libcli/smb/smb2cli_ioctl.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    smb2 lib
   4    Copyright (C) Stefan Metzmacher 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/network.h"
  22 #include "lib/util/tevent_ntstatus.h"
  23 #include "smb_common.h"
  24 #include "smbXcli_base.h"
  25 #include "librpc/ndr/libndr.h"
  26
  27 struct smb2cli_ioctl_state {
  28         uint8_t fixed[0x38];
  29         uint8_t dyn_pad[1];
  30         uint32_t max_input_length;
  31         uint32_t max_output_length;
  32         struct iovec *recv_iov;
  33         DATA_BLOB out_input_buffer;
  34         DATA_BLOB out_output_buffer;
  35 };
  36
  37 static void smb2cli_ioctl_done(struct tevent_req *subreq);
  38
  39 struct tevent_req *smb2cli_ioctl_send(TALLOC_CTX *mem_ctx,
  40                                       struct tevent_context *ev,
  41                                       struct smbXcli_conn *conn,
  42                                       uint32_t timeout_msec,
  43                                       struct smbXcli_session *session,
  44                                       struct smbXcli_tcon *tcon,
  45                                       uint64_t in_fid_persistent,
  46                                       uint64_t in_fid_volatile,
  47                                       uint32_t in_ctl_code,
  48                                       uint32_t in_max_input_length,
  49                                       const DATA_BLOB *in_input_buffer,
  50                                       uint32_t in_max_output_length,
  51                                       const DATA_BLOB *in_output_buffer,
  52                                       uint32_t in_flags)
  53 {
  54         struct tevent_req *req, *subreq;
  55         struct smb2cli_ioctl_state *state;
  56         uint8_t *fixed;
  57         uint8_t *dyn;
  58         size_t dyn_len;
  59         uint32_t input_buffer_offset = 0;
  60         uint32_t input_buffer_length = 0;
  61         uint32_t output_buffer_offset = 0;
  62         uint32_t output_buffer_length = 0;
  63         uint32_t pad_length = 0;
  64         uint64_t tmp64;
  65         uint32_t max_dyn_len = 0;
  66
  67         req = tevent_req_create(mem_ctx, &state,
  68                                 struct smb2cli_ioctl_state);
  69         if (req == NULL) {
  70                 return NULL;
  71         }
  72         state->max_input_length = in_max_input_length;
  73         state->max_output_length = in_max_output_length;
  74
  75         tmp64 = in_max_input_length;
  76         tmp64 += in_max_output_length;
  77         if (tmp64 > UINT32_MAX) {
  78                 max_dyn_len = UINT32_MAX;
  79         } else {
  80                 max_dyn_len = tmp64;
  81         }
  82
  83         if (in_input_buffer) {
  84                 input_buffer_offset = SMB2_HDR_BODY+0x38;
  85                 input_buffer_length = in_input_buffer->length;
  86         }
  87
  88         if (in_output_buffer) {
  89                 output_buffer_offset = SMB2_HDR_BODY+0x38;
  90                 output_buffer_length = in_output_buffer->length;
  91                 if (input_buffer_length > 0 && output_buffer_length > 0) {
  92                         uint32_t tmp;
  93                         output_buffer_offset += input_buffer_length;
  94                         tmp = output_buffer_offset;
  95                         output_buffer_offset = NDR_ROUND(output_buffer_offset, 8);
  96                         pad_length = output_buffer_offset - tmp;
  97                 }
  98         }
  99
 100         fixed = state->fixed;
 101
 102         SSVAL(fixed, 0x00, 0x39);
 103         SSVAL(fixed, 0x02, 0); /* reserved */
 104         SIVAL(fixed, 0x04, in_ctl_code);
 105         SBVAL(fixed, 0x08, in_fid_persistent);
 106         SBVAL(fixed, 0x10, in_fid_volatile);
 107         SIVAL(fixed, 0x18, input_buffer_offset);
 108         SIVAL(fixed, 0x1C, input_buffer_length);
 109         SIVAL(fixed, 0x20, in_max_input_length);
 110         SIVAL(fixed, 0x24, output_buffer_offset);
 111         SIVAL(fixed, 0x28, output_buffer_length);
 112         SIVAL(fixed, 0x2C, in_max_output_length);
 113         SIVAL(fixed, 0x30, in_flags);
 114         SIVAL(fixed, 0x34, 0); /* reserved */
 115
 116         if (input_buffer_length > 0 && output_buffer_length > 0) {
 117                 size_t avail = UINT32_MAX - (input_buffer_length + pad_length);
 118                 size_t ofs = output_buffer_offset - input_buffer_offset;
 119
 120                 if (avail < output_buffer_length) {
 121                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
 122                         return tevent_req_post(req, ev);
 123                 }
 124
 125                 dyn_len = input_buffer_length + output_buffer_length + pad_length;
 126
 127                 dyn = talloc_zero_array(state, uint8_t, dyn_len);
 128                 if (tevent_req_nomem(dyn, req)) {
 129                         return tevent_req_post(req, ev);
 130                 }
 131                 memcpy(dyn, in_input_buffer->data,
 132                        in_input_buffer->length);
 133                 memcpy(dyn + ofs, in_output_buffer->data,
 134                        in_output_buffer->length);
 135         } else if (input_buffer_length > 0) {
 136                 dyn = in_input_buffer->data;
 137                 dyn_len = in_input_buffer->length;
 138         } else if (output_buffer_length > 0) {
 139                 dyn = in_output_buffer->data;
 140                 dyn_len = in_output_buffer->length;
 141         } else {
 142                 dyn = state->dyn_pad;
 143                 dyn_len = sizeof(state->dyn_pad);
 144         }
 145
 146         subreq = smb2cli_req_send(state, ev, conn, SMB2_OP_IOCTL,
 147                                   0, 0, /* flags */
 148                                   timeout_msec,
 149                                   tcon,
 150                                   session,
 151                                   state->fixed, sizeof(state->fixed),
 152                                   dyn, dyn_len,
 153                                   max_dyn_len);
 154         if (tevent_req_nomem(subreq, req)) {
 155                 return tevent_req_post(req, ev);
 156         }
 157         tevent_req_set_callback(subreq, smb2cli_ioctl_done, req);
 158         return req;
 159 }
 160
 161 static void smb2cli_ioctl_done(struct tevent_req *subreq)
 162 {
 163         struct tevent_req *req =
 164                 tevent_req_callback_data(subreq,
 165                 struct tevent_req);
 166         struct smb2cli_ioctl_state *state =
 167                 tevent_req_data(req,
 168                 struct smb2cli_ioctl_state);
 169         NTSTATUS status;
 170         struct iovec *iov;
 171         uint8_t *fixed;
 172         uint8_t *dyn;
 173         size_t dyn_len;
 174         uint32_t dyn_ofs = SMB2_HDR_BODY + 0x30;
 175         uint32_t input_buffer_offset;
 176         uint32_t input_buffer_length;
 177         uint32_t output_buffer_offset;
 178         uint32_t output_buffer_length;
 179         static const struct smb2cli_req_expected_response expected[] = {
 180         {
 181                 .status = NT_STATUS_OK,
 182                 .body_size = 0x31
 183         },
 184         {
 185                 .status = STATUS_BUFFER_OVERFLOW,
 186                 .body_size = 0x31
 187         },
 188         {
 189                 /*
 190                  * We need to make sure that
 191                  * a response with NT_STATUS_FILE_CLOSED
 192                  * without signing generates NT_STATUS_ACCESS_DENIED
 193                  * if the request was signed.
 194                  */
 195                 .status = NT_STATUS_FILE_CLOSED,
 196                 .body_size = 0x09,
 197         },
 198         };
 199
 200         status = smb2cli_req_recv(subreq, state, &iov,
 201                                   expected, ARRAY_SIZE(expected));
 202         TALLOC_FREE(subreq);
 203         if (tevent_req_nterror(req, status)) {
 204                 return;
 205         }
 206
 207         state->recv_iov = iov;
 208         fixed = (uint8_t *)iov[1].iov_base;
 209         dyn = (uint8_t *)iov[2].iov_base;
 210         dyn_len = iov[2].iov_len;
 211
 212         input_buffer_offset = IVAL(fixed, 0x18);
 213         input_buffer_length = IVAL(fixed, 0x1C);
 214         output_buffer_offset = IVAL(fixed, 0x20);
 215         output_buffer_length = IVAL(fixed, 0x24);
 216
 217         if ((input_buffer_offset > 0) && (input_buffer_length > 0)) {
 218                 uint32_t ofs;
 219
 220                 if (input_buffer_offset != dyn_ofs) {
 221                         tevent_req_nterror(
 222                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 223                         return;
 224                 }
 225
 226                 ofs = input_buffer_length;
 227                 ofs = NDR_ROUND(ofs, 8);
 228
 229                 if (state->max_input_length == 0) {
 230                         /*
 231                          * If max_input_length is 0 we ignore
 232                          * the input_buffer_length, because
 233                          * Windows 2008 echos the DCERPC request
 234                          * from the requested input_buffer
 235                          * to the response input_buffer.
 236                          */
 237                         input_buffer_length = 0;
 238                 }
 239
 240                 if (input_buffer_length > dyn_len) {
 241                         tevent_req_nterror(
 242                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 243                         return;
 244                 }
 245
 246                 if (input_buffer_length > state->max_input_length) {
 247                         tevent_req_nterror(
 248                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 249                         return;
 250                 }
 251
 252                 state->out_input_buffer.data = dyn;
 253                 state->out_input_buffer.length = input_buffer_length;
 254
 255                 if (ofs > dyn_len) {
 256                         tevent_req_nterror(
 257                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 258                         return;
 259                 }
 260
 261                 dyn_ofs += ofs;
 262                 dyn += ofs;
 263                 dyn_len -= ofs;
 264         }
 265
 266         if ((output_buffer_offset > 0) && (output_buffer_length > 0)) {
 267                 if (output_buffer_offset != dyn_ofs) {
 268                         tevent_req_nterror(
 269                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 270                         return;
 271                 }
 272
 273                 if (state->max_output_length == 0) {
 274                         /*
 275                          * We do the same logic as for
 276                          * max_input_length.
 277                          */
 278                         output_buffer_length = 0;
 279                 }
 280
 281                 if (output_buffer_length > dyn_len) {
 282                         tevent_req_nterror(
 283                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 284                         return;
 285                 }
 286
 287                 if (output_buffer_length > state->max_output_length) {
 288                         tevent_req_nterror(
 289                                 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
 290                         return;
 291                 }
 292
 293                 state->out_output_buffer.data = dyn;
 294                 state->out_output_buffer.length = output_buffer_length;
 295         }
 296
 297         tevent_req_done(req);
 298 }
 299
 300 NTSTATUS smb2cli_ioctl_recv(struct tevent_req *req,
 301                             TALLOC_CTX *mem_ctx,
 302                             DATA_BLOB *out_input_buffer,
 303                             DATA_BLOB *out_output_buffer)
 304 {
 305         struct smb2cli_ioctl_state *state =
 306                 tevent_req_data(req,
 307                 struct smb2cli_ioctl_state);
 308         NTSTATUS status;
 309
 310         if (tevent_req_is_nterror(req, &status)) {
 311                 tevent_req_received(req);
 312                 return status;
 313         }
 314
 315         talloc_steal(mem_ctx, state->recv_iov);
 316         if (out_input_buffer) {
 317                 *out_input_buffer = state->out_input_buffer;
 318         }
 319         if (out_output_buffer) {
 320                 *out_output_buffer = state->out_output_buffer;
 321         }
 322
 323         tevent_req_received(req);
 324         return NT_STATUS_OK;
 325 }
 326
 327 NTSTATUS smb2cli_ioctl(struct smbXcli_conn *conn,
 328                        uint32_t timeout_msec,
 329                        struct smbXcli_session *session,
 330                        struct smbXcli_tcon *tcon,
 331                        uint64_t in_fid_persistent,
 332                        uint64_t in_fid_volatile,
 333                        uint32_t in_ctl_code,
 334                        uint32_t in_max_input_length,
 335                        const DATA_BLOB *in_input_buffer,
 336                        uint32_t in_max_output_length,
 337                        const DATA_BLOB *in_output_buffer,
 338                        uint32_t in_flags,
 339                        TALLOC_CTX *mem_ctx,
 340                        DATA_BLOB *out_input_buffer,
 341                        DATA_BLOB *out_output_buffer)
 342 {
 343         TALLOC_CTX *frame = talloc_stackframe();
 344         struct tevent_context *ev;
 345         struct tevent_req *req;
 346         NTSTATUS status = NT_STATUS_NO_MEMORY;
 347
 348         if (smbXcli_conn_has_async_calls(conn)) {
 349                 /*
 350                  * Can't use sync call while an async call is in flight
 351                  */
 352                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 353                 goto fail;
 354         }
 355         ev = samba_tevent_context_init(frame);
 356         if (ev == NULL) {
 357                 goto fail;
 358         }
 359         req = smb2cli_ioctl_send(frame, ev, conn, timeout_msec,
 360                                  session, tcon,
 361                                  in_fid_persistent,
 362                                  in_fid_volatile,
 363                                  in_ctl_code,
 364                                  in_max_input_length,
 365                                  in_input_buffer,
 366                                  in_max_output_length,
 367                                  in_output_buffer,
 368                                  in_flags);
 369         if (req == NULL) {
 370                 goto fail;
 371         }
 372         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
 373                 goto fail;
 374         }
 375         status = smb2cli_ioctl_recv(req, mem_ctx,
 376                                     out_input_buffer,
 377                                     out_output_buffer);
 378  fail:
 379         TALLOC_FREE(frame);
 380         return status;
 381 }