?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smb2_ioctl: remove FSCTL_VALIDATE_NEGOTIATE_INFO_224 implementation
[Samba/gebeck_regimport.git] / source3 / smbd / smb2_ioctl.c
blob56c075e1dbe914a4ddcc97c9597558e0d9a42b05
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
28 #include "../librpc/ndr/libndr.h"
29
30 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
31 struct tevent_context *ev,
32 struct smbd_smb2_request *smb2req,
33 struct files_struct *in_fsp,
34 uint32_t in_ctl_code,
35 DATA_BLOB in_input,
36 uint32_t in_max_output,
37 uint32_t in_flags);
38 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
39 TALLOC_CTX *mem_ctx,
40 DATA_BLOB *out_output,
41 bool *disconnect);
42
43 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq);
44 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
45 {
46 NTSTATUS status;
47 const uint8_t *inbody;
48 int i = req->current_idx;
49 uint32_t min_buffer_offset;
50 uint32_t max_buffer_offset;
51 uint32_t min_output_offset;
52 uint32_t allowed_length_in;
53 uint32_t allowed_length_out;
54 uint32_t in_ctl_code;
55 uint64_t in_file_id_persistent;
56 uint64_t in_file_id_volatile;
57 struct files_struct *in_fsp = NULL;
58 uint32_t in_input_offset;
59 uint32_t in_input_length;
60 DATA_BLOB in_input_buffer = data_blob_null;
61 uint32_t in_max_input_length;
62 uint32_t in_output_offset;
63 uint32_t in_output_length;
64 DATA_BLOB in_output_buffer = data_blob_null;
65 uint32_t in_max_output_length;
66 uint32_t in_flags;
67 uint32_t data_length_in;
68 uint32_t data_length_out;
69 uint32_t data_length_tmp;
70 uint32_t data_length_max;
71 struct tevent_req *subreq;
72
73 status = smbd_smb2_request_verify_sizes(req, 0x39);
74 if (!NT_STATUS_IS_OK(status)) {
75 return smbd_smb2_request_error(req, status);
76 }
77 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
78
79 in_ctl_code = IVAL(inbody, 0x04);
80 in_file_id_persistent = BVAL(inbody, 0x08);
81 in_file_id_volatile = BVAL(inbody, 0x10);
82 in_input_offset = IVAL(inbody, 0x18);
83 in_input_length = IVAL(inbody, 0x1C);
84 in_max_input_length = IVAL(inbody, 0x20);
85 in_output_offset = IVAL(inbody, 0x24);
86 in_output_length = IVAL(inbody, 0x28);
87 in_max_output_length = IVAL(inbody, 0x2C);
88 in_flags = IVAL(inbody, 0x30);
89
90 min_buffer_offset = SMB2_HDR_BODY + req->in.vector[i+1].iov_len;
91 max_buffer_offset = min_buffer_offset + req->in.vector[i+2].iov_len;
92 min_output_offset = min_buffer_offset;
93
94 /*
95 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
96 * the SMB2 header to the input data buffer. If no input data is
97 * required for the FSCTL/IOCTL command being issued, the client SHOULD
98 * set this value to 0.<49>
99 * <49> If no input data is required for the FSCTL/IOCTL command being
100 * issued, Windows-based clients set this field to any value.
101 */
102 allowed_length_in = 0;
103 if ((in_input_offset > 0) && (in_input_length > 0)) {
104 uint32_t tmp_ofs;
105
106 if (in_input_offset < min_buffer_offset) {
107 return smbd_smb2_request_error(req,
108 NT_STATUS_INVALID_PARAMETER);
109 }
110 if (in_input_offset > max_buffer_offset) {
111 return smbd_smb2_request_error(req,
112 NT_STATUS_INVALID_PARAMETER);
113 }
114 allowed_length_in = max_buffer_offset - in_input_offset;
115
116 tmp_ofs = in_input_offset - min_buffer_offset;
117 in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
118 in_input_buffer.data += tmp_ofs;
119 in_input_buffer.length = in_input_length;
120 min_output_offset += tmp_ofs;
121 min_output_offset += in_input_length;
122 }
123
124 if (in_input_length > allowed_length_in) {
125 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
126 }
127
128 allowed_length_out = 0;
129 if (in_output_offset > 0) {
130 if (in_output_offset < min_buffer_offset) {
131 return smbd_smb2_request_error(req,
132 NT_STATUS_INVALID_PARAMETER);
133 }
134 if (in_output_offset > max_buffer_offset) {
135 return smbd_smb2_request_error(req,
136 NT_STATUS_INVALID_PARAMETER);
137 }
138 allowed_length_out = max_buffer_offset - in_output_offset;
139 }
140
141 if (in_output_length > allowed_length_out) {
142 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
143 }
144
145 if (in_output_length > 0) {
146 uint32_t tmp_ofs;
147
148 if (in_output_offset < min_output_offset) {
149 return smbd_smb2_request_error(req,
150 NT_STATUS_INVALID_PARAMETER);
151 }
152
153 tmp_ofs = in_output_offset - min_buffer_offset;
154 in_output_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
155 in_output_buffer.data += tmp_ofs;
156 in_output_buffer.length = in_output_length;
157 }
158
159 /*
160 * verify the credits and avoid overflows
161 * in_input_buffer.length and in_output_buffer.length
162 * are already verified.
163 */
164 data_length_in = in_input_buffer.length + in_output_buffer.length;
165
166 data_length_out = in_max_input_length;
167 data_length_tmp = UINT32_MAX - data_length_out;
168 if (data_length_tmp < in_max_output_length) {
169 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
170 }
171 data_length_out += in_max_output_length;
172
173 data_length_max = MAX(data_length_in, data_length_out);
174
175 status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
176 if (!NT_STATUS_IS_OK(status)) {
177 return smbd_smb2_request_error(req, status);
178 }
179
180 /*
181 * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
182 * server MUST fail the request with STATUS_NOT_SUPPORTED.
183 */
184 if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
185 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
186 }
187
188 switch (in_ctl_code) {
189 case FSCTL_DFS_GET_REFERRALS:
190 case FSCTL_DFS_GET_REFERRALS_EX:
191 case FSCTL_PIPE_WAIT:
192 case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
193 case FSCTL_VALIDATE_NEGOTIATE_INFO:
194 case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
195 /*
196 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
197 * FSCTL_PIPE_WAIT does not take a file handle.
198 *
199 * If FileId in the SMB2 Header of the request is not
200 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
201 * with STATUS_INVALID_PARAMETER.
202 */
203 if (in_file_id_persistent != UINT64_MAX ||
204 in_file_id_volatile != UINT64_MAX) {
205 return smbd_smb2_request_error(req,
206 NT_STATUS_INVALID_PARAMETER);
207 }
208 break;
209 default:
210 in_fsp = file_fsp_smb2(req, in_file_id_persistent,
211 in_file_id_volatile);
212 if (in_fsp == NULL) {
213 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
214 }
215 break;
216 }
217
218 subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
219 req, in_fsp,
220 in_ctl_code,
221 in_input_buffer,
222 in_max_output_length,
223 in_flags);
224 if (subreq == NULL) {
225 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
226 }
227 tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
228
229 return smbd_smb2_request_pending_queue(req, subreq, 1000);
230 }
231
232 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
233 {
234 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
235 struct smbd_smb2_request);
236 const uint8_t *inbody;
237 int i = req->current_idx;
238 DATA_BLOB outbody;
239 DATA_BLOB outdyn;
240 uint32_t in_ctl_code;
241 uint64_t in_file_id_persistent;
242 uint64_t in_file_id_volatile;
243 uint32_t out_input_offset;
244 uint32_t out_output_offset;
245 DATA_BLOB out_output_buffer = data_blob_null;
246 NTSTATUS status;
247 NTSTATUS error; /* transport error */
248 bool disconnect = false;
249
250 status = smbd_smb2_ioctl_recv(subreq, req,
251 &out_output_buffer,
252 &disconnect);
253
254 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
255 "%u status %s\n",
256 (unsigned int)out_output_buffer.length,
257 nt_errstr(status) ));
258
259 TALLOC_FREE(subreq);
260 if (disconnect) {
261 error = status;
262 smbd_server_connection_terminate(req->sconn,
263 nt_errstr(error));
264 return;
265 }
266
267 if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
268 /* also ok */
269 } else if (!NT_STATUS_IS_OK(status)) {
270 error = smbd_smb2_request_error(req, status);
271 if (!NT_STATUS_IS_OK(error)) {
272 smbd_server_connection_terminate(req->sconn,
273 nt_errstr(error));
274 return;
275 }
276 return;
277 }
278
279 out_input_offset = SMB2_HDR_BODY + 0x30;
280 out_output_offset = SMB2_HDR_BODY + 0x30;
281
282 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
283
284 in_ctl_code = IVAL(inbody, 0x04);
285 in_file_id_persistent = BVAL(inbody, 0x08);
286 in_file_id_volatile = BVAL(inbody, 0x10);
287
288 outbody = data_blob_talloc(req->out.vector, NULL, 0x30);
289 if (outbody.data == NULL) {
290 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
291 if (!NT_STATUS_IS_OK(error)) {
292 smbd_server_connection_terminate(req->sconn,
293 nt_errstr(error));
294 return;
295 }
296 return;
297 }
298
299 SSVAL(outbody.data, 0x00, 0x30 + 1); /* struct size */
300 SSVAL(outbody.data, 0x02, 0); /* reserved */
301 SIVAL(outbody.data, 0x04,
302 in_ctl_code); /* ctl code */
303 SBVAL(outbody.data, 0x08,
304 in_file_id_persistent); /* file id (persistent) */
305 SBVAL(outbody.data, 0x10,
306 in_file_id_volatile); /* file id (volatile) */
307 SIVAL(outbody.data, 0x18,
308 out_input_offset); /* input offset */
309 SIVAL(outbody.data, 0x1C, 0); /* input count */
310 SIVAL(outbody.data, 0x20,
311 out_output_offset); /* output offset */
312 SIVAL(outbody.data, 0x24,
313 out_output_buffer.length); /* output count */
314 SIVAL(outbody.data, 0x28, 0); /* flags */
315 SIVAL(outbody.data, 0x2C, 0); /* reserved */
316
317 /*
318 * Note: Windows Vista and 2008 send back also the
319 * input from the request. But it was fixed in
320 * Windows 7.
321 */
322 outdyn = out_output_buffer;
323
324 error = smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
325 __location__);
326 if (!NT_STATUS_IS_OK(error)) {
327 smbd_server_connection_terminate(req->sconn,
328 nt_errstr(error));
329 return;
330 }
331 }
332
333 struct smbd_smb2_ioctl_state {
334 struct smbd_smb2_request *smb2req;
335 struct smb_request *smbreq;
336 files_struct *fsp;
337 DATA_BLOB in_input;
338 uint32_t in_max_output;
339 DATA_BLOB out_output;
340 bool disconnect;
341 };
342
343 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq);
344 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq);
345
346 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
347 struct tevent_context *ev,
348 struct smbd_smb2_request *smb2req,
349 struct files_struct *fsp,
350 uint32_t in_ctl_code,
351 DATA_BLOB in_input,
352 uint32_t in_max_output,
353 uint32_t in_flags)
354 {
355 struct tevent_req *req;
356 struct smbd_smb2_ioctl_state *state;
357 struct smb_request *smbreq;
358 struct tevent_req *subreq;
359
360 req = tevent_req_create(mem_ctx, &state,
361 struct smbd_smb2_ioctl_state);
362 if (req == NULL) {
363 return NULL;
364 }
365 state->smb2req = smb2req;
366 state->smbreq = NULL;
367 state->fsp = fsp;
368 state->in_input = in_input;
369 state->in_max_output = in_max_output;
370 state->out_output = data_blob_null;
371
372 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s, %s\n",
373 (unsigned)in_ctl_code,
374 fsp ? fsp_str_dbg(fsp) : "<no handle>",
375 fsp_fnum_dbg(fsp)));
376
377 smbreq = smbd_smb2_fake_smb_request(smb2req);
378 if (tevent_req_nomem(smbreq, req)) {
379 return tevent_req_post(req, ev);
380 }
381 state->smbreq = smbreq;
382
383 switch (in_ctl_code) {
384 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
385 {
386 uint16_t in_max_referral_level;
387 DATA_BLOB in_file_name_buffer;
388 char *in_file_name_string;
389 size_t in_file_name_string_size;
390 bool ok;
391 bool overflow = false;
392 NTSTATUS status;
393 int dfs_size;
394 char *dfs_data = NULL;
395
396 if (!IS_IPC(smbreq->conn)) {
397 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
398 return tevent_req_post(req, ev);
399 }
400
401 if (!lp_host_msdfs()) {
402 tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED);
403 return tevent_req_post(req, ev);
404 }
405
406 if (in_input.length < (2 + 2)) {
407 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
408 return tevent_req_post(req, ev);
409 }
410
411 in_max_referral_level = SVAL(in_input.data, 0);
412 in_file_name_buffer.data = in_input.data + 2;
413 in_file_name_buffer.length = in_input.length - 2;
414
415 ok = convert_string_talloc(state, CH_UTF16, CH_UNIX,
416 in_file_name_buffer.data,
417 in_file_name_buffer.length,
418 &in_file_name_string,
419 &in_file_name_string_size);
420 if (!ok) {
421 tevent_req_nterror(req, NT_STATUS_ILLEGAL_CHARACTER);
422 return tevent_req_post(req, ev);
423 }
424
425 dfs_size = setup_dfs_referral(smbreq->conn,
426 in_file_name_string,
427 in_max_referral_level,
428 &dfs_data, &status);
429 if (dfs_size < 0) {
430 tevent_req_nterror(req, status);
431 return tevent_req_post(req, ev);
432 }
433
434 if (dfs_size > in_max_output) {
435 /*
436 * TODO: we need a testsuite for this
437 */
438 overflow = true;
439 dfs_size = in_max_output;
440 }
441
442 state->out_output = data_blob_talloc(state,
443 (uint8_t *)dfs_data,
444 dfs_size);
445 SAFE_FREE(dfs_data);
446 if (dfs_size > 0 &&
447 tevent_req_nomem(state->out_output.data, req)) {
448 return tevent_req_post(req, ev);
449 }
450
451 if (overflow) {
452 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
453 } else {
454 tevent_req_done(req);
455 }
456 return tevent_req_post(req, ev);
457 }
458 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
459
460 if (!IS_IPC(smbreq->conn)) {
461 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
462 return tevent_req_post(req, ev);
463 }
464
465 if (fsp == NULL) {
466 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
467 return tevent_req_post(req, ev);
468 }
469
470 if (!fsp_is_np(fsp)) {
471 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
472 return tevent_req_post(req, ev);
473 }
474
475 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
476 (unsigned int)in_input.length ));
477
478 subreq = np_write_send(state, ev,
479 fsp->fake_file_handle,
480 in_input.data,
481 in_input.length);
482 if (tevent_req_nomem(subreq, req)) {
483 return tevent_req_post(req, ev);
484 }
485 tevent_req_set_callback(subreq,
486 smbd_smb2_ioctl_pipe_write_done,
487 req);
488 return req;
489
490 case FSCTL_VALIDATE_NEGOTIATE_INFO:
491 {
492 struct smbXsrv_connection *conn = smbreq->sconn->conn;
493 uint32_t in_capabilities;
494 DATA_BLOB in_guid_blob;
495 struct GUID in_guid;
496 uint16_t in_security_mode;
497 uint16_t in_num_dialects;
498 uint16_t i;
499 DATA_BLOB out_guid_blob;
500 NTSTATUS status;
501
502 if (in_input.length < 0x18) {
503 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
504 return tevent_req_post(req, ev);
505 }
506
507 in_capabilities = IVAL(in_input.data, 0x00);
508 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
509 in_security_mode = SVAL(in_input.data, 0x14);
510 in_num_dialects = SVAL(in_input.data, 0x16);
511
512 if (in_input.length != (0x18 + in_num_dialects*2)) {
513 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
514 return tevent_req_post(req, ev);
515 }
516
517 if (in_max_output < 0x18) {
518 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
519 return tevent_req_post(req, ev);
520 }
521
522 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
523 if (tevent_req_nterror(req, status)) {
524 return tevent_req_post(req, ev);
525 }
526
527 if (in_num_dialects != conn->smb2.client.num_dialects) {
528 state->disconnect = true;
529 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
530 return tevent_req_post(req, ev);
531 }
532
533 for (i=0; i < in_num_dialects; i++) {
534 uint16_t v = SVAL(in_input.data, 0x18 + i*2);
535
536 if (conn->smb2.client.dialects[i] != v) {
537 state->disconnect = true;
538 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
539 return tevent_req_post(req, ev);
540 }
541 }
542
543 if (!GUID_compare(&in_guid, &conn->smb2.client.guid)) {
544 state->disconnect = true;
545 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
546 return tevent_req_post(req, ev);
547 }
548
549 if (in_security_mode != conn->smb2.client.security_mode) {
550 state->disconnect = true;
551 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
552 return tevent_req_post(req, ev);
553 }
554
555 if (in_capabilities != conn->smb2.client.capabilities) {
556 state->disconnect = true;
557 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
558 return tevent_req_post(req, ev);
559 }
560
561 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
562 &out_guid_blob);
563 if (tevent_req_nterror(req, status)) {
564 return tevent_req_post(req, ev);
565 }
566
567 state->out_output = data_blob_talloc(state, NULL, 0x18);
568 if (tevent_req_nomem(state->out_output.data, req)) {
569 return tevent_req_post(req, ev);
570 }
571
572 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
573 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
574 SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
575 SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
576
577 tevent_req_done(req);
578 return tevent_req_post(req, ev);
579 }
580
581 default: {
582 uint8_t *out_data = NULL;
583 uint32_t out_data_len = 0;
584 NTSTATUS status;
585
586 if (fsp == NULL) {
587 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
588 return tevent_req_post(req, ev);
589 }
590
591 status = SMB_VFS_FSCTL(fsp,
592 state,
593 in_ctl_code,
594 smbreq->flags2,
595 in_input.data,
596 in_input.length,
597 &out_data,
598 in_max_output,
599 &out_data_len);
600 state->out_output = data_blob_const(out_data, out_data_len);
601 if (NT_STATUS_IS_OK(status)) {
602 tevent_req_done(req);
603 return tevent_req_post(req, ev);
604 }
605
606 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
607 if (IS_IPC(smbreq->conn)) {
608 status = NT_STATUS_FS_DRIVER_REQUIRED;
609 } else {
610 status = NT_STATUS_INVALID_DEVICE_REQUEST;
611 }
612 }
613
614 tevent_req_nterror(req, status);
615 return tevent_req_post(req, ev);
616 }
617 }
618
619 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
620 return tevent_req_post(req, ev);
621 }
622
623 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq)
624 {
625 struct tevent_req *req = tevent_req_callback_data(subreq,
626 struct tevent_req);
627 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
628 struct smbd_smb2_ioctl_state);
629 NTSTATUS status;
630 ssize_t nwritten = -1;
631
632 status = np_write_recv(subreq, &nwritten);
633
634 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
635 (long int)nwritten ));
636
637 TALLOC_FREE(subreq);
638 if (!NT_STATUS_IS_OK(status)) {
639 NTSTATUS old = status;
640 status = nt_status_np_pipe(old);
641 tevent_req_nterror(req, status);
642 return;
643 }
644
645 if (nwritten != state->in_input.length) {
646 tevent_req_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
647 return;
648 }
649
650 state->out_output = data_blob_talloc(state, NULL, state->in_max_output);
651 if (state->in_max_output > 0 &&
652 tevent_req_nomem(state->out_output.data, req)) {
653 return;
654 }
655
656 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
657 "of size %u\n",
658 (unsigned int)state->out_output.length ));
659
660 TALLOC_FREE(subreq);
661 subreq = np_read_send(state->smbreq->conn,
662 state->smb2req->sconn->ev_ctx,
663 state->fsp->fake_file_handle,
664 state->out_output.data,
665 state->out_output.length);
666 if (tevent_req_nomem(subreq, req)) {
667 return;
668 }
669 tevent_req_set_callback(subreq, smbd_smb2_ioctl_pipe_read_done, req);
670 }
671
672 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq)
673 {
674 struct tevent_req *req = tevent_req_callback_data(subreq,
675 struct tevent_req);
676 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
677 struct smbd_smb2_ioctl_state);
678 NTSTATUS status;
679 NTSTATUS old;
680 ssize_t nread = -1;
681 bool is_data_outstanding = false;
682
683 status = np_read_recv(subreq, &nread, &is_data_outstanding);
684 TALLOC_FREE(subreq);
685
686 old = status;
687 status = nt_status_np_pipe(old);
688
689 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
690 "is_data_outstanding = %d, status = %s%s%s\n",
691 (int)nread,
692 (int)is_data_outstanding,
693 nt_errstr(old),
694 NT_STATUS_EQUAL(old, status)?"":" => ",
695 NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
696
697 if (!NT_STATUS_IS_OK(status)) {
698 tevent_req_nterror(req, status);
699 return;
700 }
701
702 state->out_output.length = nread;
703
704 if (is_data_outstanding) {
705 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
706 return;
707 }
708
709 tevent_req_done(req);
710 }
711
712 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
713 TALLOC_CTX *mem_ctx,
714 DATA_BLOB *out_output,
715 bool *disconnect)
716 {
717 NTSTATUS status = NT_STATUS_OK;
718 struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
719 struct smbd_smb2_ioctl_state);
720
721 *disconnect = state->disconnect;
722
723 if (tevent_req_is_nterror(req, &status)) {
724 if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
725 tevent_req_received(req);
726 return status;
727 }
728 }
729
730 *out_output = state->out_output;
731 talloc_steal(mem_ctx, out_output->data);
732
733 tevent_req_received(req);
734 return status;
735 }
reg import