?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
auth: Make sure that creds_out is initialized with NULL.
[Samba.git] / source3 / smbd / smb2_ioctl.c
blob8d24fb59bed0647d981d21ee63de3c8efb9197ee
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
28 #include "../librpc/ndr/libndr.h"
29
30 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
31 struct tevent_context *ev,
32 struct smbd_smb2_request *smb2req,
33 struct files_struct *in_fsp,
34 uint32_t in_ctl_code,
35 DATA_BLOB in_input,
36 uint32_t in_max_output,
37 uint32_t in_flags);
38 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
39 TALLOC_CTX *mem_ctx,
40 DATA_BLOB *out_output,
41 bool *disconnect);
42
43 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq);
44 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
45 {
46 NTSTATUS status;
47 const uint8_t *inbody;
48 uint32_t min_buffer_offset;
49 uint32_t max_buffer_offset;
50 uint32_t min_output_offset;
51 uint32_t allowed_length_in;
52 uint32_t allowed_length_out;
53 uint32_t in_ctl_code;
54 uint64_t in_file_id_persistent;
55 uint64_t in_file_id_volatile;
56 struct files_struct *in_fsp = NULL;
57 uint32_t in_input_offset;
58 uint32_t in_input_length;
59 DATA_BLOB in_input_buffer = data_blob_null;
60 uint32_t in_max_input_length;
61 uint32_t in_output_offset;
62 uint32_t in_output_length;
63 DATA_BLOB in_output_buffer = data_blob_null;
64 uint32_t in_max_output_length;
65 uint32_t in_flags;
66 uint32_t data_length_in;
67 uint32_t data_length_out;
68 uint32_t data_length_tmp;
69 uint32_t data_length_max;
70 struct tevent_req *subreq;
71
72 status = smbd_smb2_request_verify_sizes(req, 0x39);
73 if (!NT_STATUS_IS_OK(status)) {
74 return smbd_smb2_request_error(req, status);
75 }
76 inbody = SMBD_SMB2_IN_BODY_PTR(req);
77
78 in_ctl_code = IVAL(inbody, 0x04);
79 in_file_id_persistent = BVAL(inbody, 0x08);
80 in_file_id_volatile = BVAL(inbody, 0x10);
81 in_input_offset = IVAL(inbody, 0x18);
82 in_input_length = IVAL(inbody, 0x1C);
83 in_max_input_length = IVAL(inbody, 0x20);
84 in_output_offset = IVAL(inbody, 0x24);
85 in_output_length = IVAL(inbody, 0x28);
86 in_max_output_length = IVAL(inbody, 0x2C);
87 in_flags = IVAL(inbody, 0x30);
88
89 min_buffer_offset = SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req);
90 max_buffer_offset = min_buffer_offset + SMBD_SMB2_IN_DYN_LEN(req);
91 min_output_offset = min_buffer_offset;
92
93 /*
94 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
95 * the SMB2 header to the input data buffer. If no input data is
96 * required for the FSCTL/IOCTL command being issued, the client SHOULD
97 * set this value to 0.<49>
98 * <49> If no input data is required for the FSCTL/IOCTL command being
99 * issued, Windows-based clients set this field to any value.
100 */
101 allowed_length_in = 0;
102 if ((in_input_offset > 0) && (in_input_length > 0)) {
103 uint32_t tmp_ofs;
104
105 if (in_input_offset < min_buffer_offset) {
106 return smbd_smb2_request_error(req,
107 NT_STATUS_INVALID_PARAMETER);
108 }
109 if (in_input_offset > max_buffer_offset) {
110 return smbd_smb2_request_error(req,
111 NT_STATUS_INVALID_PARAMETER);
112 }
113 allowed_length_in = max_buffer_offset - in_input_offset;
114
115 tmp_ofs = in_input_offset - min_buffer_offset;
116 in_input_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
117 in_input_buffer.data += tmp_ofs;
118 in_input_buffer.length = in_input_length;
119 min_output_offset += tmp_ofs;
120 min_output_offset += in_input_length;
121 }
122
123 if (in_input_length > allowed_length_in) {
124 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
125 }
126
127 allowed_length_out = 0;
128 if (in_output_offset > 0) {
129 if (in_output_offset < min_buffer_offset) {
130 return smbd_smb2_request_error(req,
131 NT_STATUS_INVALID_PARAMETER);
132 }
133 if (in_output_offset > max_buffer_offset) {
134 return smbd_smb2_request_error(req,
135 NT_STATUS_INVALID_PARAMETER);
136 }
137 allowed_length_out = max_buffer_offset - in_output_offset;
138 }
139
140 if (in_output_length > allowed_length_out) {
141 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
142 }
143
144 if (in_output_length > 0) {
145 uint32_t tmp_ofs;
146
147 if (in_output_offset < min_output_offset) {
148 return smbd_smb2_request_error(req,
149 NT_STATUS_INVALID_PARAMETER);
150 }
151
152 tmp_ofs = in_output_offset - min_buffer_offset;
153 in_output_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
154 in_output_buffer.data += tmp_ofs;
155 in_output_buffer.length = in_output_length;
156 }
157
158 /*
159 * verify the credits and avoid overflows
160 * in_input_buffer.length and in_output_buffer.length
161 * are already verified.
162 */
163 data_length_in = in_input_buffer.length + in_output_buffer.length;
164
165 data_length_out = in_max_input_length;
166 data_length_tmp = UINT32_MAX - data_length_out;
167 if (data_length_tmp < in_max_output_length) {
168 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
169 }
170 data_length_out += in_max_output_length;
171
172 data_length_max = MAX(data_length_in, data_length_out);
173
174 status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
175 if (!NT_STATUS_IS_OK(status)) {
176 return smbd_smb2_request_error(req, status);
177 }
178
179 /*
180 * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
181 * server MUST fail the request with STATUS_NOT_SUPPORTED.
182 */
183 if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
184 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
185 }
186
187 switch (in_ctl_code) {
188 case FSCTL_DFS_GET_REFERRALS:
189 case FSCTL_DFS_GET_REFERRALS_EX:
190 case FSCTL_PIPE_WAIT:
191 case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
192 case FSCTL_VALIDATE_NEGOTIATE_INFO:
193 case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
194 /*
195 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
196 * FSCTL_PIPE_WAIT does not take a file handle.
197 *
198 * If FileId in the SMB2 Header of the request is not
199 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
200 * with STATUS_INVALID_PARAMETER.
201 */
202 if (in_file_id_persistent != UINT64_MAX ||
203 in_file_id_volatile != UINT64_MAX) {
204 return smbd_smb2_request_error(req,
205 NT_STATUS_INVALID_PARAMETER);
206 }
207 break;
208 default:
209 in_fsp = file_fsp_smb2(req, in_file_id_persistent,
210 in_file_id_volatile);
211 if (in_fsp == NULL) {
212 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
213 }
214 break;
215 }
216
217 subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
218 req, in_fsp,
219 in_ctl_code,
220 in_input_buffer,
221 in_max_output_length,
222 in_flags);
223 if (subreq == NULL) {
224 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
225 }
226 tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
227
228 return smbd_smb2_request_pending_queue(req, subreq, 1000);
229 }
230
231 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
232 {
233 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
234 struct smbd_smb2_request);
235 const uint8_t *inbody;
236 DATA_BLOB outbody;
237 DATA_BLOB outdyn;
238 uint32_t in_ctl_code;
239 uint64_t in_file_id_persistent;
240 uint64_t in_file_id_volatile;
241 uint32_t out_input_offset;
242 uint32_t out_output_offset;
243 DATA_BLOB out_output_buffer = data_blob_null;
244 NTSTATUS status;
245 NTSTATUS error; /* transport error */
246 bool disconnect = false;
247
248 status = smbd_smb2_ioctl_recv(subreq, req,
249 &out_output_buffer,
250 &disconnect);
251
252 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
253 "%u status %s\n",
254 (unsigned int)out_output_buffer.length,
255 nt_errstr(status) ));
256
257 TALLOC_FREE(subreq);
258 if (disconnect) {
259 error = status;
260 smbd_server_connection_terminate(req->sconn,
261 nt_errstr(error));
262 return;
263 }
264
265 if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
266 /* also ok */
267 } else if (!NT_STATUS_IS_OK(status)) {
268 error = smbd_smb2_request_error(req, status);
269 if (!NT_STATUS_IS_OK(error)) {
270 smbd_server_connection_terminate(req->sconn,
271 nt_errstr(error));
272 return;
273 }
274 return;
275 }
276
277 out_input_offset = SMB2_HDR_BODY + 0x30;
278 out_output_offset = SMB2_HDR_BODY + 0x30;
279
280 inbody = SMBD_SMB2_IN_BODY_PTR(req);
281
282 in_ctl_code = IVAL(inbody, 0x04);
283 in_file_id_persistent = BVAL(inbody, 0x08);
284 in_file_id_volatile = BVAL(inbody, 0x10);
285
286 outbody = data_blob_talloc(req->out.vector, NULL, 0x30);
287 if (outbody.data == NULL) {
288 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
289 if (!NT_STATUS_IS_OK(error)) {
290 smbd_server_connection_terminate(req->sconn,
291 nt_errstr(error));
292 return;
293 }
294 return;
295 }
296
297 SSVAL(outbody.data, 0x00, 0x30 + 1); /* struct size */
298 SSVAL(outbody.data, 0x02, 0); /* reserved */
299 SIVAL(outbody.data, 0x04,
300 in_ctl_code); /* ctl code */
301 SBVAL(outbody.data, 0x08,
302 in_file_id_persistent); /* file id (persistent) */
303 SBVAL(outbody.data, 0x10,
304 in_file_id_volatile); /* file id (volatile) */
305 SIVAL(outbody.data, 0x18,
306 out_input_offset); /* input offset */
307 SIVAL(outbody.data, 0x1C, 0); /* input count */
308 SIVAL(outbody.data, 0x20,
309 out_output_offset); /* output offset */
310 SIVAL(outbody.data, 0x24,
311 out_output_buffer.length); /* output count */
312 SIVAL(outbody.data, 0x28, 0); /* flags */
313 SIVAL(outbody.data, 0x2C, 0); /* reserved */
314
315 /*
316 * Note: Windows Vista and 2008 send back also the
317 * input from the request. But it was fixed in
318 * Windows 7.
319 */
320 outdyn = out_output_buffer;
321
322 error = smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
323 __location__);
324 if (!NT_STATUS_IS_OK(error)) {
325 smbd_server_connection_terminate(req->sconn,
326 nt_errstr(error));
327 return;
328 }
329 }
330
331 struct smbd_smb2_ioctl_state {
332 struct smbd_smb2_request *smb2req;
333 struct smb_request *smbreq;
334 files_struct *fsp;
335 DATA_BLOB in_input;
336 uint32_t in_max_output;
337 DATA_BLOB out_output;
338 bool disconnect;
339 };
340
341 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq);
342 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq);
343
344 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
345 struct tevent_context *ev,
346 struct smbd_smb2_request *smb2req,
347 struct files_struct *fsp,
348 uint32_t in_ctl_code,
349 DATA_BLOB in_input,
350 uint32_t in_max_output,
351 uint32_t in_flags)
352 {
353 struct tevent_req *req;
354 struct smbd_smb2_ioctl_state *state;
355 struct smb_request *smbreq;
356 struct tevent_req *subreq;
357
358 req = tevent_req_create(mem_ctx, &state,
359 struct smbd_smb2_ioctl_state);
360 if (req == NULL) {
361 return NULL;
362 }
363 state->smb2req = smb2req;
364 state->smbreq = NULL;
365 state->fsp = fsp;
366 state->in_input = in_input;
367 state->in_max_output = in_max_output;
368 state->out_output = data_blob_null;
369
370 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s, %s\n",
371 (unsigned)in_ctl_code,
372 fsp ? fsp_str_dbg(fsp) : "<no handle>",
373 fsp_fnum_dbg(fsp)));
374
375 smbreq = smbd_smb2_fake_smb_request(smb2req);
376 if (tevent_req_nomem(smbreq, req)) {
377 return tevent_req_post(req, ev);
378 }
379 state->smbreq = smbreq;
380
381 switch (in_ctl_code) {
382 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
383 {
384 uint16_t in_max_referral_level;
385 DATA_BLOB in_file_name_buffer;
386 char *in_file_name_string;
387 size_t in_file_name_string_size;
388 bool ok;
389 bool overflow = false;
390 NTSTATUS status;
391 int dfs_size;
392 char *dfs_data = NULL;
393
394 if (!IS_IPC(smbreq->conn)) {
395 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
396 return tevent_req_post(req, ev);
397 }
398
399 if (!lp_host_msdfs()) {
400 tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED);
401 return tevent_req_post(req, ev);
402 }
403
404 if (in_input.length < (2 + 2)) {
405 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
406 return tevent_req_post(req, ev);
407 }
408
409 in_max_referral_level = SVAL(in_input.data, 0);
410 in_file_name_buffer.data = in_input.data + 2;
411 in_file_name_buffer.length = in_input.length - 2;
412
413 ok = convert_string_talloc(state, CH_UTF16, CH_UNIX,
414 in_file_name_buffer.data,
415 in_file_name_buffer.length,
416 &in_file_name_string,
417 &in_file_name_string_size);
418 if (!ok) {
419 tevent_req_nterror(req, NT_STATUS_ILLEGAL_CHARACTER);
420 return tevent_req_post(req, ev);
421 }
422
423 dfs_size = setup_dfs_referral(smbreq->conn,
424 in_file_name_string,
425 in_max_referral_level,
426 &dfs_data, &status);
427 if (dfs_size < 0) {
428 tevent_req_nterror(req, status);
429 return tevent_req_post(req, ev);
430 }
431
432 if (dfs_size > in_max_output) {
433 /*
434 * TODO: we need a testsuite for this
435 */
436 overflow = true;
437 dfs_size = in_max_output;
438 }
439
440 state->out_output = data_blob_talloc(state,
441 (uint8_t *)dfs_data,
442 dfs_size);
443 SAFE_FREE(dfs_data);
444 if (dfs_size > 0 &&
445 tevent_req_nomem(state->out_output.data, req)) {
446 return tevent_req_post(req, ev);
447 }
448
449 if (overflow) {
450 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
451 } else {
452 tevent_req_done(req);
453 }
454 return tevent_req_post(req, ev);
455 }
456 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
457
458 if (!IS_IPC(smbreq->conn)) {
459 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
460 return tevent_req_post(req, ev);
461 }
462
463 if (fsp == NULL) {
464 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
465 return tevent_req_post(req, ev);
466 }
467
468 if (!fsp_is_np(fsp)) {
469 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
470 return tevent_req_post(req, ev);
471 }
472
473 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
474 (unsigned int)in_input.length ));
475
476 subreq = np_write_send(state, ev,
477 fsp->fake_file_handle,
478 in_input.data,
479 in_input.length);
480 if (tevent_req_nomem(subreq, req)) {
481 return tevent_req_post(req, ev);
482 }
483 tevent_req_set_callback(subreq,
484 smbd_smb2_ioctl_pipe_write_done,
485 req);
486 return req;
487
488 case FSCTL_VALIDATE_NEGOTIATE_INFO:
489 {
490 struct smbXsrv_connection *conn = smbreq->sconn->conn;
491 uint32_t in_capabilities;
492 DATA_BLOB in_guid_blob;
493 struct GUID in_guid;
494 uint16_t in_security_mode;
495 uint16_t in_num_dialects;
496 uint16_t i;
497 DATA_BLOB out_guid_blob;
498 NTSTATUS status;
499
500 if (in_input.length < 0x18) {
501 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
502 return tevent_req_post(req, ev);
503 }
504
505 in_capabilities = IVAL(in_input.data, 0x00);
506 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
507 in_security_mode = SVAL(in_input.data, 0x14);
508 in_num_dialects = SVAL(in_input.data, 0x16);
509
510 if (in_input.length < (0x18 + in_num_dialects*2)) {
511 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
512 return tevent_req_post(req, ev);
513 }
514
515 if (in_max_output < 0x18) {
516 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
517 return tevent_req_post(req, ev);
518 }
519
520 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
521 if (tevent_req_nterror(req, status)) {
522 return tevent_req_post(req, ev);
523 }
524
525 if (in_num_dialects != conn->smb2.client.num_dialects) {
526 state->disconnect = true;
527 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
528 return tevent_req_post(req, ev);
529 }
530
531 for (i=0; i < in_num_dialects; i++) {
532 uint16_t v = SVAL(in_input.data, 0x18 + i*2);
533
534 if (conn->smb2.client.dialects[i] != v) {
535 state->disconnect = true;
536 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
537 return tevent_req_post(req, ev);
538 }
539 }
540
541 if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) {
542 state->disconnect = true;
543 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
544 return tevent_req_post(req, ev);
545 }
546
547 if (in_security_mode != conn->smb2.client.security_mode) {
548 state->disconnect = true;
549 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
550 return tevent_req_post(req, ev);
551 }
552
553 if (in_capabilities != conn->smb2.client.capabilities) {
554 state->disconnect = true;
555 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
556 return tevent_req_post(req, ev);
557 }
558
559 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
560 &out_guid_blob);
561 if (tevent_req_nterror(req, status)) {
562 return tevent_req_post(req, ev);
563 }
564
565 state->out_output = data_blob_talloc(state, NULL, 0x18);
566 if (tevent_req_nomem(state->out_output.data, req)) {
567 return tevent_req_post(req, ev);
568 }
569
570 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
571 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
572 SSVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
573 SSVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
574
575 tevent_req_done(req);
576 return tevent_req_post(req, ev);
577 }
578
579 default: {
580 uint8_t *out_data = NULL;
581 uint32_t out_data_len = 0;
582 NTSTATUS status;
583
584 if (fsp == NULL) {
585 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
586 return tevent_req_post(req, ev);
587 }
588
589 status = SMB_VFS_FSCTL(fsp,
590 state,
591 in_ctl_code,
592 smbreq->flags2,
593 in_input.data,
594 in_input.length,
595 &out_data,
596 in_max_output,
597 &out_data_len);
598 state->out_output = data_blob_const(out_data, out_data_len);
599 if (NT_STATUS_IS_OK(status)) {
600 tevent_req_done(req);
601 return tevent_req_post(req, ev);
602 }
603
604 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
605 if (IS_IPC(smbreq->conn)) {
606 status = NT_STATUS_FS_DRIVER_REQUIRED;
607 } else {
608 status = NT_STATUS_INVALID_DEVICE_REQUEST;
609 }
610 }
611
612 tevent_req_nterror(req, status);
613 return tevent_req_post(req, ev);
614 }
615 }
616
617 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
618 return tevent_req_post(req, ev);
619 }
620
621 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq)
622 {
623 struct tevent_req *req = tevent_req_callback_data(subreq,
624 struct tevent_req);
625 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
626 struct smbd_smb2_ioctl_state);
627 NTSTATUS status;
628 ssize_t nwritten = -1;
629
630 status = np_write_recv(subreq, &nwritten);
631
632 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
633 (long int)nwritten ));
634
635 TALLOC_FREE(subreq);
636 if (!NT_STATUS_IS_OK(status)) {
637 NTSTATUS old = status;
638 status = nt_status_np_pipe(old);
639 tevent_req_nterror(req, status);
640 return;
641 }
642
643 if (nwritten != state->in_input.length) {
644 tevent_req_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
645 return;
646 }
647
648 state->out_output = data_blob_talloc(state, NULL, state->in_max_output);
649 if (state->in_max_output > 0 &&
650 tevent_req_nomem(state->out_output.data, req)) {
651 return;
652 }
653
654 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
655 "of size %u\n",
656 (unsigned int)state->out_output.length ));
657
658 TALLOC_FREE(subreq);
659 subreq = np_read_send(state->smbreq->conn,
660 state->smb2req->sconn->ev_ctx,
661 state->fsp->fake_file_handle,
662 state->out_output.data,
663 state->out_output.length);
664 if (tevent_req_nomem(subreq, req)) {
665 return;
666 }
667 tevent_req_set_callback(subreq, smbd_smb2_ioctl_pipe_read_done, req);
668 }
669
670 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq)
671 {
672 struct tevent_req *req = tevent_req_callback_data(subreq,
673 struct tevent_req);
674 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
675 struct smbd_smb2_ioctl_state);
676 NTSTATUS status;
677 NTSTATUS old;
678 ssize_t nread = -1;
679 bool is_data_outstanding = false;
680
681 status = np_read_recv(subreq, &nread, &is_data_outstanding);
682 TALLOC_FREE(subreq);
683
684 old = status;
685 status = nt_status_np_pipe(old);
686
687 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
688 "is_data_outstanding = %d, status = %s%s%s\n",
689 (int)nread,
690 (int)is_data_outstanding,
691 nt_errstr(old),
692 NT_STATUS_EQUAL(old, status)?"":" => ",
693 NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
694
695 if (!NT_STATUS_IS_OK(status)) {
696 tevent_req_nterror(req, status);
697 return;
698 }
699
700 state->out_output.length = nread;
701
702 if (is_data_outstanding) {
703 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
704 return;
705 }
706
707 tevent_req_done(req);
708 }
709
710 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
711 TALLOC_CTX *mem_ctx,
712 DATA_BLOB *out_output,
713 bool *disconnect)
714 {
715 NTSTATUS status = NT_STATUS_OK;
716 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
717 struct smbd_smb2_ioctl_state);
718
719 *disconnect = state->disconnect;
720
721 if (tevent_req_is_nterror(req, &status)) {
722 if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
723 tevent_req_received(req);
724 return status;
725 }
726 }
727
728 *out_output = state->out_output;
729 talloc_steal(mem_ctx, out_output->data);
730
731 tevent_req_received(req);
732 return status;
733 }
Samba GIT mirror