?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_ioctl: make use of file_fsp_smb2()
[Samba/gebeck_regimport.git] / source3 / smbd / smb2_ioctl.c
blob7710a9ebb244e402a0b20b685361bfb9716764a5
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
28 #include "../librpc/ndr/libndr.h"
29
30 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
31 struct tevent_context *ev,
32 struct smbd_smb2_request *smb2req,
33 struct files_struct *in_fsp,
34 uint32_t in_ctl_code,
35 DATA_BLOB in_input,
36 uint32_t in_max_output,
37 uint32_t in_flags);
38 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
39 TALLOC_CTX *mem_ctx,
40 DATA_BLOB *out_output,
41 bool *disconnect);
42
43 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq);
44 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
45 {
46 NTSTATUS status;
47 const uint8_t *inbody;
48 int i = req->current_idx;
49 uint32_t min_buffer_offset;
50 uint32_t max_buffer_offset;
51 uint32_t min_output_offset;
52 uint32_t allowed_length_in;
53 uint32_t allowed_length_out;
54 uint32_t in_ctl_code;
55 uint64_t in_file_id_persistent;
56 uint64_t in_file_id_volatile;
57 struct files_struct *in_fsp = NULL;
58 uint32_t in_input_offset;
59 uint32_t in_input_length;
60 DATA_BLOB in_input_buffer = data_blob_null;
61 uint32_t in_max_input_length;
62 uint32_t in_output_offset;
63 uint32_t in_output_length;
64 DATA_BLOB in_output_buffer = data_blob_null;
65 uint32_t in_max_output_length;
66 uint32_t in_flags;
67 uint32_t data_length_in;
68 uint32_t data_length_out;
69 uint32_t data_length_tmp;
70 uint32_t data_length_max;
71 struct tevent_req *subreq;
72
73 status = smbd_smb2_request_verify_sizes(req, 0x39);
74 if (!NT_STATUS_IS_OK(status)) {
75 return smbd_smb2_request_error(req, status);
76 }
77 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
78
79 in_ctl_code = IVAL(inbody, 0x04);
80 in_file_id_persistent = BVAL(inbody, 0x08);
81 in_file_id_volatile = BVAL(inbody, 0x10);
82 in_input_offset = IVAL(inbody, 0x18);
83 in_input_length = IVAL(inbody, 0x1C);
84 in_max_input_length = IVAL(inbody, 0x20);
85 in_output_offset = IVAL(inbody, 0x24);
86 in_output_length = IVAL(inbody, 0x28);
87 in_max_output_length = IVAL(inbody, 0x2C);
88 in_flags = IVAL(inbody, 0x30);
89
90 min_buffer_offset = SMB2_HDR_BODY + req->in.vector[i+1].iov_len;
91 max_buffer_offset = min_buffer_offset + req->in.vector[i+2].iov_len;
92 min_output_offset = min_buffer_offset;
93
94 /*
95 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
96 * the SMB2 header to the input data buffer. If no input data is
97 * required for the FSCTL/IOCTL command being issued, the client SHOULD
98 * set this value to 0.<49>
99 * <49> If no input data is required for the FSCTL/IOCTL command being
100 * issued, Windows-based clients set this field to any value.
101 */
102 allowed_length_in = 0;
103 if ((in_input_offset > 0) && (in_input_length > 0)) {
104 uint32_t tmp_ofs;
105
106 if (in_input_offset < min_buffer_offset) {
107 return smbd_smb2_request_error(req,
108 NT_STATUS_INVALID_PARAMETER);
109 }
110 if (in_input_offset > max_buffer_offset) {
111 return smbd_smb2_request_error(req,
112 NT_STATUS_INVALID_PARAMETER);
113 }
114 allowed_length_in = max_buffer_offset - in_input_offset;
115
116 tmp_ofs = in_input_offset - min_buffer_offset;
117 in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
118 in_input_buffer.data += tmp_ofs;
119 in_input_buffer.length = in_input_length;
120 min_output_offset += tmp_ofs;
121 min_output_offset += in_input_length;
122 }
123
124 if (in_input_length > allowed_length_in) {
125 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
126 }
127
128 allowed_length_out = 0;
129 if (in_output_offset > 0) {
130 if (in_output_offset < min_buffer_offset) {
131 return smbd_smb2_request_error(req,
132 NT_STATUS_INVALID_PARAMETER);
133 }
134 if (in_output_offset > max_buffer_offset) {
135 return smbd_smb2_request_error(req,
136 NT_STATUS_INVALID_PARAMETER);
137 }
138 allowed_length_out = max_buffer_offset - in_output_offset;
139 }
140
141 if (in_output_length > allowed_length_out) {
142 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
143 }
144
145 if (in_output_length > 0) {
146 uint32_t tmp_ofs;
147
148 if (in_output_offset < min_output_offset) {
149 return smbd_smb2_request_error(req,
150 NT_STATUS_INVALID_PARAMETER);
151 }
152
153 tmp_ofs = in_output_offset - min_buffer_offset;
154 in_output_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
155 in_output_buffer.data += tmp_ofs;
156 in_output_buffer.length = in_output_length;
157 }
158
159 /*
160 * verify the credits and avoid overflows
161 * in_input_buffer.length and in_output_buffer.length
162 * are already verified.
163 */
164 data_length_in = in_input_buffer.length + in_output_buffer.length;
165
166 data_length_out = in_max_input_length;
167 data_length_tmp = UINT32_MAX - data_length_out;
168 if (data_length_tmp < in_max_output_length) {
169 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
170 }
171 data_length_out += in_max_output_length;
172
173 data_length_max = MAX(data_length_in, data_length_out);
174
175 status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
176 if (!NT_STATUS_IS_OK(status)) {
177 return smbd_smb2_request_error(req, status);
178 }
179
180 /*
181 * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
182 * server MUST fail the request with STATUS_NOT_SUPPORTED.
183 */
184 if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
185 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
186 }
187
188 switch (in_ctl_code) {
189 case FSCTL_DFS_GET_REFERRALS:
190 case FSCTL_DFS_GET_REFERRALS_EX:
191 case FSCTL_PIPE_WAIT:
192 case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
193 case FSCTL_VALIDATE_NEGOTIATE_INFO:
194 case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
195 /*
196 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
197 * FSCTL_PIPE_WAIT does not take a file handle.
198 *
199 * If FileId in the SMB2 Header of the request is not
200 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
201 * with STATUS_INVALID_PARAMETER.
202 */
203 if (in_file_id_persistent != UINT64_MAX ||
204 in_file_id_volatile != UINT64_MAX) {
205 return smbd_smb2_request_error(req,
206 NT_STATUS_INVALID_PARAMETER);
207 }
208 break;
209 default:
210 in_fsp = file_fsp_smb2(req, in_file_id_persistent,
211 in_file_id_volatile);
212 if (in_fsp == NULL) {
213 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
214 }
215 break;
216 }
217
218 subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
219 req, in_fsp,
220 in_ctl_code,
221 in_input_buffer,
222 in_max_output_length,
223 in_flags);
224 if (subreq == NULL) {
225 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
226 }
227 tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
228
229 return smbd_smb2_request_pending_queue(req, subreq, 1000);
230 }
231
232 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
233 {
234 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
235 struct smbd_smb2_request);
236 const uint8_t *inbody;
237 int i = req->current_idx;
238 DATA_BLOB outbody;
239 DATA_BLOB outdyn;
240 uint32_t in_ctl_code;
241 uint64_t in_file_id_persistent;
242 uint64_t in_file_id_volatile;
243 uint32_t out_input_offset;
244 uint32_t out_output_offset;
245 DATA_BLOB out_output_buffer = data_blob_null;
246 NTSTATUS status;
247 NTSTATUS error; /* transport error */
248 bool disconnect = false;
249
250 status = smbd_smb2_ioctl_recv(subreq, req,
251 &out_output_buffer,
252 &disconnect);
253
254 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
255 "%u status %s\n",
256 (unsigned int)out_output_buffer.length,
257 nt_errstr(status) ));
258
259 TALLOC_FREE(subreq);
260 if (disconnect) {
261 error = status;
262 smbd_server_connection_terminate(req->sconn,
263 nt_errstr(error));
264 return;
265 }
266
267 if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
268 /* also ok */
269 } else if (!NT_STATUS_IS_OK(status)) {
270 error = smbd_smb2_request_error(req, status);
271 if (!NT_STATUS_IS_OK(error)) {
272 smbd_server_connection_terminate(req->sconn,
273 nt_errstr(error));
274 return;
275 }
276 return;
277 }
278
279 out_input_offset = SMB2_HDR_BODY + 0x30;
280 out_output_offset = SMB2_HDR_BODY + 0x30;
281
282 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
283
284 in_ctl_code = IVAL(inbody, 0x04);
285 in_file_id_persistent = BVAL(inbody, 0x08);
286 in_file_id_volatile = BVAL(inbody, 0x10);
287
288 outbody = data_blob_talloc(req->out.vector, NULL, 0x30);
289 if (outbody.data == NULL) {
290 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
291 if (!NT_STATUS_IS_OK(error)) {
292 smbd_server_connection_terminate(req->sconn,
293 nt_errstr(error));
294 return;
295 }
296 return;
297 }
298
299 SSVAL(outbody.data, 0x00, 0x30 + 1); /* struct size */
300 SSVAL(outbody.data, 0x02, 0); /* reserved */
301 SIVAL(outbody.data, 0x04,
302 in_ctl_code); /* ctl code */
303 SBVAL(outbody.data, 0x08,
304 in_file_id_persistent); /* file id (persistent) */
305 SBVAL(outbody.data, 0x10,
306 in_file_id_volatile); /* file id (volatile) */
307 SIVAL(outbody.data, 0x18,
308 out_input_offset); /* input offset */
309 SIVAL(outbody.data, 0x1C, 0); /* input count */
310 SIVAL(outbody.data, 0x20,
311 out_output_offset); /* output offset */
312 SIVAL(outbody.data, 0x24,
313 out_output_buffer.length); /* output count */
314 SIVAL(outbody.data, 0x28, 0); /* flags */
315 SIVAL(outbody.data, 0x2C, 0); /* reserved */
316
317 /*
318 * Note: Windows Vista and 2008 send back also the
319 * input from the request. But it was fixed in
320 * Windows 7.
321 */
322 outdyn = out_output_buffer;
323
324 error = smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
325 __location__);
326 if (!NT_STATUS_IS_OK(error)) {
327 smbd_server_connection_terminate(req->sconn,
328 nt_errstr(error));
329 return;
330 }
331 }
332
333 struct smbd_smb2_ioctl_state {
334 struct smbd_smb2_request *smb2req;
335 struct smb_request *smbreq;
336 files_struct *fsp;
337 DATA_BLOB in_input;
338 uint32_t in_max_output;
339 DATA_BLOB out_output;
340 bool disconnect;
341 };
342
343 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq);
344 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq);
345
346 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
347 struct tevent_context *ev,
348 struct smbd_smb2_request *smb2req,
349 struct files_struct *fsp,
350 uint32_t in_ctl_code,
351 DATA_BLOB in_input,
352 uint32_t in_max_output,
353 uint32_t in_flags)
354 {
355 struct tevent_req *req;
356 struct smbd_smb2_ioctl_state *state;
357 struct smb_request *smbreq;
358 struct tevent_req *subreq;
359
360 req = tevent_req_create(mem_ctx, &state,
361 struct smbd_smb2_ioctl_state);
362 if (req == NULL) {
363 return NULL;
364 }
365 state->smb2req = smb2req;
366 state->smbreq = NULL;
367 state->fsp = fsp;
368 state->in_input = in_input;
369 state->in_max_output = in_max_output;
370 state->out_output = data_blob_null;
371
372 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s fnum[%d]\n",
373 (unsigned)in_ctl_code,
374 fsp ? fsp_str_dbg(fsp) : "<no handle>",
375 fsp ? fsp->fnum : -1));
376
377 smbreq = smbd_smb2_fake_smb_request(smb2req);
378 if (tevent_req_nomem(smbreq, req)) {
379 return tevent_req_post(req, ev);
380 }
381 state->smbreq = smbreq;
382
383 switch (in_ctl_code) {
384 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
385 {
386 uint16_t in_max_referral_level;
387 DATA_BLOB in_file_name_buffer;
388 char *in_file_name_string;
389 size_t in_file_name_string_size;
390 bool ok;
391 bool overflow = false;
392 NTSTATUS status;
393 int dfs_size;
394 char *dfs_data = NULL;
395
396 if (!IS_IPC(smbreq->conn)) {
397 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
398 return tevent_req_post(req, ev);
399 }
400
401 if (!lp_host_msdfs()) {
402 tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED);
403 return tevent_req_post(req, ev);
404 }
405
406 if (in_input.length < (2 + 2)) {
407 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
408 return tevent_req_post(req, ev);
409 }
410
411 in_max_referral_level = SVAL(in_input.data, 0);
412 in_file_name_buffer.data = in_input.data + 2;
413 in_file_name_buffer.length = in_input.length - 2;
414
415 ok = convert_string_talloc(state, CH_UTF16, CH_UNIX,
416 in_file_name_buffer.data,
417 in_file_name_buffer.length,
418 &in_file_name_string,
419 &in_file_name_string_size);
420 if (!ok) {
421 tevent_req_nterror(req, NT_STATUS_ILLEGAL_CHARACTER);
422 return tevent_req_post(req, ev);
423 }
424
425 dfs_size = setup_dfs_referral(smbreq->conn,
426 in_file_name_string,
427 in_max_referral_level,
428 &dfs_data, &status);
429 if (dfs_size < 0) {
430 tevent_req_nterror(req, status);
431 return tevent_req_post(req, ev);
432 }
433
434 if (dfs_size > in_max_output) {
435 /*
436 * TODO: we need a testsuite for this
437 */
438 overflow = true;
439 dfs_size = in_max_output;
440 }
441
442 state->out_output = data_blob_talloc(state,
443 (uint8_t *)dfs_data,
444 dfs_size);
445 SAFE_FREE(dfs_data);
446 if (dfs_size > 0 &&
447 tevent_req_nomem(state->out_output.data, req)) {
448 return tevent_req_post(req, ev);
449 }
450
451 if (overflow) {
452 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
453 } else {
454 tevent_req_done(req);
455 }
456 return tevent_req_post(req, ev);
457 }
458 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
459
460 if (!IS_IPC(smbreq->conn)) {
461 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
462 return tevent_req_post(req, ev);
463 }
464
465 if (fsp == NULL) {
466 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
467 return tevent_req_post(req, ev);
468 }
469
470 if (!fsp_is_np(fsp)) {
471 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
472 return tevent_req_post(req, ev);
473 }
474
475 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
476 (unsigned int)in_input.length ));
477
478 subreq = np_write_send(state, ev,
479 fsp->fake_file_handle,
480 in_input.data,
481 in_input.length);
482 if (tevent_req_nomem(subreq, req)) {
483 return tevent_req_post(req, ev);
484 }
485 tevent_req_set_callback(subreq,
486 smbd_smb2_ioctl_pipe_write_done,
487 req);
488 return req;
489
490 case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
491 {
492 struct smbXsrv_connection *conn = smbreq->sconn->conn;
493 uint32_t in_capabilities;
494 DATA_BLOB in_guid_blob;
495 struct GUID in_guid;
496 uint16_t in_security_mode;
497 uint16_t in_max_dialect;
498 uint16_t max_dialect;
499 DATA_BLOB out_guid_blob;
500 NTSTATUS status;
501
502 if (in_input.length != 0x18) {
503 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
504 return tevent_req_post(req, ev);
505 }
506
507 if (in_max_output < 0x18) {
508 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
509 return tevent_req_post(req, ev);
510 }
511
512 in_capabilities = IVAL(in_input.data, 0x00);
513 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
514 in_security_mode = SVAL(in_input.data, 0x14);
515 in_max_dialect = SVAL(in_input.data, 0x16);
516
517 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
518 if (tevent_req_nterror(req, status)) {
519 return tevent_req_post(req, ev);
520 }
521
522 max_dialect = conn->smb2.client.dialects[conn->smb2.client.num_dialects-1];
523 if (in_max_dialect != max_dialect) {
524 state->disconnect = true;
525 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
526 return tevent_req_post(req, ev);
527 }
528
529 if (!GUID_compare(&in_guid, &conn->smb2.client.guid)) {
530 state->disconnect = true;
531 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
532 return tevent_req_post(req, ev);
533 }
534
535 if (in_security_mode != conn->smb2.client.security_mode) {
536 state->disconnect = true;
537 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
538 return tevent_req_post(req, ev);
539 }
540
541 if (in_capabilities != conn->smb2.client.capabilities) {
542 state->disconnect = true;
543 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
544 return tevent_req_post(req, ev);
545 }
546
547 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
548 &out_guid_blob);
549 if (tevent_req_nterror(req, status)) {
550 return tevent_req_post(req, ev);
551 }
552
553 state->out_output = data_blob_talloc(state, NULL, 0x18);
554 if (tevent_req_nomem(state->out_output.data, req)) {
555 return tevent_req_post(req, ev);
556 }
557
558 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
559 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
560 SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
561 SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
562
563 tevent_req_done(req);
564 return tevent_req_post(req, ev);
565 }
566
567 case FSCTL_VALIDATE_NEGOTIATE_INFO:
568 {
569 struct smbXsrv_connection *conn = smbreq->sconn->conn;
570 uint32_t in_capabilities;
571 DATA_BLOB in_guid_blob;
572 struct GUID in_guid;
573 uint16_t in_security_mode;
574 uint16_t in_num_dialects;
575 uint16_t i;
576 DATA_BLOB out_guid_blob;
577 NTSTATUS status;
578
579 if (in_input.length < 0x18) {
580 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
581 return tevent_req_post(req, ev);
582 }
583
584 in_capabilities = IVAL(in_input.data, 0x00);
585 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
586 in_security_mode = SVAL(in_input.data, 0x14);
587 in_num_dialects = SVAL(in_input.data, 0x16);
588
589 if (in_input.length != (0x18 + in_num_dialects*2)) {
590 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
591 return tevent_req_post(req, ev);
592 }
593
594 if (in_max_output < 0x18) {
595 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
596 return tevent_req_post(req, ev);
597 }
598
599 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
600 if (tevent_req_nterror(req, status)) {
601 return tevent_req_post(req, ev);
602 }
603
604 if (in_num_dialects != conn->smb2.client.num_dialects) {
605 state->disconnect = true;
606 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
607 return tevent_req_post(req, ev);
608 }
609
610 for (i=0; i < in_num_dialects; i++) {
611 uint16_t v = SVAL(in_input.data, 0x18 + i*2);
612
613 if (conn->smb2.client.dialects[i] != v) {
614 state->disconnect = true;
615 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
616 return tevent_req_post(req, ev);
617 }
618 }
619
620 if (!GUID_compare(&in_guid, &conn->smb2.client.guid)) {
621 state->disconnect = true;
622 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
623 return tevent_req_post(req, ev);
624 }
625
626 if (in_security_mode != conn->smb2.client.security_mode) {
627 state->disconnect = true;
628 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
629 return tevent_req_post(req, ev);
630 }
631
632 if (in_capabilities != conn->smb2.client.capabilities) {
633 state->disconnect = true;
634 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
635 return tevent_req_post(req, ev);
636 }
637
638 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
639 &out_guid_blob);
640 if (tevent_req_nterror(req, status)) {
641 return tevent_req_post(req, ev);
642 }
643
644 state->out_output = data_blob_talloc(state, NULL, 0x18);
645 if (tevent_req_nomem(state->out_output.data, req)) {
646 return tevent_req_post(req, ev);
647 }
648
649 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
650 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
651 SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
652 SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
653
654 tevent_req_done(req);
655 return tevent_req_post(req, ev);
656 }
657
658 default: {
659 uint8_t *out_data = NULL;
660 uint32_t out_data_len = 0;
661 NTSTATUS status;
662
663 if (fsp == NULL) {
664 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
665 return tevent_req_post(req, ev);
666 }
667
668 status = SMB_VFS_FSCTL(fsp,
669 state,
670 in_ctl_code,
671 smbreq->flags2,
672 in_input.data,
673 in_input.length,
674 &out_data,
675 in_max_output,
676 &out_data_len);
677 state->out_output = data_blob_const(out_data, out_data_len);
678 if (NT_STATUS_IS_OK(status)) {
679 tevent_req_done(req);
680 return tevent_req_post(req, ev);
681 }
682
683 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
684 if (IS_IPC(smbreq->conn)) {
685 status = NT_STATUS_FS_DRIVER_REQUIRED;
686 } else {
687 status = NT_STATUS_INVALID_DEVICE_REQUEST;
688 }
689 }
690
691 tevent_req_nterror(req, status);
692 return tevent_req_post(req, ev);
693 }
694 }
695
696 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
697 return tevent_req_post(req, ev);
698 }
699
700 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq)
701 {
702 struct tevent_req *req = tevent_req_callback_data(subreq,
703 struct tevent_req);
704 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
705 struct smbd_smb2_ioctl_state);
706 NTSTATUS status;
707 ssize_t nwritten = -1;
708
709 status = np_write_recv(subreq, &nwritten);
710
711 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
712 (long int)nwritten ));
713
714 TALLOC_FREE(subreq);
715 if (!NT_STATUS_IS_OK(status)) {
716 NTSTATUS old = status;
717 status = nt_status_np_pipe(old);
718 tevent_req_nterror(req, status);
719 return;
720 }
721
722 if (nwritten != state->in_input.length) {
723 tevent_req_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
724 return;
725 }
726
727 state->out_output = data_blob_talloc(state, NULL, state->in_max_output);
728 if (state->in_max_output > 0 &&
729 tevent_req_nomem(state->out_output.data, req)) {
730 return;
731 }
732
733 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
734 "of size %u\n",
735 (unsigned int)state->out_output.length ));
736
737 TALLOC_FREE(subreq);
738 subreq = np_read_send(state->smbreq->conn,
739 state->smb2req->sconn->ev_ctx,
740 state->fsp->fake_file_handle,
741 state->out_output.data,
742 state->out_output.length);
743 if (tevent_req_nomem(subreq, req)) {
744 return;
745 }
746 tevent_req_set_callback(subreq, smbd_smb2_ioctl_pipe_read_done, req);
747 }
748
749 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq)
750 {
751 struct tevent_req *req = tevent_req_callback_data(subreq,
752 struct tevent_req);
753 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
754 struct smbd_smb2_ioctl_state);
755 NTSTATUS status;
756 NTSTATUS old;
757 ssize_t nread = -1;
758 bool is_data_outstanding = false;
759
760 status = np_read_recv(subreq, &nread, &is_data_outstanding);
761 TALLOC_FREE(subreq);
762
763 old = status;
764 status = nt_status_np_pipe(old);
765
766 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
767 "is_data_outstanding = %d, status = %s%s%s\n",
768 (int)nread,
769 (int)is_data_outstanding,
770 nt_errstr(old),
771 NT_STATUS_EQUAL(old, status)?"":" => ",
772 NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
773
774 if (!NT_STATUS_IS_OK(status)) {
775 tevent_req_nterror(req, status);
776 return;
777 }
778
779 state->out_output.length = nread;
780
781 if (is_data_outstanding) {
782 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
783 return;
784 }
785
786 tevent_req_done(req);
787 }
788
789 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
790 TALLOC_CTX *mem_ctx,
791 DATA_BLOB *out_output,
792 bool *disconnect)
793 {
794 NTSTATUS status = NT_STATUS_OK;
795 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
796 struct smbd_smb2_ioctl_state);
797
798 *disconnect = state->disconnect;
799
800 if (tevent_req_is_nterror(req, &status)) {
801 if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
802 tevent_req_received(req);
803 return status;
804 }
805 }
806
807 *out_output = state->out_output;
808 talloc_steal(mem_ctx, out_output->data);
809
810 tevent_req_received(req);
811 return status;
812 }
reg import