2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
29 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
30 struct tevent_context
*ev
,
31 struct smbd_smb2_request
*smb2req
,
33 uint64_t in_file_id_volatile
,
35 uint32_t in_max_output
,
37 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
39 DATA_BLOB
*out_output
);
41 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
);
42 NTSTATUS
smbd_smb2_request_process_ioctl(struct smbd_smb2_request
*req
)
45 const uint8_t *inbody
;
46 int i
= req
->current_idx
;
48 uint64_t in_file_id_persistent
;
49 uint64_t in_file_id_volatile
;
50 uint32_t in_input_offset
;
51 uint32_t in_input_length
;
52 DATA_BLOB in_input_buffer
;
53 uint32_t in_max_output_length
;
55 struct tevent_req
*subreq
;
57 status
= smbd_smb2_request_verify_sizes(req
, 0x39);
58 if (!NT_STATUS_IS_OK(status
)) {
59 return smbd_smb2_request_error(req
, status
);
61 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
63 in_ctl_code
= IVAL(inbody
, 0x04);
64 in_file_id_persistent
= BVAL(inbody
, 0x08);
65 in_file_id_volatile
= BVAL(inbody
, 0x10);
66 in_input_offset
= IVAL(inbody
, 0x18);
67 in_input_length
= IVAL(inbody
, 0x1C);
68 in_max_output_length
= IVAL(inbody
, 0x2C);
69 in_flags
= IVAL(inbody
, 0x30);
72 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
73 * the SMB2 header to the input data buffer. If no input data is
74 * required for the FSCTL/IOCTL command being issued, the client SHOULD
75 * set this value to 0.<49>
76 * <49> If no input data is required for the FSCTL/IOCTL command being
77 * issued, Windows-based clients set this field to any value.
79 if ((in_input_length
> 0)
80 && (in_input_offset
!= (SMB2_HDR_BODY
+ req
->in
.vector
[i
+1].iov_len
))) {
81 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
84 if (in_input_length
> req
->in
.vector
[i
+2].iov_len
) {
85 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
88 in_input_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
89 in_input_buffer
.length
= in_input_length
;
91 if (req
->compat_chain_fsp
) {
93 } else if (in_file_id_persistent
== UINT64_MAX
&&
94 in_file_id_volatile
== UINT64_MAX
) {
95 /* without a handle */
96 } else if (in_file_id_persistent
!= in_file_id_volatile
) {
97 return smbd_smb2_request_error(req
, NT_STATUS_FILE_CLOSED
);
100 subreq
= smbd_smb2_ioctl_send(req
,
106 in_max_output_length
,
108 if (subreq
== NULL
) {
109 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
111 tevent_req_set_callback(subreq
, smbd_smb2_request_ioctl_done
, req
);
113 return smbd_smb2_request_pending_queue(req
, subreq
, 1000);
116 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
)
118 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
119 struct smbd_smb2_request
);
120 const uint8_t *inbody
;
121 int i
= req
->current_idx
;
124 uint32_t in_ctl_code
;
125 uint64_t in_file_id_persistent
;
126 uint64_t in_file_id_volatile
;
127 uint32_t out_input_offset
;
128 uint32_t out_output_offset
;
129 DATA_BLOB out_output_buffer
= data_blob_null
;
131 NTSTATUS error
; /* transport error */
133 status
= smbd_smb2_ioctl_recv(subreq
, req
, &out_output_buffer
);
135 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
137 (unsigned int)out_output_buffer
.length
,
138 nt_errstr(status
) ));
141 if (NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
143 } else if (!NT_STATUS_IS_OK(status
)) {
144 error
= smbd_smb2_request_error(req
, status
);
145 if (!NT_STATUS_IS_OK(error
)) {
146 smbd_server_connection_terminate(req
->sconn
,
153 out_input_offset
= SMB2_HDR_BODY
+ 0x30;
154 out_output_offset
= SMB2_HDR_BODY
+ 0x30;
156 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
158 in_ctl_code
= IVAL(inbody
, 0x04);
159 in_file_id_persistent
= BVAL(inbody
, 0x08);
160 in_file_id_volatile
= BVAL(inbody
, 0x10);
162 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x30);
163 if (outbody
.data
== NULL
) {
164 error
= smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
165 if (!NT_STATUS_IS_OK(error
)) {
166 smbd_server_connection_terminate(req
->sconn
,
173 SSVAL(outbody
.data
, 0x00, 0x30 + 1); /* struct size */
174 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
175 SIVAL(outbody
.data
, 0x04,
176 in_ctl_code
); /* ctl code */
177 SBVAL(outbody
.data
, 0x08,
178 in_file_id_persistent
); /* file id (persistent) */
179 SBVAL(outbody
.data
, 0x10,
180 in_file_id_volatile
); /* file id (volatile) */
181 SIVAL(outbody
.data
, 0x18,
182 out_input_offset
); /* input offset */
183 SIVAL(outbody
.data
, 0x1C, 0); /* input count */
184 SIVAL(outbody
.data
, 0x20,
185 out_output_offset
); /* output offset */
186 SIVAL(outbody
.data
, 0x24,
187 out_output_buffer
.length
); /* output count */
188 SIVAL(outbody
.data
, 0x28, 0); /* flags */
189 SIVAL(outbody
.data
, 0x2C, 0); /* reserved */
192 * Note: Windows Vista and 2008 send back also the
193 * input from the request. But it was fixed in
196 outdyn
= out_output_buffer
;
198 error
= smbd_smb2_request_done_ex(req
, status
, outbody
, &outdyn
,
200 if (!NT_STATUS_IS_OK(error
)) {
201 smbd_server_connection_terminate(req
->sconn
,
207 struct smbd_smb2_ioctl_state
{
208 struct smbd_smb2_request
*smb2req
;
209 struct smb_request
*smbreq
;
212 uint32_t in_max_output
;
213 DATA_BLOB out_output
;
216 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
);
217 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
);
219 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
220 struct tevent_context
*ev
,
221 struct smbd_smb2_request
*smb2req
,
222 uint32_t in_ctl_code
,
223 uint64_t in_file_id_volatile
,
225 uint32_t in_max_output
,
228 struct tevent_req
*req
;
229 struct smbd_smb2_ioctl_state
*state
;
230 struct smb_request
*smbreq
;
231 files_struct
*fsp
= NULL
;
232 struct tevent_req
*subreq
;
234 req
= tevent_req_create(mem_ctx
, &state
,
235 struct smbd_smb2_ioctl_state
);
239 state
->smb2req
= smb2req
;
240 state
->smbreq
= NULL
;
242 state
->in_input
= in_input
;
243 state
->in_max_output
= in_max_output
;
244 state
->out_output
= data_blob_null
;
246 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] file_id[0x%016llX]\n",
247 (unsigned)in_ctl_code
,
248 (unsigned long long)in_file_id_volatile
));
250 smbreq
= smbd_smb2_fake_smb_request(smb2req
);
251 if (tevent_req_nomem(smbreq
, req
)) {
252 return tevent_req_post(req
, ev
);
254 state
->smbreq
= smbreq
;
256 if (in_file_id_volatile
!= UINT64_MAX
) {
257 fsp
= file_fsp(smbreq
, (uint16_t)in_file_id_volatile
);
259 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
260 return tevent_req_post(req
, ev
);
262 if (smbreq
->conn
!= fsp
->conn
) {
263 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
264 return tevent_req_post(req
, ev
);
266 if (smb2req
->session
->vuid
!= fsp
->vuid
) {
267 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
268 return tevent_req_post(req
, ev
);
273 switch (in_ctl_code
) {
274 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
276 uint16_t in_max_referral_level
;
277 DATA_BLOB in_file_name_buffer
;
278 char *in_file_name_string
;
279 size_t in_file_name_string_size
;
281 bool overflow
= false;
284 char *dfs_data
= NULL
;
286 if (!IS_IPC(smbreq
->conn
)) {
287 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
288 return tevent_req_post(req
, ev
);
291 if (!lp_host_msdfs()) {
292 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
293 return tevent_req_post(req
, ev
);
296 if (in_input
.length
< (2 + 2)) {
297 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
298 return tevent_req_post(req
, ev
);
301 in_max_referral_level
= SVAL(in_input
.data
, 0);
302 in_file_name_buffer
.data
= in_input
.data
+ 2;
303 in_file_name_buffer
.length
= in_input
.length
- 2;
305 ok
= convert_string_talloc(state
, CH_UTF16
, CH_UNIX
,
306 in_file_name_buffer
.data
,
307 in_file_name_buffer
.length
,
308 &in_file_name_string
,
309 &in_file_name_string_size
);
311 tevent_req_nterror(req
, NT_STATUS_ILLEGAL_CHARACTER
);
312 return tevent_req_post(req
, ev
);
315 dfs_size
= setup_dfs_referral(smbreq
->conn
,
317 in_max_referral_level
,
320 tevent_req_nterror(req
, status
);
321 return tevent_req_post(req
, ev
);
324 if (dfs_size
> in_max_output
) {
326 * TODO: we need a testsuite for this
329 dfs_size
= in_max_output
;
332 state
->out_output
= data_blob_talloc(state
,
337 tevent_req_nomem(state
->out_output
.data
, req
)) {
338 return tevent_req_post(req
, ev
);
342 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
344 tevent_req_done(req
);
346 return tevent_req_post(req
, ev
);
348 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
350 if (!IS_IPC(smbreq
->conn
)) {
351 tevent_req_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
352 return tevent_req_post(req
, ev
);
356 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
357 return tevent_req_post(req
, ev
);
360 if (!fsp_is_np(fsp
)) {
361 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
362 return tevent_req_post(req
, ev
);
365 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
366 (unsigned int)in_input
.length
));
368 subreq
= np_write_send(state
, ev
,
369 fsp
->fake_file_handle
,
372 if (tevent_req_nomem(subreq
, req
)) {
373 return tevent_req_post(req
, ev
);
375 tevent_req_set_callback(subreq
,
376 smbd_smb2_ioctl_pipe_write_done
,
380 case 0x00144064: /* FSCTL_SRV_ENUMERATE_SNAPSHOTS */
383 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
384 * and return their volume names. If max_data_count is 16, then it is just
385 * asking for the number of volumes and length of the combined names.
387 * pdata is the data allocated by our caller, but that uses
388 * total_data_count (which is 0 in our case) rather than max_data_count.
389 * Allocate the correct amount and return the pointer to let
390 * it be deallocated when we return.
392 struct shadow_copy_data
*shadow_data
= NULL
;
394 uint32_t labels_data_count
= 0;
401 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
402 return tevent_req_post(req
, ev
);
405 if (in_max_output
< 16) {
406 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
407 "in_max_output(%u) < 16 is invalid!\n",
409 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
410 return tevent_req_post(req
, ev
);
413 if (in_max_output
> 16) {
417 shadow_data
= talloc_zero(talloc_tos(),
418 struct shadow_copy_data
);
419 if (tevent_req_nomem(shadow_data
, req
)) {
420 DEBUG(0,("TALLOC_ZERO() failed!\n"));
421 return tevent_req_post(req
, ev
);
425 * Call the VFS routine to actually do the work.
427 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp
, shadow_data
, labels
)
429 if (errno
== ENOSYS
) {
430 DEBUG(5, ("FSCTL_GET_SHADOW_COPY_DATA: "
431 "connectpath %s, not supported.\n",
432 smbreq
->conn
->connectpath
));
433 status
= NT_STATUS_NOT_SUPPORTED
;
435 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
436 "connectpath %s, failed.\n",
437 smbreq
->conn
->connectpath
));
438 status
= map_nt_error_from_unix(errno
);
440 TALLOC_FREE(shadow_data
);
441 tevent_req_nterror(req
, status
);
442 return tevent_req_post(req
, ev
);
446 (shadow_data
->num_volumes
*2*sizeof(SHADOW_COPY_LABEL
))
450 data_count
= 12+labels_data_count
+4;
455 if (labels
&& (in_max_output
< data_count
)) {
456 DEBUG(0, ("FSCTL_GET_SHADOW_COPY_DATA: "
457 "in_max_output(%u) too small (%u) bytes "
458 "needed!\n", in_max_output
, data_count
));
459 TALLOC_FREE(shadow_data
);
460 tevent_req_nterror(req
, NT_STATUS_BUFFER_TOO_SMALL
);
461 return tevent_req_post(req
, ev
);
464 state
->out_output
= data_blob_talloc(state
, NULL
, data_count
);
465 if (tevent_req_nomem(state
->out_output
.data
, req
)) {
466 return tevent_req_post(req
, ev
);
469 pdata
= (char *)state
->out_output
.data
;
471 /* num_volumes 4 bytes */
472 SIVAL(pdata
, 0, shadow_data
->num_volumes
);
475 /* num_labels 4 bytes */
476 SIVAL(pdata
, 4, shadow_data
->num_volumes
);
479 /* needed_data_count 4 bytes */
480 SIVAL(pdata
, 8, labels_data_count
+4);
484 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for "
486 shadow_data
->num_volumes
, fsp_str_dbg(fsp
)));
487 if (labels
&& shadow_data
->labels
) {
488 for (i
=0; i
<shadow_data
->num_volumes
; i
++) {
489 srvstr_push(pdata
, smbreq
->flags2
,
490 pdata
, shadow_data
->labels
[i
],
491 2*sizeof(SHADOW_COPY_LABEL
),
492 STR_UNICODE
|STR_TERMINATE
);
493 pdata
+= 2*sizeof(SHADOW_COPY_LABEL
);
494 DEBUGADD(10, ("Label[%u]: '%s'\n", i
,
495 shadow_data
->labels
[i
]));
499 TALLOC_FREE(shadow_data
);
501 tevent_req_done(req
);
502 return tevent_req_post(req
, ev
);
506 if (IS_IPC(smbreq
->conn
)) {
507 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
508 return tevent_req_post(req
, ev
);
510 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
511 return tevent_req_post(req
, ev
);
514 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
515 return tevent_req_post(req
, ev
);
518 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
)
520 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
522 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
523 struct smbd_smb2_ioctl_state
);
525 ssize_t nwritten
= -1;
527 status
= np_write_recv(subreq
, &nwritten
);
529 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
530 (long int)nwritten
));
533 if (!NT_STATUS_IS_OK(status
)) {
534 tevent_req_nterror(req
, status
);
538 if (nwritten
!= state
->in_input
.length
) {
539 tevent_req_nterror(req
, NT_STATUS_PIPE_NOT_AVAILABLE
);
543 state
->out_output
= data_blob_talloc(state
, NULL
, state
->in_max_output
);
544 if (state
->in_max_output
> 0 &&
545 tevent_req_nomem(state
->out_output
.data
, req
)) {
549 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
551 (unsigned int)state
->out_output
.length
));
554 subreq
= np_read_send(state
->smbreq
->conn
,
555 state
->smb2req
->sconn
->ev_ctx
,
556 state
->fsp
->fake_file_handle
,
557 state
->out_output
.data
,
558 state
->out_output
.length
);
559 if (tevent_req_nomem(subreq
, req
)) {
562 tevent_req_set_callback(subreq
, smbd_smb2_ioctl_pipe_read_done
, req
);
565 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
)
567 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
569 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
570 struct smbd_smb2_ioctl_state
);
573 bool is_data_outstanding
= false;
575 status
= np_read_recv(subreq
, &nread
, &is_data_outstanding
);
577 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
578 "is_data_outstanding = %d, status = %s\n",
580 (int)is_data_outstanding
,
581 nt_errstr(status
) ));
584 if (!NT_STATUS_IS_OK(status
)) {
585 tevent_req_nterror(req
, status
);
589 state
->out_output
.length
= nread
;
591 if (is_data_outstanding
) {
592 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
596 tevent_req_done(req
);
599 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
601 DATA_BLOB
*out_output
)
603 NTSTATUS status
= NT_STATUS_OK
;
604 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
605 struct smbd_smb2_ioctl_state
);
607 if (tevent_req_is_nterror(req
, &status
)) {
608 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
609 tevent_req_received(req
);
614 *out_output
= state
->out_output
;
615 talloc_steal(mem_ctx
, out_output
->data
);
617 tevent_req_received(req
);