?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
smb2_ioctl: split ioctl handlers into separate funtions
[Samba/bjacke.git] / source3 / smbd / smb2_ioctl.c
blob1c7b94dbecccf5601c35ce40d6d2829ab7136470
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
28 #include "../librpc/ndr/libndr.h"
29
30 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
31 struct tevent_context *ev,
32 struct smbd_smb2_request *smb2req,
33 struct files_struct *in_fsp,
34 uint32_t in_ctl_code,
35 DATA_BLOB in_input,
36 uint32_t in_max_output,
37 uint32_t in_flags);
38 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
39 TALLOC_CTX *mem_ctx,
40 DATA_BLOB *out_output,
41 bool *disconnect);
42
43 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq);
44 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
45 {
46 NTSTATUS status;
47 const uint8_t *inbody;
48 uint32_t min_buffer_offset;
49 uint32_t max_buffer_offset;
50 uint32_t min_output_offset;
51 uint32_t allowed_length_in;
52 uint32_t allowed_length_out;
53 uint32_t in_ctl_code;
54 uint64_t in_file_id_persistent;
55 uint64_t in_file_id_volatile;
56 struct files_struct *in_fsp = NULL;
57 uint32_t in_input_offset;
58 uint32_t in_input_length;
59 DATA_BLOB in_input_buffer = data_blob_null;
60 uint32_t in_max_input_length;
61 uint32_t in_output_offset;
62 uint32_t in_output_length;
63 DATA_BLOB in_output_buffer = data_blob_null;
64 uint32_t in_max_output_length;
65 uint32_t in_flags;
66 uint32_t data_length_in;
67 uint32_t data_length_out;
68 uint32_t data_length_tmp;
69 uint32_t data_length_max;
70 struct tevent_req *subreq;
71
72 status = smbd_smb2_request_verify_sizes(req, 0x39);
73 if (!NT_STATUS_IS_OK(status)) {
74 return smbd_smb2_request_error(req, status);
75 }
76 inbody = SMBD_SMB2_IN_BODY_PTR(req);
77
78 in_ctl_code = IVAL(inbody, 0x04);
79 in_file_id_persistent = BVAL(inbody, 0x08);
80 in_file_id_volatile = BVAL(inbody, 0x10);
81 in_input_offset = IVAL(inbody, 0x18);
82 in_input_length = IVAL(inbody, 0x1C);
83 in_max_input_length = IVAL(inbody, 0x20);
84 in_output_offset = IVAL(inbody, 0x24);
85 in_output_length = IVAL(inbody, 0x28);
86 in_max_output_length = IVAL(inbody, 0x2C);
87 in_flags = IVAL(inbody, 0x30);
88
89 min_buffer_offset = SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req);
90 max_buffer_offset = min_buffer_offset + SMBD_SMB2_IN_DYN_LEN(req);
91 min_output_offset = min_buffer_offset;
92
93 /*
94 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
95 * the SMB2 header to the input data buffer. If no input data is
96 * required for the FSCTL/IOCTL command being issued, the client SHOULD
97 * set this value to 0.<49>
98 * <49> If no input data is required for the FSCTL/IOCTL command being
99 * issued, Windows-based clients set this field to any value.
100 */
101 allowed_length_in = 0;
102 if ((in_input_offset > 0) && (in_input_length > 0)) {
103 uint32_t tmp_ofs;
104
105 if (in_input_offset < min_buffer_offset) {
106 return smbd_smb2_request_error(req,
107 NT_STATUS_INVALID_PARAMETER);
108 }
109 if (in_input_offset > max_buffer_offset) {
110 return smbd_smb2_request_error(req,
111 NT_STATUS_INVALID_PARAMETER);
112 }
113 allowed_length_in = max_buffer_offset - in_input_offset;
114
115 tmp_ofs = in_input_offset - min_buffer_offset;
116 in_input_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
117 in_input_buffer.data += tmp_ofs;
118 in_input_buffer.length = in_input_length;
119 min_output_offset += tmp_ofs;
120 min_output_offset += in_input_length;
121 }
122
123 if (in_input_length > allowed_length_in) {
124 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
125 }
126
127 allowed_length_out = 0;
128 if (in_output_offset > 0) {
129 if (in_output_offset < min_buffer_offset) {
130 return smbd_smb2_request_error(req,
131 NT_STATUS_INVALID_PARAMETER);
132 }
133 if (in_output_offset > max_buffer_offset) {
134 return smbd_smb2_request_error(req,
135 NT_STATUS_INVALID_PARAMETER);
136 }
137 allowed_length_out = max_buffer_offset - in_output_offset;
138 }
139
140 if (in_output_length > allowed_length_out) {
141 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
142 }
143
144 if (in_output_length > 0) {
145 uint32_t tmp_ofs;
146
147 if (in_output_offset < min_output_offset) {
148 return smbd_smb2_request_error(req,
149 NT_STATUS_INVALID_PARAMETER);
150 }
151
152 tmp_ofs = in_output_offset - min_buffer_offset;
153 in_output_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
154 in_output_buffer.data += tmp_ofs;
155 in_output_buffer.length = in_output_length;
156 }
157
158 /*
159 * verify the credits and avoid overflows
160 * in_input_buffer.length and in_output_buffer.length
161 * are already verified.
162 */
163 data_length_in = in_input_buffer.length + in_output_buffer.length;
164
165 data_length_out = in_max_input_length;
166 data_length_tmp = UINT32_MAX - data_length_out;
167 if (data_length_tmp < in_max_output_length) {
168 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
169 }
170 data_length_out += in_max_output_length;
171
172 data_length_max = MAX(data_length_in, data_length_out);
173
174 status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
175 if (!NT_STATUS_IS_OK(status)) {
176 return smbd_smb2_request_error(req, status);
177 }
178
179 /*
180 * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
181 * server MUST fail the request with STATUS_NOT_SUPPORTED.
182 */
183 if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
184 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
185 }
186
187 switch (in_ctl_code) {
188 case FSCTL_DFS_GET_REFERRALS:
189 case FSCTL_DFS_GET_REFERRALS_EX:
190 case FSCTL_PIPE_WAIT:
191 case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
192 case FSCTL_VALIDATE_NEGOTIATE_INFO:
193 case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
194 /*
195 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
196 * FSCTL_PIPE_WAIT does not take a file handle.
197 *
198 * If FileId in the SMB2 Header of the request is not
199 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
200 * with STATUS_INVALID_PARAMETER.
201 */
202 if (in_file_id_persistent != UINT64_MAX ||
203 in_file_id_volatile != UINT64_MAX) {
204 return smbd_smb2_request_error(req,
205 NT_STATUS_INVALID_PARAMETER);
206 }
207 break;
208 default:
209 in_fsp = file_fsp_smb2(req, in_file_id_persistent,
210 in_file_id_volatile);
211 if (in_fsp == NULL) {
212 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
213 }
214 break;
215 }
216
217 subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
218 req, in_fsp,
219 in_ctl_code,
220 in_input_buffer,
221 in_max_output_length,
222 in_flags);
223 if (subreq == NULL) {
224 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
225 }
226 tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
227
228 return smbd_smb2_request_pending_queue(req, subreq, 1000);
229 }
230
231 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
232 {
233 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
234 struct smbd_smb2_request);
235 const uint8_t *inbody;
236 DATA_BLOB outbody;
237 DATA_BLOB outdyn;
238 uint32_t in_ctl_code;
239 uint64_t in_file_id_persistent;
240 uint64_t in_file_id_volatile;
241 uint32_t out_input_offset;
242 uint32_t out_output_offset;
243 DATA_BLOB out_output_buffer = data_blob_null;
244 NTSTATUS status;
245 NTSTATUS error; /* transport error */
246 bool disconnect = false;
247
248 status = smbd_smb2_ioctl_recv(subreq, req,
249 &out_output_buffer,
250 &disconnect);
251
252 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
253 "%u status %s\n",
254 (unsigned int)out_output_buffer.length,
255 nt_errstr(status) ));
256
257 TALLOC_FREE(subreq);
258 if (disconnect) {
259 error = status;
260 smbd_server_connection_terminate(req->sconn,
261 nt_errstr(error));
262 return;
263 }
264
265 if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
266 /* also ok */
267 } else if (!NT_STATUS_IS_OK(status)) {
268 error = smbd_smb2_request_error(req, status);
269 if (!NT_STATUS_IS_OK(error)) {
270 smbd_server_connection_terminate(req->sconn,
271 nt_errstr(error));
272 return;
273 }
274 return;
275 }
276
277 out_input_offset = SMB2_HDR_BODY + 0x30;
278 out_output_offset = SMB2_HDR_BODY + 0x30;
279
280 inbody = SMBD_SMB2_IN_BODY_PTR(req);
281
282 in_ctl_code = IVAL(inbody, 0x04);
283 in_file_id_persistent = BVAL(inbody, 0x08);
284 in_file_id_volatile = BVAL(inbody, 0x10);
285
286 outbody = data_blob_talloc(req->out.vector, NULL, 0x30);
287 if (outbody.data == NULL) {
288 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
289 if (!NT_STATUS_IS_OK(error)) {
290 smbd_server_connection_terminate(req->sconn,
291 nt_errstr(error));
292 return;
293 }
294 return;
295 }
296
297 SSVAL(outbody.data, 0x00, 0x30 + 1); /* struct size */
298 SSVAL(outbody.data, 0x02, 0); /* reserved */
299 SIVAL(outbody.data, 0x04,
300 in_ctl_code); /* ctl code */
301 SBVAL(outbody.data, 0x08,
302 in_file_id_persistent); /* file id (persistent) */
303 SBVAL(outbody.data, 0x10,
304 in_file_id_volatile); /* file id (volatile) */
305 SIVAL(outbody.data, 0x18,
306 out_input_offset); /* input offset */
307 SIVAL(outbody.data, 0x1C, 0); /* input count */
308 SIVAL(outbody.data, 0x20,
309 out_output_offset); /* output offset */
310 SIVAL(outbody.data, 0x24,
311 out_output_buffer.length); /* output count */
312 SIVAL(outbody.data, 0x28, 0); /* flags */
313 SIVAL(outbody.data, 0x2C, 0); /* reserved */
314
315 /*
316 * Note: Windows Vista and 2008 send back also the
317 * input from the request. But it was fixed in
318 * Windows 7.
319 */
320 outdyn = out_output_buffer;
321
322 error = smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
323 __location__);
324 if (!NT_STATUS_IS_OK(error)) {
325 smbd_server_connection_terminate(req->sconn,
326 nt_errstr(error));
327 return;
328 }
329 }
330
331 static NTSTATUS fsctl_dfs_get_refers(TALLOC_CTX *mem_ctx,
332 struct tevent_context *ev,
333 struct connection_struct *conn,
334 DATA_BLOB *in_input,
335 uint32_t in_max_output,
336 DATA_BLOB *out_output)
337 {
338 uint16_t in_max_referral_level;
339 DATA_BLOB in_file_name_buffer;
340 char *in_file_name_string;
341 size_t in_file_name_string_size;
342 bool ok;
343 bool overflow = false;
344 NTSTATUS status;
345 int dfs_size;
346 char *dfs_data = NULL;
347 DATA_BLOB output;
348
349 if (!IS_IPC(conn)) {
350 return NT_STATUS_INVALID_DEVICE_REQUEST;
351 }
352
353 if (!lp_host_msdfs()) {
354 return NT_STATUS_FS_DRIVER_REQUIRED;
355 }
356
357 if (in_input->length < (2 + 2)) {
358 return NT_STATUS_INVALID_PARAMETER;
359 }
360
361 in_max_referral_level = SVAL(in_input->data, 0);
362 in_file_name_buffer.data = in_input->data + 2;
363 in_file_name_buffer.length = in_input->length - 2;
364
365 ok = convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
366 in_file_name_buffer.data,
367 in_file_name_buffer.length,
368 &in_file_name_string,
369 &in_file_name_string_size);
370 if (!ok) {
371 return NT_STATUS_ILLEGAL_CHARACTER;
372 }
373
374 dfs_size = setup_dfs_referral(conn,
375 in_file_name_string,
376 in_max_referral_level,
377 &dfs_data, &status);
378 if (dfs_size < 0) {
379 return status;
380 }
381
382 if (dfs_size > in_max_output) {
383 /*
384 * TODO: we need a testsuite for this
385 */
386 overflow = true;
387 dfs_size = in_max_output;
388 }
389
390 output = data_blob_talloc(mem_ctx, (uint8_t *)dfs_data, dfs_size);
391 SAFE_FREE(dfs_data);
392 if ((dfs_size > 0) && (output.data == NULL)) {
393 return NT_STATUS_NO_MEMORY;
394 }
395 *out_output = output;
396
397 if (overflow) {
398 return STATUS_BUFFER_OVERFLOW;
399 }
400 return NT_STATUS_OK;
401 }
402
403 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
404 struct tevent_context *ev,
405 struct smbXsrv_connection *conn,
406 DATA_BLOB *in_input,
407 uint32_t in_max_output,
408 DATA_BLOB *out_output,
409 bool *disconnect)
410 {
411 uint32_t in_capabilities;
412 DATA_BLOB in_guid_blob;
413 struct GUID in_guid;
414 uint16_t in_security_mode;
415 uint16_t in_num_dialects;
416 uint16_t i;
417 DATA_BLOB out_guid_blob;
418 NTSTATUS status;
419
420 if (in_input->length < 0x18) {
421 return NT_STATUS_INVALID_PARAMETER;
422 }
423
424 in_capabilities = IVAL(in_input->data, 0x00);
425 in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
426 in_security_mode = SVAL(in_input->data, 0x14);
427 in_num_dialects = SVAL(in_input->data, 0x16);
428
429 if (in_input->length < (0x18 + in_num_dialects*2)) {
430 return NT_STATUS_INVALID_PARAMETER;
431 }
432
433 if (in_max_output < 0x18) {
434 return NT_STATUS_BUFFER_TOO_SMALL;
435 }
436
437 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
438 if (!NT_STATUS_IS_OK(status)) {
439 return status;
440 }
441
442 if (in_num_dialects != conn->smb2.client.num_dialects) {
443 *disconnect = true;
444 return NT_STATUS_ACCESS_DENIED;
445 }
446
447 for (i=0; i < in_num_dialects; i++) {
448 uint16_t v = SVAL(in_input->data, 0x18 + i*2);
449
450 if (conn->smb2.client.dialects[i] != v) {
451 *disconnect = true;
452 return NT_STATUS_ACCESS_DENIED;
453 }
454 }
455
456 if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) {
457 *disconnect = true;
458 return NT_STATUS_ACCESS_DENIED;
459 }
460
461 if (in_security_mode != conn->smb2.client.security_mode) {
462 *disconnect = true;
463 return NT_STATUS_ACCESS_DENIED;
464 }
465
466 if (in_capabilities != conn->smb2.client.capabilities) {
467 *disconnect = true;
468 return NT_STATUS_ACCESS_DENIED;
469 }
470
471 status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
472 &out_guid_blob);
473 if (!NT_STATUS_IS_OK(status)) {
474 return status;
475 }
476
477 *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
478 if (out_output->data == NULL) {
479 return NT_STATUS_NO_MEMORY;
480 }
481
482 SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
483 memcpy(out_output->data+0x04, out_guid_blob.data, 16);
484 SIVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
485 SIVAL(out_output->data, 0x16, conn->smb2.server.dialect);
486
487 return NT_STATUS_OK;
488 }
489
490
491 struct smbd_smb2_ioctl_state {
492 struct smbd_smb2_request *smb2req;
493 struct smb_request *smbreq;
494 files_struct *fsp;
495 DATA_BLOB in_input;
496 uint32_t in_max_output;
497 DATA_BLOB out_output;
498 bool disconnect;
499 };
500
501 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq);
502 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq);
503
504 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
505 struct tevent_context *ev,
506 struct smbd_smb2_request *smb2req,
507 struct files_struct *fsp,
508 uint32_t in_ctl_code,
509 DATA_BLOB in_input,
510 uint32_t in_max_output,
511 uint32_t in_flags)
512 {
513 struct tevent_req *req;
514 struct smbd_smb2_ioctl_state *state;
515 struct smb_request *smbreq;
516 struct tevent_req *subreq;
517
518 req = tevent_req_create(mem_ctx, &state,
519 struct smbd_smb2_ioctl_state);
520 if (req == NULL) {
521 return NULL;
522 }
523 state->smb2req = smb2req;
524 state->smbreq = NULL;
525 state->fsp = fsp;
526 state->in_input = in_input;
527 state->in_max_output = in_max_output;
528 state->out_output = data_blob_null;
529
530 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s, %s\n",
531 (unsigned)in_ctl_code,
532 fsp ? fsp_str_dbg(fsp) : "<no handle>",
533 fsp_fnum_dbg(fsp)));
534
535 smbreq = smbd_smb2_fake_smb_request(smb2req);
536 if (tevent_req_nomem(smbreq, req)) {
537 return tevent_req_post(req, ev);
538 }
539 state->smbreq = smbreq;
540
541 switch (in_ctl_code) {
542 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
543 {
544 status = fsctl_dfs_get_refers(state, ev, state->smbreq->conn,
545 &state->in_input,
546 state->in_max_output,
547 &state->out_output);
548 if (!tevent_req_nterror(req, status)) {
549 tevent_req_done(req);
550 }
551 return tevent_req_post(req, ev);
552 }
553 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
554
555 if (!IS_IPC(smbreq->conn)) {
556 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
557 return tevent_req_post(req, ev);
558 }
559
560 if (fsp == NULL) {
561 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
562 return tevent_req_post(req, ev);
563 }
564
565 if (!fsp_is_np(fsp)) {
566 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
567 return tevent_req_post(req, ev);
568 }
569
570 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
571 (unsigned int)in_input.length ));
572
573 subreq = np_write_send(state, ev,
574 fsp->fake_file_handle,
575 in_input.data,
576 in_input.length);
577 if (tevent_req_nomem(subreq, req)) {
578 return tevent_req_post(req, ev);
579 }
580 tevent_req_set_callback(subreq,
581 smbd_smb2_ioctl_pipe_write_done,
582 req);
583 return req;
584
585 case FSCTL_VALIDATE_NEGOTIATE_INFO:
586 {
587 status = fsctl_validate_neg_info(state, ev,
588 state->smbreq->sconn->conn,
589 &state->in_input,
590 state->in_max_output,
591 &state->out_output,
592 &state->disconnect);
593 if (!tevent_req_nterror(req, status)) {
594 tevent_req_done(req);
595 }
596 return tevent_req_post(req, ev);
597 }
598
599 default: {
600 uint8_t *out_data = NULL;
601 uint32_t out_data_len = 0;
602 NTSTATUS status;
603
604 if (fsp == NULL) {
605 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
606 return tevent_req_post(req, ev);
607 }
608
609 status = SMB_VFS_FSCTL(fsp,
610 state,
611 in_ctl_code,
612 smbreq->flags2,
613 in_input.data,
614 in_input.length,
615 &out_data,
616 in_max_output,
617 &out_data_len);
618 state->out_output = data_blob_const(out_data, out_data_len);
619 if (NT_STATUS_IS_OK(status)) {
620 tevent_req_done(req);
621 return tevent_req_post(req, ev);
622 }
623
624 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
625 if (IS_IPC(smbreq->conn)) {
626 status = NT_STATUS_FS_DRIVER_REQUIRED;
627 } else {
628 status = NT_STATUS_INVALID_DEVICE_REQUEST;
629 }
630 }
631
632 tevent_req_nterror(req, status);
633 return tevent_req_post(req, ev);
634 }
635 }
636
637 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
638 return tevent_req_post(req, ev);
639 }
640
641 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq)
642 {
643 struct tevent_req *req = tevent_req_callback_data(subreq,
644 struct tevent_req);
645 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
646 struct smbd_smb2_ioctl_state);
647 NTSTATUS status;
648 ssize_t nwritten = -1;
649
650 status = np_write_recv(subreq, &nwritten);
651
652 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
653 (long int)nwritten ));
654
655 TALLOC_FREE(subreq);
656 if (!NT_STATUS_IS_OK(status)) {
657 NTSTATUS old = status;
658 status = nt_status_np_pipe(old);
659 tevent_req_nterror(req, status);
660 return;
661 }
662
663 if (nwritten != state->in_input.length) {
664 tevent_req_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
665 return;
666 }
667
668 state->out_output = data_blob_talloc(state, NULL, state->in_max_output);
669 if (state->in_max_output > 0 &&
670 tevent_req_nomem(state->out_output.data, req)) {
671 return;
672 }
673
674 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
675 "of size %u\n",
676 (unsigned int)state->out_output.length ));
677
678 subreq = np_read_send(state->smbreq->conn,
679 state->smb2req->sconn->ev_ctx,
680 state->fsp->fake_file_handle,
681 state->out_output.data,
682 state->out_output.length);
683 if (tevent_req_nomem(subreq, req)) {
684 return;
685 }
686 tevent_req_set_callback(subreq, smbd_smb2_ioctl_pipe_read_done, req);
687 }
688
689 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq)
690 {
691 struct tevent_req *req = tevent_req_callback_data(subreq,
692 struct tevent_req);
693 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
694 struct smbd_smb2_ioctl_state);
695 NTSTATUS status;
696 NTSTATUS old;
697 ssize_t nread = -1;
698 bool is_data_outstanding = false;
699
700 status = np_read_recv(subreq, &nread, &is_data_outstanding);
701 TALLOC_FREE(subreq);
702
703 old = status;
704 status = nt_status_np_pipe(old);
705
706 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
707 "is_data_outstanding = %d, status = %s%s%s\n",
708 (int)nread,
709 (int)is_data_outstanding,
710 nt_errstr(old),
711 NT_STATUS_EQUAL(old, status)?"":" => ",
712 NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
713
714 if (!NT_STATUS_IS_OK(status)) {
715 tevent_req_nterror(req, status);
716 return;
717 }
718
719 state->out_output.length = nread;
720
721 if (is_data_outstanding) {
722 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
723 return;
724 }
725
726 tevent_req_done(req);
727 }
728
729 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
730 TALLOC_CTX *mem_ctx,
731 DATA_BLOB *out_output,
732 bool *disconnect)
733 {
734 NTSTATUS status = NT_STATUS_OK;
735 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
736 struct smbd_smb2_ioctl_state);
737
738 *disconnect = state->disconnect;
739
740 if (tevent_req_is_nterror(req, &status)) {
741 if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
742 tevent_req_received(req);
743 return status;
744 }
745 }
746
747 *out_output = state->out_output;
748 talloc_steal(mem_ctx, out_output->data);
749
750 tevent_req_received(req);
751 return status;
752 }
stuff from bjacke