2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/smbd.h"
23 #include "smbd/globals.h"
24 #include "../libcli/smb/smb_common.h"
25 #include "../lib/util/tevent_ntstatus.h"
26 #include "rpc_server/srv_pipe_hnd.h"
27 #include "include/ntioctl.h"
28 #include "../librpc/ndr/libndr.h"
30 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
31 struct tevent_context
*ev
,
32 struct smbd_smb2_request
*smb2req
,
34 uint64_t in_file_id_volatile
,
36 uint32_t in_max_output
,
38 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
40 DATA_BLOB
*out_output
,
43 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
);
44 NTSTATUS
smbd_smb2_request_process_ioctl(struct smbd_smb2_request
*req
)
47 const uint8_t *inbody
;
48 int i
= req
->current_idx
;
49 uint32_t min_buffer_offset
;
50 uint32_t max_buffer_offset
;
51 uint32_t min_output_offset
;
52 uint32_t allowed_length_in
;
53 uint32_t allowed_length_out
;
55 uint64_t in_file_id_persistent
;
56 uint64_t in_file_id_volatile
;
57 uint32_t in_input_offset
;
58 uint32_t in_input_length
;
59 DATA_BLOB in_input_buffer
= data_blob_null
;
60 uint32_t in_max_input_length
;
61 uint32_t in_output_offset
;
62 uint32_t in_output_length
;
63 DATA_BLOB in_output_buffer
= data_blob_null
;
64 uint32_t in_max_output_length
;
66 uint32_t data_length_in
;
67 uint32_t data_length_out
;
68 uint32_t data_length_tmp
;
69 uint32_t data_length_max
;
70 struct tevent_req
*subreq
;
72 status
= smbd_smb2_request_verify_sizes(req
, 0x39);
73 if (!NT_STATUS_IS_OK(status
)) {
74 return smbd_smb2_request_error(req
, status
);
76 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
78 in_ctl_code
= IVAL(inbody
, 0x04);
79 in_file_id_persistent
= BVAL(inbody
, 0x08);
80 in_file_id_volatile
= BVAL(inbody
, 0x10);
81 in_input_offset
= IVAL(inbody
, 0x18);
82 in_input_length
= IVAL(inbody
, 0x1C);
83 in_max_input_length
= IVAL(inbody
, 0x20);
84 in_output_offset
= IVAL(inbody
, 0x24);
85 in_output_length
= IVAL(inbody
, 0x28);
86 in_max_output_length
= IVAL(inbody
, 0x2C);
87 in_flags
= IVAL(inbody
, 0x30);
89 min_buffer_offset
= SMB2_HDR_BODY
+ req
->in
.vector
[i
+1].iov_len
;
90 max_buffer_offset
= min_buffer_offset
+ req
->in
.vector
[i
+2].iov_len
;
91 min_output_offset
= min_buffer_offset
;
94 * InputOffset (4 bytes): The offset, in bytes, from the beginning of
95 * the SMB2 header to the input data buffer. If no input data is
96 * required for the FSCTL/IOCTL command being issued, the client SHOULD
97 * set this value to 0.<49>
98 * <49> If no input data is required for the FSCTL/IOCTL command being
99 * issued, Windows-based clients set this field to any value.
101 allowed_length_in
= 0;
102 if ((in_input_offset
> 0) && (in_input_length
> 0)) {
105 if (in_input_offset
< min_buffer_offset
) {
106 return smbd_smb2_request_error(req
,
107 NT_STATUS_INVALID_PARAMETER
);
109 if (in_input_offset
> max_buffer_offset
) {
110 return smbd_smb2_request_error(req
,
111 NT_STATUS_INVALID_PARAMETER
);
113 allowed_length_in
= max_buffer_offset
- in_input_offset
;
115 tmp_ofs
= in_input_offset
- min_buffer_offset
;
116 in_input_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
117 in_input_buffer
.data
+= tmp_ofs
;
118 in_input_buffer
.length
= in_input_length
;
119 min_output_offset
+= tmp_ofs
;
120 min_output_offset
+= in_input_length
;
123 if (in_input_length
> allowed_length_in
) {
124 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
127 allowed_length_out
= 0;
128 if (in_output_offset
> 0) {
129 if (in_output_offset
< min_buffer_offset
) {
130 return smbd_smb2_request_error(req
,
131 NT_STATUS_INVALID_PARAMETER
);
133 if (in_output_offset
> max_buffer_offset
) {
134 return smbd_smb2_request_error(req
,
135 NT_STATUS_INVALID_PARAMETER
);
137 allowed_length_out
= max_buffer_offset
- in_output_offset
;
140 if (in_output_length
> allowed_length_out
) {
141 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
144 if (in_output_length
> 0) {
147 if (in_output_offset
< min_output_offset
) {
148 return smbd_smb2_request_error(req
,
149 NT_STATUS_INVALID_PARAMETER
);
152 tmp_ofs
= in_output_offset
- min_buffer_offset
;
153 in_output_buffer
.data
= (uint8_t *)req
->in
.vector
[i
+2].iov_base
;
154 in_output_buffer
.data
+= tmp_ofs
;
155 in_output_buffer
.length
= in_output_length
;
159 * verify the credits and avoid overflows
160 * in_input_buffer.length and in_output_buffer.length
161 * are already verified.
163 data_length_in
= in_input_buffer
.length
+ in_output_buffer
.length
;
165 data_length_out
= in_max_input_length
;
166 data_length_tmp
= UINT32_MAX
- data_length_out
;
167 if (data_length_tmp
< in_max_output_length
) {
168 return smbd_smb2_request_error(req
, NT_STATUS_INVALID_PARAMETER
);
170 data_length_out
+= in_max_output_length
;
172 data_length_max
= MAX(data_length_in
, data_length_out
);
174 status
= smbd_smb2_request_verify_creditcharge(req
, data_length_max
);
175 if (!NT_STATUS_IS_OK(status
)) {
176 return smbd_smb2_request_error(req
, status
);
180 * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
181 * server MUST fail the request with STATUS_NOT_SUPPORTED.
183 if (in_flags
!= SMB2_IOCTL_FLAG_IS_FSCTL
) {
184 return smbd_smb2_request_error(req
, NT_STATUS_NOT_SUPPORTED
);
187 switch (in_ctl_code
) {
188 case FSCTL_DFS_GET_REFERRALS
:
189 case FSCTL_DFS_GET_REFERRALS_EX
:
190 case FSCTL_PIPE_WAIT
:
191 case FSCTL_VALIDATE_NEGOTIATE_INFO_224
:
192 case FSCTL_VALIDATE_NEGOTIATE_INFO
:
193 case FSCTL_QUERY_NETWORK_INTERFACE_INFO
:
195 * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
196 * FSCTL_PIPE_WAIT does not take a file handle.
198 * If FileId in the SMB2 Header of the request is not
199 * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
200 * with STATUS_INVALID_PARAMETER.
202 if (in_file_id_persistent
!= UINT64_MAX
||
203 in_file_id_volatile
!= UINT64_MAX
) {
204 return smbd_smb2_request_error(req
,
205 NT_STATUS_INVALID_PARAMETER
);
209 if (req
->compat_chain_fsp
) {
211 } else if (in_file_id_persistent
!= in_file_id_volatile
) {
212 return smbd_smb2_request_error(req
, NT_STATUS_FILE_CLOSED
);
217 subreq
= smbd_smb2_ioctl_send(req
,
223 in_max_output_length
,
225 if (subreq
== NULL
) {
226 return smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
228 tevent_req_set_callback(subreq
, smbd_smb2_request_ioctl_done
, req
);
230 return smbd_smb2_request_pending_queue(req
, subreq
, 1000);
233 static void smbd_smb2_request_ioctl_done(struct tevent_req
*subreq
)
235 struct smbd_smb2_request
*req
= tevent_req_callback_data(subreq
,
236 struct smbd_smb2_request
);
237 const uint8_t *inbody
;
238 int i
= req
->current_idx
;
241 uint32_t in_ctl_code
;
242 uint64_t in_file_id_persistent
;
243 uint64_t in_file_id_volatile
;
244 uint32_t out_input_offset
;
245 uint32_t out_output_offset
;
246 DATA_BLOB out_output_buffer
= data_blob_null
;
248 NTSTATUS error
; /* transport error */
249 bool disconnect
= false;
251 status
= smbd_smb2_ioctl_recv(subreq
, req
,
255 DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
257 (unsigned int)out_output_buffer
.length
,
258 nt_errstr(status
) ));
263 smbd_server_connection_terminate(req
->sconn
,
268 if (NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
270 } else if (!NT_STATUS_IS_OK(status
)) {
271 error
= smbd_smb2_request_error(req
, status
);
272 if (!NT_STATUS_IS_OK(error
)) {
273 smbd_server_connection_terminate(req
->sconn
,
280 out_input_offset
= SMB2_HDR_BODY
+ 0x30;
281 out_output_offset
= SMB2_HDR_BODY
+ 0x30;
283 inbody
= (const uint8_t *)req
->in
.vector
[i
+1].iov_base
;
285 in_ctl_code
= IVAL(inbody
, 0x04);
286 in_file_id_persistent
= BVAL(inbody
, 0x08);
287 in_file_id_volatile
= BVAL(inbody
, 0x10);
289 outbody
= data_blob_talloc(req
->out
.vector
, NULL
, 0x30);
290 if (outbody
.data
== NULL
) {
291 error
= smbd_smb2_request_error(req
, NT_STATUS_NO_MEMORY
);
292 if (!NT_STATUS_IS_OK(error
)) {
293 smbd_server_connection_terminate(req
->sconn
,
300 SSVAL(outbody
.data
, 0x00, 0x30 + 1); /* struct size */
301 SSVAL(outbody
.data
, 0x02, 0); /* reserved */
302 SIVAL(outbody
.data
, 0x04,
303 in_ctl_code
); /* ctl code */
304 SBVAL(outbody
.data
, 0x08,
305 in_file_id_persistent
); /* file id (persistent) */
306 SBVAL(outbody
.data
, 0x10,
307 in_file_id_volatile
); /* file id (volatile) */
308 SIVAL(outbody
.data
, 0x18,
309 out_input_offset
); /* input offset */
310 SIVAL(outbody
.data
, 0x1C, 0); /* input count */
311 SIVAL(outbody
.data
, 0x20,
312 out_output_offset
); /* output offset */
313 SIVAL(outbody
.data
, 0x24,
314 out_output_buffer
.length
); /* output count */
315 SIVAL(outbody
.data
, 0x28, 0); /* flags */
316 SIVAL(outbody
.data
, 0x2C, 0); /* reserved */
319 * Note: Windows Vista and 2008 send back also the
320 * input from the request. But it was fixed in
323 outdyn
= out_output_buffer
;
325 error
= smbd_smb2_request_done_ex(req
, status
, outbody
, &outdyn
,
327 if (!NT_STATUS_IS_OK(error
)) {
328 smbd_server_connection_terminate(req
->sconn
,
334 struct smbd_smb2_ioctl_state
{
335 struct smbd_smb2_request
*smb2req
;
336 struct smb_request
*smbreq
;
339 uint32_t in_max_output
;
340 DATA_BLOB out_output
;
344 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
);
345 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
);
347 static struct tevent_req
*smbd_smb2_ioctl_send(TALLOC_CTX
*mem_ctx
,
348 struct tevent_context
*ev
,
349 struct smbd_smb2_request
*smb2req
,
350 uint32_t in_ctl_code
,
351 uint64_t in_file_id_volatile
,
353 uint32_t in_max_output
,
356 struct tevent_req
*req
;
357 struct smbd_smb2_ioctl_state
*state
;
358 struct smb_request
*smbreq
;
359 files_struct
*fsp
= NULL
;
360 struct tevent_req
*subreq
;
362 req
= tevent_req_create(mem_ctx
, &state
,
363 struct smbd_smb2_ioctl_state
);
367 state
->smb2req
= smb2req
;
368 state
->smbreq
= NULL
;
370 state
->in_input
= in_input
;
371 state
->in_max_output
= in_max_output
;
372 state
->out_output
= data_blob_null
;
374 DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] file_id[0x%016llX]\n",
375 (unsigned)in_ctl_code
,
376 (unsigned long long)in_file_id_volatile
));
378 smbreq
= smbd_smb2_fake_smb_request(smb2req
);
379 if (tevent_req_nomem(smbreq
, req
)) {
380 return tevent_req_post(req
, ev
);
382 state
->smbreq
= smbreq
;
384 if (in_file_id_volatile
!= UINT64_MAX
) {
385 fsp
= file_fsp(smbreq
, (uint16_t)in_file_id_volatile
);
387 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
388 return tevent_req_post(req
, ev
);
390 if (smbreq
->conn
!= fsp
->conn
) {
391 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
392 return tevent_req_post(req
, ev
);
394 if (smb2req
->session
->vuid
!= fsp
->vuid
) {
395 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
396 return tevent_req_post(req
, ev
);
401 switch (in_ctl_code
) {
402 case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
404 uint16_t in_max_referral_level
;
405 DATA_BLOB in_file_name_buffer
;
406 char *in_file_name_string
;
407 size_t in_file_name_string_size
;
409 bool overflow
= false;
412 char *dfs_data
= NULL
;
414 if (!IS_IPC(smbreq
->conn
)) {
415 tevent_req_nterror(req
, NT_STATUS_INVALID_DEVICE_REQUEST
);
416 return tevent_req_post(req
, ev
);
419 if (!lp_host_msdfs()) {
420 tevent_req_nterror(req
, NT_STATUS_FS_DRIVER_REQUIRED
);
421 return tevent_req_post(req
, ev
);
424 if (in_input
.length
< (2 + 2)) {
425 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
426 return tevent_req_post(req
, ev
);
429 in_max_referral_level
= SVAL(in_input
.data
, 0);
430 in_file_name_buffer
.data
= in_input
.data
+ 2;
431 in_file_name_buffer
.length
= in_input
.length
- 2;
433 ok
= convert_string_talloc(state
, CH_UTF16
, CH_UNIX
,
434 in_file_name_buffer
.data
,
435 in_file_name_buffer
.length
,
436 &in_file_name_string
,
437 &in_file_name_string_size
);
439 tevent_req_nterror(req
, NT_STATUS_ILLEGAL_CHARACTER
);
440 return tevent_req_post(req
, ev
);
443 dfs_size
= setup_dfs_referral(smbreq
->conn
,
445 in_max_referral_level
,
448 tevent_req_nterror(req
, status
);
449 return tevent_req_post(req
, ev
);
452 if (dfs_size
> in_max_output
) {
454 * TODO: we need a testsuite for this
457 dfs_size
= in_max_output
;
460 state
->out_output
= data_blob_talloc(state
,
465 tevent_req_nomem(state
->out_output
.data
, req
)) {
466 return tevent_req_post(req
, ev
);
470 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
472 tevent_req_done(req
);
474 return tevent_req_post(req
, ev
);
476 case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
478 if (!IS_IPC(smbreq
->conn
)) {
479 tevent_req_nterror(req
, NT_STATUS_NOT_SUPPORTED
);
480 return tevent_req_post(req
, ev
);
484 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
485 return tevent_req_post(req
, ev
);
488 if (!fsp_is_np(fsp
)) {
489 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
490 return tevent_req_post(req
, ev
);
493 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
494 (unsigned int)in_input
.length
));
496 subreq
= np_write_send(state
, ev
,
497 fsp
->fake_file_handle
,
500 if (tevent_req_nomem(subreq
, req
)) {
501 return tevent_req_post(req
, ev
);
503 tevent_req_set_callback(subreq
,
504 smbd_smb2_ioctl_pipe_write_done
,
508 case FSCTL_VALIDATE_NEGOTIATE_INFO_224
:
510 struct smbXsrv_connection
*conn
= smbreq
->sconn
->conn
;
511 uint32_t in_capabilities
;
512 DATA_BLOB in_guid_blob
;
514 uint16_t in_security_mode
;
515 uint16_t in_max_dialect
;
516 uint16_t max_dialect
;
517 DATA_BLOB out_guid_blob
;
520 if (in_input
.length
!= 0x18) {
521 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
522 return tevent_req_post(req
, ev
);
525 if (in_max_output
< 0x18) {
526 tevent_req_nterror(req
, NT_STATUS_BUFFER_TOO_SMALL
);
527 return tevent_req_post(req
, ev
);
530 in_capabilities
= IVAL(in_input
.data
, 0x00);
531 in_guid_blob
= data_blob_const(in_input
.data
+ 0x04, 16);
532 in_security_mode
= SVAL(in_input
.data
, 0x14);
533 in_max_dialect
= SVAL(in_input
.data
, 0x16);
535 status
= GUID_from_ndr_blob(&in_guid_blob
, &in_guid
);
536 if (tevent_req_nterror(req
, status
)) {
537 return tevent_req_post(req
, ev
);
540 max_dialect
= conn
->smb2
.client
.dialects
[conn
->smb2
.client
.num_dialects
-1];
541 if (in_max_dialect
!= max_dialect
) {
542 state
->disconnect
= true;
543 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
544 return tevent_req_post(req
, ev
);
547 if (!GUID_compare(&in_guid
, &conn
->smb2
.client
.guid
)) {
548 state
->disconnect
= true;
549 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
550 return tevent_req_post(req
, ev
);
553 if (in_security_mode
!= conn
->smb2
.client
.security_mode
) {
554 state
->disconnect
= true;
555 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
556 return tevent_req_post(req
, ev
);
559 if (in_capabilities
!= conn
->smb2
.client
.capabilities
) {
560 state
->disconnect
= true;
561 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
562 return tevent_req_post(req
, ev
);
565 status
= GUID_to_ndr_blob(&conn
->smb2
.server
.guid
, state
,
567 if (tevent_req_nterror(req
, status
)) {
568 return tevent_req_post(req
, ev
);
571 state
->out_output
= data_blob_talloc(state
, NULL
, 0x18);
572 if (tevent_req_nomem(state
->out_output
.data
, req
)) {
573 return tevent_req_post(req
, ev
);
576 SIVAL(state
->out_output
.data
, 0x00, conn
->smb2
.server
.capabilities
);
577 memcpy(state
->out_output
.data
+0x04, out_guid_blob
.data
, 16);
578 SIVAL(state
->out_output
.data
, 0x14, conn
->smb2
.server
.security_mode
);
579 SIVAL(state
->out_output
.data
, 0x16, conn
->smb2
.server
.dialect
);
581 tevent_req_done(req
);
582 return tevent_req_post(req
, ev
);
585 case FSCTL_VALIDATE_NEGOTIATE_INFO
:
587 struct smbXsrv_connection
*conn
= smbreq
->sconn
->conn
;
588 uint32_t in_capabilities
;
589 DATA_BLOB in_guid_blob
;
591 uint16_t in_security_mode
;
592 uint16_t in_num_dialects
;
594 DATA_BLOB out_guid_blob
;
597 if (in_input
.length
< 0x18) {
598 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
599 return tevent_req_post(req
, ev
);
602 in_capabilities
= IVAL(in_input
.data
, 0x00);
603 in_guid_blob
= data_blob_const(in_input
.data
+ 0x04, 16);
604 in_security_mode
= SVAL(in_input
.data
, 0x14);
605 in_num_dialects
= SVAL(in_input
.data
, 0x16);
607 if (in_input
.length
!= (0x18 + in_num_dialects
*2)) {
608 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER
);
609 return tevent_req_post(req
, ev
);
612 if (in_max_output
< 0x18) {
613 tevent_req_nterror(req
, NT_STATUS_BUFFER_TOO_SMALL
);
614 return tevent_req_post(req
, ev
);
617 status
= GUID_from_ndr_blob(&in_guid_blob
, &in_guid
);
618 if (tevent_req_nterror(req
, status
)) {
619 return tevent_req_post(req
, ev
);
622 if (in_num_dialects
!= conn
->smb2
.client
.num_dialects
) {
623 state
->disconnect
= true;
624 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
625 return tevent_req_post(req
, ev
);
628 for (i
=0; i
< in_num_dialects
; i
++) {
629 uint16_t v
= SVAL(in_input
.data
, 0x18 + i
*2);
631 if (conn
->smb2
.client
.dialects
[i
] != v
) {
632 state
->disconnect
= true;
633 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
634 return tevent_req_post(req
, ev
);
638 if (!GUID_compare(&in_guid
, &conn
->smb2
.client
.guid
)) {
639 state
->disconnect
= true;
640 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
641 return tevent_req_post(req
, ev
);
644 if (in_security_mode
!= conn
->smb2
.client
.security_mode
) {
645 state
->disconnect
= true;
646 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
647 return tevent_req_post(req
, ev
);
650 if (in_capabilities
!= conn
->smb2
.client
.capabilities
) {
651 state
->disconnect
= true;
652 tevent_req_nterror(req
, NT_STATUS_ACCESS_DENIED
);
653 return tevent_req_post(req
, ev
);
656 status
= GUID_to_ndr_blob(&conn
->smb2
.server
.guid
, state
,
658 if (tevent_req_nterror(req
, status
)) {
659 return tevent_req_post(req
, ev
);
662 state
->out_output
= data_blob_talloc(state
, NULL
, 0x18);
663 if (tevent_req_nomem(state
->out_output
.data
, req
)) {
664 return tevent_req_post(req
, ev
);
667 SIVAL(state
->out_output
.data
, 0x00, conn
->smb2
.server
.capabilities
);
668 memcpy(state
->out_output
.data
+0x04, out_guid_blob
.data
, 16);
669 SIVAL(state
->out_output
.data
, 0x14, conn
->smb2
.server
.security_mode
);
670 SIVAL(state
->out_output
.data
, 0x16, conn
->smb2
.server
.dialect
);
672 tevent_req_done(req
);
673 return tevent_req_post(req
, ev
);
677 uint8_t *out_data
= NULL
;
678 uint32_t out_data_len
= 0;
682 tevent_req_nterror(req
, NT_STATUS_FILE_CLOSED
);
683 return tevent_req_post(req
, ev
);
686 status
= SMB_VFS_FSCTL(fsp
,
695 state
->out_output
= data_blob_const(out_data
, out_data_len
);
696 if (NT_STATUS_IS_OK(status
)) {
697 tevent_req_done(req
);
698 return tevent_req_post(req
, ev
);
701 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_SUPPORTED
)) {
702 if (IS_IPC(smbreq
->conn
)) {
703 status
= NT_STATUS_FS_DRIVER_REQUIRED
;
705 status
= NT_STATUS_INVALID_DEVICE_REQUEST
;
709 tevent_req_nterror(req
, status
);
710 return tevent_req_post(req
, ev
);
714 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
715 return tevent_req_post(req
, ev
);
718 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req
*subreq
)
720 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
722 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
723 struct smbd_smb2_ioctl_state
);
725 ssize_t nwritten
= -1;
727 status
= np_write_recv(subreq
, &nwritten
);
729 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
730 (long int)nwritten
));
733 if (!NT_STATUS_IS_OK(status
)) {
734 NTSTATUS old
= status
;
735 status
= nt_status_np_pipe(old
);
736 tevent_req_nterror(req
, status
);
740 if (nwritten
!= state
->in_input
.length
) {
741 tevent_req_nterror(req
, NT_STATUS_PIPE_NOT_AVAILABLE
);
745 state
->out_output
= data_blob_talloc(state
, NULL
, state
->in_max_output
);
746 if (state
->in_max_output
> 0 &&
747 tevent_req_nomem(state
->out_output
.data
, req
)) {
751 DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
753 (unsigned int)state
->out_output
.length
));
756 subreq
= np_read_send(state
->smbreq
->conn
,
757 state
->smb2req
->sconn
->ev_ctx
,
758 state
->fsp
->fake_file_handle
,
759 state
->out_output
.data
,
760 state
->out_output
.length
);
761 if (tevent_req_nomem(subreq
, req
)) {
764 tevent_req_set_callback(subreq
, smbd_smb2_ioctl_pipe_read_done
, req
);
767 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req
*subreq
)
769 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
771 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
772 struct smbd_smb2_ioctl_state
);
776 bool is_data_outstanding
= false;
778 status
= np_read_recv(subreq
, &nread
, &is_data_outstanding
);
782 status
= nt_status_np_pipe(old
);
784 DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
785 "is_data_outstanding = %d, status = %s%s%s\n",
787 (int)is_data_outstanding
,
789 NT_STATUS_EQUAL(old
, status
)?"":" => ",
790 NT_STATUS_EQUAL(old
, status
)?"":nt_errstr(status
)));
792 if (!NT_STATUS_IS_OK(status
)) {
793 tevent_req_nterror(req
, status
);
797 state
->out_output
.length
= nread
;
799 if (is_data_outstanding
) {
800 tevent_req_nterror(req
, STATUS_BUFFER_OVERFLOW
);
804 tevent_req_done(req
);
807 static NTSTATUS
smbd_smb2_ioctl_recv(struct tevent_req
*req
,
809 DATA_BLOB
*out_output
,
812 NTSTATUS status
= NT_STATUS_OK
;
813 struct smbd_smb2_ioctl_state
*state
= tevent_req_data(req
,
814 struct smbd_smb2_ioctl_state
);
816 *disconnect
= state
->disconnect
;
818 if (tevent_req_is_nterror(req
, &status
)) {
819 if (!NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
820 tevent_req_received(req
);
825 *out_output
= state
->out_output
;
826 talloc_steal(mem_ctx
, out_output
->data
);
828 tevent_req_received(req
);