diff options
Diffstat (limited to 'source3/smbd')
| -rw-r--r-- | source3/smbd/smb2_ioctl.c | 327 |
1 files changed, 173 insertions, 154 deletions
diff --git a/source3/smbd/smb2_ioctl.c b/source3/smbd/smb2_ioctl.c index c46520a5a7..1c7b94dbec 100644 --- a/source3/smbd/smb2_ioctl.c +++ b/source3/smbd/smb2_ioctl.c @@ -328,6 +328,166 @@ static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq) } } +static NTSTATUS fsctl_dfs_get_refers(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct connection_struct *conn, + DATA_BLOB *in_input, + uint32_t in_max_output, + DATA_BLOB *out_output) +{ + uint16_t in_max_referral_level; + DATA_BLOB in_file_name_buffer; + char *in_file_name_string; + size_t in_file_name_string_size; + bool ok; + bool overflow = false; + NTSTATUS status; + int dfs_size; + char *dfs_data = NULL; + DATA_BLOB output; + + if (!IS_IPC(conn)) { + return NT_STATUS_INVALID_DEVICE_REQUEST; + } + + if (!lp_host_msdfs()) { + return NT_STATUS_FS_DRIVER_REQUIRED; + } + + if (in_input->length < (2 + 2)) { + return NT_STATUS_INVALID_PARAMETER; + } + + in_max_referral_level = SVAL(in_input->data, 0); + in_file_name_buffer.data = in_input->data + 2; + in_file_name_buffer.length = in_input->length - 2; + + ok = convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX, + in_file_name_buffer.data, + in_file_name_buffer.length, + &in_file_name_string, + &in_file_name_string_size); + if (!ok) { + return NT_STATUS_ILLEGAL_CHARACTER; + } + + dfs_size = setup_dfs_referral(conn, + in_file_name_string, + in_max_referral_level, + &dfs_data, &status); + if (dfs_size < 0) { + return status; + } + + if (dfs_size > in_max_output) { + /* + * TODO: we need a testsuite for this + */ + overflow = true; + dfs_size = in_max_output; + } + + output = data_blob_talloc(mem_ctx, (uint8_t *)dfs_data, dfs_size); + SAFE_FREE(dfs_data); + if ((dfs_size > 0) && (output.data == NULL)) { + return NT_STATUS_NO_MEMORY; + } + *out_output = output; + + if (overflow) { + return STATUS_BUFFER_OVERFLOW; + } + return NT_STATUS_OK; +} + +static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct smbXsrv_connection *conn, + DATA_BLOB *in_input, + uint32_t in_max_output, + DATA_BLOB *out_output, + bool *disconnect) +{ + uint32_t in_capabilities; + DATA_BLOB in_guid_blob; + struct GUID in_guid; + uint16_t in_security_mode; + uint16_t in_num_dialects; + uint16_t i; + DATA_BLOB out_guid_blob; + NTSTATUS status; + + if (in_input->length < 0x18) { + return NT_STATUS_INVALID_PARAMETER; + } + + in_capabilities = IVAL(in_input->data, 0x00); + in_guid_blob = data_blob_const(in_input->data + 0x04, 16); + in_security_mode = SVAL(in_input->data, 0x14); + in_num_dialects = SVAL(in_input->data, 0x16); + + if (in_input->length < (0x18 + in_num_dialects*2)) { + return NT_STATUS_INVALID_PARAMETER; + } + + if (in_max_output < 0x18) { + return NT_STATUS_BUFFER_TOO_SMALL; + } + + status = GUID_from_ndr_blob(&in_guid_blob, &in_guid); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + if (in_num_dialects != conn->smb2.client.num_dialects) { + *disconnect = true; + return NT_STATUS_ACCESS_DENIED; + } + + for (i=0; i < in_num_dialects; i++) { + uint16_t v = SVAL(in_input->data, 0x18 + i*2); + + if (conn->smb2.client.dialects[i] != v) { + *disconnect = true; + return NT_STATUS_ACCESS_DENIED; + } + } + + if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) { + *disconnect = true; + return NT_STATUS_ACCESS_DENIED; + } + + if (in_security_mode != conn->smb2.client.security_mode) { + *disconnect = true; + return NT_STATUS_ACCESS_DENIED; + } + + if (in_capabilities != conn->smb2.client.capabilities) { + *disconnect = true; + return NT_STATUS_ACCESS_DENIED; + } + + status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx, + &out_guid_blob); + if (!NT_STATUS_IS_OK(status)) { + return status; + } + + *out_output = data_blob_talloc(mem_ctx, NULL, 0x18); + if (out_output->data == NULL) { + return NT_STATUS_NO_MEMORY; + } + + SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities); + memcpy(out_output->data+0x04, out_guid_blob.data, 16); + SIVAL(out_output->data, 0x14, conn->smb2.server.security_mode); + SIVAL(out_output->data, 0x16, conn->smb2.server.dialect); + + return NT_STATUS_OK; +} + + struct smbd_smb2_ioctl_state { struct smbd_smb2_request *smb2req; struct smb_request *smbreq; @@ -381,74 +541,11 @@ static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx, switch (in_ctl_code) { case 0x00060194: /* FSCTL_DFS_GET_REFERRALS */ { - uint16_t in_max_referral_level; - DATA_BLOB in_file_name_buffer; - char *in_file_name_string; - size_t in_file_name_string_size; - bool ok; - bool overflow = false; - NTSTATUS status; - int dfs_size; - char *dfs_data = NULL; - - if (!IS_IPC(smbreq->conn)) { - tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST); - return tevent_req_post(req, ev); - } - - if (!lp_host_msdfs()) { - tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED); - return tevent_req_post(req, ev); - } - - if (in_input.length < (2 + 2)) { - tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER); - return tevent_req_post(req, ev); - } - - in_max_referral_level = SVAL(in_input.data, 0); - in_file_name_buffer.data = in_input.data + 2; - in_file_name_buffer.length = in_input.length - 2; - - ok = convert_string_talloc(state, CH_UTF16, CH_UNIX, - in_file_name_buffer.data, - in_file_name_buffer.length, - &in_file_name_string, - &in_file_name_string_size); - if (!ok) { - tevent_req_nterror(req, NT_STATUS_ILLEGAL_CHARACTER); - return tevent_req_post(req, ev); - } - - dfs_size = setup_dfs_referral(smbreq->conn, - in_file_name_string, - in_max_referral_level, - &dfs_data, &status); - if (dfs_size < 0) { - tevent_req_nterror(req, status); - return tevent_req_post(req, ev); - } - - if (dfs_size > in_max_output) { - /* - * TODO: we need a testsuite for this - */ - overflow = true; - dfs_size = in_max_output; - } - - state->out_output = data_blob_talloc(state, - (uint8_t *)dfs_data, - dfs_size); - SAFE_FREE(dfs_data); - if (dfs_size > 0 && - tevent_req_nomem(state->out_output.data, req)) { - return tevent_req_post(req, ev); - } - - if (overflow) { - tevent_req_nterror(req, STATUS_BUFFER_OVERFLOW); - } else { + status = fsctl_dfs_get_refers(state, ev, state->smbreq->conn, + &state->in_input, + state->in_max_output, + &state->out_output); + if (!tevent_req_nterror(req, status)) { tevent_req_done(req); } return tevent_req_post(req, ev); @@ -487,92 +584,15 @@ static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx, case FSCTL_VALIDATE_NEGOTIATE_INFO: { - struct smbXsrv_connection *conn = smbreq->sconn->conn; - uint32_t in_capabilities; - DATA_BLOB in_guid_blob; - struct GUID in_guid; - uint16_t in_security_mode; - uint16_t in_num_dialects; - uint16_t i; - DATA_BLOB out_guid_blob; - NTSTATUS status; - - if (in_input.length < 0x18) { - tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER); - return tevent_req_post(req, ev); - } - - in_capabilities = IVAL(in_input.data, 0x00); - in_guid_blob = data_blob_const(in_input.data + 0x04, 16); - in_security_mode = SVAL(in_input.data, 0x14); - in_num_dialects = SVAL(in_input.data, 0x16); - - if (in_input.length < (0x18 + in_num_dialects*2)) { - tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER); - return tevent_req_post(req, ev); - } - - if (in_max_output < 0x18) { - tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL); - return tevent_req_post(req, ev); - } - - status = GUID_from_ndr_blob(&in_guid_blob, &in_guid); - if (tevent_req_nterror(req, status)) { - return tevent_req_post(req, ev); - } - - if (in_num_dialects != conn->smb2.client.num_dialects) { - state->disconnect = true; - tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED); - return tevent_req_post(req, ev); - } - - for (i=0; i < in_num_dialects; i++) { - uint16_t v = SVAL(in_input.data, 0x18 + i*2); - - if (conn->smb2.client.dialects[i] != v) { - state->disconnect = true; - tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED); - return tevent_req_post(req, ev); - } - } - - if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) { - state->disconnect = true; - tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED); - return tevent_req_post(req, ev); - } - - if (in_security_mode != conn->smb2.client.security_mode) { - state->disconnect = true; - tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED); - return tevent_req_post(req, ev); - } - - if (in_capabilities != conn->smb2.client.capabilities) { - state->disconnect = true; - tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED); - return tevent_req_post(req, ev); - } - - status = GUID_to_ndr_blob(&conn->smb2.server.guid, state, - &out_guid_blob); - if (tevent_req_nterror(req, status)) { - return tevent_req_post(req, ev); - } - - state->out_output = data_blob_talloc(state, NULL, 0x18); - if (tevent_req_nomem(state->out_output.data, req)) { - return tevent_req_post(req, ev); + status = fsctl_validate_neg_info(state, ev, + state->smbreq->sconn->conn, + &state->in_input, + state->in_max_output, + &state->out_output, + &state->disconnect); + if (!tevent_req_nterror(req, status)) { + tevent_req_done(req); } - - SIVAL(state->out_output.data, 0x00, conn->smb2.server.capabilities); - memcpy(state->out_output.data+0x04, out_guid_blob.data, 16); - SIVAL(state->out_output.data, 0x14, conn->smb2.server.security_mode); - SIVAL(state->out_output.data, 0x16, conn->smb2.server.dialect); - - tevent_req_done(req); return tevent_req_post(req, ev); } @@ -655,7 +675,6 @@ static void smbd_smb2_ioctl_pipe_write_done(struct tevent_req *subreq) "of size %u\n", (unsigned int)state->out_output.length )); - TALLOC_FREE(subreq); subreq = np_read_send(state->smbreq->conn, state->smb2req->sconn->ev_ctx, state->fsp->fake_file_handle, |