**************************************************************************************************/
/* FPSpotlightRPC subcommand codes */
+#define SPOTLIGHT_CMD_VOLPATH 1
#define SPOTLIGHT_CMD_FLAGS 2
#define SPOTLIGHT_CMD_RPC 3
-#define SPOTLIGHT_CMD_VOLPATH 4
/* Spotlight epoch is UNIX epoch minus SPOTLIGHT_TIME_DELTA */
#define SPOTLIGHT_TIME_DELTA INT64_C(280878921600U)
#define SQ_TYPE_CNIDS 0x8700
#define SQ_TYPE_UUID 0x0e00
#define SQ_TYPE_DATE 0x8600
+#define SQ_TYPE_TOC 0x8800
-#define SQ_CPX_TYPE_ARRAY 0x0a00
-#define SQ_CPX_TYPE_STRING 0x0c00
-#define SQ_CPX_TYPE_UTF16_STRING 0x1c00
-#define SQ_CPX_TYPE_DICT 0x0d00
-#define SQ_CPX_TYPE_CNIDS 0x1a00
-#define SQ_CPX_TYPE_FILEMETA 0x1b00
+#define SQ_CPX_TYPE_ARRAY 0x0a00
+#define SQ_CPX_TYPE_STRING 0x0c00
+#define SQ_CPX_TYPE_UTF16_STRING 0x1c00
+#define SQ_CPX_TYPE_DICT 0x0d00
+#define SQ_CPX_TYPE_CNIDS 0x1a00
+#define SQ_CPX_TYPE_FILEMETA 0x1b00
#define SUBQ_SAFETY_LIM 20
#define SL_ENC_UTF_16 4
/* Forward declarations */
-static int dissect_spotlight(TALLOC_CTX *mem_ctx, const char *buf);
+static int dissect_spotlight(DALLOC_CTX *query, const char *buf);
+static int sl_pack_loop(DALLOC_CTX *query, char *buf, int offset, char *toc_buf, int *toc_idx);
-static double spotlight_ieee_double(const char *buf, int offset, uint encoding)
+/* Helper functions and stuff */
+static const char *neststrings[] = {
+ "",
+ "\t",
+ "\t\t",
+ "\t\t\t",
+ "\t\t\t\t",
+ "\t\t\t\t\t",
+ "\t\t\t\t\t\t",
+};
+
+static int dd_dump(DALLOC_CTX *dd, int nestinglevel)
+{
+ const char *type;
+
+ LOG(log_debug, logtype_sl, "%s%s(#%d): {",
+ neststrings[nestinglevel], talloc_get_name(dd), talloc_array_length(dd->dd_talloc_array));
+
+ for (int n = 0; n < talloc_array_length(dd->dd_talloc_array); n++) {
+
+ type = talloc_get_name(dd->dd_talloc_array[n]);
+
+ if (STRCMP(type, ==, "DALLOC_CTX")
+ || STRCMP(type, ==, "sl_array_t")
+ || STRCMP(type, ==, "sl_dict_t")) {
+ dd_dump(dd->dd_talloc_array[n], nestinglevel + 1);
+ } else if (STRCMP(type, ==, "uint64_t")) {
+ uint64_t i;
+ memcpy(&i, dd->dd_talloc_array[n], sizeof(uint64_t));
+ LOG(log_debug, logtype_sl, "%suint64_t: 0x%04x", neststrings[nestinglevel + 1], i);
+ } else if (STRCMP(type, ==, "int64_t")) {
+ int64_t i;
+ memcpy(&i, dd->dd_talloc_array[n], sizeof(int64_t));
+ LOG(log_debug, logtype_sl, "%sint64_t: %" PRId64, neststrings[nestinglevel + 1], i);
+ } else if (STRCMP(type, ==, "uint32_t")) {
+ uint32_t i;
+ memcpy(&i, dd->dd_talloc_array[n], sizeof(uint32_t));
+ LOG(log_debug, logtype_sl, "%s%s: %" PRIu32, neststrings[nestinglevel + 1], type, i);
+ } else if (STRCMP(type, ==, "char *")) {
+ char *s;
+ memcpy(&s, dd->dd_talloc_array[n], sizeof(char *));
+ LOG(log_debug, logtype_sl, "%sstring: %s", neststrings[nestinglevel + 1], s);
+ } else if (STRCMP(type, ==, "sl_bool_t")) {
+ sl_bool_t bl;
+ memcpy(&bl, dd->dd_talloc_array[n], sizeof(sl_bool_t));
+ LOG(log_debug, logtype_sl, "%sbool: %s", neststrings[nestinglevel + 1], bl ? "true" : "false");
+ } else if (STRCMP(type, ==, "sl_cnids_t")) {
+ sl_cnids_t cnids;
+ memcpy(&cnids, dd->dd_talloc_array[n], sizeof(sl_cnids_t));
+ LOG(log_debug, logtype_sl, "%sCNIDs: unkn1: %" PRIu16 ", unkn2: %" PRIu32,
+ neststrings[nestinglevel + 1], cnids.ca_unkn1, cnids.ca_context);
+ if (cnids.ca_cnids)
+ dd_dump(cnids.ca_cnids, nestinglevel + 1);
+ }
+ }
+ LOG(log_debug, logtype_sl, "%s}", neststrings[nestinglevel]);
+}
+
+/*
+* Returns the UTF-16 string encoding, by checking the 2-byte byte order mark.
+* If there is no byte order mark, -1 is returned.
+*/
+static uint spotlight_get_utf16_string_encoding(const char *buf, int offset, int query_length, uint encoding) {
+ uint utf16_encoding;
+
+ /* check for byte order mark */
+ utf16_encoding = SL_ENC_BIG_ENDIAN;
+ if (query_length >= 2) {
+ uint16_t byte_order_mark;
+ if (encoding == SL_ENC_LITTLE_ENDIAN)
+ byte_order_mark = SVAL(buf, offset);
+ else
+ byte_order_mark = RSVAL(buf, offset);
+
+ if (byte_order_mark == 0xFFFE) {
+ utf16_encoding = SL_ENC_BIG_ENDIAN | SL_ENC_UTF_16;
+ }
+ else if (byte_order_mark == 0xFEFF) {
+ utf16_encoding = SL_ENC_LITTLE_ENDIAN | SL_ENC_UTF_16;
+ }
+ }
+
+ return utf16_encoding;
+}
+
+/**************************************************************************************************
+ * marshalling functions
+ **************************************************************************************************/
+
+#define SL_OFFSET_DELTA 16
+
+static uint64_t sl_pack_tag(uint16_t type, uint16_t size_or_count, uint32_t val)
+{
+ uint64_t tag = ((uint64_t)val << 32) | ((uint64_t)type << 16) | size_or_count;
+ return tag;
+}
+
+static int sl_pack_float(double d, char *buf, int offset)
{
union {
double d;
- uint32_t w[2];
+ uint64_t w;
} ieee_fp_union;
- if (encoding == SL_ENC_LITTLE_ENDIAN) {
-#ifdef WORDS_BIGENDIAN
- ieee_fp_union.w[0] = IVAL(buf, offset + 4);
- ieee_fp_union.w[1] = IVAL(buf, offset);
-#else
- ieee_fp_union.w[0] = IVAL(buf, offset);
- ieee_fp_union.w[1] = IVAL(buf, offset + 4);
-#endif
- return ieee_fp_union.d;
- } else {
-#ifdef WORDS_BIGENDIAN
- ieee_fp_union.w[0] = RIVAL(buf, offset);
- ieee_fp_union.w[1] = RIVAL(buf, offset + 4);
-#else
- ieee_fp_union.w[0] = RIVAL(buf, offset + 4);
- ieee_fp_union.w[1] = RIVAL(buf, offset);
-#endif
- return ieee_fp_union.d;
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_FLOAT, 2, 1));
+ SLVAL(buf, offset + 8, ieee_fp_union.w);
+
+ return offset + 2 * sizeof(uint64_t);
+}
+
+static int sl_pack_uint64(uint64_t u, char *buf, int offset)
+{
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_INT64, 2, 1));
+ SLVAL(buf, offset + 8, u);
+
+ return offset + 2 * sizeof(uint64_t);
+}
+
+static int sl_pack_bool(sl_bool_t bl, char *buf, int offset)
+{
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_BOOL, 1, bl ? 1 : 0));
+
+ return offset + sizeof(uint64_t);
+}
+
+static int sl_pack_nil(char *buf, int offset)
+{
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_NULL, 1, 1));
+
+ return offset + sizeof(uint64_t);
+}
+
+static int sl_pack_date(sl_time_t t, char *buf, int offset)
+{
+ uint64_t data = 0;
+
+ data = (t.tv_sec + SPOTLIGHT_TIME_DELTA) << 24;
+
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_DATE, 2, 1));
+ SLVAL(buf, offset + 8, data);
+
+ return offset + 2 * sizeof(uint64_t);
+}
+
+static int sl_pack_uuid(sl_uuid_t *uuid, char *buf, int offset)
+{
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_UUID, 3, 1));
+ memcpy(buf + offset + 8, uuid, 16);
+
+ return offset + sizeof(uint64_t) + 16;
+}
+
+static int sl_pack_CNID(sl_cnids_t *cnids, char *buf, int offset, char *toc_buf, int *toc_idx)
+{
+ int len = 0, off = 0;
+ int cnid_count = talloc_array_length(cnids->ca_cnids);
+
+ SLVAL(toc_buf, *toc_idx * 8, sl_pack_tag(SQ_CPX_TYPE_CNIDS, (offset + SL_OFFSET_DELTA) / 8, cnid_count));
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_COMPLEX, 1, *toc_idx + 1));
+ *toc_idx += 1;
+ offset += 8;
+
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_CNIDS, 2 + cnid_count, 8 /* unknown meaning, but always 8 */));
+ offset += 8;
+
+ if (cnid_count > 0) {
+ SLVAL(buf, offset, sl_pack_tag(0x0add, cnid_count, cnids->ca_context));
+ offset += 8;
+
+ for (int i = 0; i < cnid_count; i++) {
+ SLVAL(buf, offset, cnids->ca_cnids->dd_talloc_array[i]);
+ offset += 8;
+ }
}
+
+ return offset;
}
-static uint64_t spotlight_ntoh64(const char *buf, int off, uint encoding)
+static int sl_pack_array(sl_array_t *array, char *buf, int offset, char *toc_buf, int *toc_idx)
{
- if (encoding == SL_ENC_LITTLE_ENDIAN)
- return LVAL(buf, off);
- else
- return ntoh64(LVAL(buf, off));
+ int count = talloc_array_length(array->dd_talloc_array);
+ int octets = (offset + SL_OFFSET_DELTA) / 8;
+
+ LOG(log_maxdebug, logtype_sl, "sl_pack_array: count: %d, offset:%d, octets: %d", count, offset, octets);
+
+ SLVAL(toc_buf, *toc_idx * 8, sl_pack_tag(SQ_CPX_TYPE_ARRAY, octets, count));
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_COMPLEX, 1, *toc_idx + 1));
+ *toc_idx += 1;
+ offset += 8;
+
+ offset = sl_pack_loop(array, buf, offset, toc_buf, toc_idx);
+
+ return offset;
}
-/*
-* Returns the UTF-16 string encoding, by checking the 2-byte byte order mark.
-* If there is no byte order mark, -1 is returned.
-*/
-static uint spotlight_get_utf16_string_encoding(const char *buf, int offset, int query_length, uint encoding) {
- uint utf16_encoding;
-
- /* check for byte order mark */
- utf16_encoding = SL_ENC_BIG_ENDIAN;
- if (query_length >= 2) {
- uint16_t byte_order_mark;
- if (encoding == SL_ENC_LITTLE_ENDIAN)
- byte_order_mark = SVAL(buf, offset);
- else
- byte_order_mark = RSVAL(buf, offset);
-
- if (byte_order_mark == 0xFFFE) {
- utf16_encoding = SL_ENC_BIG_ENDIAN | SL_ENC_UTF_16;
- }
- else if (byte_order_mark == 0xFEFF) {
- utf16_encoding = SL_ENC_LITTLE_ENDIAN | SL_ENC_UTF_16;
- }
- }
-
- return utf16_encoding;
+static int sl_pack_dict(sl_array_t *dict, char *buf, int offset, char *toc_buf, int *toc_idx)
+{
+ SLVAL(toc_buf, *toc_idx * 8, sl_pack_tag(SQ_CPX_TYPE_DICT, (offset + SL_OFFSET_DELTA) / 8, talloc_array_length(dict->dd_talloc_array)));
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_COMPLEX, 1, *toc_idx + 1));
+ *toc_idx += 1;
+ offset += 8;
+
+ offset = sl_pack_loop(dict, buf, offset, toc_buf, toc_idx);
+
+ return offset;
}
-static int spotlight_int64(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
+static int sl_pack_string(char **string, char *buf, int offset, char *toc_buf, int *toc_idx)
{
- int count, i;
- uint64_t query_data64;
+ int len, octets, used_in_last_octet;
+ char *s = *string;
+ len = strlen(s);
+ octets = (len / 8) + (len & 7 ? 1 : 0);
+ used_in_last_octet = 8 - (octets * 8 - len);
+
+ LOG(log_maxdebug, logtype_sl, "sl_pack_string(\"%s\"): len: %d, octets: %d, used_in_last_octet: %d",
+ s, len, octets, used_in_last_octet);
+
+ SLVAL(toc_buf, *toc_idx * 8, sl_pack_tag(SQ_CPX_TYPE_STRING, (offset + SL_OFFSET_DELTA) / 8, used_in_last_octet));
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_COMPLEX, 1, *toc_idx + 1));
+ *toc_idx += 1;
+ offset += 8;
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- count = query_data64 >> 32;
- offset += 8;
+ SLVAL(buf, offset, sl_pack_tag(SQ_TYPE_DATA, octets + 1, used_in_last_octet));
+ offset += 8;
- i = 0;
- while (i++ < count) {
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
+ memset(buf + offset, 0, octets * 8);
+ strncpy(buf + offset, s, len);
+ offset += octets * 8;
+
+ return offset;
+}
+
+static int sl_pack_loop(DALLOC_CTX *query, char *buf, int offset, char *toc_buf, int *toc_idx)
+{
+ const char *type;
+
+ for (int n = 0; n < talloc_array_length(query->dd_talloc_array); n++) {
+
+ type = talloc_get_name(query->dd_talloc_array[n]);
+
+ if (STRCMP(type, ==, "sl_array_t")) {
+ offset = sl_pack_array(query->dd_talloc_array[n], buf, offset, toc_buf, toc_idx);
+ } else if (STRCMP(type, ==, "sl_dict_t")) {
+ offset = sl_pack_dict(query->dd_talloc_array[n], buf, offset, toc_buf, toc_idx);
+ } else if (STRCMP(type, ==, "uint64_t")) {
+ uint64_t i;
+ memcpy(&i, query->dd_talloc_array[n], sizeof(uint64_t));
+ offset = sl_pack_uint64(i, buf, offset);
+ } else if (STRCMP(type, ==, "char *")) {
+ offset = sl_pack_string(query->dd_talloc_array[n], buf, offset, toc_buf, toc_idx);
+ } else if (STRCMP(type, ==, "sl_bool_t")) {
+ sl_bool_t bl;
+ memcpy(&bl, query->dd_talloc_array[n], sizeof(sl_bool_t));
+ offset = sl_pack_bool(bl, buf, offset);
+ } else if (STRCMP(type, ==, "double")) {
+ double d;
+ memcpy(&d, query->dd_talloc_array[n], sizeof(double));
+ offset = sl_pack_float(d, buf, offset);
+ } else if (STRCMP(type, ==, "sl_nil_t")) {
+ offset = sl_pack_nil(buf, offset);
+ } else if (STRCMP(type, ==, "sl_time_t")) {
+ sl_time_t t;
+ memcpy(&t, query->dd_talloc_array[n], sizeof(sl_time_t));
+ offset = sl_pack_date(t, buf, offset);
+ } else if (STRCMP(type, ==, "sl_uuid_t")) {
+ offset = sl_pack_uuid(query->dd_talloc_array[n], buf, offset);
+ } else if (STRCMP(type, ==, "sl_cnids_t")) {
+ offset = sl_pack_CNID(query->dd_talloc_array[n], buf, offset, toc_buf, toc_idx);
+ }
+ }
+
+ return offset;
+}
+
+#define MAX_SLQ_DAT 65000
+#define MAX_SLQ_TOC 2048
+
+static int sl_pack(DALLOC_CTX *query, char *buf)
+{
+ EC_INIT;
+ char toc_buf[MAX_SLQ_TOC];
+ int toc_index = 0;
+ int len = 0;
+
+ memcpy(buf, "432130dm", 8);
+ EC_NEG1_LOG( len = sl_pack_loop(query, buf + 16, 0, toc_buf + 8, &toc_index) );
+ SIVAL(buf, 8, len / 8 + 1 + toc_index + 1);
+ SIVAL(buf, 12, len / 8 + 1);
+
+ SLVAL(toc_buf, 0, sl_pack_tag(SQ_TYPE_TOC, toc_index + 1, 0));
+ memcpy(buf + 16 + len, toc_buf, (toc_index + 1 ) * 8);
+
+ len += 16 + (toc_index + 1 ) * 8;
+
+EC_CLEANUP:
+ if (ret != 0)
+ len = -1;
+ return len;
+}
+
+/**************************************************************************************************
+ * unmarshalling functions
+ **************************************************************************************************/
+
+static uint64_t sl_unpack_uint64(const char *buf, int offset, uint encoding)
+{
+ if (encoding == SL_ENC_LITTLE_ENDIAN)
+ return LVAL(buf, offset);
+ else
+ return RLVAL(buf, offset);
+}
+
+static int sl_unpack_ints(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
+{
+ int count, i;
+ uint64_t query_data64;
+
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ count = query_data64 >> 32;
+ offset += 8;
+
+ i = 0;
+ while (i++ < count) {
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
dalloc_add(query, &query_data64, uint64_t);
- offset += 8;
- }
+ offset += 8;
+ }
- return count;
+ return count;
}
-static int spotlight_date(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
+static int sl_unpack_date(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
{
- int count, i;
- uint64_t query_data64;
- sl_time_t t;
-
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- count = query_data64 >> 32;
- offset += 8;
-
- i = 0;
- while (i++ < count) {
- query_data64 = spotlight_ntoh64(buf, offset, encoding) >> 24;
- t.tv_sec = query_data64 - SPOTLIGHT_TIME_DELTA;
- t.tv_usec = 0;
+ int count, i;
+ uint64_t query_data64;
+ sl_time_t t;
+
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ count = query_data64 >> 32;
+ offset += 8;
+
+ i = 0;
+ while (i++ < count) {
+ query_data64 = sl_unpack_uint64(buf, offset, encoding) >> 24;
+ t.tv_sec = query_data64 - SPOTLIGHT_TIME_DELTA;
+ t.tv_usec = 0;
dalloc_add(query, &t, sl_time_t);
- offset += 8;
- }
+ offset += 8;
+ }
- return count;
+ return count;
}
-static int spotlight_uuid(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
+static int sl_unpack_uuid(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
{
- int count, i;
+ int count, i;
uint64_t query_data64;
sl_uuid_t uuid;
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- count = query_data64 >> 32;
- offset += 8;
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ count = query_data64 >> 32;
+ offset += 8;
- i = 0;
- while (i++ < count) {
+ i = 0;
+ while (i++ < count) {
memcpy(uuid.sl_uuid, buf + offset, 16);
dalloc_add(query, &uuid, sl_uuid_t);
- offset += 16;
- }
+ offset += 16;
+ }
- return count;
+ return count;
}
-static int spotlight_float(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
+static int sl_unpack_floats(DALLOC_CTX *query, const char *buf, int offset, uint encoding)
{
- int count, i;
- uint64_t query_data64;
- double fval;
-
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- count = query_data64 >> 32;
- offset += 8;
-
- i = 0;
- while (i++ < count) {
- fval = spotlight_ieee_double(buf, offset, encoding);
- dalloc_add(query, &fval, double);
- offset += 8;
- }
-
- return count;
+ int count, i;
+ uint64_t query_data64;
+ double fval;
+ union {
+ double d;
+ uint32_t w[2];
+ } ieee_fp_union;
+
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ count = query_data64 >> 32;
+ offset += 8;
+
+ i = 0;
+ while (i++ < count) {
+ if (encoding == SL_ENC_LITTLE_ENDIAN) {
+#ifdef WORDS_BIGENDIAN
+ ieee_fp_union.w[0] = IVAL(buf, offset + 4);
+ ieee_fp_union.w[1] = IVAL(buf, offset);
+#else
+ ieee_fp_union.w[0] = IVAL(buf, offset);
+ ieee_fp_union.w[1] = IVAL(buf, offset + 4);
+#endif
+ } else {
+#ifdef WORDS_BIGENDIAN
+ ieee_fp_union.w[0] = RIVAL(buf, offset);
+ ieee_fp_union.w[1] = RIVAL(buf, offset + 4);
+#else
+ ieee_fp_union.w[0] = RIVAL(buf, offset + 4);
+ ieee_fp_union.w[1] = RIVAL(buf, offset);
+#endif
+ }
+ dalloc_add(query, &ieee_fp_union.d, double);
+ offset += 8;
+ }
+
+ return count;
}
-static int spotlight_CNID_array(DALLOC_CTX *query, const char *buf, int offset, int length, uint encoding)
+static int sl_unpack_CNID(DALLOC_CTX *query, const char *buf, int offset, int length, uint encoding)
{
EC_INIT;
- int count;
- uint64_t query_data64;
+ int count;
+ uint64_t query_data64;
sl_cnids_t cnids;
EC_NULL( cnids.ca_cnids = talloc_zero(query, DALLOC_CTX) );
/* that's permitted, it's an empty array */
goto EC_CLEANUP;
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- count = query_data64 & 0xffff;
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ count = query_data64 & 0xffff;
- cnids.ca_unkn1 = (query_data64 & 0xffff0000) >> 16;
- cnids.ca_unkn2 = query_data64 >> 32;
+ cnids.ca_unkn1 = (query_data64 & 0xffff0000) >> 16;
+ cnids.ca_context = query_data64 >> 32;
- offset += 8;
+ offset += 8;
- while (count --) {
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
+ while (count --) {
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
dalloc_add(cnids.ca_cnids, &query_data64, uint64_t);
- offset += 8;
- }
+ offset += 8;
+ }
dalloc_add(query, &cnids, sl_cnids_t);
static const char *spotlight_get_qtype_string(uint64_t query_type)
{
- switch (query_type) {
- case SQ_TYPE_NULL:
- return "null";
- case SQ_TYPE_COMPLEX:
- return "complex";
- case SQ_TYPE_INT64:
- return "int64";
- case SQ_TYPE_BOOL:
- return "bool";
- case SQ_TYPE_FLOAT:
- return "float";
- case SQ_TYPE_DATA:
- return "data";
- case SQ_TYPE_CNIDS:
- return "CNIDs";
- default:
- return "unknown";
- }
+ switch (query_type) {
+ case SQ_TYPE_NULL:
+ return "null";
+ case SQ_TYPE_COMPLEX:
+ return "complex";
+ case SQ_TYPE_INT64:
+ return "int64";
+ case SQ_TYPE_BOOL:
+ return "bool";
+ case SQ_TYPE_FLOAT:
+ return "float";
+ case SQ_TYPE_DATA:
+ return "data";
+ case SQ_TYPE_CNIDS:
+ return "CNIDs";
+ default:
+ return "unknown";
+ }
}
static const char *spotlight_get_cpx_qtype_string(uint64_t cpx_query_type)
{
- switch (cpx_query_type) {
- case SQ_CPX_TYPE_ARRAY:
- return "array";
- case SQ_CPX_TYPE_STRING:
- return "string";
- case SQ_CPX_TYPE_UTF16_STRING:
- return "utf-16 string";
- case SQ_CPX_TYPE_DICT:
- return "dictionary";
- case SQ_CPX_TYPE_CNIDS:
- return "CNIDs";
- case SQ_CPX_TYPE_FILEMETA:
- return "FileMeta";
- default:
- return "unknown";
- }
+ switch (cpx_query_type) {
+ case SQ_CPX_TYPE_ARRAY:
+ return "array";
+ case SQ_CPX_TYPE_STRING:
+ return "string";
+ case SQ_CPX_TYPE_UTF16_STRING:
+ return "utf-16 string";
+ case SQ_CPX_TYPE_DICT:
+ return "dictionary";
+ case SQ_CPX_TYPE_CNIDS:
+ return "CNIDs";
+ case SQ_CPX_TYPE_FILEMETA:
+ return "FileMeta";
+ default:
+ return "unknown";
+ }
}
static int spotlight_dissect_loop(DALLOC_CTX *query,
const uint encoding)
{
EC_INIT;
- int i, toc_index, query_length;
+ int i, toc_index, query_length;
uint subcount, cpx_query_type, cpx_query_count;
- uint64_t query_data64, query_type;
- uint unicode_encoding;
- uint8_t mark_exists;
- const char *p;
-
- while (count > 0 && (offset < toc_offset)) {
- query_data64 = spotlight_ntoh64(buf, offset, encoding);
- query_length = (query_data64 & 0xffff) * 8;
- query_type = (query_data64 & 0xffff0000) >> 16;
- if (query_length == 0)
+ uint64_t query_data64, query_type;
+ uint unicode_encoding;
+ uint8_t mark_exists;
+ char *p;
+ int padding, slen;
+
+ while (count > 0 && (offset < toc_offset)) {
+ query_data64 = sl_unpack_uint64(buf, offset, encoding);
+ query_length = (query_data64 & 0xffff) * 8;
+ query_type = (query_data64 & 0xffff0000) >> 16;
+ if (query_length == 0)
EC_FAIL;
- switch (query_type) {
- case SQ_TYPE_COMPLEX:
- toc_index = (query_data64 >> 32) - 1;
- query_data64 = spotlight_ntoh64(buf, toc_offset + toc_index * 8, encoding);
- query_length += (query_data64 & 0xffff) * 8;
- cpx_query_type = (query_data64 & 0xffff0000) >> 16;
+ switch (query_type) {
+ case SQ_TYPE_COMPLEX:
+ toc_index = (query_data64 >> 32) - 1;
+ query_data64 = sl_unpack_uint64(buf, toc_offset + toc_index * 8, encoding);
+ cpx_query_type = (query_data64 & 0xffff0000) >> 16;
cpx_query_count = query_data64 >> 32;
switch (cpx_query_type) {
- case SQ_CPX_TYPE_ARRAY:
- EC_NEG1_LOG( spotlight_dissect_loop(query, buf, offset + 8, cpx_query_count, toc_offset, encoding) );
+ case SQ_CPX_TYPE_ARRAY: {
+ sl_array_t *sl_arrary = talloc_zero(query, sl_array_t);
+ EC_NEG1_LOG( offset = spotlight_dissect_loop(sl_arrary, buf, offset + 8, cpx_query_count, toc_offset, encoding) );
+ dalloc_add(query, sl_arrary, sl_array_t);
break;
- case SQ_CPX_TYPE_DICT:
- EC_NEG1_LOG( spotlight_dissect_loop(query, buf, offset + 8, cpx_query_count, toc_offset, encoding) );
+ }
+
+ case SQ_CPX_TYPE_DICT: {
+ sl_dict_t *sl_dict = talloc_zero(query, sl_dict_t);
+ EC_NEG1_LOG( offset = spotlight_dissect_loop(sl_dict, buf, offset + 8, cpx_query_count, toc_offset, encoding) );
+ dalloc_add(query, sl_dict, sl_dict_t);
break;
+ }
case SQ_CPX_TYPE_STRING:
- p = buf + offset + 16;
+ query_data64 = sl_unpack_uint64(buf, offset + 8, encoding);
+ query_length += (query_data64 & 0xffff) * 8;
+ if ((padding = 8 - (query_data64 >> 32)) < 0)
+ EC_FAIL;
+ if ((slen = query_length - 16 - padding) < 1)
+ EC_FAIL;
+ p = talloc_strndup(query, buf + offset + 16, slen);
dalloc_add(query, &p, char *);
break;
+
case SQ_CPX_TYPE_UTF16_STRING:
- unicode_encoding = spotlight_get_utf16_string_encoding(buf, offset + 16, query_length, encoding);
+ query_data64 = sl_unpack_uint64(buf, offset + 8, encoding);
+ query_length += (query_data64 & 0xffff) * 8;
+ if ((padding = 8 - (query_data64 >> 32)) < 0)
+ EC_FAIL;
+ if ((slen = query_length - 16 - padding) < 1)
+ EC_FAIL;
+
+ unicode_encoding = spotlight_get_utf16_string_encoding(buf, offset + 16, slen, encoding);
mark_exists = (unicode_encoding & SL_ENC_UTF_16);
unicode_encoding &= ~SL_ENC_UTF_16;
+
+ EC_NEG1( convert_string_allocate(CH_UCS2, CH_UTF8, buf + offset + (mark_exists ? 18 : 16), slen, &p) );
+ dalloc_add(query, &p, char *);
break;
+
case SQ_CPX_TYPE_FILEMETA:
+ query_data64 = sl_unpack_uint64(buf, offset + 8, encoding);
+ query_length += (query_data64 & 0xffff) * 8;
+
if (query_length <= 8) {
+ EC_FAIL_LOG("SQ_CPX_TYPE_FILEMETA: query_length <= 8%s", "");
} else {
EC_NEG1_LOG( dissect_spotlight(query, buf + offset + 16) );
}
break;
+
case SQ_CPX_TYPE_CNIDS:
- EC_NEG1_LOG( spotlight_CNID_array(query, buf, offset + 16, query_length, encoding) );
+ query_data64 = sl_unpack_uint64(buf, offset + 8, encoding);
+ query_length += (query_data64 & 0xffff) * 8;
+ EC_NEG1_LOG( sl_unpack_CNID(query, buf, offset + 16, query_length, encoding) );
break;
} /* switch (cpx_query_type) */
- count--;
- break;
+ count--;
+ break;
case SQ_TYPE_NULL: {
subcount = query_data64 >> 32;
if (subcount > 64)
EC_FAIL;
- sl_nit_t nil = 0;
+ sl_nil_t nil = 0;
for (i = 0; i < subcount; i++)
- dalloc_add(query, &nil, sl_nit_t);
+ dalloc_add(query, &nil, sl_nil_t);
count -= subcount;
break;
}
break;
}
case SQ_TYPE_INT64:
- EC_NEG1_LOG( subcount = spotlight_int64(query, buf, offset, encoding) );
+ EC_NEG1_LOG( subcount = sl_unpack_ints(query, buf, offset, encoding) );
count -= subcount;
break;
case SQ_TYPE_UUID:
- EC_NEG1_LOG( subcount = spotlight_uuid(query, buf, offset, encoding) );
+ EC_NEG1_LOG( subcount = sl_unpack_uuid(query, buf, offset, encoding) );
count -= subcount;
break;
case SQ_TYPE_FLOAT:
- EC_NEG1_LOG( subcount = spotlight_float(query, buf, offset, encoding) );
+ EC_NEG1_LOG( subcount = sl_unpack_floats(query, buf, offset, encoding) );
count -= subcount;
break;
case SQ_TYPE_DATE:
- EC_NEG1_LOG( subcount = spotlight_date(query, buf, offset, encoding) );
+ EC_NEG1_LOG( subcount = sl_unpack_date(query, buf, offset, encoding) );
count -= subcount;
break;
- case SQ_TYPE_CNIDS:
- EC_NEG1_LOG( spotlight_CNID_array(query, buf, offset + 8, query_length, encoding) );
- break;
default:
EC_FAIL;
}
if (ret != 0) {
offset = -1;
}
- return offset;
+ return offset;
}
-static int dissect_spotlight(TALLOC_CTX *mem_ctx, const char *buf)
+static int dissect_spotlight(DALLOC_CTX *query, const char *buf)
{
EC_INIT;
- int encoding, i, toc_entries;
- uint64_t toc_offset, tquerylen, toc_entry;
- DALLOC_CTX *query;
+ int encoding, i, toc_entries;
+ uint64_t toc_offset, tquerylen, toc_entry;
- if (strncmp(buf, "md031234", 8) == 0)
- encoding = SL_ENC_BIG_ENDIAN;
- else
- encoding = SL_ENC_LITTLE_ENDIAN;
+ if (strncmp(buf, "md031234", 8) == 0)
+ encoding = SL_ENC_BIG_ENDIAN;
+ else
+ encoding = SL_ENC_LITTLE_ENDIAN;
- buf += 8;
+ buf += 8;
- toc_offset = ((spotlight_ntoh64(buf, 0, encoding) >> 32) - 1 ) * 8;
- if (toc_offset < 0 || (toc_offset > 65000)) {
+ toc_offset = ((sl_unpack_uint64(buf, 0, encoding) >> 32) - 1 ) * 8;
+ if (toc_offset < 0 || (toc_offset > 65000)) {
EC_FAIL;
- }
+ }
- buf += 8;
+ buf += 8;
- toc_entries = (int)(spotlight_ntoh64(buf, toc_offset, encoding) & 0xffff);
+ toc_entries = (int)(sl_unpack_uint64(buf, toc_offset, encoding) & 0xffff);
- EC_NULL( query = talloc_zero(mem_ctx, DALLOC_CTX) );
- EC_NEG1( spotlight_dissect_loop(query, buf, 0, 1, toc_offset + 8, encoding) );
+ EC_NEG1( spotlight_dissect_loop(query, buf, 0, 1, toc_offset + 8, encoding) );
+
+EC_CLEANUP:
+ EC_EXIT;
+}
+
+/**************************************************************************************************
+ * Spotlight RPC functions
+ **************************************************************************************************/
+
+static int sl_rpc_fetchPropertiesForContext(AFPObj *obj, const DALLOC_CTX *query, DALLOC_CTX *reply, const struct vol *v)
+{
+ EC_INIT;
+
+ char *s;
+ sl_dict_t *dict;
+ sl_array_t *array;
+ sl_uuid_t uuid;
+
+ if (!v->v_uuid)
+ EC_FAIL_LOG("sl_rpc_fetchPropertiesForContext: missing UUID for volume: %s", v->v_localname);
+
+ dict = talloc_zero(reply, sl_dict_t);
+
+ /* key/val 1 */
+ s = talloc_strdup(dict, "kMDSStoreMetaScopes");
+ dalloc_add(dict, &s, char *);
+
+ array = talloc_zero(dict, sl_array_t);
+ s = talloc_strdup(array, "kMDQueryScopeComputer");
+ dalloc_add(array, &s, char *);
+ dalloc_add(dict, array, sl_array_t);
+
+ /* key/val 2 */
+ s = talloc_strdup(dict, "kMDSStorePathScopes");
+ dalloc_add(dict, &s, char *);
+
+ array = talloc_zero(dict, sl_array_t);
+ s = talloc_strdup(array, v->v_path);
+ dalloc_add(array, &s, char *);
+ dalloc_add(dict, array, sl_array_t);
+
+ /* key/val 3 */
+ s = talloc_strdup(dict, "kMDSStoreUUID");
+ dalloc_add(dict, &s, char *);
+
+ memcpy(uuid.sl_uuid, v->v_uuid, 16);
+ dalloc_add(dict, &uuid, sl_uuid_t);
+
+ /* key/val 4 */
+ s = talloc_strdup(dict, "kMDSStoreHasPersistentUUID");
+ dalloc_add(dict, &s, char *);
+ sl_bool_t b = true;
+ dalloc_add(dict, &b, sl_bool_t);
+
+ dalloc_add(reply, dict, sl_dict_t);
EC_CLEANUP:
EC_EXIT;
int cmd;
int endianess = SL_ENC_LITTLE_ENDIAN;
struct vol *vol;
+ DALLOC_CTX *query;
*rbuflen = 0;
ibuflen -= 2;
vid = SVAL(ibuf, 0);
- LOG(logtype_default, log_note, "afp_spotlight_rpc(vid: %" PRIu16 ")", vid);
+ LOG(log_debug, logtype_sl, "afp_spotlight_rpc(vid: %" PRIu16 ")", vid);
if ((vol = getvolbyvid(vid)) == NULL) {
- LOG(logtype_default, log_error, "afp_spotlight_rpc: bad volume id: %" PRIu16 ")", vid);
+ LOG(log_error, logtype_sl, "afp_spotlight_rpc: bad volume id: %" PRIu16 ")", vid);
ret = AFPERR_ACCESS;
goto EC_CLEANUP;
}
/* IVAL(ibuf, 2): unknown, always 0x00008004, some flags ? */
cmd = RIVAL(ibuf, 6);
- LOG(logtype_default, log_note, "afp_spotlight_rpc(cmd: %d)", cmd);
+ LOG(log_debug, logtype_sl, "afp_spotlight_rpc(cmd: %d)", cmd);
/* IVAL(ibuf, 10: unknown, always 0x00000000 */
- switch (cmd) {
+ switch (cmd) {
- case SPOTLIGHT_CMD_VOLPATH: {
+ case SPOTLIGHT_CMD_VOLPATH: {
RSIVAL(rbuf, 0, ntohs(vid));
RSIVAL(rbuf, 4, 0);
int len = strlen(vol->v_path) + 1;
strncpy(rbuf + 8, vol->v_path, len);
*rbuflen += 8 + len;
- break;
+ break;
}
- case SPOTLIGHT_CMD_FLAGS:
+ case SPOTLIGHT_CMD_FLAGS:
RSIVAL(rbuf, 0, 0x0100006b); /* Whatever this value means... flags? */
*rbuflen += 4;
- break;
+ break;
+
+ case SPOTLIGHT_CMD_RPC: {
+ DALLOC_CTX *query;
+ EC_NULL( query = talloc_zero(tmp_ctx, DALLOC_CTX) );
+ DALLOC_CTX *reply;
+ EC_NULL( reply = talloc_zero(tmp_ctx, DALLOC_CTX) );
+
+ EC_ZERO( dissect_spotlight(query, ibuf + 22) );
+ dd_dump(query, 0);
+
+ char **cmd;
+ EC_NULL_LOG( cmd = dalloc_get(query, "DALLOC_CTX", 0, "DALLOC_CTX", 0, "char *", 0) );
- case SPOTLIGHT_CMD_RPC:
- (void)dissect_spotlight(tmp_ctx, ibuf + 22);
- break;
- }
+
+ if (STRCMP(*cmd, ==, "fetchPropertiesForContext:")) {
+ EC_ZERO_LOG( sl_rpc_fetchPropertiesForContext(obj, query, reply, vol) );
+ } else if (STRCMP(*cmd, ==, "fetchQueryResultsForContext:")) {
+ uint64_t *p;
+ if ((p = dalloc_get(query, "DALLOC_CTX", 0, "DALLOC_CTX", 0, "uint64_t", 1)) != NULL) {
+ LOG(log_info, logtype_sl, "fetchQueryResultsForContext: 0x%" PRIx64, *p);
+ }
+ }
+
+ /* Spotlight RPC status code ? 0 in all traces, we use 0xffffffff for an error, never seen from Apple */
+ if (ret == 0)
+ memset(rbuf, 0, 4);
+ else
+ memset(rbuf, 0xff, 4);
+ *rbuflen += 4;
+
+ int len;
+ EC_NEG1_LOG( len = sl_pack(reply, rbuf + 4) );
+ *rbuflen += len;
+ break;
+ }
+ }
EC_CLEANUP:
talloc_free(tmp_ctx);
if (ret != AFP_OK) {
-
+ *rbuflen = 0;
+ return AFPERR_MISC;
}
EC_EXIT;
}
#ifdef SPOT_TEST_MAIN
-static const char *neststrings[] = {
- "",
- " ",
- " ",
- " ",
- " ",
- " ",
- " "
-};
-
-static int dd_dump(DALLOC_CTX *dd, int nestinglevel)
-{
- const char *type;
-
- printf("%sArray(#%d): {\n", neststrings[nestinglevel], talloc_array_length(dd->dd_talloc_array));
-
- for (int n = 0; n < talloc_array_length(dd->dd_talloc_array); n++) {
-
- type = talloc_get_name(dd->dd_talloc_array[n]);
-
- if (STRCMP(type, ==, "int64_t")) {
- int64_t i;
- memcpy(&i, dd->dd_talloc_array[n], sizeof(int64_t));
- printf("%s%d:\t%" PRId64 "\n", neststrings[nestinglevel + 1], n, i);
- } else if (STRCMP(type, ==, "uint32_t")) {
- uint32_t i;
- memcpy(&i, dd->dd_talloc_array[n], sizeof(uint32_t));
- printf("%s%d:\t%" PRIu32 "\n", neststrings[nestinglevel + 1], n, i);
- } else if (STRCMP(type, ==, "char *")) {
- char *s;
- memcpy(&s, dd->dd_talloc_array[n], sizeof(char *));
- printf("%s%d:\t%s\n", neststrings[nestinglevel + 1], n, s);
- } else if (STRCMP(type, ==, "sl_bool_t")) {
- sl_bool_t bl;
- memcpy(&bl, dd->dd_talloc_array[n], sizeof(sl_bool_t));
- printf("%s%d:\t%s\n", neststrings[nestinglevel + 1], n, bl ? "true" : "false");
- } else if (STRCMP(type, ==, "DALLOC_CTX")) {
- DALLOC_CTX nested;
- memcpy(&nested, dd->dd_talloc_array[n], sizeof(DALLOC_CTX));
- dd_dump(&nested, nestinglevel + 1);
- } else if (STRCMP(type, ==, "sl_cnids_t *")) {
- sl_cnids_t *cnids;
- memcpy(&cnids, dd->dd_talloc_array[n], sizeof(sl_cnids_t *));
- printf("%s%d:\tunkn1: %" PRIu16 ", unkn2: %" PRIu32,
- neststrings[nestinglevel + 1], n, cnids->ca_unkn1, cnids->ca_unkn2);
- if (cnids->ca_cnids)
- dd_dump(cnids->ca_cnids, nestinglevel + 1);
- } else if (STRCMP(type, ==, "sl_cnids_t")) {
- sl_cnids_t cnids;
- memcpy(&cnids, dd->dd_talloc_array[n], sizeof(sl_cnids_t));
- printf("%s%d:\tunkn1: %" PRIu16 ", unkn2: %" PRIu32,
- neststrings[nestinglevel + 1], n, cnids.ca_unkn1, cnids.ca_unkn2);
- if (cnids.ca_cnids)
- dd_dump(cnids.ca_cnids, nestinglevel + 1);
- }
- }
- printf("%s}\n", neststrings[nestinglevel]);
-}
-
-#include <stdarg.h>
-
int main(int argc, char **argv)
{
+ EC_INIT;
TALLOC_CTX *mem_ctx = talloc_new(NULL);
DALLOC_CTX *dd = talloc_zero(mem_ctx, DALLOC_CTX);
int64_t i;
set_processname("spot");
- setuplog("default:info", "/dev/tty");
+ setuplog("default:info,spotlight:debug", "/dev/tty");
- LOG(logtype_default, log_info, "Start");
+ LOG(log_info, logtype_sl, "Start");
+#if 0
i = 2;
dalloc_add(dd, &i, int64_t);
cnids->ca_unkn2 = 2;
dalloc_add(cnids->ca_cnids, &id, uint32_t);
- dalloc_add(dd, &cnids, sl_cnids_t *);
+ dalloc_add(dd, cnids, sl_cnids_t);
- /* test an stack CNID array */
- id = 17;
- sl_cnids_t cnids2;
+#endif
- cnids2.ca_cnids = talloc_zero(mem_ctx, DALLOC_CTX);
- cnids2.ca_unkn1 = 3;
- cnids2.ca_unkn2 = 4;
+ /* Now the Spotlight types */
+ sl_array_t *sl_arrary = talloc_zero(dd, sl_array_t);
+ i = 1234;
+ dalloc_add(sl_arrary, &i, int64_t);
- dalloc_add(cnids2.ca_cnids, &id, uint32_t);
- dalloc_add(dd, &cnids2, sl_cnids_t);
+ sl_dict_t *sl_dict = talloc_zero(dd, sl_dict_t);
+ i = 5678;
+ dalloc_add(sl_dict, &i, int64_t);
+ dalloc_add(sl_arrary, sl_dict, sl_dict_t);
+ dalloc_add(dd, sl_arrary, sl_array_t);
dd_dump(dd, 0);
- talloc_free(mem_ctx);
- return 0;
+
+#if 0
+ /* now parse a real spotlight packet */
+ char ibuf[8192];
+ char rbuf[8192];
+ int fd;
+ size_t len;
+ DALLOC_CTX *query;
+
+ EC_NULL( query = talloc_zero(mem_ctx, DALLOC_CTX) );
+
+ EC_NEG1_LOG( fd = open("spotlight-packet.bin", O_RDONLY) );
+ EC_NEG1_LOG( len = read(fd, ibuf, 8192) );
+ close(fd);
+ EC_NEG1_LOG( dissect_spotlight(query, ibuf + 24) );
+
+ /* Now dump the whole thing */
+ dd_dump(query, 0);
+
+ int qlen;
+ char buf[MAX_SLQ_DAT];
+ EC_NEG1_LOG( qlen = sl_pack(query, buf) );
+
+ EC_NEG1_LOG( fd = open("test.bin", O_RDWR) );
+ lseek(fd, 24, SEEK_SET);
+ write(fd, buf, qlen);
+ close(fd);
+#endif
+
+EC_CLEANUP:
+ if (mem_ctx) {
+ talloc_free(mem_ctx);
+ mem_ctx = NULL;
+ }
+ EC_EXIT;
}
#endif
projects / netatalk.git / blobdiff