NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
{
struct smbXsrv_connection *xconn = req->xconn;
NTSTATUS status;
const uint8_t *inbody;
uint32_t in_length;
uint64_t in_offset;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
struct files_struct *in_fsp;
uint32_t in_minimum_count;
uint32_t in_remaining_bytes;
struct tevent_req *subreq;
status = smbd_smb2_request_verify_sizes(req, 0x31);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
inbody = SMBD_SMB2_IN_BODY_PTR(req);
in_length = IVAL(inbody, 0x04);
in_offset = BVAL(inbody, 0x08);
in_file_id_persistent = BVAL(inbody, 0x10);
in_file_id_volatile = BVAL(inbody, 0x18);
in_minimum_count = IVAL(inbody, 0x20);
in_remaining_bytes = IVAL(inbody, 0x28);
/* check the max read size */
if (in_length > xconn->smb2.server.max_read) {
DEBUG(2,("smbd_smb2_request_process_read: "
"client ignored max read: %s: 0x%08X: 0x%08X\n",
__location__, in_length, xconn->smb2.server.max_read));
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
status = smbd_smb2_request_verify_creditcharge(req, in_length);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
subreq = smbd_smb2_read_send(req, req->sconn->ev_ctx,
req, in_fsp,
in_length,
in_offset,
in_minimum_count,
in_remaining_bytes);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
return smbd_smb2_request_pending_queue(req, subreq, 500);
}
NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
{
struct smbXsrv_connection *xconn = req->xconn;
NTSTATUS status;
const uint8_t *inbody;
uint16_t in_flags;
uint32_t in_output_buffer_length;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
struct files_struct *in_fsp;
uint64_t in_completion_filter;
struct tevent_req *subreq;
status = smbd_smb2_request_verify_sizes(req, 0x20);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
inbody = SMBD_SMB2_IN_BODY_PTR(req);
in_flags = SVAL(inbody, 0x02);
in_output_buffer_length = IVAL(inbody, 0x04);
in_file_id_persistent = BVAL(inbody, 0x08);
in_file_id_volatile = BVAL(inbody, 0x10);
in_completion_filter = IVAL(inbody, 0x18);
/*
* 0x00010000 is what Windows 7 uses,
* Windows 2008 uses 0x00080000
*/
if (in_output_buffer_length > xconn->smb2.server.max_trans) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
status = smbd_smb2_request_verify_creditcharge(req,
in_output_buffer_length);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
subreq = smbd_smb2_notify_send(req, req->sconn->ev_ctx,
req, in_fsp,
in_flags,
in_output_buffer_length,
in_completion_filter);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
tevent_req_set_callback(subreq, smbd_smb2_request_notify_done, req);
return smbd_smb2_request_pending_queue(req, subreq, 500);
}
NTSTATUS smbd_smb2_request_process_write(struct smbd_smb2_request *req)
{
struct smbXsrv_connection *xconn = req->xconn;
NTSTATUS status;
const uint8_t *inbody;
uint16_t in_data_offset;
uint32_t in_data_length;
DATA_BLOB in_data_buffer;
uint64_t in_offset;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
struct files_struct *in_fsp;
uint32_t in_flags;
size_t in_dyn_len = 0;
uint8_t *in_dyn_ptr = NULL;
struct tevent_req *subreq;
status = smbd_smb2_request_verify_sizes(req, 0x31);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
inbody = SMBD_SMB2_IN_BODY_PTR(req);
in_data_offset = SVAL(inbody, 0x02);
in_data_length = IVAL(inbody, 0x04);
in_offset = BVAL(inbody, 0x08);
in_file_id_persistent = BVAL(inbody, 0x10);
in_file_id_volatile = BVAL(inbody, 0x18);
in_flags = IVAL(inbody, 0x2C);
if (in_data_offset != (SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req))) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
if (req->smb1req != NULL && req->smb1req->unread_bytes > 0) {
in_dyn_ptr = NULL;
in_dyn_len = req->smb1req->unread_bytes;
} else {
in_dyn_ptr = SMBD_SMB2_IN_DYN_PTR(req);
in_dyn_len = SMBD_SMB2_IN_DYN_LEN(req);
}
if (in_data_length > in_dyn_len) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
/* check the max write size */
if (in_data_length > xconn->smb2.server.max_write) {
DEBUG(2,("smbd_smb2_request_process_write : "
"client ignored max write :%s: 0x%08X: 0x%08X\n",
__location__, in_data_length, xconn->smb2.server.max_write));
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
/*
* Note: that in_dyn_ptr is NULL for the recvfile case.
*/
in_data_buffer.data = in_dyn_ptr;
in_data_buffer.length = in_data_length;
status = smbd_smb2_request_verify_creditcharge(req, in_data_length);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
subreq = smbd_smb2_write_send(req, req->sconn->ev_ctx,
req, in_fsp,
in_data_buffer,
in_offset,
in_flags);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
tevent_req_set_callback(subreq, smbd_smb2_request_write_done, req);
return smbd_smb2_request_pending_queue(req, subreq, 500);
}
NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req)
{
NTSTATUS status;
const uint8_t *inbody;
uint8_t in_info_type;
uint8_t in_file_info_class;
uint32_t in_output_buffer_length;
uint16_t in_input_buffer_offset;
uint32_t in_input_buffer_length;
DATA_BLOB in_input_buffer;
uint32_t in_additional_information;
uint32_t in_flags;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
struct files_struct *in_fsp;
struct tevent_req *subreq;
status = smbd_smb2_request_verify_sizes(req, 0x29);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
inbody = SMBD_SMB2_IN_BODY_PTR(req);
in_info_type = CVAL(inbody, 0x02);
in_file_info_class = CVAL(inbody, 0x03);
in_output_buffer_length = IVAL(inbody, 0x04);
in_input_buffer_offset = SVAL(inbody, 0x08);
/* 0x0A 2 bytes reserved */
in_input_buffer_length = IVAL(inbody, 0x0C);
in_additional_information = IVAL(inbody, 0x10);
in_flags = IVAL(inbody, 0x14);
in_file_id_persistent = BVAL(inbody, 0x18);
in_file_id_volatile = BVAL(inbody, 0x20);
if (in_input_buffer_offset == 0 && in_input_buffer_length == 0) {
/* This is ok */
} else if (in_input_buffer_offset !=
(SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req))) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
if (in_input_buffer_length > SMBD_SMB2_IN_DYN_LEN(req)) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
in_input_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
in_input_buffer.length = in_input_buffer_length;
if (in_input_buffer.length > req->sconn->smb2.max_trans) {
DEBUG(2,("smbd_smb2_request_process_getinfo: "
"client ignored max trans: %s: 0x%08X: 0x%08X\n",
__location__, (unsigned)in_input_buffer.length,
(unsigned)req->sconn->smb2.max_trans));
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
if (in_output_buffer_length > req->sconn->smb2.max_trans) {
DEBUG(2,("smbd_smb2_request_process_getinfo: "
"client ignored max trans: %s: 0x%08X: 0x%08X\n",
__location__, in_output_buffer_length,
req->sconn->smb2.max_trans));
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
status = smbd_smb2_request_verify_creditcharge(req,
MAX(in_input_buffer.length,in_output_buffer_length));
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
subreq = smbd_smb2_getinfo_send(req, req->sconn->ev_ctx,
req, in_fsp,
in_info_type,
in_file_info_class,
in_output_buffer_length,
in_input_buffer,
in_additional_information,
in_flags);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
tevent_req_set_callback(subreq, smbd_smb2_request_getinfo_done, req);
return smbd_smb2_request_pending_queue(req, subreq, 500);
}
NTSTATUS smbd_smb2_request_process_ioctl(struct smbd_smb2_request *req)
{
NTSTATUS status;
const uint8_t *inbody;
uint32_t min_buffer_offset;
uint32_t max_buffer_offset;
uint32_t min_output_offset;
uint32_t allowed_length_in;
uint32_t allowed_length_out;
uint32_t in_ctl_code;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
struct files_struct *in_fsp = NULL;
uint32_t in_input_offset;
uint32_t in_input_length;
DATA_BLOB in_input_buffer = data_blob_null;
uint32_t in_max_input_length;
uint32_t in_output_offset;
uint32_t in_output_length;
DATA_BLOB in_output_buffer = data_blob_null;
uint32_t in_max_output_length;
uint32_t in_flags;
uint32_t data_length_in;
uint32_t data_length_out;
uint32_t data_length_tmp;
uint32_t data_length_max;
struct tevent_req *subreq;
status = smbd_smb2_request_verify_sizes(req, 0x39);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
inbody = SMBD_SMB2_IN_BODY_PTR(req);
in_ctl_code = IVAL(inbody, 0x04);
in_file_id_persistent = BVAL(inbody, 0x08);
in_file_id_volatile = BVAL(inbody, 0x10);
in_input_offset = IVAL(inbody, 0x18);
in_input_length = IVAL(inbody, 0x1C);
in_max_input_length = IVAL(inbody, 0x20);
in_output_offset = IVAL(inbody, 0x24);
in_output_length = IVAL(inbody, 0x28);
in_max_output_length = IVAL(inbody, 0x2C);
in_flags = IVAL(inbody, 0x30);
min_buffer_offset = SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req);
max_buffer_offset = min_buffer_offset + SMBD_SMB2_IN_DYN_LEN(req);
min_output_offset = min_buffer_offset;
/*
* InputOffset (4 bytes): The offset, in bytes, from the beginning of
* the SMB2 header to the input data buffer. If no input data is
* required for the FSCTL/IOCTL command being issued, the client SHOULD
* set this value to 0.<49>
* <49> If no input data is required for the FSCTL/IOCTL command being
* issued, Windows-based clients set this field to any value.
*/
allowed_length_in = 0;
if ((in_input_offset > 0) && (in_input_length > 0)) {
uint32_t tmp_ofs;
if (in_input_offset < min_buffer_offset) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
if (in_input_offset > max_buffer_offset) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
allowed_length_in = max_buffer_offset - in_input_offset;
tmp_ofs = in_input_offset - min_buffer_offset;
in_input_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
in_input_buffer.data += tmp_ofs;
in_input_buffer.length = in_input_length;
min_output_offset += tmp_ofs;
min_output_offset += in_input_length;
}
if (in_input_length > allowed_length_in) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
allowed_length_out = 0;
if (in_output_offset > 0) {
if (in_output_offset < min_buffer_offset) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
if (in_output_offset > max_buffer_offset) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
allowed_length_out = max_buffer_offset - in_output_offset;
}
if (in_output_length > allowed_length_out) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
if (in_output_length > 0) {
uint32_t tmp_ofs;
if (in_output_offset < min_output_offset) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
tmp_ofs = in_output_offset - min_buffer_offset;
in_output_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
in_output_buffer.data += tmp_ofs;
in_output_buffer.length = in_output_length;
}
/*
* verify the credits and avoid overflows
* in_input_buffer.length and in_output_buffer.length
* are already verified.
*/
data_length_in = in_input_buffer.length + in_output_buffer.length;
data_length_out = in_max_input_length;
data_length_tmp = UINT32_MAX - data_length_out;
if (data_length_tmp < in_max_output_length) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
data_length_out += in_max_output_length;
data_length_max = MAX(data_length_in, data_length_out);
status = smbd_smb2_request_verify_creditcharge(req, data_length_max);
if (!NT_STATUS_IS_OK(status)) {
return smbd_smb2_request_error(req, status);
}
/*
* If the Flags field of the request is not SMB2_0_IOCTL_IS_FSCTL the
* server MUST fail the request with STATUS_NOT_SUPPORTED.
*/
if (in_flags != SMB2_IOCTL_FLAG_IS_FSCTL) {
return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
}
switch (in_ctl_code) {
case FSCTL_DFS_GET_REFERRALS:
case FSCTL_DFS_GET_REFERRALS_EX:
case FSCTL_PIPE_WAIT:
case FSCTL_VALIDATE_NEGOTIATE_INFO_224:
case FSCTL_VALIDATE_NEGOTIATE_INFO:
case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
/*
* Some SMB2 specific CtlCodes like FSCTL_DFS_GET_REFERRALS or
* FSCTL_PIPE_WAIT does not take a file handle.
*
* If FileId in the SMB2 Header of the request is not
* 0xFFFFFFFFFFFFFFFF, then the server MUST fail the request
* with STATUS_INVALID_PARAMETER.
*/
if (in_file_id_persistent != UINT64_MAX ||
in_file_id_volatile != UINT64_MAX) {
return smbd_smb2_request_error(req,
NT_STATUS_INVALID_PARAMETER);
}
break;
default:
in_fsp = file_fsp_smb2(req, in_file_id_persistent,
in_file_id_volatile);
if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
break;
}
subreq = smbd_smb2_ioctl_send(req, req->sconn->ev_ctx,
req, in_fsp,
in_ctl_code,
in_input_buffer,
in_max_output_length,
in_flags);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
tevent_req_set_callback(subreq, smbd_smb2_request_ioctl_done, req);
return smbd_smb2_request_pending_queue(req, subreq, 1000);
}