From fabdebdcf4479fe85db41577c7acfa08378bd425 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 5 Jun 2009 17:32:58 +0200 Subject: s3:smbd: add support for SMB2 Ioctl We don't implement any level yet. metze --- source3/Makefile.in | 11 +- source3/smbd/globals.h | 1 + source3/smbd/smb2_ioctl.c | 271 +++++++++++++++++++++++++++++++++++++++++++++ source3/smbd/smb2_server.c | 2 +- 4 files changed, 281 insertions(+), 4 deletions(-) create mode 100644 source3/smbd/smb2_ioctl.c (limited to 'source3') diff --git a/source3/Makefile.in b/source3/Makefile.in index 689f715f1d..7229cea01d 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -750,14 +750,19 @@ SMBD_OBJ_SRV = smbd/files.o smbd/chgpasswd.o smbd/connection.o \ smbd/dmapi.o smbd/signing.o \ smbd/file_access.o \ smbd/dnsregister.o smbd/globals.o \ - smbd/smb2_server.o smbd/smb2_negprot.o \ - smbd/smb2_sesssetup.o smbd/smb2_tcon.o smbd/smb2_glue.o \ + smbd/smb2_server.o \ + smbd/smb2_signing.o \ + smbd/smb2_glue.o \ + smbd/smb2_negprot.o \ + smbd/smb2_sesssetup.o \ + smbd/smb2_tcon.o \ smbd/smb2_create.o \ smbd/smb2_close.o \ smbd/smb2_flush.o \ smbd/smb2_read.o \ smbd/smb2_write.o \ - smbd/smb2_keepalive.o smbd/smb2_signing.o \ + smbd/smb2_ioctl.o \ + smbd/smb2_keepalive.o \ $(MANGLE_OBJ) @VFS_STATIC@ SMBD_OBJ_BASE = $(PARAM_WITHOUT_REG_OBJ) $(SMBD_OBJ_SRV) $(LIBSMB_OBJ) \ diff --git a/source3/smbd/globals.h b/source3/smbd/globals.h index 26e63f1be4..db19a3a108 100644 --- a/source3/smbd/globals.h +++ b/source3/smbd/globals.h @@ -210,6 +210,7 @@ NTSTATUS smbd_smb2_request_process_close(struct smbd_smb2_request *req); NTSTATUS smbd_smb2_request_process_flush(struct smbd_smb2_request *req); NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req); NTSTATUS smbd_smb2_request_process_write(struct smbd_smb2_request *req); +NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req); NTSTATUS smbd_smb2_request_process_keepalive(struct smbd_smb2_request *req); struct smbd_smb2_request { diff --git a/source3/smbd/smb2_ioctl.c b/source3/smbd/smb2_ioctl.c new file mode 100644 index 0000000000..3ebce3eba8 --- /dev/null +++ b/source3/smbd/smb2_ioctl.c @@ -0,0 +1,271 @@ +/* + Unix SMB/CIFS implementation. + Core SMB2 server + + Copyright (C) Stefan Metzmacher 2009 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include "includes.h" +#include "smbd/globals.h" +#include "../source4/libcli/smb2/smb2_constants.h" + +static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct smbd_smb2_request *smb2req, + uint32_t in_ctl_code, + uint64_t in_file_id_volatile, + DATA_BLOB in_input, + uint32_t in_max_output, + uint32_t in_flags); +static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out_output); + +static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq); +NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req) +{ + const uint8_t *inhdr; + const uint8_t *inbody; + int i = req->current_idx; + size_t expected_body_size = 0x39; + size_t body_size; + uint32_t in_ctl_code; + uint64_t in_file_id_persistent; + uint64_t in_file_id_volatile; + uint32_t in_input_offset; + uint32_t in_input_length; + DATA_BLOB in_input_buffer; + uint32_t in_max_output_length; + uint32_t in_flags; + struct tevent_req *subreq; + + inhdr = (const uint8_t *)req->in.vector[i+0].iov_base; + if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + inbody = (const uint8_t *)req->in.vector[i+1].iov_base; + + body_size = SVAL(inbody, 0x00); + if (body_size != expected_body_size) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + in_ctl_code = IVAL(inbody, 0x04); + in_file_id_persistent = BVAL(inbody, 0x08); + in_file_id_volatile = BVAL(inbody, 0x10); + in_input_offset = IVAL(inbody, 0x18); + in_input_length = IVAL(inbody, 0x1C); + in_max_output_length = IVAL(inbody, 0x2C); + in_flags = IVAL(inbody, 0x30); + + if (in_input_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + if (in_input_length > req->in.vector[i+2].iov_len) { + return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER); + } + + in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base; + in_input_buffer.length = in_input_length; + + if (in_file_id_persistent == UINT64_MAX && + in_file_id_volatile == UINT64_MAX) { + /* without a handle */ + } else if (in_file_id_persistent != 0) { + return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED); + } + + subreq = smbd_smb2_ioctl_send(req, + req->conn->smb2.event_ctx, + req, + in_ctl_code, + in_file_id_volatile, + in_input_buffer, + in_max_output_length, + in_flags); + if (subreq == NULL) { + return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); + } + tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req); + return NT_STATUS_OK; +} + +static void smbd_smb2_request_ioctl_done(struct tevent_req *subreq) +{ + struct smbd_smb2_request *req = tevent_req_callback_data(subreq, + struct smbd_smb2_request); + int i = req->current_idx; + uint8_t *outhdr; + DATA_BLOB outbody; + DATA_BLOB outdyn; + uint32_t out_output_offset; + DATA_BLOB out_output_buffer; + NTSTATUS status; + NTSTATUS error; /* transport error */ + + status = smbd_smb2_ioctl_recv(subreq, req, &out_output_buffer); + TALLOC_FREE(subreq); + if (!NT_STATUS_IS_OK(status)) { + error = smbd_smb2_request_error(req, status); + if (!NT_STATUS_IS_OK(error)) { + smbd_server_connection_terminate(req->conn, + nt_errstr(error)); + return; + } + return; + } + + out_output_offset = SMB2_HDR_BODY + 0x30; + + outhdr = (uint8_t *)req->out.vector[i].iov_base; + + outbody = data_blob_talloc(req->out.vector, NULL, 0x30); + if (outbody.data == NULL) { + error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY); + if (!NT_STATUS_IS_OK(error)) { + smbd_server_connection_terminate(req->conn, + nt_errstr(error)); + return; + } + return; + } + + SSVAL(outbody.data, 0x00, 0x30 + 1); /* struct size */ + SSVAL(outbody.data, 0x02, 0); /* reserved */ + SIVAL(outbody.data, 0x04, 0); /* ctl code */ + SBVAL(outbody.data, 0x08, 0); /* file id (persistent) */ + SBVAL(outbody.data, 0x10, 0); /* file id (volatile) */ + SIVAL(outbody.data, 0x18, 0); /* input offset */ + SIVAL(outbody.data, 0x1C, 0); /* input count */ + SIVAL(outbody.data, 0x20, + out_output_offset); /* output offset */ + SIVAL(outbody.data, 0x24, + out_output_buffer.length); /* output count */ + SIVAL(outbody.data, 0x28, 0); /* flags */ + SIVAL(outbody.data, 0x2C, 0); /* reserved */ + + /* + * Note: Windows sends back also the input from the request. + * I think this is stupid and I hope not required. + * For now we avoid a talloc + memcopy here... + */ + outdyn = out_output_buffer; + + error = smbd_smb2_request_done(req, outbody, &outdyn); + if (!NT_STATUS_IS_OK(error)) { + smbd_server_connection_terminate(req->conn, + nt_errstr(error)); + return; + } +} + +struct smbd_smb2_ioctl_state { + struct smbd_smb2_request *smb2req; + struct smb_request *smbreq; + files_struct *fsp; + DATA_BLOB in_input; + uint32_t in_max_output; + DATA_BLOB out_output; +}; + +static struct tevent_req *smbd_smb2_ioctl_send(TALLOC_CTX *mem_ctx, + struct tevent_context *ev, + struct smbd_smb2_request *smb2req, + uint32_t in_ctl_code, + uint64_t in_file_id_volatile, + DATA_BLOB in_input, + uint32_t in_max_output, + uint32_t in_flags) +{ + struct tevent_req *req; + struct smbd_smb2_ioctl_state *state; + struct smb_request *smbreq; + files_struct *fsp = NULL; + struct tevent_req *subreq; + + req = tevent_req_create(mem_ctx, &state, + struct smbd_smb2_ioctl_state); + if (req == NULL) { + return NULL; + } + state->smb2req = smb2req; + state->smbreq = NULL; + state->fsp = NULL; + state->in_input = in_input; + state->in_max_output = in_max_output; + state->out_output = data_blob_null; + + DEBUG(10,("smbd_smb2_ioctl: file_id[0x%016llX]\n", + (unsigned long long)in_file_id_volatile)); + + smbreq = smbd_smb2_fake_smb_request(smb2req); + if (tevent_req_nomem(smbreq, req)) { + return tevent_req_post(req, ev); + } + state->smbreq = smbreq; + + if (in_file_id_volatile != UINT64_MAX) { + fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile); + if (fsp == NULL) { + tevent_req_nterror(req, NT_STATUS_FILE_CLOSED); + return tevent_req_post(req, ev); + } + if (smbreq->conn != fsp->conn) { + tevent_req_nterror(req, NT_STATUS_FILE_CLOSED); + return tevent_req_post(req, ev); + } + if (smb2req->session->vuid != fsp->vuid) { + tevent_req_nterror(req, NT_STATUS_FILE_CLOSED); + return tevent_req_post(req, ev); + } + state->fsp = fsp; + } + + switch (in_ctl_code) { + default: + if (IS_IPC(smbreq->conn)) { + tevent_req_nterror(req, NT_STATUS_FS_DRIVER_REQUIRED); + return tevent_req_post(req, ev); + } + tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST); + return tevent_req_post(req, ev); + } + + tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR); + return tevent_req_post(req, ev); +} + +static NTSTATUS smbd_smb2_ioctl_recv(struct tevent_req *req, + TALLOC_CTX *mem_ctx, + DATA_BLOB *out_output) +{ + NTSTATUS status; + struct smbd_smb2_ioctl_state *state = tevent_req_data(req, + struct smbd_smb2_ioctl_state); + + if (tevent_req_is_nterror(req, &status)) { + tevent_req_received(req); + return status; + } + + *out_output = state->out_output; + talloc_steal(mem_ctx, out_output->data); + + tevent_req_received(req); + return NT_STATUS_OK; +} diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c index e797bdd9ee..75138a85a0 100644 --- a/source3/smbd/smb2_server.c +++ b/source3/smbd/smb2_server.c @@ -431,7 +431,7 @@ static NTSTATUS smbd_smb2_request_dispatch(struct smbd_smb2_request *req) if (!NT_STATUS_IS_OK(status)) { return smbd_smb2_request_error(req, status); } - return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED); + return smbd_smb2_request_process_ioctl(req); case SMB2_OP_CANCEL: return smbd_smb2_request_error(req, NT_STATUS_NOT_IMPLEMENTED); -- cgit