LCOV - code coverage report
Current view: top level - libcli/smb - smb2cli_ioctl.c (source / functions) Hit Total Coverage
Test: coverage report for abartlet/fix-coverage dd10fb34 Lines: 113 151 74.8 %
Date: 2021-09-23 10:06:22 Functions: 4 4 100.0 %

          Line data    Source code
       1             : /*
       2             :    Unix SMB/CIFS implementation.
       3             :    smb2 lib
       4             :    Copyright (C) Stefan Metzmacher 2011
       5             : 
       6             :    This program is free software; you can redistribute it and/or modify
       7             :    it under the terms of the GNU General Public License as published by
       8             :    the Free Software Foundation; either version 3 of the License, or
       9             :    (at your option) any later version.
      10             : 
      11             :    This program is distributed in the hope that it will be useful,
      12             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :    GNU General Public License for more details.
      15             : 
      16             :    You should have received a copy of the GNU General Public License
      17             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      18             : */
      19             : 
      20             : #include "includes.h"
      21             : #include "system/network.h"
      22             : #include "lib/util/tevent_ntstatus.h"
      23             : #include "smb_common.h"
      24             : #include "smbXcli_base.h"
      25             : 
      26             : struct smb2cli_ioctl_state {
      27             :         uint8_t fixed[0x38];
      28             :         uint8_t dyn_pad[1];
      29             :         uint32_t max_input_length;
      30             :         uint32_t max_output_length;
      31             :         struct iovec *recv_iov;
      32             :         bool out_valid;
      33             :         DATA_BLOB out_input_buffer;
      34             :         DATA_BLOB out_output_buffer;
      35             :         uint32_t ctl_code;
      36             : };
      37             : 
      38             : static void smb2cli_ioctl_done(struct tevent_req *subreq);
      39             : 
      40      349652 : struct tevent_req *smb2cli_ioctl_send(TALLOC_CTX *mem_ctx,
      41             :                                       struct tevent_context *ev,
      42             :                                       struct smbXcli_conn *conn,
      43             :                                       uint32_t timeout_msec,
      44             :                                       struct smbXcli_session *session,
      45             :                                       struct smbXcli_tcon *tcon,
      46             :                                       uint64_t in_fid_persistent,
      47             :                                       uint64_t in_fid_volatile,
      48             :                                       uint32_t in_ctl_code,
      49             :                                       uint32_t in_max_input_length,
      50             :                                       const DATA_BLOB *in_input_buffer,
      51             :                                       uint32_t in_max_output_length,
      52             :                                       const DATA_BLOB *in_output_buffer,
      53             :                                       uint32_t in_flags)
      54             : {
      55             :         struct tevent_req *req, *subreq;
      56             :         struct smb2cli_ioctl_state *state;
      57             :         uint8_t *fixed;
      58             :         uint8_t *dyn;
      59             :         size_t dyn_len;
      60      349652 :         uint32_t input_buffer_offset = 0;
      61      349652 :         uint32_t input_buffer_length = 0;
      62      349652 :         uint32_t output_buffer_offset = 0;
      63      349652 :         uint32_t output_buffer_length = 0;
      64      349652 :         uint32_t pad_length = 0;
      65             :         uint64_t tmp64;
      66      349652 :         uint32_t max_dyn_len = 0;
      67             : 
      68      349652 :         req = tevent_req_create(mem_ctx, &state,
      69             :                                 struct smb2cli_ioctl_state);
      70      349652 :         if (req == NULL) {
      71           0 :                 return NULL;
      72             :         }
      73      349652 :         state->ctl_code = in_ctl_code;
      74      349652 :         state->max_input_length = in_max_input_length;
      75      349652 :         state->max_output_length = in_max_output_length;
      76             : 
      77      349652 :         tmp64 = in_max_input_length;
      78      349652 :         tmp64 += in_max_output_length;
      79      349652 :         if (tmp64 > UINT32_MAX) {
      80           0 :                 max_dyn_len = UINT32_MAX;
      81             :         } else {
      82      349652 :                 max_dyn_len = tmp64;
      83             :         }
      84             : 
      85      349652 :         if (in_input_buffer) {
      86      348232 :                 input_buffer_offset = SMB2_HDR_BODY+0x38;
      87      348232 :                 input_buffer_length = in_input_buffer->length;
      88             :         }
      89             : 
      90      349652 :         if (in_output_buffer) {
      91      348218 :                 output_buffer_offset = SMB2_HDR_BODY+0x38;
      92      348218 :                 output_buffer_length = in_output_buffer->length;
      93      348218 :                 if (input_buffer_length > 0 && output_buffer_length > 0) {
      94             :                         uint32_t tmp;
      95           0 :                         output_buffer_offset += input_buffer_length;
      96           0 :                         tmp = output_buffer_offset;
      97           0 :                         output_buffer_offset = NDR_ROUND(output_buffer_offset, 8);
      98           0 :                         pad_length = output_buffer_offset - tmp;
      99             :                 }
     100             :         }
     101             : 
     102      349652 :         fixed = state->fixed;
     103             : 
     104      349652 :         SSVAL(fixed, 0x00, 0x39);
     105      349652 :         SSVAL(fixed, 0x02, 0); /* reserved */
     106      349652 :         SIVAL(fixed, 0x04, in_ctl_code);
     107      349652 :         SBVAL(fixed, 0x08, in_fid_persistent);
     108      349652 :         SBVAL(fixed, 0x10, in_fid_volatile);
     109      349652 :         SIVAL(fixed, 0x18, input_buffer_offset);
     110      349652 :         SIVAL(fixed, 0x1C, input_buffer_length);
     111      349652 :         SIVAL(fixed, 0x20, in_max_input_length);
     112      349652 :         SIVAL(fixed, 0x24, output_buffer_offset);
     113      349652 :         SIVAL(fixed, 0x28, output_buffer_length);
     114      349652 :         SIVAL(fixed, 0x2C, in_max_output_length);
     115      349652 :         SIVAL(fixed, 0x30, in_flags);
     116      349652 :         SIVAL(fixed, 0x34, 0); /* reserved */
     117             : 
     118      349652 :         if (input_buffer_length > 0 && output_buffer_length > 0) {
     119           0 :                 size_t avail = UINT32_MAX - (input_buffer_length + pad_length);
     120           0 :                 size_t ofs = output_buffer_offset - input_buffer_offset;
     121             : 
     122           0 :                 if (avail < output_buffer_length) {
     123           0 :                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
     124           0 :                         return tevent_req_post(req, ev);
     125             :                 }
     126             : 
     127           0 :                 dyn_len = input_buffer_length + output_buffer_length + pad_length;
     128             : 
     129           0 :                 dyn = talloc_zero_array(state, uint8_t, dyn_len);
     130           0 :                 if (tevent_req_nomem(dyn, req)) {
     131           0 :                         return tevent_req_post(req, ev);
     132             :                 }
     133           0 :                 memcpy(dyn, in_input_buffer->data,
     134           0 :                        in_input_buffer->length);
     135           0 :                 memcpy(dyn + ofs, in_output_buffer->data,
     136           0 :                        in_output_buffer->length);
     137      349652 :         } else if (input_buffer_length > 0) {
     138      347839 :                 dyn = in_input_buffer->data;
     139      347839 :                 dyn_len = in_input_buffer->length;
     140        1813 :         } else if (output_buffer_length > 0) {
     141           0 :                 dyn = in_output_buffer->data;
     142           0 :                 dyn_len = in_output_buffer->length;
     143             :         } else {
     144        1813 :                 dyn = state->dyn_pad;
     145        1813 :                 dyn_len = sizeof(state->dyn_pad);
     146             :         }
     147             : 
     148      641831 :         subreq = smb2cli_req_send(state, ev, conn, SMB2_OP_IOCTL,
     149             :                                   0, 0, /* flags */
     150             :                                   timeout_msec,
     151             :                                   tcon,
     152             :                                   session,
     153      349652 :                                   state->fixed, sizeof(state->fixed),
     154             :                                   dyn, dyn_len,
     155             :                                   max_dyn_len);
     156      349652 :         if (tevent_req_nomem(subreq, req)) {
     157           0 :                 return tevent_req_post(req, ev);
     158             :         }
     159      349652 :         tevent_req_set_callback(subreq, smb2cli_ioctl_done, req);
     160      349652 :         return req;
     161             : }
     162             : 
     163      349652 : static void smb2cli_ioctl_done(struct tevent_req *subreq)
     164             : {
     165      292179 :         struct tevent_req *req =
     166      349652 :                 tevent_req_callback_data(subreq,
     167             :                 struct tevent_req);
     168      292179 :         struct smb2cli_ioctl_state *state =
     169      349652 :                 tevent_req_data(req,
     170             :                 struct smb2cli_ioctl_state);
     171             :         NTSTATUS status;
     172             :         NTSTATUS error;
     173             :         struct iovec *iov;
     174             :         uint8_t *fixed;
     175      343023 :         DATA_BLOB dyn_buffer = data_blob_null;
     176      349652 :         uint32_t dyn_ofs = SMB2_HDR_BODY + 0x30;
     177             :         uint32_t input_min_offset;
     178             :         uint32_t input_buffer_offset;
     179             :         uint32_t input_buffer_length;
     180             :         uint32_t input_next_offset;
     181             :         uint32_t output_min_offset;
     182             :         uint32_t output_buffer_offset;
     183             :         uint32_t output_buffer_length;
     184             :         uint32_t output_next_offset;
     185             :         static const struct smb2cli_req_expected_response expected[] = {
     186             :         {
     187             :                 .status = NT_STATUS_OK,
     188             :                 .body_size = 0x31
     189             :         },
     190             :         {
     191             :                 .status = STATUS_BUFFER_OVERFLOW,
     192             :                 .body_size = 0x31
     193             :         },
     194             :         {
     195             :                 /*
     196             :                  * We need to make sure that
     197             :                  * a response with NT_STATUS_FILE_CLOSED
     198             :                  * without signing generates NT_STATUS_ACCESS_DENIED
     199             :                  * if the request was signed.
     200             :                  */
     201             :                 .status = NT_STATUS_FILE_CLOSED,
     202             :                 .body_size = 0x09,
     203             :         },
     204             :         {
     205             :                 /*
     206             :                  * a normal error
     207             :                  */
     208             :                 .status = NT_STATUS_INVALID_PARAMETER,
     209             :                 .body_size = 0x09
     210             :         },
     211             :         {
     212             :                 /*
     213             :                  * a special case for FSCTL_SRV_COPYCHUNK_*
     214             :                  */
     215             :                 .status = NT_STATUS_INVALID_PARAMETER,
     216             :                 .body_size = 0x31
     217             :         },
     218             :         };
     219             : 
     220      349652 :         status = smb2cli_req_recv(subreq, state, &iov,
     221             :                                   expected, ARRAY_SIZE(expected));
     222      349652 :         TALLOC_FREE(subreq);
     223      349652 :         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
     224           0 :                 switch (state->ctl_code) {
     225           0 :                 case FSCTL_SRV_COPYCHUNK:
     226             :                 case FSCTL_SRV_COPYCHUNK_WRITE:
     227           0 :                         break;
     228           0 :                 default:
     229           0 :                         tevent_req_nterror(req, status);
     230         717 :                         return;
     231             :                 }
     232             : 
     233           0 :                 if (iov[1].iov_len != 0x30) {
     234           0 :                         tevent_req_nterror(req,
     235             :                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
     236           0 :                         return;
     237             :                 }
     238      349652 :         } else if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
     239             :                 /* no error */
     240             :         } else {
     241      349652 :                 if (tevent_req_nterror(req, status)) {
     242        6822 :                         return;
     243             :                 }
     244             :         }
     245             : 
     246             :         /*
     247             :          * At this stage we're sure that got a body size of 0x31,
     248             :          * either with NT_STATUS_OK, STATUS_BUFFER_OVERFLOW or
     249             :          * NT_STATUS_INVALID_PARAMETER.
     250             :          */
     251             : 
     252      342827 :         state->recv_iov = iov;
     253      342827 :         fixed = (uint8_t *)iov[1].iov_base;
     254      342827 :         dyn_buffer = data_blob_const((uint8_t *)iov[2].iov_base,
     255      336201 :                                      iov[2].iov_len);
     256             : 
     257      342827 :         input_buffer_offset = IVAL(fixed, 0x18);
     258      342827 :         input_buffer_length = IVAL(fixed, 0x1C);
     259      342827 :         output_buffer_offset = IVAL(fixed, 0x20);
     260      342827 :         output_buffer_length = IVAL(fixed, 0x24);
     261             : 
     262      342827 :         input_min_offset = dyn_ofs;
     263      342827 :         input_next_offset = dyn_ofs;
     264      342827 :         error = smb2cli_parse_dyn_buffer(dyn_ofs,
     265             :                                          dyn_buffer,
     266             :                                          input_min_offset,
     267             :                                          input_buffer_offset,
     268             :                                          input_buffer_length,
     269             :                                          state->max_input_length,
     270             :                                          &input_next_offset,
     271             :                                          &state->out_input_buffer);
     272      342827 :         if (tevent_req_nterror(req, error)) {
     273           0 :                 return;
     274             :         }
     275             : 
     276             :         /*
     277             :          * If output data is returned, the output offset MUST be set to
     278             :          * InputOffset + InputCount rounded up to a multiple of 8.
     279             :          */
     280      342827 :         output_min_offset = NDR_ROUND(input_next_offset, 8);
     281      342827 :         output_next_offset = 0; /* this variable is completely ignored */
     282      342827 :         error = smb2cli_parse_dyn_buffer(dyn_ofs,
     283             :                                          dyn_buffer,
     284             :                                          output_min_offset,
     285             :                                          output_buffer_offset,
     286             :                                          output_buffer_length,
     287             :                                          state->max_output_length,
     288             :                                          &output_next_offset,
     289             :                                          &state->out_output_buffer);
     290      342827 :         if (tevent_req_nterror(req, error)) {
     291           0 :                 return;
     292             :         }
     293             : 
     294      342827 :         state->out_valid = true;
     295             : 
     296      342827 :         if (tevent_req_nterror(req, status)) {
     297           0 :                 return;
     298             :         }
     299             : 
     300      342827 :         tevent_req_done(req);
     301             : }
     302             : 
     303      349652 : NTSTATUS smb2cli_ioctl_recv(struct tevent_req *req,
     304             :                             TALLOC_CTX *mem_ctx,
     305             :                             DATA_BLOB *out_input_buffer,
     306             :                             DATA_BLOB *out_output_buffer)
     307             : {
     308      292179 :         struct smb2cli_ioctl_state *state =
     309      349652 :                 tevent_req_data(req,
     310             :                 struct smb2cli_ioctl_state);
     311      349652 :         NTSTATUS status = NT_STATUS_OK;
     312             : 
     313      349652 :         if (tevent_req_is_nterror(req, &status) && !state->out_valid) {
     314        6825 :                 if (out_input_buffer) {
     315        6811 :                         *out_input_buffer = data_blob_null;
     316             :                 }
     317        6825 :                 if (out_output_buffer) {
     318        6811 :                         *out_output_buffer = data_blob_null;
     319             :                 }
     320        6825 :                 tevent_req_received(req);
     321        6825 :                 return status;
     322             :         }
     323             : 
     324      342827 :         talloc_steal(mem_ctx, state->recv_iov);
     325      342827 :         if (out_input_buffer) {
     326      342827 :                 *out_input_buffer = state->out_input_buffer;
     327             :         }
     328      342827 :         if (out_output_buffer) {
     329      342827 :                 *out_output_buffer = state->out_output_buffer;
     330             :         }
     331             : 
     332      342827 :         tevent_req_received(req);
     333      342827 :         return status;
     334             : }
     335             : 
     336        6675 : NTSTATUS smb2cli_ioctl(struct smbXcli_conn *conn,
     337             :                        uint32_t timeout_msec,
     338             :                        struct smbXcli_session *session,
     339             :                        struct smbXcli_tcon *tcon,
     340             :                        uint64_t in_fid_persistent,
     341             :                        uint64_t in_fid_volatile,
     342             :                        uint32_t in_ctl_code,
     343             :                        uint32_t in_max_input_length,
     344             :                        const DATA_BLOB *in_input_buffer,
     345             :                        uint32_t in_max_output_length,
     346             :                        const DATA_BLOB *in_output_buffer,
     347             :                        uint32_t in_flags,
     348             :                        TALLOC_CTX *mem_ctx,
     349             :                        DATA_BLOB *out_input_buffer,
     350             :                        DATA_BLOB *out_output_buffer)
     351             : {
     352        6675 :         TALLOC_CTX *frame = talloc_stackframe();
     353             :         struct tevent_context *ev;
     354             :         struct tevent_req *req;
     355        6675 :         NTSTATUS status = NT_STATUS_NO_MEMORY;
     356             : 
     357        6675 :         if (smbXcli_conn_has_async_calls(conn)) {
     358             :                 /*
     359             :                  * Can't use sync call while an async call is in flight
     360             :                  */
     361           0 :                 status = NT_STATUS_INVALID_PARAMETER_MIX;
     362           0 :                 goto fail;
     363             :         }
     364        6675 :         ev = samba_tevent_context_init(frame);
     365        6675 :         if (ev == NULL) {
     366           0 :                 goto fail;
     367             :         }
     368        6675 :         req = smb2cli_ioctl_send(frame, ev, conn, timeout_msec,
     369             :                                  session, tcon,
     370             :                                  in_fid_persistent,
     371             :                                  in_fid_volatile,
     372             :                                  in_ctl_code,
     373             :                                  in_max_input_length,
     374             :                                  in_input_buffer,
     375             :                                  in_max_output_length,
     376             :                                  in_output_buffer,
     377             :                                  in_flags);
     378        6675 :         if (req == NULL) {
     379           0 :                 goto fail;
     380             :         }
     381        6675 :         if (!tevent_req_poll_ntstatus(req, ev, &status)) {
     382           0 :                 goto fail;
     383             :         }
     384        6675 :         status = smb2cli_ioctl_recv(req, mem_ctx,
     385             :                                     out_input_buffer,
     386             :                                     out_output_buffer);
     387        6675 :  fail:
     388        6675 :         TALLOC_FREE(frame);
     389        6675 :         return status;
     390             : }

Generated by: LCOV version 1.13