sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-10-31 12:23:52 +03:00
Code Activity

r11741: - the buffer code (first 2 bytes in the SMB2 body) seem to be the length

Browse Source 
of the fixed body part, and +1 if there's a dynamic part
- there're 3 types of dynamic blobs
  with uint16_t offset/uint16_t size
  with uint16_t offset/uint32_t size
  with uint32_t offset/uint32_t size /* aligned to 8 bytes */
- strings are transmitted in UTF-16 with no termination and
  packet into a uint16/uint16 blob

metze
This commit is contained in:
Stefan Metzmacher
2005-11-16 11:01:15 +00:00
committed by Gerald (Jerry) Carter
parent b1afcced39
commit 79103c51e5
16 changed files with 476 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
source/libcli/smb2/negprot.c
View File

@@ -33,12 +33,15 @@ struct smb2_request *smb2_negprot_send(struct smb2_transport *transport,
{
struct smb2_request *req;
req = smb2_request_init(transport, SMB2_OP_NEGPROT, 0x26);
req = smb2_request_init(transport, SMB2_OP_NEGPROT, 0x26, 0);
if (req == NULL) return NULL;
SIVAL(req->out.body, 0x00, io->in.unknown1);
SSVAL(req->out.body, 0x04, io->in.unknown2);
memcpy(req->out.body+0x06, io->in.unknown3, 32);
/* this seems to be a bug, they use 0x24 but the length is 0x26 */
SSVAL(req->out.body, 0x00, 0x24);
SSVAL(req->out.body, 0x02, io->in.unknown1);
memcpy(req->out.body+0x04, io->in.unknown2, 32);
SSVAL(req->out.body, 0x24, io->in.unknown3);
smb2_transport_send(req);
@@ -51,18 +54,14 @@ struct smb2_request *smb2_negprot_send(struct smb2_transport *transport,
NTSTATUS smb2_negprot_recv(struct smb2_request *req, TALLOC_CTX *mem_ctx,
struct smb2_negprot *io)
{
uint16_t blobsize;
NTSTATUS status;
if (!smb2_request_receive(req) ||
if (!smb2_request_receive(req) ||
smb2_request_is_error(req)) {
return smb2_request_destroy(req);
}
if (req->in.body_size < 0x40) {
return NT_STATUS_BUFFER_TOO_SMALL;
}
SMB2_CHECK_BUFFER_CODE(req, 0x41);
SMB2_CHECK_PACKET_RECV(req, 0x40, True);
io->out._pad = SVAL(req->in.body, 0x02);
io->out.unknown2 = IVAL(req->in.body, 0x04);
@@ -74,10 +73,14 @@ NTSTATUS smb2_negprot_recv(struct smb2_request *req, TALLOC_CTX *mem_ctx,
io->out.unknown7 = SVAL(req->in.body, 0x26);
io->out.current_time = smbcli_pull_nttime(req->in.body, 0x28);
io->out.boot_time = smbcli_pull_nttime(req->in.body, 0x30);
io->out.unknown8 = SVAL(req->in.body, 0x38);
blobsize = SVAL(req->in.body, 0x3A);
status = smb2_pull_o16s16_blob(&req->in, mem_ctx, req->in.body+0x38, &io->out.secblob);
if (!NT_STATUS_IS_OK(status)) {
smb2_request_destroy(req);
return status;
}
io->out.unknown9 = IVAL(req->in.body, 0x3C);
io->out.secblob = smb2_pull_blob(&req->in, mem_ctx, req->in.body+0x40, blobsize);
return smb2_request_destroy(req);
}