2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
26 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
27 struct tevent_context
*ev
,
28 struct smbd_smb2_request
*smb2req
,
30 uint64_t in_file_id_volatile
,
32 uint32_t in_max_output
,
34 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
36 DATA_BLOB
*out_output
);
38 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
);
39 NTSTATUS
smbd_smb2_request_process_ioctl(struct smbd_smb2_request
*req
)
42 const uint8_t *inbody
;
43 int i
= req
->current_idx
;
44 size_t expected_body_size
= 0x39;
47 uint64_t in_file_id_persistent
;
48 uint64_t in_file_id_volatile
;
49 uint32_t in_input_offset
;
50 uint32_t in_input_length
;
51 DATA_BLOB in_input_buffer
;
52 uint32_t in_max_output_length
;
54 struct tevent_req
*subreq
;
56 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
57 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
58 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
61 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
63 body_size
= SVAL(inbody
, 0x00);
64 if (body_size
!= expected_body_size
) {
65 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
68 in_ctl_code
= IVAL(inbody
, 0x04);
69 in_file_id_persistent
= BVAL(inbody
, 0x08);
70 in_file_id_volatile
= BVAL(inbody
, 0x10);
71 in_input_offset
= IVAL(inbody
, 0x18);
72 in_input_length
= IVAL(inbody
, 0x1C);
73 in_max_output_length
= IVAL(inbody
, 0x2C);
74 in_flags
= IVAL(inbody
, 0x30);
76 if (in_input_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
77 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
80 if (in_input_length
> req
->in
.vector
[i
+2].iov_len
) {
81 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
84 in_input_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
85 in_input_buffer
.length
= in_input_length
;
87 if (req
->compat_chain_fsp
) {
89 } else if (in_file_id_persistent
== UINT64_MAX
&&
90 in_file_id_volatile
== UINT64_MAX
) {
91 /* without a handle */
92 } else if (in_file_id_persistent
!= in_file_id_volatile
) {
93 return smbd_smb2_request_error(req
, NT_STATUS_FILE_CLOSED
);
96 subreq
= smbd_smb2_ioctl_send(req
,
97 req
->sconn
->smb2
.event_ctx
,
102 in_max_output_length
,
104 if (subreq
== NULL
) {
105 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
107 tevent_req_set_callback(subreq
, smbd_smb2_request_ioctl_done
, req
);
109 return smbd_smb2_request_pending_queue(req
, subreq
);
112 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
)
114 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
115 struct smbd_smb2_request
);
116 const uint8_t *inbody
;
117 int i
= req
->current_idx
;
121 uint32_t in_ctl_code
;
122 uint64_t in_file_id_persistent
;
123 uint64_t in_file_id_volatile
;
124 uint32_t out_input_offset
;
125 uint32_t out_output_offset
;
126 DATA_BLOB out_output_buffer
= data_blob_null
;
128 NTSTATUS error
; /* transport error */
130 status
= smbd_smb2_ioctl_recv(subreq
, req
, &out_output_buffer
);
132 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
134 (unsigned int)out_output_buffer
.length
,
135 nt_errstr(status
) ));
138 if (NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
140 } else if (!NT_STATUS_IS_OK(status
)) {
141 error
= smbd_smb2_request_error(req
, status
);
142 if (!NT_STATUS_IS_OK(error
)) {
143 smbd_server_connection_terminate(req
->sconn
,
150 out_input_offset
= SMB2_HDR_BODY
+ 0x30;
151 out_output_offset
= SMB2_HDR_BODY
+ 0x30;
153 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
155 in_ctl_code
= IVAL(inbody
, 0x04);
156 in_file_id_persistent
= BVAL(inbody
, 0x08);
157 in_file_id_volatile
= BVAL(inbody
, 0x10);
159 outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
161 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x30);
162 if (outbody
.data
== NULL
) {
163 error
= smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
164 if (!NT_STATUS_IS_OK(error
)) {
165 smbd_server_connection_terminate(req
->sconn
,
172 SSVAL(outbody
.data
, 0x00, 0x30 + 1); /* struct size */
173 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
174 SIVAL(outbody
.data
, 0x04,
175 in_ctl_code
); /* ctl code */
176 SBVAL(outbody
.data
, 0x08,
177 in_file_id_persistent
); /* file id (persistent) */
178 SBVAL(outbody
.data
, 0x10,
179 in_file_id_volatile
); /* file id (volatile) */
180 SIVAL(outbody
.data
, 0x18,
181 out_input_offset
); /* input offset */
182 SIVAL(outbody
.data
, 0x1C, 0); /* input count */
183 SIVAL(outbody
.data
, 0x20,
184 out_output_offset
); /* output offset */
185 SIVAL(outbody
.data
, 0x24,
186 out_output_buffer
.length
); /* output count */
187 SIVAL(outbody
.data
, 0x28, 0); /* flags */
188 SIVAL(outbody
.data
, 0x2C, 0); /* reserved */
191 * Note: Windows Vista and 2008 send back also the
192 * input from the request. But it was fixed in
195 outdyn
= out_output_buffer
;
197 error
= smbd_smb2_request_done_ex(req
, status
, outbody
, &outdyn
,
199 if (!NT_STATUS_IS_OK(error
)) {
200 smbd_server_connection_terminate(req
->sconn
,
206 struct smbd_smb2_ioctl_state
{
207 struct smbd_smb2_request
*smb2req
;
208 struct smb_request
*smbreq
;
211 uint32_t in_max_output
;
212 DATA_BLOB out_output
;
215 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
);
216 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
);
218 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
219 struct tevent_context
*ev
,
220 struct smbd_smb2_request
*smb2req
,
221 uint32_t in_ctl_code
,
222 uint64_t in_file_id_volatile
,
224 uint32_t in_max_output
,
227 struct tevent_req
*req
;
228 struct smbd_smb2_ioctl_state
*state
;
229 struct smb_request
*smbreq
;
230 files_struct
*fsp
= NULL
;
231 struct tevent_req
*subreq
;
233 req
= tevent_req_create(mem_ctx
, &state
,
234 struct smbd_smb2_ioctl_state
);
238 state
->smb2req
= smb2req
;
239 state
->smbreq
= NULL
;
241 state
->in_input
= in_input
;
242 state
->in_max_output
= in_max_output
;
243 state
->out_output
= data_blob_null
;
245 DEBUG(10,("smbd_smb2_ioctl: file_id[0x%016llX]\n",
246 (unsigned long long)in_file_id_volatile
));
248 smbreq
= smbd_smb2_fake_smb_request(smb2req
);
249 if (tevent_req_nomem(smbreq
, req
)) {
250 return tevent_req_post(req
, ev
);
252 state
->smbreq
= smbreq
;
254 if (in_file_id_volatile
!= UINT64_MAX
) {
255 fsp
= file_fsp(smbreq
, (uint16_t)in_file_id_volatile
);
257 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
258 return tevent_req_post(req
, ev
);
260 if (smbreq
->conn
!= fsp
->conn
) {
261 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
262 return tevent_req_post(req
, ev
);
264 if (smb2req
->session
->vuid
!= fsp
->vuid
) {
265 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
266 return tevent_req_post(req
, ev
);
271 switch (in_ctl_code
) {
272 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
274 uint16_t in_max_referral_level
;
275 DATA_BLOB in_file_name_buffer
;
276 char *in_file_name_string
;
277 size_t in_file_name_string_size
;
279 bool overflow
= false;
282 char *dfs_data
= NULL
;
284 if (!IS_IPC(smbreq
->conn
)) {
285 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
286 return tevent_req_post(req
, ev
);
289 if (!lp_host_msdfs()) {
290 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
291 return tevent_req_post(req
, ev
);
294 if (in_input
.length
< (2 + 2)) {
295 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
296 return tevent_req_post(req
, ev
);
299 in_max_referral_level
= SVAL(in_input
.data
, 0);
300 in_file_name_buffer
.data
= in_input
.data
+ 2;
301 in_file_name_buffer
.length
= in_input
.length
- 2;
303 ok
= convert_string_talloc(state
, CH_UTF16
, CH_UNIX
,
304 in_file_name_buffer
.data
,
305 in_file_name_buffer
.length
,
306 &in_file_name_string
,
307 &in_file_name_string_size
, false);
309 tevent_req_nterror(req
, NT_STATUS_ILLEGAL_CHARACTER
);
310 return tevent_req_post(req
, ev
);
313 dfs_size
= setup_dfs_referral(smbreq
->conn
,
315 in_max_referral_level
,
318 tevent_req_nterror(req
, status
);
319 return tevent_req_post(req
, ev
);
322 if (dfs_size
> in_max_output
) {
324 * TODO: we need a testsuite for this
327 dfs_size
= in_max_output
;
330 state
->out_output
= data_blob_talloc(state
,
335 tevent_req_nomem(state
->out_output
.data
, req
)) {
336 return tevent_req_post(req
, ev
);
340 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
342 tevent_req_done(req
);
344 return tevent_req_post(req
, ev
);
346 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
348 if (!IS_IPC(smbreq
->conn
)) {
349 tevent_req_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
350 return tevent_req_post(req
, ev
);
354 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
355 return tevent_req_post(req
, ev
);
358 if (!fsp_is_np(fsp
)) {
359 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
360 return tevent_req_post(req
, ev
);
363 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
364 (unsigned int)in_input
.length
));
366 subreq
= np_write_send(state
, ev
,
367 fsp
->fake_file_handle
,
370 if (tevent_req_nomem(subreq
, req
)) {
371 return tevent_req_post(req
, ev
);
373 tevent_req_set_callback(subreq
,
374 smbd_smb2_ioctl_pipe_write_done
,
379 if (IS_IPC(smbreq
->conn
)) {
380 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
381 return tevent_req_post(req
, ev
);
383 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
384 return tevent_req_post(req
, ev
);
387 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
388 return tevent_req_post(req
, ev
);
391 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
)
393 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
395 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
396 struct smbd_smb2_ioctl_state
);
398 ssize_t nwritten
= -1;
400 status
= np_write_recv(subreq
, &nwritten
);
402 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
403 (long int)nwritten
));
406 if (!NT_STATUS_IS_OK(status
)) {
407 tevent_req_nterror(req
, status
);
411 if (nwritten
!= state
->in_input
.length
) {
412 tevent_req_nterror(req
, NT_STATUS_PIPE_NOT_AVAILABLE
);
416 state
->out_output
= data_blob_talloc(state
, NULL
, state
->in_max_output
);
417 if (state
->in_max_output
> 0 &&
418 tevent_req_nomem(state
->out_output
.data
, req
)) {
422 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
424 (unsigned int)state
->out_output
.length
));
427 subreq
= np_read_send(state
->smbreq
->conn
,
428 state
->smb2req
->sconn
->smb2
.event_ctx
,
429 state
->fsp
->fake_file_handle
,
430 state
->out_output
.data
,
431 state
->out_output
.length
);
432 if (tevent_req_nomem(subreq
, req
)) {
435 tevent_req_set_callback(subreq
, smbd_smb2_ioctl_pipe_read_done
, req
);
438 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
)
440 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
442 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
443 struct smbd_smb2_ioctl_state
);
446 bool is_data_outstanding
= false;
448 status
= np_read_recv(subreq
, &nread
, &is_data_outstanding
);
450 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
451 "is_data_outstanding = %d, status = %s\n",
453 (int)is_data_outstanding
,
454 nt_errstr(status
) ));
457 if (!NT_STATUS_IS_OK(status
)) {
458 tevent_req_nterror(req
, status
);
462 state
->out_output
.length
= nread
;
464 tevent_req_done(req
);
467 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
469 DATA_BLOB
*out_output
)
471 NTSTATUS status
= NT_STATUS_OK
;
472 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
473 struct smbd_smb2_ioctl_state
);
475 if (tevent_req_is_nterror(req
, &status
)) {
476 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
477 tevent_req_received(req
);
482 *out_output
= state
->out_output
;
483 talloc_steal(mem_ctx
, out_output
->data
);
485 tevent_req_received(req
);