source3/smbd/smb2_ioctl.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/smb/smb_common.h"
  25 #include "../lib/util/tevent_ntstatus.h"
  26 #include "rpc_server/srv_pipe_hnd.h"
  27 #include "include/ntioctl.h"
  28 #include "../librpc/ndr/libndr.h"
  29
  30 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
  31                                                struct tevent_context *ev,
  32                                                struct smbd_smb2_request *smb2req,
  33                                                struct files_struct *in_fsp,
  34                                                uint32_t in_ctl_code,
  35                                                DATA_BLOB in_input,
  36                                                uint32_t in_max_output,
  37                                                uint32_t in_flags);
  38 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
  39                                      TALLOC_CTX *mem_ctx,
  40                                      DATA_BLOB *out_output,
  41                                      bool *disconnect);
  42
  43 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq);
  44 NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
  45 {
  46         NTSTATUS status;
  47         const uint8_t *inbody;
  48         int i = req->current_idx;
  49         uint32_t min_buffer_offset;
  50         uint32_t max_buffer_offset;
  51         uint32_t min_output_offset;
  52         uint32_t allowed_length_in;
  53         uint32_t allowed_length_out;
  54         uint32_t in_ctl_code;
  55         uint64_t in_file_id_persistent;
  56         uint64_t in_file_id_volatile;
  57         struct files_struct *in_fsp = NULL;
  58         uint32_t in_input_offset;
  59         uint32_t in_input_length;
  60         DATA_BLOB in_input_buffer = data_blob_null;
  61         uint32_t in_max_input_length;
  62         uint32_t in_output_offset;
  63         uint32_t in_output_length;
  64         DATA_BLOB in_output_buffer = data_blob_null;
  65         uint32_t in_max_output_length;
  66         uint32_t in_flags;
  67         uint32_t data_length_in;
  68         uint32_t data_length_out;
  69         uint32_t data_length_tmp;
  70         uint32_t data_length_max;
  71         struct tevent_req *subreq;
  72
  73         status = smbd_smb2_request_verify_sizes(req, 0x39);
  74         if (!NT_STATUS_IS_OK(status)) {
  75                 return smbd_smb2_request_error(req, status);
  76         }
  77         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
  78
  79         in_ctl_code             = IVAL(inbody, 0x04);
  80         in_file_id_persistent   = BVAL(inbody, 0x08);
  81         in_file_id_volatile     = BVAL(inbody, 0x10);
  82         in_input_offset         = IVAL(inbody, 0x18);
  83         in_input_length         = IVAL(inbody, 0x1C);
  84         in_max_input_length     = IVAL(inbody, 0x20);
  85         in_output_offset        = IVAL(inbody, 0x24);
  86         in_output_length        = IVAL(inbody, 0x28);
  87         in_max_output_length    = IVAL(inbody, 0x2C);
  88         in_flags                = IVAL(inbody, 0x30);
  89
  90         min_buffer_offset = SMB2_HDR_BODY + req->in.vector[i+1].iov_len;
  91         max_buffer_offset = min_buffer_offset + req->in.vector[i+2].iov_len;
  92         min_output_offset = min_buffer_offset;
  93
  94         /*
  95          * InputOffset (4 bytes): The offset, in bytes, from the beginning of
  96          * the SMB2 header to the input data buffer. If no input data is
  97          * required for the FSCTL/IOCTL command being issued, the client SHOULD
  98          * set this value to 0.<49>
  99          * <49> If no input data is required for the FSCTL/IOCTL command being
 100          * issued, Windows-based clients set this field to any value.
 101          */
 102         allowed_length_in = 0;
 103         if ((in_input_offset > 0) && (in_input_length > 0)) {
 104                 uint32_t tmp_ofs;
 105
 106                 if (in_input_offset < min_buffer_offset) {
 107                         return smbd_smb2_request_error(req,
 108                                         NT_STATUS_INVALID_PARAMETER);
 109                 }
 110                 if (in_input_offset > max_buffer_offset) {
 111                         return smbd_smb2_request_error(req,
 112                                         NT_STATUS_INVALID_PARAMETER);
 113                 }
 114                 allowed_length_in = max_buffer_offset - in_input_offset;
 115
 116                 tmp_ofs = in_input_offset - min_buffer_offset;
 117                 in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
 118                 in_input_buffer.data += tmp_ofs;
 119                 in_input_buffer.length = in_input_length;
 120                 min_output_offset += tmp_ofs;
 121                 min_output_offset += in_input_length;
 122         }
 123
 124         if (in_input_length > allowed_length_in) {
 125                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 126         }
 127
 128         allowed_length_out = 0;
 129         if (in_output_offset > 0) {
 130                 if (in_output_offset < min_buffer_offset) {
 131                         return smbd_smb2_request_error(req,
 132                                         NT_STATUS_INVALID_PARAMETER);
 133                 }
 134                 if (in_output_offset > max_buffer_offset) {
 135                         return smbd_smb2_request_error(req,
 136                                         NT_STATUS_INVALID_PARAMETER);
 137                 }
 138                 allowed_length_out = max_buffer_offset - in_output_offset;
 139         }
 140
 141         if (in_output_length > allowed_length_out) {
 142                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 143         }
 144
 145         if (in_output_length > 0) {
 146                 uint32_t tmp_ofs;
 147
 148                 if (in_output_offset < min_output_offset) {
 149                         return smbd_smb2_request_error(req,
 150                                         NT_STATUS_INVALID_PARAMETER);
 151                 }
 152
 153                 tmp_ofs = in_output_offset - min_buffer_offset;
 154                 in_output_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
 155                 in_output_buffer.data += tmp_ofs;
 156                 in_output_buffer.length = in_output_length;
 157         }
 158
 159         /*
 160          * verify the credits and avoid overflows
 161          * in_input_buffer.length and in_output_buffer.length
 162          * are already verified.
 163          */
 164         data_length_in = in_input_buffer.length + in_output_buffer.length;
 165
 166         data_length_out = in_max_input_length;
 167         data_length_tmp = UINT32_MAX - data_length_out;
 168         if (data_length_tmp < in_max_output_length) {
 169                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 170         }
 171         data_length_out += in_max_output_length;
 172
 173         data_length_max = MAX(data_length_in, data_length_out);
 174
 175         status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
 176         if (!NT_STATUS_IS_OK(status)) {
 177                 return smbd_smb2_request_error(req, status);
 178         }
 179
 180         /*
 181          * If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
 182          * server MUST fail the request with STATUS_NOT_SUPPORTED.
 183          */
 184         if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
 185                 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
 186         }
 187
 188         switch (in_ctl_code) {
 189         case FSCTL_DFS_GET_REFERRALS:
 190         case FSCTL_DFS_GET_REFERRALS_EX:
 191         case FSCTL_PIPE_WAIT:
 192         case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
 193         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 194         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 195                 /*
 196                  * Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
 197                  * FSCTL_PIPE_WAIT does not take a file handle.
 198                  *
 199                  * If FileId in the SMB2 Header of the request is not
 200                  * 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
 201                  * with STATUS_INVALID_PARAMETER.
 202                  */
 203                 if (in_file_id_persistent != UINT64_MAX ||
 204                     in_file_id_volatile != UINT64_MAX) {
 205                         return smbd_smb2_request_error(req,
 206                                 NT_STATUS_INVALID_PARAMETER);
 207                 }
 208                 break;
 209         default:
 210                 in_fsp = file_fsp_smb2(req, in_file_id_persistent,
 211                                        in_file_id_volatile);
 212                 if (in_fsp == NULL) {
 213                         return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
 214                 }
 215                 break;
 216         }
 217
 218         subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
 219                                       req, in_fsp,
 220                                       in_ctl_code,
 221                                       in_input_buffer,
 222                                       in_max_output_length,
 223                                       in_flags);
 224         if (subreq == NULL) {
 225                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 226         }
 227         tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
 228
 229         return smbd_smb2_request_pending_queue(req, subreq, 1000);
 230 }
 231
 232 static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq)
 233 {
 234         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
 235                                         struct smbd_smb2_request);
 236         const uint8_t *inbody;
 237         int i = req->current_idx;
 238         DATA_BLOB outbody;
 239         DATA_BLOB outdyn;
 240         uint32_t in_ctl_code;
 241         uint64_t in_file_id_persistent;
 242         uint64_t in_file_id_volatile;
 243         uint32_t out_input_offset;
 244         uint32_t out_output_offset;
 245         DATA_BLOB out_output_buffer = data_blob_null;
 246         NTSTATUS status;
 247         NTSTATUS error; /* transport error */
 248         bool disconnect = false;
 249
 250         status = smbd_smb2_ioctl_recv(subreq, req,
 251                                       &out_output_buffer,
 252                                       &disconnect);
 253
 254         DEBUG(10,("smbd_smb2_request_ioctl_done: smbd_smb2_ioctl_recv returned "
 255                 "%u status %s\n",
 256                 (unsigned int)out_output_buffer.length,
 257                 nt_errstr(status) ));
 258
 259         TALLOC_FREE(subreq);
 260         if (disconnect) {
 261                 error = status;
 262                 smbd_server_connection_terminate(req->sconn,
 263                                                  nt_errstr(error));
 264                 return;
 265         }
 266
 267         if (NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
 268                 /* also ok */
 269         } else if (!NT_STATUS_IS_OK(status)) {
 270                 error = smbd_smb2_request_error(req, status);
 271                 if (!NT_STATUS_IS_OK(error)) {
 272                         smbd_server_connection_terminate(req->sconn,
 273                                                          nt_errstr(error));
 274                         return;
 275                 }
 276                 return;
 277         }
 278
 279         out_input_offset = SMB2_HDR_BODY + 0x30;
 280         out_output_offset = SMB2_HDR_BODY + 0x30;
 281
 282         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
 283
 284         in_ctl_code             = IVAL(inbody, 0x04);
 285         in_file_id_persistent   = BVAL(inbody, 0x08);
 286         in_file_id_volatile     = BVAL(inbody, 0x10);
 287
 288         outbody = data_blob_talloc(req->out.vector, NULL, 0x30);
 289         if (outbody.data == NULL) {
 290                 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 291                 if (!NT_STATUS_IS_OK(error)) {
 292                         smbd_server_connection_terminate(req->sconn,
 293                                                          nt_errstr(error));
 294                         return;
 295                 }
 296                 return;
 297         }
 298
 299         SSVAL(outbody.data, 0x00, 0x30 + 1);    /* struct size */
 300         SSVAL(outbody.data, 0x02, 0);           /* reserved */
 301         SIVAL(outbody.data, 0x04,
 302               in_ctl_code);                     /* ctl code */
 303         SBVAL(outbody.data, 0x08,
 304               in_file_id_persistent);           /* file id (persistent) */
 305         SBVAL(outbody.data, 0x10,
 306               in_file_id_volatile);             /* file id (volatile) */
 307         SIVAL(outbody.data, 0x18,
 308               out_input_offset);                /* input offset */
 309         SIVAL(outbody.data, 0x1C, 0);           /* input count */
 310         SIVAL(outbody.data, 0x20,
 311               out_output_offset);               /* output offset */
 312         SIVAL(outbody.data, 0x24,
 313               out_output_buffer.length);        /* output count */
 314         SIVAL(outbody.data, 0x28, 0);           /* flags */
 315         SIVAL(outbody.data, 0x2C, 0);           /* reserved */
 316
 317         /*
 318          * Note: Windows Vista and 2008 send back also the
 319          *       input from the request. But it was fixed in
 320          *       Windows 7.
 321          */
 322         outdyn = out_output_buffer;
 323
 324         error = smbd_smb2_request_done_ex(req, status, outbody, &outdyn,
 325                                           __location__);
 326         if (!NT_STATUS_IS_OK(error)) {
 327                 smbd_server_connection_terminate(req->sconn,
 328                                                  nt_errstr(error));
 329                 return;
 330         }
 331 }
 332
 333 struct smbd_smb2_ioctl_state {
 334         struct smbd_smb2_request *smb2req;
 335         struct smb_request *smbreq;
 336         files_struct *fsp;
 337         DATA_BLOB in_input;
 338         uint32_t in_max_output;
 339         DATA_BLOB out_output;
 340         bool disconnect;
 341 };
 342
 343 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq);
 344 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq);
 345
 346 static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx,
 347                                                struct tevent_context *ev,
 348                                                struct smbd_smb2_request *smb2req,
 349                                                struct files_struct *fsp,
 350                                                uint32_t in_ctl_code,
 351                                                DATA_BLOB in_input,
 352                                                uint32_t in_max_output,
 353                                                uint32_t in_flags)
 354 {
 355         struct tevent_req *req;
 356         struct smbd_smb2_ioctl_state *state;
 357         struct smb_request *smbreq;
 358         struct tevent_req *subreq;
 359
 360         req = tevent_req_create(mem_ctx, &state,
 361                                 struct smbd_smb2_ioctl_state);
 362         if (req == NULL) {
 363                 return NULL;
 364         }
 365         state->smb2req = smb2req;
 366         state->smbreq = NULL;
 367         state->fsp = fsp;
 368         state->in_input = in_input;
 369         state->in_max_output = in_max_output;
 370         state->out_output = data_blob_null;
 371
 372         DEBUG(10, ("smbd_smb2_ioctl: ctl_code[0x%08x] %s fnum[%d]\n",
 373                    (unsigned)in_ctl_code,
 374                    fsp ? fsp_str_dbg(fsp) : "<no handle>",
 375                    fsp ? fsp->fnum : -1));
 376
 377         smbreq = smbd_smb2_fake_smb_request(smb2req);
 378         if (tevent_req_nomem(smbreq, req)) {
 379                 return tevent_req_post(req, ev);
 380         }
 381         state->smbreq = smbreq;
 382
 383         switch (in_ctl_code) {
 384         case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */
 385         {
 386                 uint16_t in_max_referral_level;
 387                 DATA_BLOB in_file_name_buffer;
 388                 char *in_file_name_string;
 389                 size_t in_file_name_string_size;
 390                 bool ok;
 391                 bool overflow = false;
 392                 NTSTATUS status;
 393                 int dfs_size;
 394                 char *dfs_data = NULL;
 395
 396                 if (!IS_IPC(smbreq->conn)) {
 397                         tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 398                         return tevent_req_post(req, ev);
 399                 }
 400
 401                 if (!lp_host_msdfs()) {
 402                         tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED);
 403                         return tevent_req_post(req, ev);
 404                 }
 405
 406                 if (in_input.length < (2 + 2)) {
 407                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 408                         return tevent_req_post(req, ev);
 409                 }
 410
 411                 in_max_referral_level = SVAL(in_input.data, 0);
 412                 in_file_name_buffer.data = in_input.data + 2;
 413                 in_file_name_buffer.length = in_input.length - 2;
 414
 415                 ok = convert_string_talloc(state, CH_UTF16, CH_UNIX,
 416                                            in_file_name_buffer.data,
 417                                            in_file_name_buffer.length,
 418                                            &in_file_name_string,
 419                                            &in_file_name_string_size);
 420                 if (!ok) {
 421                         tevent_req_nterror(req, NT_STATUS_ILLEGAL_CHARACTER);
 422                         return tevent_req_post(req, ev);
 423                 }
 424
 425                 dfs_size = setup_dfs_referral(smbreq->conn,
 426                                               in_file_name_string,
 427                                               in_max_referral_level,
 428                                               &dfs_data, &status);
 429                 if (dfs_size < 0) {
 430                         tevent_req_nterror(req, status);
 431                         return tevent_req_post(req, ev);
 432                 }
 433
 434                 if (dfs_size > in_max_output) {
 435                         /*
 436                          * TODO: we need a testsuite for this
 437                          */
 438                         overflow = true;
 439                         dfs_size = in_max_output;
 440                 }
 441
 442                 state->out_output = data_blob_talloc(state,
 443                                                      (uint8_t *)dfs_data,
 444                                                      dfs_size);
 445                 SAFE_FREE(dfs_data);
 446                 if (dfs_size > 0 &&
 447                     tevent_req_nomem(state->out_output.data, req)) {
 448                         return tevent_req_post(req, ev);
 449                 }
 450
 451                 if (overflow) {
 452                         tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
 453                 } else {
 454                         tevent_req_done(req);
 455                 }
 456                 return tevent_req_post(req, ev);
 457         }
 458         case 0x0011C017: /* FSCTL_PIPE_TRANSCEIVE */
 459
 460                 if (!IS_IPC(smbreq->conn)) {
 461                         tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
 462                         return tevent_req_post(req, ev);
 463                 }
 464
 465                 if (fsp == NULL) {
 466                         tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 467                         return tevent_req_post(req, ev);
 468                 }
 469
 470                 if (!fsp_is_np(fsp)) {
 471                         tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 472                         return tevent_req_post(req, ev);
 473                 }
 474
 475                 DEBUG(10,("smbd_smb2_ioctl_send: np_write_send of size %u\n",
 476                         (unsigned int)in_input.length ));
 477
 478                 subreq = np_write_send(state, ev,
 479                                        fsp->fake_file_handle,
 480                                        in_input.data,
 481                                        in_input.length);
 482                 if (tevent_req_nomem(subreq, req)) {
 483                         return tevent_req_post(req, ev);
 484                 }
 485                 tevent_req_set_callback(subreq,
 486                                         smbd_smb2_ioctl_pipe_write_done,
 487                                         req);
 488                 return req;
 489
 490         case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
 491         {
 492                 struct smbXsrv_connection *conn = smbreq->sconn->conn;
 493                 uint32_t in_capabilities;
 494                 DATA_BLOB in_guid_blob;
 495                 struct GUID in_guid;
 496                 uint16_t in_security_mode;
 497                 uint16_t in_max_dialect;
 498                 uint16_t max_dialect;
 499                 DATA_BLOB out_guid_blob;
 500                 NTSTATUS status;
 501
 502                 if (in_input.length != 0x18) {
 503                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 504                         return tevent_req_post(req, ev);
 505                 }
 506
 507                 if (in_max_output < 0x18) {
 508                         tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
 509                         return tevent_req_post(req, ev);
 510                 }
 511
 512                 in_capabilities = IVAL(in_input.data, 0x00);
 513                 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
 514                 in_security_mode = SVAL(in_input.data, 0x14);
 515                 in_max_dialect = SVAL(in_input.data, 0x16);
 516
 517                 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 518                 if (tevent_req_nterror(req, status)) {
 519                         return tevent_req_post(req, ev);
 520                 }
 521
 522                 max_dialect = conn->smb2.client.dialects[conn->smb2.client.num_dialects-1];
 523                 if (in_max_dialect != max_dialect) {
 524                         state->disconnect = true;
 525                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 526                         return tevent_req_post(req, ev);
 527                 }
 528
 529                 if (!GUID_compare(&in_guid, &conn->smb2.client.guid)) {
 530                         state->disconnect = true;
 531                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 532                         return tevent_req_post(req, ev);
 533                 }
 534
 535                 if (in_security_mode != conn->smb2.client.security_mode) {
 536                         state->disconnect = true;
 537                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 538                         return tevent_req_post(req, ev);
 539                 }
 540
 541                 if (in_capabilities != conn->smb2.client.capabilities) {
 542                         state->disconnect = true;
 543                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 544                         return tevent_req_post(req, ev);
 545                 }
 546
 547                 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
 548                                           &out_guid_blob);
 549                 if (tevent_req_nterror(req, status)) {
 550                         return tevent_req_post(req, ev);
 551                 }
 552
 553                 state->out_output = data_blob_talloc(state, NULL, 0x18);
 554                 if (tevent_req_nomem(state->out_output.data, req)) {
 555                         return tevent_req_post(req, ev);
 556                 }
 557
 558                 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
 559                 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
 560                 SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
 561                 SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
 562
 563                 tevent_req_done(req);
 564                 return tevent_req_post(req, ev);
 565         }
 566
 567         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 568         {
 569                 struct smbXsrv_connection *conn = smbreq->sconn->conn;
 570                 uint32_t in_capabilities;
 571                 DATA_BLOB in_guid_blob;
 572                 struct GUID in_guid;
 573                 uint16_t in_security_mode;
 574                 uint16_t in_num_dialects;
 575                 uint16_t i;
 576                 DATA_BLOB out_guid_blob;
 577                 NTSTATUS status;
 578
 579                 if (in_input.length < 0x18) {
 580                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 581                         return tevent_req_post(req, ev);
 582                 }
 583
 584                 in_capabilities = IVAL(in_input.data, 0x00);
 585                 in_guid_blob = data_blob_const(in_input.data + 0x04, 16);
 586                 in_security_mode = SVAL(in_input.data, 0x14);
 587                 in_num_dialects = SVAL(in_input.data, 0x16);
 588
 589                 if (in_input.length != (0x18 + in_num_dialects*2)) {
 590                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 591                         return tevent_req_post(req, ev);
 592                 }
 593
 594                 if (in_max_output < 0x18) {
 595                         tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
 596                         return tevent_req_post(req, ev);
 597                 }
 598
 599                 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 600                 if (tevent_req_nterror(req, status)) {
 601                         return tevent_req_post(req, ev);
 602                 }
 603
 604                 if (in_num_dialects != conn->smb2.client.num_dialects) {
 605                         state->disconnect = true;
 606                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 607                         return tevent_req_post(req, ev);
 608                 }
 609
 610                 for (i=0; i < in_num_dialects; i++) {
 611                         uint16_t v = SVAL(in_input.data, 0x18 + i*2);
 612
 613                         if (conn->smb2.client.dialects[i] != v) {
 614                                 state->disconnect = true;
 615                                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 616                                 return tevent_req_post(req, ev);
 617                         }
 618                 }
 619
 620                 if (!GUID_compare(&in_guid, &conn->smb2.client.guid)) {
 621                         state->disconnect = true;
 622                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 623                         return tevent_req_post(req, ev);
 624                 }
 625
 626                 if (in_security_mode != conn->smb2.client.security_mode) {
 627                         state->disconnect = true;
 628                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 629                         return tevent_req_post(req, ev);
 630                 }
 631
 632                 if (in_capabilities != conn->smb2.client.capabilities) {
 633                         state->disconnect = true;
 634                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 635                         return tevent_req_post(req, ev);
 636                 }
 637
 638                 status = GUID_to_ndr_blob(&conn->smb2.server.guid, state,
 639                                           &out_guid_blob);
 640                 if (tevent_req_nterror(req, status)) {
 641                         return tevent_req_post(req, ev);
 642                 }
 643
 644                 state->out_output = data_blob_talloc(state, NULL, 0x18);
 645                 if (tevent_req_nomem(state->out_output.data, req)) {
 646                         return tevent_req_post(req, ev);
 647                 }
 648
 649                 SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities);
 650                 memcpy(state->out_output.data+0x04, out_guid_blob.data, 16);
 651                 SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode);
 652                 SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect);
 653
 654                 tevent_req_done(req);
 655                 return tevent_req_post(req, ev);
 656         }
 657
 658         default: {
 659                 uint8_t *out_data = NULL;
 660                 uint32_t out_data_len = 0;
 661                 NTSTATUS status;
 662
 663                 if (fsp == NULL) {
 664                         tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 665                         return tevent_req_post(req, ev);
 666                 }
 667
 668                 status = SMB_VFS_FSCTL(fsp,
 669                                        state,
 670                                        in_ctl_code,
 671                                        smbreq->flags2,
 672                                        in_input.data,
 673                                        in_input.length,
 674                                        &out_data,
 675                                        in_max_output,
 676                                        &out_data_len);
 677                 state->out_output = data_blob_const(out_data, out_data_len);
 678                 if (NT_STATUS_IS_OK(status)) {
 679                         tevent_req_done(req);
 680                         return tevent_req_post(req, ev);
 681                 }
 682
 683                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 684                         if (IS_IPC(smbreq->conn)) {
 685                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 686                         } else {
 687                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 688                         }
 689                 }
 690
 691                 tevent_req_nterror(req, status);
 692                 return tevent_req_post(req, ev);
 693         }
 694         }
 695
 696         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 697         return tevent_req_post(req, ev);
 698 }
 699
 700 static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq)
 701 {
 702         struct tevent_req *req = tevent_req_callback_data(subreq,
 703                                  struct tevent_req);
 704         struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
 705                                               struct smbd_smb2_ioctl_state);
 706         NTSTATUS status;
 707         ssize_t nwritten = -1;
 708
 709         status = np_write_recv(subreq, &nwritten);
 710
 711         DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: received %ld\n",
 712                 (long int)nwritten ));
 713
 714         TALLOC_FREE(subreq);
 715         if (!NT_STATUS_IS_OK(status)) {
 716                 NTSTATUS old = status;
 717                 status = nt_status_np_pipe(old);
 718                 tevent_req_nterror(req, status);
 719                 return;
 720         }
 721
 722         if (nwritten != state->in_input.length) {
 723                 tevent_req_nterror(req, NT_STATUS_PIPE_NOT_AVAILABLE);
 724                 return;
 725         }
 726
 727         state->out_output = data_blob_talloc(state, NULL, state->in_max_output);
 728         if (state->in_max_output > 0 &&
 729             tevent_req_nomem(state->out_output.data, req)) {
 730                 return;
 731         }
 732
 733         DEBUG(10,("smbd_smb2_ioctl_pipe_write_done: issuing np_read_send "
 734                 "of size %u\n",
 735                 (unsigned int)state->out_output.length ));
 736
 737         TALLOC_FREE(subreq);
 738         subreq = np_read_send(state->smbreq->conn,
 739                               state->smb2req->sconn->ev_ctx,
 740                               state->fsp->fake_file_handle,
 741                               state->out_output.data,
 742                               state->out_output.length);
 743         if (tevent_req_nomem(subreq, req)) {
 744                 return;
 745         }
 746         tevent_req_set_callback(subreq, smbd_smb2_ioctl_pipe_read_done, req);
 747 }
 748
 749 static void smbd_smb2_ioctl_pipe_read_done(struct tevent_req *subreq)
 750 {
 751         struct tevent_req *req = tevent_req_callback_data(subreq,
 752                                  struct tevent_req);
 753         struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
 754                                               struct smbd_smb2_ioctl_state);
 755         NTSTATUS status;
 756         NTSTATUS old;
 757         ssize_t nread = -1;
 758         bool is_data_outstanding = false;
 759
 760         status = np_read_recv(subreq, &nread, &is_data_outstanding);
 761         TALLOC_FREE(subreq);
 762
 763         old = status;
 764         status = nt_status_np_pipe(old);
 765
 766         DEBUG(10,("smbd_smb2_ioctl_pipe_read_done: np_read_recv nread = %d "
 767                  "is_data_outstanding = %d, status = %s%s%s\n",
 768                 (int)nread,
 769                 (int)is_data_outstanding,
 770                 nt_errstr(old),
 771                 NT_STATUS_EQUAL(old, status)?"":" => ",
 772                 NT_STATUS_EQUAL(old, status)?"":nt_errstr(status)));
 773
 774         if (!NT_STATUS_IS_OK(status)) {
 775                 tevent_req_nterror(req, status);
 776                 return;
 777         }
 778
 779         state->out_output.length = nread;
 780
 781         if (is_data_outstanding) {
 782                 tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW);
 783                 return;
 784         }
 785
 786         tevent_req_done(req);
 787 }
 788
 789 static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req,
 790                                      TALLOC_CTX *mem_ctx,
 791                                      DATA_BLOB *out_output,
 792                                      bool *disconnect)
 793 {
 794         NTSTATUS status = NT_STATUS_OK;
 795         struct smbd_smb2_ioctl_state *state = tevent_req_data(req,
 796                                               struct smbd_smb2_ioctl_state);
 797
 798         *disconnect = state->disconnect;
 799
 800         if (tevent_req_is_nterror(req, &status)) {
 801                 if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
 802                         tevent_req_received(req);
 803                         return status;
 804                 }
 805         }
 806
 807         *out_output = state->out_output;
 808         talloc_steal(mem_ctx, out_output->data);
 809
 810         tevent_req_received(req);
 811         return status;
 812 }