catch (UnsupportedInformationLevelException)
  255. {
  256. header.Status = NTStatus.STATUS_INVALID_PARAMETER;
  257. return new ErrorResponse(command.CommandName);
  258. }
  259. }
  260. else if (command is NTTransactRequest)
  261. {
  262. NTTransactRequest request = (NTTransactRequest)command;
  263. return NTTransactHelper.GetNTTransactResponse(header, request, share, state, sendQueue);
  264. }
  265. else if (command is NTTransactSecondaryRequest)
  266. {
  267. NTTransactSecondaryRequest request = (NTTransactSecondaryRequest)command;
  268. return NTTransactHelper.GetNTTransactResponse(header, request, share, state, sendQueue);
  269. }
  270. else if (command is NTCreateAndXRequest)
  271. {
  272. NTCreateAndXRequest request = (NTCreateAndXRequest)command;
  273. return NTCreateHelper.GetNTCreateResponse(header, request, share, state);
  274. }
  275. }
  276. }
  277. header.Status = NTStatus.STATUS_SMB_BAD_COMMAND;
  278. return new ErrorResponse(command.CommandName);
  279. }
  280. public static void TrySendMessage(ConnectionState state, SMB1Message response)
  281. {
  282. SessionMessagePacket packet = new SessionMessagePacket();
  283. packet.Trailer = response.GetBytes();
  284. TrySendPacket(state, packet);
  285. state.LogToServer(Severity.Verbose, "SMB1 message sent: {0} responses, First response: {1}, Packet length: {2}", response.Commands.Count, response.Commands[0].CommandName.ToString(), packet.Length);
  286. }
  287. private static void PrepareResponseHeader(SMB1Message response, SMB1Message request)
  288. {
  289. response.Header.Status = NTStatus.STATUS_SUCCESS;
  290. response.Header.Flags = HeaderFlags.CaseInsensitive | HeaderFlags.CanonicalizedPaths | HeaderFlags.Reply;
  291. response.Header.Flags2 = HeaderFlags2.NTStatusCode;
  292. if ((request.Header.Flags2 & HeaderFlags2.LongNamesAllowed) > 0)
  293. {
  294. response.Header.Flags2 |= HeaderFlags2.LongNamesAllowed | HeaderFlags2.LongNameUsed;
  295. }
  296. if ((request.Header.Flags2 & HeaderFlags2.ExtendedAttributes) > 0)
  297. {
  298. response.Header.Flags2 |= HeaderFlags2.ExtendedAttributes;
  299. }
  300. if ((request.Header.Flags2 & HeaderFlags2.ExtendedSecurity) > 0)
  301. {
  302. response.Header.Flags2 |= HeaderFlags2.ExtendedSecurity;
  303. }
  304. if ((request.Header.Flags2 & HeaderFlags2.Unicode) > 0)
  305. {
  306. response.Header.Flags2 |= HeaderFlags2.Unicode;
  307. }
  308. response.Header.MID = request.Header.MID;
  309. response.Header.PID = request.Header.PID;
  310. response.Header.UID = request.Header.UID;
  311. response.Header.TID = request.Header.TID;
  312. }
  313. }
  314. }