Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : smb2 lib
4 : Copyright (C) Stefan Metzmacher 2011
5 :
6 : This program is free software; you can redistribute it and/or modify
7 : it under the terms of the GNU General Public License as published by
8 : the Free Software Foundation; either version 3 of the License, or
9 : (at your option) any later version.
10 :
11 : This program is distributed in the hope that it will be useful,
12 : but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : GNU General Public License for more details.
15 :
16 : You should have received a copy of the GNU General Public License
17 : along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "system/network.h"
22 : #include "lib/util/tevent_ntstatus.h"
23 : #include "smb_common.h"
24 : #include "smbXcli_base.h"
25 :
26 : struct smb2cli_ioctl_state {
27 : uint8_t fixed[0x38];
28 : uint8_t dyn_pad[1];
29 : uint32_t max_input_length;
30 : uint32_t max_output_length;
31 : struct iovec *recv_iov;
32 : bool out_valid;
33 : DATA_BLOB out_input_buffer;
34 : DATA_BLOB out_output_buffer;
35 : uint32_t ctl_code;
36 : };
37 :
38 : static void smb2cli_ioctl_done(struct tevent_req *subreq);
39 :
40 349652 : struct tevent_req *smb2cli_ioctl_send(TALLOC_CTX *mem_ctx,
41 : struct tevent_context *ev,
42 : struct smbXcli_conn *conn,
43 : uint32_t timeout_msec,
44 : struct smbXcli_session *session,
45 : struct smbXcli_tcon *tcon,
46 : uint64_t in_fid_persistent,
47 : uint64_t in_fid_volatile,
48 : uint32_t in_ctl_code,
49 : uint32_t in_max_input_length,
50 : const DATA_BLOB *in_input_buffer,
51 : uint32_t in_max_output_length,
52 : const DATA_BLOB *in_output_buffer,
53 : uint32_t in_flags)
54 : {
55 : struct tevent_req *req, *subreq;
56 : struct smb2cli_ioctl_state *state;
57 : uint8_t *fixed;
58 : uint8_t *dyn;
59 : size_t dyn_len;
60 349652 : uint32_t input_buffer_offset = 0;
61 349652 : uint32_t input_buffer_length = 0;
62 349652 : uint32_t output_buffer_offset = 0;
63 349652 : uint32_t output_buffer_length = 0;
64 349652 : uint32_t pad_length = 0;
65 : uint64_t tmp64;
66 349652 : uint32_t max_dyn_len = 0;
67 :
68 349652 : req = tevent_req_create(mem_ctx, &state,
69 : struct smb2cli_ioctl_state);
70 349652 : if (req == NULL) {
71 0 : return NULL;
72 : }
73 349652 : state->ctl_code = in_ctl_code;
74 349652 : state->max_input_length = in_max_input_length;
75 349652 : state->max_output_length = in_max_output_length;
76 :
77 349652 : tmp64 = in_max_input_length;
78 349652 : tmp64 += in_max_output_length;
79 349652 : if (tmp64 > UINT32_MAX) {
80 0 : max_dyn_len = UINT32_MAX;
81 : } else {
82 349652 : max_dyn_len = tmp64;
83 : }
84 :
85 349652 : if (in_input_buffer) {
86 348232 : input_buffer_offset = SMB2_HDR_BODY+0x38;
87 348232 : input_buffer_length = in_input_buffer->length;
88 : }
89 :
90 349652 : if (in_output_buffer) {
91 348218 : output_buffer_offset = SMB2_HDR_BODY+0x38;
92 348218 : output_buffer_length = in_output_buffer->length;
93 348218 : if (input_buffer_length > 0 && output_buffer_length > 0) {
94 : uint32_t tmp;
95 0 : output_buffer_offset += input_buffer_length;
96 0 : tmp = output_buffer_offset;
97 0 : output_buffer_offset = NDR_ROUND(output_buffer_offset, 8);
98 0 : pad_length = output_buffer_offset - tmp;
99 : }
100 : }
101 :
102 349652 : fixed = state->fixed;
103 :
104 349652 : SSVAL(fixed, 0x00, 0x39);
105 349652 : SSVAL(fixed, 0x02, 0); /* reserved */
106 349652 : SIVAL(fixed, 0x04, in_ctl_code);
107 349652 : SBVAL(fixed, 0x08, in_fid_persistent);
108 349652 : SBVAL(fixed, 0x10, in_fid_volatile);
109 349652 : SIVAL(fixed, 0x18, input_buffer_offset);
110 349652 : SIVAL(fixed, 0x1C, input_buffer_length);
111 349652 : SIVAL(fixed, 0x20, in_max_input_length);
112 349652 : SIVAL(fixed, 0x24, output_buffer_offset);
113 349652 : SIVAL(fixed, 0x28, output_buffer_length);
114 349652 : SIVAL(fixed, 0x2C, in_max_output_length);
115 349652 : SIVAL(fixed, 0x30, in_flags);
116 349652 : SIVAL(fixed, 0x34, 0); /* reserved */
117 :
118 349652 : if (input_buffer_length > 0 && output_buffer_length > 0) {
119 0 : size_t avail = UINT32_MAX - (input_buffer_length + pad_length);
120 0 : size_t ofs = output_buffer_offset - input_buffer_offset;
121 :
122 0 : if (avail < output_buffer_length) {
123 0 : tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
124 0 : return tevent_req_post(req, ev);
125 : }
126 :
127 0 : dyn_len = input_buffer_length + output_buffer_length + pad_length;
128 :
129 0 : dyn = talloc_zero_array(state, uint8_t, dyn_len);
130 0 : if (tevent_req_nomem(dyn, req)) {
131 0 : return tevent_req_post(req, ev);
132 : }
133 0 : memcpy(dyn, in_input_buffer->data,
134 0 : in_input_buffer->length);
135 0 : memcpy(dyn + ofs, in_output_buffer->data,
136 0 : in_output_buffer->length);
137 349652 : } else if (input_buffer_length > 0) {
138 347839 : dyn = in_input_buffer->data;
139 347839 : dyn_len = in_input_buffer->length;
140 1813 : } else if (output_buffer_length > 0) {
141 0 : dyn = in_output_buffer->data;
142 0 : dyn_len = in_output_buffer->length;
143 : } else {
144 1813 : dyn = state->dyn_pad;
145 1813 : dyn_len = sizeof(state->dyn_pad);
146 : }
147 :
148 641831 : subreq = smb2cli_req_send(state, ev, conn, SMB2_OP_IOCTL,
149 : 0, 0, /* flags */
150 : timeout_msec,
151 : tcon,
152 : session,
153 349652 : state->fixed, sizeof(state->fixed),
154 : dyn, dyn_len,
155 : max_dyn_len);
156 349652 : if (tevent_req_nomem(subreq, req)) {
157 0 : return tevent_req_post(req, ev);
158 : }
159 349652 : tevent_req_set_callback(subreq, smb2cli_ioctl_done, req);
160 349652 : return req;
161 : }
162 :
163 349652 : static void smb2cli_ioctl_done(struct tevent_req *subreq)
164 : {
165 292179 : struct tevent_req *req =
166 349652 : tevent_req_callback_data(subreq,
167 : struct tevent_req);
168 292179 : struct smb2cli_ioctl_state *state =
169 349652 : tevent_req_data(req,
170 : struct smb2cli_ioctl_state);
171 : NTSTATUS status;
172 : NTSTATUS error;
173 : struct iovec *iov;
174 : uint8_t *fixed;
175 343023 : DATA_BLOB dyn_buffer = data_blob_null;
176 349652 : uint32_t dyn_ofs = SMB2_HDR_BODY + 0x30;
177 : uint32_t input_min_offset;
178 : uint32_t input_buffer_offset;
179 : uint32_t input_buffer_length;
180 : uint32_t input_next_offset;
181 : uint32_t output_min_offset;
182 : uint32_t output_buffer_offset;
183 : uint32_t output_buffer_length;
184 : uint32_t output_next_offset;
185 : static const struct smb2cli_req_expected_response expected[] = {
186 : {
187 : .status = NT_STATUS_OK,
188 : .body_size = 0x31
189 : },
190 : {
191 : .status = STATUS_BUFFER_OVERFLOW,
192 : .body_size = 0x31
193 : },
194 : {
195 : /*
196 : * We need to make sure that
197 : * a response with NT_STATUS_FILE_CLOSED
198 : * without signing generates NT_STATUS_ACCESS_DENIED
199 : * if the request was signed.
200 : */
201 : .status = NT_STATUS_FILE_CLOSED,
202 : .body_size = 0x09,
203 : },
204 : {
205 : /*
206 : * a normal error
207 : */
208 : .status = NT_STATUS_INVALID_PARAMETER,
209 : .body_size = 0x09
210 : },
211 : {
212 : /*
213 : * a special case for FSCTL_SRV_COPYCHUNK_*
214 : */
215 : .status = NT_STATUS_INVALID_PARAMETER,
216 : .body_size = 0x31
217 : },
218 : };
219 :
220 349652 : status = smb2cli_req_recv(subreq, state, &iov,
221 : expected, ARRAY_SIZE(expected));
222 349652 : TALLOC_FREE(subreq);
223 349652 : if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
224 0 : switch (state->ctl_code) {
225 0 : case FSCTL_SRV_COPYCHUNK:
226 : case FSCTL_SRV_COPYCHUNK_WRITE:
227 0 : break;
228 0 : default:
229 0 : tevent_req_nterror(req, status);
230 717 : return;
231 : }
232 :
233 0 : if (iov[1].iov_len != 0x30) {
234 0 : tevent_req_nterror(req,
235 : NT_STATUS_INVALID_NETWORK_RESPONSE);
236 0 : return;
237 : }
238 349652 : } else if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
239 : /* no error */
240 : } else {
241 349652 : if (tevent_req_nterror(req, status)) {
242 6822 : return;
243 : }
244 : }
245 :
246 : /*
247 : * At this stage we're sure that got a body size of 0x31,
248 : * either with NT_STATUS_OK, STATUS_BUFFER_OVERFLOW or
249 : * NT_STATUS_INVALID_PARAMETER.
250 : */
251 :
252 342827 : state->recv_iov = iov;
253 342827 : fixed = (uint8_t *)iov[1].iov_base;
254 342827 : dyn_buffer = data_blob_const((uint8_t *)iov[2].iov_base,
255 336201 : iov[2].iov_len);
256 :
257 342827 : input_buffer_offset = IVAL(fixed, 0x18);
258 342827 : input_buffer_length = IVAL(fixed, 0x1C);
259 342827 : output_buffer_offset = IVAL(fixed, 0x20);
260 342827 : output_buffer_length = IVAL(fixed, 0x24);
261 :
262 342827 : input_min_offset = dyn_ofs;
263 342827 : input_next_offset = dyn_ofs;
264 342827 : error = smb2cli_parse_dyn_buffer(dyn_ofs,
265 : dyn_buffer,
266 : input_min_offset,
267 : input_buffer_offset,
268 : input_buffer_length,
269 : state->max_input_length,
270 : &input_next_offset,
271 : &state->out_input_buffer);
272 342827 : if (tevent_req_nterror(req, error)) {
273 0 : return;
274 : }
275 :
276 : /*
277 : * If output data is returned, the output offset MUST be set to
278 : * InputOffset + InputCount rounded up to a multiple of 8.
279 : */
280 342827 : output_min_offset = NDR_ROUND(input_next_offset, 8);
281 342827 : output_next_offset = 0; /* this variable is completely ignored */
282 342827 : error = smb2cli_parse_dyn_buffer(dyn_ofs,
283 : dyn_buffer,
284 : output_min_offset,
285 : output_buffer_offset,
286 : output_buffer_length,
287 : state->max_output_length,
288 : &output_next_offset,
289 : &state->out_output_buffer);
290 342827 : if (tevent_req_nterror(req, error)) {
291 0 : return;
292 : }
293 :
294 342827 : state->out_valid = true;
295 :
296 342827 : if (tevent_req_nterror(req, status)) {
297 0 : return;
298 : }
299 :
300 342827 : tevent_req_done(req);
301 : }
302 :
303 349652 : NTSTATUS smb2cli_ioctl_recv(struct tevent_req *req,
304 : TALLOC_CTX *mem_ctx,
305 : DATA_BLOB *out_input_buffer,
306 : DATA_BLOB *out_output_buffer)
307 : {
308 292179 : struct smb2cli_ioctl_state *state =
309 349652 : tevent_req_data(req,
310 : struct smb2cli_ioctl_state);
311 349652 : NTSTATUS status = NT_STATUS_OK;
312 :
313 349652 : if (tevent_req_is_nterror(req, &status) && !state->out_valid) {
314 6825 : if (out_input_buffer) {
315 6811 : *out_input_buffer = data_blob_null;
316 : }
317 6825 : if (out_output_buffer) {
318 6811 : *out_output_buffer = data_blob_null;
319 : }
320 6825 : tevent_req_received(req);
321 6825 : return status;
322 : }
323 :
324 342827 : talloc_steal(mem_ctx, state->recv_iov);
325 342827 : if (out_input_buffer) {
326 342827 : *out_input_buffer = state->out_input_buffer;
327 : }
328 342827 : if (out_output_buffer) {
329 342827 : *out_output_buffer = state->out_output_buffer;
330 : }
331 :
332 342827 : tevent_req_received(req);
333 342827 : return status;
334 : }
335 :
336 6675 : NTSTATUS smb2cli_ioctl(struct smbXcli_conn *conn,
337 : uint32_t timeout_msec,
338 : struct smbXcli_session *session,
339 : struct smbXcli_tcon *tcon,
340 : uint64_t in_fid_persistent,
341 : uint64_t in_fid_volatile,
342 : uint32_t in_ctl_code,
343 : uint32_t in_max_input_length,
344 : const DATA_BLOB *in_input_buffer,
345 : uint32_t in_max_output_length,
346 : const DATA_BLOB *in_output_buffer,
347 : uint32_t in_flags,
348 : TALLOC_CTX *mem_ctx,
349 : DATA_BLOB *out_input_buffer,
350 : DATA_BLOB *out_output_buffer)
351 : {
352 6675 : TALLOC_CTX *frame = talloc_stackframe();
353 : struct tevent_context *ev;
354 : struct tevent_req *req;
355 6675 : NTSTATUS status = NT_STATUS_NO_MEMORY;
356 :
357 6675 : if (smbXcli_conn_has_async_calls(conn)) {
358 : /*
359 : * Can't use sync call while an async call is in flight
360 : */
361 0 : status = NT_STATUS_INVALID_PARAMETER_MIX;
362 0 : goto fail;
363 : }
364 6675 : ev = samba_tevent_context_init(frame);
365 6675 : if (ev == NULL) {
366 0 : goto fail;
367 : }
368 6675 : req = smb2cli_ioctl_send(frame, ev, conn, timeout_msec,
369 : session, tcon,
370 : in_fid_persistent,
371 : in_fid_volatile,
372 : in_ctl_code,
373 : in_max_input_length,
374 : in_input_buffer,
375 : in_max_output_length,
376 : in_output_buffer,
377 : in_flags);
378 6675 : if (req == NULL) {
379 0 : goto fail;
380 : }
381 6675 : if (!tevent_req_poll_ntstatus(req, ev, &status)) {
382 0 : goto fail;
383 : }
384 6675 : status = smb2cli_ioctl_recv(req, mem_ctx,
385 : out_input_buffer,
386 : out_output_buffer);
387 6675 : fail:
388 6675 : TALLOC_FREE(frame);
389 6675 : return status;
390 : }
|