Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

268 lines
8.9 KiB

  1. #include <ntreppch.h>
  2. #include <frs.h>
  3. #include "attack.h"
  4. ULONG NtFrsMajor = NTFRS_MAJOR;
  5. ULONG NtFrsCommMinor = NTFRS_COMM_MINOR_7;
  6. //
  7. // Note: When using COMM_DECODE_VAR_LEN_BLOB you must also use COMM_SZ_NULL
  8. // in the table below so that no length check is made when the field is decoded.
  9. // This allows the field size to grow. Down level members must be able to
  10. // handle this by ignoring var len field components they do not understand.
  11. //
  12. //
  13. // The Communication packet element table below is used to construct and
  14. // decode comm packet data sent between members.
  15. // *** WARNING *** - the order of the rows in the table must match the
  16. // the order of the elements in the COMM_TYPE enum. See comments for COMM_TYPE
  17. // enum for restrictions on adding new elements to the table.
  18. //
  19. // Data Element Type DisplayText Size Decode Type Offset to Native Cmd Packet
  20. //
  21. COMM_PACKET_ELEMENT CommPacketTable[COMM_MAX] = {
  22. {COMM_NONE, "NONE" , COMM_SZ_NULL, COMM_DECODE_NONE, 0 },
  23. {COMM_BOP, "BOP" , COMM_SZ_UL, COMM_DECODE_ULONG, RsOffsetSkip },
  24. {COMM_COMMAND, "COMMAND" , COMM_SZ_UL, COMM_DECODE_ULONG_TO_USHORT, OFFSET(COMMAND_PACKET, Command)},
  25. {COMM_TO, "TO" , COMM_SZ_NULL, COMM_DECODE_GNAME, RsOffset(To) },
  26. {COMM_FROM, "FROM" , COMM_SZ_NULL, COMM_DECODE_GNAME, RsOffset(From) },
  27. {COMM_REPLICA, "REPLICA" , COMM_SZ_NULL, COMM_DECODE_GNAME, RsOffset(ReplicaName) },
  28. {COMM_JOIN_GUID, "JOIN_GUID" , COMM_SZ_GUL, COMM_DECODE_BLOB, RsOffset(JoinGuid) },
  29. {COMM_VVECTOR, "VVECTOR" , COMM_SZ_GVSN, COMM_DECODE_VVECTOR, RsOffset(VVector) },
  30. {COMM_CXTION, "CXTION" , COMM_SZ_NULL, COMM_DECODE_GNAME, RsOffset(Cxtion) },
  31. {COMM_BLOCK, "BLOCK" , COMM_SZ_NULL, COMM_DECODE_BLOB, RsOffset(Block) },
  32. {COMM_BLOCK_SIZE, "BLOCK_SIZE" , COMM_SZ_ULL, COMM_DECODE_ULONGLONG, RsOffset(BlockSize) },
  33. {COMM_FILE_SIZE, "FILE_SIZE" , COMM_SZ_ULL, COMM_DECODE_ULONGLONG, RsOffset(FileSize) },
  34. {COMM_FILE_OFFSET, "FILE_OFFSET" , COMM_SZ_ULL, COMM_DECODE_ULONGLONG, RsOffset(FileOffset) },
  35. {COMM_REMOTE_CO, "REMOTE_CO" , COMM_SZ_COC, COMM_DECODE_REMOTE_CO, RsOffset(PartnerChangeOrderCommand)},
  36. {COMM_GVSN, "GVSN" , COMM_SZ_GVSN, COMM_DECODE_BLOB, RsOffset(GVsn) },
  37. {COMM_CO_GUID, "CO_GUID" , COMM_SZ_GUL, COMM_DECODE_BLOB, RsOffset(ChangeOrderGuid) },
  38. {COMM_CO_SEQUENCE_NUMBER, "CO_SEQUENCE_NUMBER" , COMM_SZ_UL, COMM_DECODE_ULONG, RsOffset(ChangeOrderSequenceNumber)},
  39. {COMM_JOIN_TIME, "JOIN_TIME" , COMM_SZ_JTIME, COMM_DECODE_BLOB, RsOffset(JoinTime) },
  40. {COMM_LAST_JOIN_TIME, "LAST_JOIN_TIME" , COMM_SZ_ULL, COMM_DECODE_ULONGLONG, RsOffset(LastJoinTime) },
  41. {COMM_EOP, "EOP" , COMM_SZ_UL, COMM_DECODE_ULONG, RsOffsetSkip },
  42. {COMM_REPLICA_VERSION_GUID, "REPLICA_VERSION_GUID", COMM_SZ_GUL, COMM_DECODE_BLOB, RsOffset(ReplicaVersionGuid)},
  43. {COMM_MD5_DIGEST, "MD5_DIGEST" , COMM_SZ_MD5, COMM_DECODE_BLOB, RsOffset(Md5Digest) },
  44. {COMM_CO_EXT_WIN2K, "CO_EXT_WIN2K" , COMM_SZ_COEXT_W2K,COMM_DECODE_BLOB, RsOffset(PartnerChangeOrderCommandExt)},
  45. {COMM_CO_EXTENSION_2, "CO_EXTENSION_2" , COMM_SZ_NULL, COMM_DECODE_VAR_LEN_BLOB, RsOffset(PartnerChangeOrderCommandExt)},
  46. {COMM_COMPRESSION_GUID, "COMPRESSION_GUID" , COMM_SZ_GUID, COMM_DECODE_GUID, RsOffset(CompressionTable)}
  47. };
  48. VOID
  49. CommCopyMemory(
  50. IN PCOMM_PACKET CommPkt,
  51. IN PUCHAR Src,
  52. IN ULONG Len
  53. )
  54. /*++
  55. Routine Description:
  56. Copy memory into a comm packet, extending as necessary
  57. Arguments:
  58. CommPkt
  59. Src
  60. Len
  61. Return Value:
  62. None.
  63. --*/
  64. {
  65. #undef DEBSUB
  66. #define DEBSUB "CommCopyMemory:"
  67. ULONG MemLeft;
  68. PUCHAR NewPkt;
  69. //
  70. // Adjust size of comm packet if necessary
  71. //
  72. // PERF: How many allocs get done to send a CO??? This looks expensive.
  73. MemLeft = CommPkt->MemLen - CommPkt->PktLen;
  74. if (Len > MemLeft) {
  75. //
  76. // Just filling memory; extend memory, tacking on a little extra
  77. //
  78. CommPkt->MemLen = (((CommPkt->MemLen + Len) + (COMM_MEM_SIZE - 1))
  79. / COMM_MEM_SIZE)
  80. * COMM_MEM_SIZE;
  81. NewPkt = MALLOC(CommPkt->MemLen);
  82. CopyMemory(NewPkt, CommPkt->Pkt, CommPkt->PktLen);
  83. FREE(CommPkt->Pkt);
  84. CommPkt->Pkt = NewPkt;
  85. }
  86. //
  87. // Copy into the packet
  88. //
  89. if (Src != NULL) {
  90. CopyMemory(CommPkt->Pkt + CommPkt->PktLen, Src, Len);
  91. } else {
  92. ZeroMemory(CommPkt->Pkt + CommPkt->PktLen, Len);
  93. }
  94. CommPkt->PktLen += Len;
  95. }
  96. VOID
  97. CommPackULong(
  98. IN PCOMM_PACKET CommPkt,
  99. IN COMM_TYPE Type,
  100. IN ULONG Data
  101. )
  102. /*++
  103. Routine Description:
  104. Copy a header and a ulong into the comm packet.
  105. Arguments:
  106. CommPkt
  107. Type
  108. Data
  109. Return Value:
  110. None.
  111. --*/
  112. {
  113. #undef DEBSUB
  114. #define DEBSUB "CommPackULong:"
  115. ULONG Len = sizeof(ULONG);
  116. USHORT CommType = (USHORT)Type;
  117. CommCopyMemory(CommPkt, (PUCHAR)&CommType, sizeof(USHORT));
  118. printf("Packed CommType.\n");
  119. CommCopyMemory(CommPkt, (PUCHAR)&Len, sizeof(ULONG));
  120. printf("Packed Len.\n");
  121. CommCopyMemory(CommPkt, (PUCHAR)&Data, sizeof(ULONG));
  122. printf("Packed Data.\n");
  123. }
  124. PCOMM_PACKET
  125. CommStartCommPkt(
  126. IN PWCHAR Name
  127. )
  128. /*++
  129. Routine Description:
  130. Allocate a comm packet.
  131. Arguments:
  132. Name
  133. Return Value:
  134. Address of a comm packet.
  135. --*/
  136. {
  137. #undef DEBSUB
  138. #define DEBSUB "CommStartCommPkt:"
  139. ULONG Size;
  140. PCOMM_PACKET CommPkt;
  141. //
  142. // We can create a comm packet in a file or in memory
  143. //
  144. CommPkt = MALLOC(sizeof(COMM_PACKET));
  145. Size = COMM_MEM_SIZE;
  146. CommPkt->Pkt = MALLOC(Size);
  147. CommPkt->MemLen = Size;
  148. CommPkt->Major = NtFrsMajor;
  149. CommPkt->Minor = NtFrsCommMinor;
  150. printf("CommPkt initialized. Getting ready to add BOP\n");
  151. //
  152. // Pack the beginning-of-packet
  153. //
  154. CommPackULong(CommPkt, COMM_BOP, 0);
  155. return CommPkt;
  156. }
  157. PCOMM_PACKET
  158. BuildCommPktFromDescriptorList(
  159. IN PCOMM_PKT_DESCRIPTOR pListHead,
  160. IN ULONG ActualPktSize,
  161. IN OPTIONAL ULONG *Major,
  162. IN OPTIONAL ULONG *Minor,
  163. IN OPTIONAL ULONG *CsId,
  164. IN OPTIONAL ULONG *MemLen,
  165. IN OPTIONAL ULONG *PktLen,
  166. IN OPTIONAL ULONG *UpkLen
  167. )
  168. /*++
  169. Routine Description:
  170. Allocate a comm packet and fill it acording to the parameters specified..
  171. Arguments:
  172. pListHead - Address of the pListEntry of a COMM_PKT_DESCRIPTOR. We walk
  173. the list of descriptors to build the Pkt.
  174. ActualPktSize - Amount of memory to allocate for the Pkt.
  175. Major
  176. Minor
  177. CsId
  178. MemLen
  179. PktLen
  180. UpkLen - These parameters correspond to the fields in a COMM_PACKET. If
  181. they are NULL, the default value is used.
  182. Return Value:
  183. Address of a comm packet.
  184. --*/
  185. {
  186. PCOMM_PKT_DESCRIPTOR pDescriptor = pListHead;
  187. PCOMM_PACKET CommPkt = NULL;
  188. //
  189. // Allocate the CommPkt struct
  190. //
  191. CommPkt = MALLOC(sizeof(COMM_PACKET));
  192. //
  193. // Allocate the Pkt
  194. //
  195. CommPkt->Pkt = MALLOC(ActualPktSize);
  196. //
  197. // Set struct values. Use defaults if parameters are not specified.
  198. //
  199. CommPkt->MemLen = (MemLen?*MemLen:COMM_MEM_SIZE);
  200. CommPkt->Major = (Major?*Major:NtFrsMajor);
  201. CommPkt->Minor = (Minor?*Minor:NtFrsCommMinor);
  202. CommPkt->CsId = (CsId?*CsId:CS_RS);
  203. CommPkt->UpkLen = (UpkLen?*UpkLen:0);
  204. //
  205. // PktLen must be 0 for now so that CommCopyMemory will work correctly.
  206. // We'll set it to the provided value later.
  207. //
  208. CommPkt->PktLen = 0;
  209. while(pDescriptor != NULL) {
  210. CommCopyMemory(CommPkt, (PUCHAR)&(pDescriptor->CommType), sizeof(USHORT));
  211. CommCopyMemory(CommPkt, (PUCHAR)&(pDescriptor->CommDataLength), sizeof(ULONG));
  212. CommCopyMemory(CommPkt, (PUCHAR)(pDescriptor->Data), pDescriptor->ActualDataLength );
  213. pDescriptor = pDescriptor->Next;
  214. };
  215. //
  216. // We're done building the packet.
  217. // Now we can set PktLen tot he supplied value.
  218. //
  219. CommPkt->PktLen = (PktLen?*PktLen:CommPkt->PktLen);
  220. return CommPkt;
  221. }