2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2011
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/network.h"
22 #include "lib/util/tevent_ntstatus.h"
23 #include "smb_common.h"
24 #include "smbXcli_base.h"
26 struct smb2cli_ioctl_state
{
29 uint32_t max_input_length
;
30 uint32_t max_output_length
;
31 struct iovec
*recv_iov
;
33 DATA_BLOB out_input_buffer
;
34 DATA_BLOB out_output_buffer
;
38 static void smb2cli_ioctl_done(struct tevent_req
*subreq
);
40 struct tevent_req
*smb2cli_ioctl_send(TALLOC_CTX
*mem_ctx
,
41 struct tevent_context
*ev
,
42 struct smbXcli_conn
*conn
,
43 uint32_t timeout_msec
,
44 struct smbXcli_session
*session
,
45 struct smbXcli_tcon
*tcon
,
46 uint64_t in_fid_persistent
,
47 uint64_t in_fid_volatile
,
49 uint32_t in_max_input_length
,
50 const DATA_BLOB
*in_input_buffer
,
51 uint32_t in_max_output_length
,
52 const DATA_BLOB
*in_output_buffer
,
55 struct tevent_req
*req
, *subreq
;
56 struct smb2cli_ioctl_state
*state
;
60 uint32_t input_buffer_offset
= 0;
61 uint32_t input_buffer_length
= 0;
62 uint32_t output_buffer_offset
= 0;
63 uint32_t output_buffer_length
= 0;
64 uint32_t pad_length
= 0;
66 uint32_t max_dyn_len
= 0;
68 req
= tevent_req_create(mem_ctx
, &state
,
69 struct smb2cli_ioctl_state
);
73 state
->ctl_code
= in_ctl_code
;
74 state
->max_input_length
= in_max_input_length
;
75 state
->max_output_length
= in_max_output_length
;
77 tmp64
= in_max_input_length
;
78 tmp64
+= in_max_output_length
;
79 if (tmp64
> UINT32_MAX
) {
80 max_dyn_len
= UINT32_MAX
;
85 if (in_input_buffer
) {
86 input_buffer_offset
= SMB2_HDR_BODY
+0x38;
87 input_buffer_length
= in_input_buffer
->length
;
90 if (in_output_buffer
) {
91 output_buffer_offset
= SMB2_HDR_BODY
+0x38;
92 output_buffer_length
= in_output_buffer
->length
;
93 if (input_buffer_length
> 0 && output_buffer_length
> 0) {
95 output_buffer_offset
+= input_buffer_length
;
96 tmp
= output_buffer_offset
;
97 output_buffer_offset
= NDR_ROUND(output_buffer_offset
, 8);
98 pad_length
= output_buffer_offset
- tmp
;
102 fixed
= state
->fixed
;
104 SSVAL(fixed
, 0x00, 0x39);
105 SSVAL(fixed
, 0x02, 0); /* reserved */
106 SIVAL(fixed
, 0x04, in_ctl_code
);
107 SBVAL(fixed
, 0x08, in_fid_persistent
);
108 SBVAL(fixed
, 0x10, in_fid_volatile
);
109 SIVAL(fixed
, 0x18, input_buffer_offset
);
110 SIVAL(fixed
, 0x1C, input_buffer_length
);
111 SIVAL(fixed
, 0x20, in_max_input_length
);
112 SIVAL(fixed
, 0x24, output_buffer_offset
);
113 SIVAL(fixed
, 0x28, output_buffer_length
);
114 SIVAL(fixed
, 0x2C, in_max_output_length
);
115 SIVAL(fixed
, 0x30, in_flags
);
116 SIVAL(fixed
, 0x34, 0); /* reserved */
118 if (input_buffer_length
> 0 && output_buffer_length
> 0) {
119 size_t avail
= UINT32_MAX
- (input_buffer_length
+ pad_length
);
120 size_t ofs
= output_buffer_offset
- input_buffer_offset
;
122 if (avail
< output_buffer_length
) {
123 tevent_req_nterror(req
, NT_STATUS_INVALID_PARAMETER_MIX
);
124 return tevent_req_post(req
, ev
);
127 dyn_len
= input_buffer_length
+ output_buffer_length
+ pad_length
;
129 dyn
= talloc_zero_array(state
, uint8_t, dyn_len
);
130 if (tevent_req_nomem(dyn
, req
)) {
131 return tevent_req_post(req
, ev
);
133 memcpy(dyn
, in_input_buffer
->data
,
134 in_input_buffer
->length
);
135 memcpy(dyn
+ ofs
, in_output_buffer
->data
,
136 in_output_buffer
->length
);
137 } else if (input_buffer_length
> 0) {
138 dyn
= in_input_buffer
->data
;
139 dyn_len
= in_input_buffer
->length
;
140 } else if (output_buffer_length
> 0) {
141 dyn
= in_output_buffer
->data
;
142 dyn_len
= in_output_buffer
->length
;
144 dyn
= state
->dyn_pad
;
145 dyn_len
= sizeof(state
->dyn_pad
);
148 subreq
= smb2cli_req_send(state
, ev
, conn
, SMB2_OP_IOCTL
,
153 state
->fixed
, sizeof(state
->fixed
),
156 if (tevent_req_nomem(subreq
, req
)) {
157 return tevent_req_post(req
, ev
);
159 tevent_req_set_callback(subreq
, smb2cli_ioctl_done
, req
);
163 static void smb2cli_ioctl_done(struct tevent_req
*subreq
)
165 struct tevent_req
*req
=
166 tevent_req_callback_data(subreq
,
168 struct smb2cli_ioctl_state
*state
=
170 struct smb2cli_ioctl_state
);
175 DATA_BLOB dyn_buffer
= data_blob_null
;
176 uint32_t dyn_ofs
= SMB2_HDR_BODY
+ 0x30;
177 uint32_t input_min_offset
;
178 uint32_t input_buffer_offset
;
179 uint32_t input_buffer_length
;
180 uint32_t input_next_offset
;
181 uint32_t output_min_offset
;
182 uint32_t output_buffer_offset
;
183 uint32_t output_buffer_length
;
184 uint32_t output_next_offset
;
185 static const struct smb2cli_req_expected_response expected
[] = {
187 .status
= NT_STATUS_OK
,
191 .status
= STATUS_BUFFER_OVERFLOW
,
196 * We need to make sure that
197 * a response with NT_STATUS_FILE_CLOSED
198 * without signing generates NT_STATUS_ACCESS_DENIED
199 * if the request was signed.
201 .status
= NT_STATUS_FILE_CLOSED
,
208 .status
= NT_STATUS_INVALID_PARAMETER
,
213 * a special case for FSCTL_SRV_COPYCHUNK_*
215 .status
= NT_STATUS_INVALID_PARAMETER
,
220 status
= smb2cli_req_recv(subreq
, state
, &iov
,
221 expected
, ARRAY_SIZE(expected
));
223 if (NT_STATUS_EQUAL(status
, NT_STATUS_INVALID_PARAMETER
)) {
224 switch (state
->ctl_code
) {
225 case FSCTL_SRV_COPYCHUNK
:
226 case FSCTL_SRV_COPYCHUNK_WRITE
:
229 tevent_req_nterror(req
, status
);
233 if (iov
[1].iov_len
!= 0x30) {
234 tevent_req_nterror(req
,
235 NT_STATUS_INVALID_NETWORK_RESPONSE
);
238 } else if (NT_STATUS_EQUAL(status
, STATUS_BUFFER_OVERFLOW
)) {
241 if (tevent_req_nterror(req
, status
)) {
247 * At this stage we're sure that got a body size of 0x31,
248 * either with NT_STATUS_OK, STATUS_BUFFER_OVERFLOW or
249 * NT_STATUS_INVALID_PARAMETER.
252 state
->recv_iov
= iov
;
253 fixed
= (uint8_t *)iov
[1].iov_base
;
254 dyn_buffer
= data_blob_const((uint8_t *)iov
[2].iov_base
,
257 input_buffer_offset
= IVAL(fixed
, 0x18);
258 input_buffer_length
= IVAL(fixed
, 0x1C);
259 output_buffer_offset
= IVAL(fixed
, 0x20);
260 output_buffer_length
= IVAL(fixed
, 0x24);
262 input_min_offset
= dyn_ofs
;
263 input_next_offset
= dyn_ofs
;
264 error
= smb2cli_parse_dyn_buffer(dyn_ofs
,
269 state
->max_input_length
,
271 &state
->out_input_buffer
);
272 if (tevent_req_nterror(req
, error
)) {
277 * If output data is returned, the output offset MUST be set to
278 * InputOffset + InputCount rounded up to a multiple of 8.
280 output_min_offset
= NDR_ROUND(input_next_offset
, 8);
281 output_next_offset
= 0; /* this variable is completely ignored */
282 error
= smb2cli_parse_dyn_buffer(dyn_ofs
,
285 output_buffer_offset
,
286 output_buffer_length
,
287 state
->max_output_length
,
289 &state
->out_output_buffer
);
290 if (tevent_req_nterror(req
, error
)) {
294 state
->out_valid
= true;
296 if (tevent_req_nterror(req
, status
)) {
300 tevent_req_done(req
);
303 NTSTATUS
smb2cli_ioctl_recv(struct tevent_req
*req
,
305 DATA_BLOB
*out_input_buffer
,
306 DATA_BLOB
*out_output_buffer
)
308 struct smb2cli_ioctl_state
*state
=
310 struct smb2cli_ioctl_state
);
311 NTSTATUS status
= NT_STATUS_OK
;
313 if (tevent_req_is_nterror(req
, &status
) && !state
->out_valid
) {
314 if (out_input_buffer
) {
315 *out_input_buffer
= data_blob_null
;
317 if (out_output_buffer
) {
318 *out_output_buffer
= data_blob_null
;
320 tevent_req_received(req
);
324 talloc_steal(mem_ctx
, state
->recv_iov
);
325 if (out_input_buffer
) {
326 *out_input_buffer
= state
->out_input_buffer
;
328 if (out_output_buffer
) {
329 *out_output_buffer
= state
->out_output_buffer
;
332 tevent_req_received(req
);
336 NTSTATUS
smb2cli_ioctl(struct smbXcli_conn
*conn
,
337 uint32_t timeout_msec
,
338 struct smbXcli_session
*session
,
339 struct smbXcli_tcon
*tcon
,
340 uint64_t in_fid_persistent
,
341 uint64_t in_fid_volatile
,
342 uint32_t in_ctl_code
,
343 uint32_t in_max_input_length
,
344 const DATA_BLOB
*in_input_buffer
,
345 uint32_t in_max_output_length
,
346 const DATA_BLOB
*in_output_buffer
,
349 DATA_BLOB
*out_input_buffer
,
350 DATA_BLOB
*out_output_buffer
)
352 TALLOC_CTX
*frame
= talloc_stackframe();
353 struct tevent_context
*ev
;
354 struct tevent_req
*req
;
355 NTSTATUS status
= NT_STATUS_NO_MEMORY
;
357 if (smbXcli_conn_has_async_calls(conn
)) {
359 * Can't use sync call while an async call is in flight
361 status
= NT_STATUS_INVALID_PARAMETER_MIX
;
364 ev
= samba_tevent_context_init(frame
);
368 req
= smb2cli_ioctl_send(frame
, ev
, conn
, timeout_msec
,
375 in_max_output_length
,
381 if (!tevent_req_poll_ntstatus(req
, ev
, &status
)) {
384 status
= smb2cli_ioctl_recv(req
, mem_ctx
,