2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2011
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/network.h"
22 #include "lib/util/tevent_ntstatus.h"
23 #include "smb_common.h"
24 #include "smbXcli_base.h"
25 #include "librpc/ndr/libndr.h"
27 struct smb2cli_ioctl_state
{
30 uint32_t max_input_length
;
31 uint32_t max_output_length
;
32 struct iovec
*recv_iov
;
33 DATA_BLOB out_input_buffer
;
34 DATA_BLOB out_output_buffer
;
37 static void smb2cli_ioctl_done(struct tevent_req
*subreq
);
39 struct tevent_req
*smb2cli_ioctl_send(TALLOC_CTX
*mem_ctx
,
40 struct tevent_context
*ev
,
41 struct smbXcli_conn
*conn
,
42 uint32_t timeout_msec
,
43 struct smbXcli_session
*session
,
44 struct smbXcli_tcon
*tcon
,
45 uint64_t in_fid_persistent
,
46 uint64_t in_fid_volatile
,
48 uint32_t in_max_input_length
,
49 const DATA_BLOB
*in_input_buffer
,
50 uint32_t in_max_output_length
,
51 const DATA_BLOB
*in_output_buffer
,
54 struct tevent_req
*req
, *subreq
;
55 struct smb2cli_ioctl_state
*state
;
59 uint32_t input_buffer_offset
= 0;
60 uint32_t input_buffer_length
= 0;
61 uint32_t output_buffer_offset
= 0;
62 uint32_t output_buffer_length
= 0;
63 uint32_t pad_length
= 0;
65 uint32_t max_dyn_len
= 0;
67 req
= tevent_req_create(mem_ctx
, &state
,
68 struct smb2cli_ioctl_state
);
72 state
->max_input_length
= in_max_input_length
;
73 state
->max_output_length
= in_max_output_length
;
75 tmp64
= in_max_input_length
;
76 tmp64
+= in_max_output_length
;
77 if (tmp64
> UINT32_MAX
) {
78 max_dyn_len
= UINT32_MAX
;
83 if (in_input_buffer
) {
84 input_buffer_offset
= SMB2_HDR_BODY
+0x38;
85 input_buffer_length
= in_input_buffer
->length
;
88 if (in_output_buffer
) {
89 output_buffer_offset
= SMB2_HDR_BODY
+0x38;
90 output_buffer_length
= in_output_buffer
->length
;
91 if (input_buffer_length
> 0 && output_buffer_length
> 0) {
93 output_buffer_offset
+= input_buffer_length
;
94 tmp
= output_buffer_offset
;
95 output_buffer_offset
= NDR_ROUND(output_buffer_offset
, 8);
96 pad_length
= output_buffer_offset
- tmp
;
100 fixed
= state
->fixed
;
102 SSVAL(fixed
, 0x00, 0x39);
103 SSVAL(fixed
, 0x02, 0); /* reserved */
104 SIVAL(fixed
, 0x04, in_ctl_code
);
105 SBVAL(fixed
, 0x08, in_fid_persistent
);
106 SBVAL(fixed
, 0x10, in_fid_volatile
);
107 SIVAL(fixed
, 0x18, input_buffer_offset
);
108 SIVAL(fixed
, 0x1C, input_buffer_length
);
109 SIVAL(fixed
, 0x20, in_max_input_length
);
110 SIVAL(fixed
, 0x24, output_buffer_offset
);
111 SIVAL(fixed
, 0x28, output_buffer_length
);
112 SIVAL(fixed
, 0x2C, in_max_output_length
);
113 SIVAL(fixed
, 0x30, in_flags
);
114 SIVAL(fixed
, 0x34, 0); /* reserved */
116 if (input_buffer_length
> 0 && output_buffer_length
> 0) {
117 size_t avail
= UINT32_MAX
- (input_buffer_length
+ pad_length
);
118 size_t ofs
= output_buffer_offset
- input_buffer_offset
;
120 if (avail
< output_buffer_length
) {
121 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER_MIX
);
122 return tevent_req_post(req
, ev
);
125 dyn_len
= input_buffer_length
+ output_buffer_length
+ pad_length
;
127 dyn
= talloc_zero_array(state
, uint8_t, dyn_len
);
128 if (tevent_req_nomem(dyn
, req
)) {
129 return tevent_req_post(req
, ev
);
131 memcpy(dyn
, in_input_buffer
->data
,
132 in_input_buffer
->length
);
133 memcpy(dyn
+ ofs
, in_output_buffer
->data
,
134 in_output_buffer
->length
);
135 } else if (input_buffer_length
> 0) {
136 dyn
= in_input_buffer
->data
;
137 dyn_len
= in_input_buffer
->length
;
138 } else if (output_buffer_length
> 0) {
139 dyn
= in_output_buffer
->data
;
140 dyn_len
= in_output_buffer
->length
;
142 dyn
= state
->dyn_pad
;
143 dyn_len
= sizeof(state
->dyn_pad
);
146 subreq
= smb2cli_req_send(state
, ev
, conn
, SMB2_OP_IOCTL
,
151 state
->fixed
, sizeof(state
->fixed
),
154 if (tevent_req_nomem(subreq
, req
)) {
155 return tevent_req_post(req
, ev
);
157 tevent_req_set_callback(subreq
, smb2cli_ioctl_done
, req
);
161 static void smb2cli_ioctl_done(struct tevent_req
*subreq
)
163 struct tevent_req
*req
=
164 tevent_req_callback_data(subreq
,
166 struct smb2cli_ioctl_state
*state
=
168 struct smb2cli_ioctl_state
);
174 uint32_t dyn_ofs
= SMB2_HDR_BODY
+ 0x30;
175 uint32_t input_buffer_offset
;
176 uint32_t input_buffer_length
;
177 uint32_t output_buffer_offset
;
178 uint32_t output_buffer_length
;
179 static const struct smb2cli_req_expected_response expected
[] = {
181 .status
= NT_STATUS_OK
,
185 .status
= STATUS_BUFFER_OVERFLOW
,
190 status
= smb2cli_req_recv(subreq
, state
, &iov
,
191 expected
, ARRAY_SIZE(expected
));
193 if (tevent_req_nterror(req
, status
)) {
197 state
->recv_iov
= iov
;
198 fixed
= (uint8_t *)iov
[1].iov_base
;
199 dyn
= (uint8_t *)iov
[2].iov_base
;
200 dyn_len
= iov
[2].iov_len
;
202 input_buffer_offset
= IVAL(fixed
, 0x18);
203 input_buffer_length
= IVAL(fixed
, 0x1C);
204 output_buffer_offset
= IVAL(fixed
, 0x20);
205 output_buffer_length
= IVAL(fixed
, 0x24);
207 if ((input_buffer_offset
> 0) && (input_buffer_length
> 0)) {
210 if (input_buffer_offset
!= dyn_ofs
) {
212 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
216 ofs
= input_buffer_length
;
217 ofs
= NDR_ROUND(ofs
, 8);
219 if (state
->max_input_length
== 0) {
221 * If max_input_length is 0 we ignore
222 * the input_buffer_length, because
223 * Windows 2008 echos the DCERPC request
224 * from the requested input_buffer
225 * to the response input_buffer.
227 input_buffer_length
= 0;
230 if (input_buffer_length
> dyn_len
) {
232 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
236 if (input_buffer_length
> state
->max_input_length
) {
238 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
242 state
->out_input_buffer
.data
= dyn
;
243 state
->out_input_buffer
.length
= input_buffer_length
;
247 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
256 if ((output_buffer_offset
> 0) && (output_buffer_length
> 0)) {
257 if (output_buffer_offset
!= dyn_ofs
) {
259 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
263 if (state
->max_output_length
== 0) {
265 * We do the same logic as for
268 output_buffer_length
= 0;
271 if (output_buffer_length
> dyn_len
) {
273 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
277 if (output_buffer_length
> state
->max_output_length
) {
279 req
, NT_STATUS_INVALID_NETWORK_RESPONSE
);
283 state
->out_output_buffer
.data
= dyn
;
284 state
->out_output_buffer
.length
= output_buffer_length
;
287 tevent_req_done(req
);
290 NTSTATUS
smb2cli_ioctl_recv(struct tevent_req
*req
,
292 DATA_BLOB
*out_input_buffer
,
293 DATA_BLOB
*out_output_buffer
)
295 struct smb2cli_ioctl_state
*state
=
297 struct smb2cli_ioctl_state
);
300 if (tevent_req_is_nterror(req
, &status
)) {
301 tevent_req_received(req
);
305 talloc_steal(mem_ctx
, state
->recv_iov
);
306 if (out_input_buffer
) {
307 *out_input_buffer
= state
->out_input_buffer
;
309 if (out_output_buffer
) {
310 *out_output_buffer
= state
->out_output_buffer
;
313 tevent_req_received(req
);
317 NTSTATUS
smb2cli_ioctl(struct smbXcli_conn
*conn
,
318 uint32_t timeout_msec
,
319 struct smbXcli_session
*session
,
320 struct smbXcli_tcon
*tcon
,
321 uint64_t in_fid_persistent
,
322 uint64_t in_fid_volatile
,
323 uint32_t in_ctl_code
,
324 uint32_t in_max_input_length
,
325 const DATA_BLOB
*in_input_buffer
,
326 uint32_t in_max_output_length
,
327 const DATA_BLOB
*in_output_buffer
,
330 DATA_BLOB
*out_input_buffer
,
331 DATA_BLOB
*out_output_buffer
)
333 TALLOC_CTX
*frame
= talloc_stackframe();
334 struct tevent_context
*ev
;
335 struct tevent_req
*req
;
336 NTSTATUS status
= NT_STATUS_NO_MEMORY
;
338 if (smbXcli_conn_has_async_calls(conn
)) {
340 * Can't use sync call while an async call is in flight
342 status
= NT_STATUS_INVALID_PARAMETER_MIX
;
345 ev
= samba_tevent_context_init(frame
);
349 req
= smb2cli_ioctl_send(frame
, ev
, conn
, timeout_msec
,
356 in_max_output_length
,
362 if (!tevent_req_poll_ntstatus(req
, ev
, &status
)) {
365 status
= smb2cli_ioctl_recv(req
, mem_ctx
,