2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
29 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
30 struct tevent_context
*ev
,
31 struct smbd_smb2_request
*smb2req
,
33 uint64_t in_file_id_volatile
,
35 uint32_t in_max_output
,
37 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
39 DATA_BLOB
*out_output
);
41 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
);
42 NTSTATUS
smbd_smb2_request_process_ioctl(struct smbd_smb2_request
*req
)
45 const uint8_t *inbody
;
46 int i
= req
->current_idx
;
47 size_t expected_body_size
= 0x39;
50 uint64_t in_file_id_persistent
;
51 uint64_t in_file_id_volatile
;
52 uint32_t in_input_offset
;
53 uint32_t in_input_length
;
54 DATA_BLOB in_input_buffer
;
55 uint32_t in_max_output_length
;
57 struct tevent_req
*subreq
;
59 inhdr
= (const uint8_t *)req
->in
.vector
[i
+0].iov_base
;
60 if (req
->in
.vector
[i
+1].iov_len
!= (expected_body_size
& 0xFFFFFFFE)) {
61 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
64 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
66 body_size
= SVAL(inbody
, 0x00);
67 if (body_size
!= expected_body_size
) {
68 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
71 in_ctl_code
= IVAL(inbody
, 0x04);
72 in_file_id_persistent
= BVAL(inbody
, 0x08);
73 in_file_id_volatile
= BVAL(inbody
, 0x10);
74 in_input_offset
= IVAL(inbody
, 0x18);
75 in_input_length
= IVAL(inbody
, 0x1C);
76 in_max_output_length
= IVAL(inbody
, 0x2C);
77 in_flags
= IVAL(inbody
, 0x30);
79 if (in_input_offset
!= (SMB2_HDR_BODY
+ (body_size
& 0xFFFFFFFE))) {
80 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
83 if (in_input_length
> req
->in
.vector
[i
+2].iov_len
) {
84 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
87 in_input_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
88 in_input_buffer
.length
= in_input_length
;
90 if (req
->compat_chain_fsp
) {
92 } else if (in_file_id_persistent
== UINT64_MAX
&&
93 in_file_id_volatile
== UINT64_MAX
) {
94 /* without a handle */
95 } else if (in_file_id_persistent
!= in_file_id_volatile
) {
96 return smbd_smb2_request_error(req
, NT_STATUS_FILE_CLOSED
);
99 subreq
= smbd_smb2_ioctl_send(req
,
100 req
->sconn
->smb2
.event_ctx
,
105 in_max_output_length
,
107 if (subreq
== NULL
) {
108 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
110 tevent_req_set_callback(subreq
, smbd_smb2_request_ioctl_done
, req
);
112 return smbd_smb2_request_pending_queue(req
, subreq
);
115 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
)
117 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
118 struct smbd_smb2_request
);
119 const uint8_t *inbody
;
120 int i
= req
->current_idx
;
124 uint32_t in_ctl_code
;
125 uint64_t in_file_id_persistent
;
126 uint64_t in_file_id_volatile
;
127 uint32_t out_input_offset
;
128 uint32_t out_output_offset
;
129 DATA_BLOB out_output_buffer
= data_blob_null
;
131 NTSTATUS error
; /* transport error */
133 status
= smbd_smb2_ioctl_recv(subreq
, req
, &out_output_buffer
);
135 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
137 (unsigned int)out_output_buffer
.length
,
138 nt_errstr(status
) ));
141 if (NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
143 } else if (!NT_STATUS_IS_OK(status
)) {
144 error
= smbd_smb2_request_error(req
, status
);
145 if (!NT_STATUS_IS_OK(error
)) {
146 smbd_server_connection_terminate(req
->sconn
,
153 out_input_offset
= SMB2_HDR_BODY
+ 0x30;
154 out_output_offset
= SMB2_HDR_BODY
+ 0x30;
156 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
158 in_ctl_code
= IVAL(inbody
, 0x04);
159 in_file_id_persistent
= BVAL(inbody
, 0x08);
160 in_file_id_volatile
= BVAL(inbody
, 0x10);
162 outhdr
= (uint8_t *)req
->out
.vector
[i
].iov_base
;
164 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x30);
165 if (outbody
.data
== NULL
) {
166 error
= smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
167 if (!NT_STATUS_IS_OK(error
)) {
168 smbd_server_connection_terminate(req
->sconn
,
175 SSVAL(outbody
.data
, 0x00, 0x30 + 1); /* struct size */
176 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
177 SIVAL(outbody
.data
, 0x04,
178 in_ctl_code
); /* ctl code */
179 SBVAL(outbody
.data
, 0x08,
180 in_file_id_persistent
); /* file id (persistent) */
181 SBVAL(outbody
.data
, 0x10,
182 in_file_id_volatile
); /* file id (volatile) */
183 SIVAL(outbody
.data
, 0x18,
184 out_input_offset
); /* input offset */
185 SIVAL(outbody
.data
, 0x1C, 0); /* input count */
186 SIVAL(outbody
.data
, 0x20,
187 out_output_offset
); /* output offset */
188 SIVAL(outbody
.data
, 0x24,
189 out_output_buffer
.length
); /* output count */
190 SIVAL(outbody
.data
, 0x28, 0); /* flags */
191 SIVAL(outbody
.data
, 0x2C, 0); /* reserved */
194 * Note: Windows Vista and 2008 send back also the
195 * input from the request. But it was fixed in
198 outdyn
= out_output_buffer
;
200 error
= smbd_smb2_request_done_ex(req
, status
, outbody
, &outdyn
,
202 if (!NT_STATUS_IS_OK(error
)) {
203 smbd_server_connection_terminate(req
->sconn
,
209 struct smbd_smb2_ioctl_state
{
210 struct smbd_smb2_request
*smb2req
;
211 struct smb_request
*smbreq
;
214 uint32_t in_max_output
;
215 DATA_BLOB out_output
;
218 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
);
219 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
);
221 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
222 struct tevent_context
*ev
,
223 struct smbd_smb2_request
*smb2req
,
224 uint32_t in_ctl_code
,
225 uint64_t in_file_id_volatile
,
227 uint32_t in_max_output
,
230 struct tevent_req
*req
;
231 struct smbd_smb2_ioctl_state
*state
;
232 struct smb_request
*smbreq
;
233 files_struct
*fsp
= NULL
;
234 struct tevent_req
*subreq
;
236 req
= tevent_req_create(mem_ctx
, &state
,
237 struct smbd_smb2_ioctl_state
);
241 state
->smb2req
= smb2req
;
242 state
->smbreq
= NULL
;
244 state
->in_input
= in_input
;
245 state
->in_max_output
= in_max_output
;
246 state
->out_output
= data_blob_null
;
248 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] file_id[0x%016llX]\n",
249 (unsigned)in_ctl_code
,
250 (unsigned long long)in_file_id_volatile
));
252 smbreq
= smbd_smb2_fake_smb_request(smb2req
);
253 if (tevent_req_nomem(smbreq
, req
)) {
254 return tevent_req_post(req
, ev
);
256 state
->smbreq
= smbreq
;
258 if (in_file_id_volatile
!= UINT64_MAX
) {
259 fsp
= file_fsp(smbreq
, (uint16_t)in_file_id_volatile
);
261 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
262 return tevent_req_post(req
, ev
);
264 if (smbreq
->conn
!= fsp
->conn
) {
265 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
266 return tevent_req_post(req
, ev
);
268 if (smb2req
->session
->vuid
!= fsp
->vuid
) {
269 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
270 return tevent_req_post(req
, ev
);
275 switch (in_ctl_code
) {
276 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
278 uint16_t in_max_referral_level
;
279 DATA_BLOB in_file_name_buffer
;
280 char *in_file_name_string
;
281 size_t in_file_name_string_size
;
283 bool overflow
= false;
286 char *dfs_data
= NULL
;
288 if (!IS_IPC(smbreq
->conn
)) {
289 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
290 return tevent_req_post(req
, ev
);
293 if (!lp_host_msdfs()) {
294 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
295 return tevent_req_post(req
, ev
);
298 if (in_input
.length
< (2 + 2)) {
299 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
300 return tevent_req_post(req
, ev
);
303 in_max_referral_level
= SVAL(in_input
.data
, 0);
304 in_file_name_buffer
.data
= in_input
.data
+ 2;
305 in_file_name_buffer
.length
= in_input
.length
- 2;
307 ok
= convert_string_talloc(state
, CH_UTF16
, CH_UNIX
,
308 in_file_name_buffer
.data
,
309 in_file_name_buffer
.length
,
310 &in_file_name_string
,
311 &in_file_name_string_size
);
313 tevent_req_nterror(req
, NT_STATUS_ILLEGAL_CHARACTER
);
314 return tevent_req_post(req
, ev
);
317 dfs_size
= setup_dfs_referral(smbreq
->conn
,
319 in_max_referral_level
,
322 tevent_req_nterror(req
, status
);
323 return tevent_req_post(req
, ev
);
326 if (dfs_size
> in_max_output
) {
328 * TODO: we need a testsuite for this
331 dfs_size
= in_max_output
;
334 state
->out_output
= data_blob_talloc(state
,
339 tevent_req_nomem(state
->out_output
.data
, req
)) {
340 return tevent_req_post(req
, ev
);
344 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
346 tevent_req_done(req
);
348 return tevent_req_post(req
, ev
);
350 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
352 if (!IS_IPC(smbreq
->conn
)) {
353 tevent_req_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
354 return tevent_req_post(req
, ev
);
358 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
359 return tevent_req_post(req
, ev
);
362 if (!fsp_is_np(fsp
)) {
363 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
364 return tevent_req_post(req
, ev
);
367 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
368 (unsigned int)in_input
.length
));
370 subreq
= np_write_send(state
, ev
,
371 fsp
->fake_file_handle
,
374 if (tevent_req_nomem(subreq
, req
)) {
375 return tevent_req_post(req
, ev
);
377 tevent_req_set_callback(subreq
,
378 smbd_smb2_ioctl_pipe_write_done
,
382 case 0x00144064: /* FSCTL_SRV_ENUMERATE_SNAPSHOTS */
385 * This is called to retrieve the number of Shadow Copies (a.k.a. snapshots)
386 * and return their volume names. If max_data_count is 16, then it is just
387 * asking for the number of volumes and length of the combined names.
389 * pdata is the data allocated by our caller, but that uses
390 * total_data_count (which is 0 in our case) rather than max_data_count.
391 * Allocate the correct amount and return the pointer to let
392 * it be deallocated when we return.
394 struct shadow_copy_data
*shadow_data
= NULL
;
396 uint32_t labels_data_count
= 0;
403 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
404 return tevent_req_post(req
, ev
);
407 if (in_max_output
< 16) {
408 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
409 "in_max_output(%u) < 16 is invalid!\n",
411 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
412 return tevent_req_post(req
, ev
);
415 if (in_max_output
> 16) {
419 shadow_data
= talloc_zero(talloc_tos(),
420 struct shadow_copy_data
);
421 if (tevent_req_nomem(shadow_data
, req
)) {
422 DEBUG(0,("TALLOC_ZERO() failed!\n"));
423 return tevent_req_post(req
, ev
);
427 * Call the VFS routine to actually do the work.
429 if (SMB_VFS_GET_SHADOW_COPY_DATA(fsp
, shadow_data
, labels
)
431 if (errno
== ENOSYS
) {
432 DEBUG(5, ("FSCTL_GET_SHADOW_COPY_DATA: "
433 "connectpath %s, not supported.\n",
434 smbreq
->conn
->connectpath
));
435 status
= NT_STATUS_NOT_SUPPORTED
;
437 DEBUG(0,("FSCTL_GET_SHADOW_COPY_DATA: "
438 "connectpath %s, failed.\n",
439 smbreq
->conn
->connectpath
));
440 status
= map_nt_error_from_unix(errno
);
442 TALLOC_FREE(shadow_data
);
443 tevent_req_nterror(req
, status
);
444 return tevent_req_post(req
, ev
);
448 (shadow_data
->num_volumes
*2*sizeof(SHADOW_COPY_LABEL
))
452 data_count
= 12+labels_data_count
+4;
457 if (labels
&& (in_max_output
< data_count
)) {
458 DEBUG(0, ("FSCTL_GET_SHADOW_COPY_DATA: "
459 "in_max_output(%u) too small (%u) bytes "
460 "needed!\n", in_max_output
, data_count
));
461 TALLOC_FREE(shadow_data
);
462 tevent_req_nterror(req
, NT_STATUS_BUFFER_TOO_SMALL
);
463 return tevent_req_post(req
, ev
);
466 state
->out_output
= data_blob_talloc(state
, NULL
, data_count
);
467 if (tevent_req_nomem(state
->out_output
.data
, req
)) {
468 return tevent_req_post(req
, ev
);
471 pdata
= (char *)state
->out_output
.data
;
473 /* num_volumes 4 bytes */
474 SIVAL(pdata
, 0, shadow_data
->num_volumes
);
477 /* num_labels 4 bytes */
478 SIVAL(pdata
, 4, shadow_data
->num_volumes
);
481 /* needed_data_count 4 bytes */
482 SIVAL(pdata
, 8, labels_data_count
+4);
486 DEBUG(10,("FSCTL_GET_SHADOW_COPY_DATA: %u volumes for "
488 shadow_data
->num_volumes
, fsp_str_dbg(fsp
)));
489 if (labels
&& shadow_data
->labels
) {
490 for (i
=0; i
<shadow_data
->num_volumes
; i
++) {
491 srvstr_push(pdata
, smbreq
->flags2
,
492 pdata
, shadow_data
->labels
[i
],
493 2*sizeof(SHADOW_COPY_LABEL
),
494 STR_UNICODE
|STR_TERMINATE
);
495 pdata
+= 2*sizeof(SHADOW_COPY_LABEL
);
496 DEBUGADD(10, ("Label[%u]: '%s'\n", i
,
497 shadow_data
->labels
[i
]));
501 TALLOC_FREE(shadow_data
);
503 tevent_req_done(req
);
504 return tevent_req_post(req
, ev
);
508 if (IS_IPC(smbreq
->conn
)) {
509 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
510 return tevent_req_post(req
, ev
);
512 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
513 return tevent_req_post(req
, ev
);
516 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
517 return tevent_req_post(req
, ev
);
520 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
)
522 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
524 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
525 struct smbd_smb2_ioctl_state
);
527 ssize_t nwritten
= -1;
529 status
= np_write_recv(subreq
, &nwritten
);
531 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
532 (long int)nwritten
));
535 if (!NT_STATUS_IS_OK(status
)) {
536 tevent_req_nterror(req
, status
);
540 if (nwritten
!= state
->in_input
.length
) {
541 tevent_req_nterror(req
, NT_STATUS_PIPE_NOT_AVAILABLE
);
545 state
->out_output
= data_blob_talloc(state
, NULL
, state
->in_max_output
);
546 if (state
->in_max_output
> 0 &&
547 tevent_req_nomem(state
->out_output
.data
, req
)) {
551 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
553 (unsigned int)state
->out_output
.length
));
556 subreq
= np_read_send(state
->smbreq
->conn
,
557 state
->smb2req
->sconn
->smb2
.event_ctx
,
558 state
->fsp
->fake_file_handle
,
559 state
->out_output
.data
,
560 state
->out_output
.length
);
561 if (tevent_req_nomem(subreq
, req
)) {
564 tevent_req_set_callback(subreq
, smbd_smb2_ioctl_pipe_read_done
, req
);
567 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
)
569 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
571 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
572 struct smbd_smb2_ioctl_state
);
575 bool is_data_outstanding
= false;
577 status
= np_read_recv(subreq
, &nread
, &is_data_outstanding
);
579 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
580 "is_data_outstanding = %d, status = %s\n",
582 (int)is_data_outstanding
,
583 nt_errstr(status
) ));
586 if (!NT_STATUS_IS_OK(status
)) {
587 tevent_req_nterror(req
, status
);
591 state
->out_output
.length
= nread
;
593 if (is_data_outstanding
) {
594 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
598 tevent_req_done(req
);
601 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
603 DATA_BLOB
*out_output
)
605 NTSTATUS status
= NT_STATUS_OK
;
606 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
607 struct smbd_smb2_ioctl_state
);
609 if (tevent_req_is_nterror(req
, &status
)) {
610 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
611 tevent_req_received(req
);
616 *out_output
= state
->out_output
;
617 talloc_steal(mem_ctx
, out_output
->data
);
619 tevent_req_received(req
);