2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2011
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "system/network.h"
22 #include "lib/util/tevent_ntstatus.h"
23 #include "smb_common.h"
24 #include "smbXcli_base.h"
25 #include "librpc/ndr/libndr.h"
27 struct smb2cli_ioctl_state {
30 uint32_t max_input_length;
31 uint32_t max_output_length;
32 struct iovec *recv_iov;
33 DATA_BLOB out_input_buffer;
34 DATA_BLOB out_output_buffer;
37 static void smb2cli_ioctl_done(struct tevent_req *subreq);
39 struct tevent_req *smb2cli_ioctl_send(TALLOC_CTX *mem_ctx,
40 struct tevent_context *ev,
41 struct smbXcli_conn *conn,
42 uint32_t timeout_msec,
43 struct smbXcli_session *session,
44 struct smbXcli_tcon *tcon,
45 uint64_t in_fid_persistent,
46 uint64_t in_fid_volatile,
48 uint32_t in_max_input_length,
49 const DATA_BLOB *in_input_buffer,
50 uint32_t in_max_output_length,
51 const DATA_BLOB *in_output_buffer,
54 struct tevent_req *req, *subreq;
55 struct smb2cli_ioctl_state *state;
59 uint32_t input_buffer_offset = 0;
60 uint32_t input_buffer_length = 0;
61 uint32_t output_buffer_offset = 0;
62 uint32_t output_buffer_length = 0;
63 uint32_t pad_length = 0;
65 uint32_t max_dyn_len = 0;
67 req = tevent_req_create(mem_ctx, &state,
68 struct smb2cli_ioctl_state);
72 state->max_input_length = in_max_input_length;
73 state->max_output_length = in_max_output_length;
75 tmp64 = in_max_input_length;
76 tmp64 += in_max_output_length;
77 if (tmp64 > UINT32_MAX) {
78 max_dyn_len = UINT32_MAX;
83 if (in_input_buffer) {
84 input_buffer_offset = SMB2_HDR_BODY+0x38;
85 input_buffer_length = in_input_buffer->length;
88 if (in_output_buffer) {
89 output_buffer_offset = SMB2_HDR_BODY+0x38;
90 output_buffer_length = in_output_buffer->length;
91 if (input_buffer_length > 0 && output_buffer_length > 0) {
93 output_buffer_offset += input_buffer_length;
94 tmp = output_buffer_offset;
95 output_buffer_offset = NDR_ROUND(output_buffer_offset, 8);
96 pad_length = output_buffer_offset - tmp;
100 fixed = state->fixed;
102 SSVAL(fixed, 0x00, 0x39);
103 SSVAL(fixed, 0x02, 0); /* reserved */
104 SIVAL(fixed, 0x04, in_ctl_code);
105 SBVAL(fixed, 0x08, in_fid_persistent);
106 SBVAL(fixed, 0x10, in_fid_volatile);
107 SIVAL(fixed, 0x18, input_buffer_offset);
108 SIVAL(fixed, 0x1C, input_buffer_length);
109 SIVAL(fixed, 0x20, in_max_input_length);
110 SIVAL(fixed, 0x24, output_buffer_offset);
111 SIVAL(fixed, 0x28, output_buffer_length);
112 SIVAL(fixed, 0x2C, in_max_output_length);
113 SIVAL(fixed, 0x30, in_flags);
114 SIVAL(fixed, 0x34, 0); /* reserved */
116 if (input_buffer_length > 0 && output_buffer_length > 0) {
117 size_t avail = UINT32_MAX - (input_buffer_length + pad_length);
118 size_t ofs = output_buffer_offset - input_buffer_offset;
120 if (avail < output_buffer_length) {
121 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
122 return tevent_req_post(req, ev);
125 dyn_len = input_buffer_length + output_buffer_length + pad_length;
127 dyn = talloc_zero_array(state, uint8_t, dyn_len);
128 if (tevent_req_nomem(dyn, req)) {
129 return tevent_req_post(req, ev);
131 memcpy(dyn, in_input_buffer->data,
132 in_input_buffer->length);
133 memcpy(dyn + ofs, in_output_buffer->data,
134 in_output_buffer->length);
135 } else if (input_buffer_length > 0) {
136 dyn = in_input_buffer->data;
137 dyn_len = in_input_buffer->length;
138 } else if (output_buffer_length > 0) {
139 dyn = in_output_buffer->data;
140 dyn_len = in_output_buffer->length;
142 dyn = state->dyn_pad;
143 dyn_len = sizeof(state->dyn_pad);
146 subreq = smb2cli_req_send(state, ev, conn, SMB2_OP_IOCTL,
151 state->fixed, sizeof(state->fixed),
154 if (tevent_req_nomem(subreq, req)) {
155 return tevent_req_post(req, ev);
157 tevent_req_set_callback(subreq, smb2cli_ioctl_done, req);
161 static void smb2cli_ioctl_done(struct tevent_req *subreq)
163 struct tevent_req *req =
164 tevent_req_callback_data(subreq,
166 struct smb2cli_ioctl_state *state =
168 struct smb2cli_ioctl_state);
174 uint32_t dyn_ofs = SMB2_HDR_BODY + 0x30;
175 uint32_t input_buffer_offset;
176 uint32_t input_buffer_length;
177 uint32_t output_buffer_offset;
178 uint32_t output_buffer_length;
179 static const struct smb2cli_req_expected_response expected[] = {
181 .status = NT_STATUS_OK,
185 .status = STATUS_BUFFER_OVERFLOW,
190 status = smb2cli_req_recv(subreq, state, &iov,
191 expected, ARRAY_SIZE(expected));
193 if (tevent_req_nterror(req, status)) {
197 state->recv_iov = iov;
198 fixed = (uint8_t *)iov[1].iov_base;
199 dyn = (uint8_t *)iov[2].iov_base;
200 dyn_len = iov[2].iov_len;
202 input_buffer_offset = IVAL(fixed, 0x18);
203 input_buffer_length = IVAL(fixed, 0x1C);
204 output_buffer_offset = IVAL(fixed, 0x20);
205 output_buffer_length = IVAL(fixed, 0x24);
207 if ((input_buffer_offset > 0) && (input_buffer_length > 0)) {
210 if (input_buffer_offset != dyn_ofs) {
212 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
216 if (input_buffer_length < dyn_len) {
218 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
222 if (input_buffer_length > state->max_input_length) {
224 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
228 state->out_input_buffer.data = dyn;
229 state->out_input_buffer.length = input_buffer_length;
231 ofs = input_buffer_length;
232 ofs = NDR_ROUND(ofs, 8);
239 if ((output_buffer_offset > 0) && (output_buffer_length > 0)) {
240 if (output_buffer_offset != dyn_ofs) {
242 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
246 if (output_buffer_length < dyn_len) {
248 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
252 if (output_buffer_length > state->max_output_length) {
254 req, NT_STATUS_INVALID_NETWORK_RESPONSE);
258 state->out_output_buffer.data = dyn;
259 state->out_output_buffer.length = output_buffer_length;
262 tevent_req_done(req);
265 NTSTATUS smb2cli_ioctl_recv(struct tevent_req *req,
267 DATA_BLOB *out_input_buffer,
268 DATA_BLOB *out_output_buffer)
270 struct smb2cli_ioctl_state *state =
272 struct smb2cli_ioctl_state);
275 if (tevent_req_is_nterror(req, &status)) {
276 tevent_req_received(req);
280 talloc_steal(mem_ctx, state->recv_iov);
281 if (out_input_buffer) {
282 *out_input_buffer = state->out_input_buffer;
284 if (out_output_buffer) {
285 *out_output_buffer = state->out_output_buffer;
288 tevent_req_received(req);
292 NTSTATUS smb2cli_ioctl(struct smbXcli_conn *conn,
293 uint32_t timeout_msec,
294 struct smbXcli_session *session,
295 struct smbXcli_tcon *tcon,
296 uint64_t in_fid_persistent,
297 uint64_t in_fid_volatile,
298 uint32_t in_ctl_code,
299 uint32_t in_max_input_length,
300 const DATA_BLOB *in_input_buffer,
301 uint32_t in_max_output_length,
302 const DATA_BLOB *in_output_buffer,
305 DATA_BLOB *out_input_buffer,
306 DATA_BLOB *out_output_buffer)
308 TALLOC_CTX *frame = talloc_stackframe();
309 struct tevent_context *ev;
310 struct tevent_req *req;
311 NTSTATUS status = NT_STATUS_NO_MEMORY;
313 if (smbXcli_conn_has_async_calls(conn)) {
315 * Can't use sync call while an async call is in flight
317 status = NT_STATUS_INVALID_PARAMETER_MIX;
320 ev = samba_tevent_context_init(frame);
324 req = smb2cli_ioctl_send(frame, ev, conn, timeout_msec,
331 in_max_output_length,
337 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
340 status = smb2cli_ioctl_recv(req, mem_ctx,