able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/fs/rdr2/rdbss/smb.mrx/fsctl.c

2317 lines
81 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
fsctl.c
Abstract:
This module implements the mini redirector call down routines pertaining to
file system control(FSCTL) and Io Device Control (IOCTL) operations on file
system objects.
Author:
Balan Sethu Raman [SethuR] 7-March-1995
Revision History:
Joe Linn [JoeLi] -- Implemented FSCTL's
--*/
#include "precomp.h"
#pragma hdrstop
#include <dfsfsctl.h>
#include <ntddrdr.h>
#include <wincred.h>
#include <secpkg.h>
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, MRxSmbFsCtl)
#pragma alloc_text(PAGE, MRxSmbNotifyChangeDirectory)
#pragma alloc_text(PAGE, MRxSmbNamedPipeFsControl)
#pragma alloc_text(PAGE, MRxSmbFsCtlUserTransact)
#pragma alloc_text(PAGE, MRxSmbMailSlotFsControl)
#pragma alloc_text(PAGE, MRxSmbFsControl)
#pragma alloc_text(PAGE, MRxSmbIoCtl)
#endif
//
// The local debug trace level
//
RXDT_DefineCategory(FSCTRL);
#define Dbg (DEBUG_TRACE_FSCTRL)
extern
NTSTATUS
MRxSmbNamedPipeFsControl(IN OUT PRX_CONTEXT RxContext);
extern
NTSTATUS
MRxSmbMailSlotFsControl(IN OUT PRX_CONTEXT RxContext);
extern
NTSTATUS
MRxSmbDfsFsControl(IN OUT PRX_CONTEXT RxContext);
extern
NTSTATUS
MRxSmbFsControl(IN OUT PRX_CONTEXT RxContext);
extern
NTSTATUS
MRxSmbFsCtlUserTransact(IN OUT PRX_CONTEXT RxContext);
NTSTATUS
MRxSmbGetPrintJobId(
IN OUT PRX_CONTEXT RxContext);
NTSTATUS
MRxSmbCoreIoCtl(
SMBPSE_ORDINARY_EXCHANGE_ARGUMENT_SIGNATURE);
NTSTATUS
MRxSmbQueryTargetInfo(
PRX_CONTEXT RxContext
);
NTSTATUS
MRxSmbFsCtl(
IN OUT PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine performs an FSCTL operation (remote) on a file across the network
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
The FSCTL's handled by a mini rdr can be classified into one of two categories.
In the first category are those FSCTL's whose implementation are shared between
RDBSS and the mini rdr's and in the second category are those FSCTL's which
are totally implemented by the mini rdr's. To this a third category can be
added, i.e., those FSCTL's which should never be seen by the mini rdr's. The
third category is solely intended as a debugging aid.
The FSCTL's handled by a mini rdr can be classified based on functionality
--*/
{
RxCaptureFobx;
RxCaptureFcb;
NTSTATUS Status = STATUS_SUCCESS;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbFsCtl...\n", 0));
RxDbgTrace( 0, Dbg, ("MRxSmbFsCtl = %08lx\n", FsControlCode));
if (capFobx != NULL) {
PMRX_V_NET_ROOT pVNetRoot;
// Avoid device opens for which the FOBX is the VNET_ROOT instance
pVNetRoot = (PMRX_V_NET_ROOT)capFobx;
if (NodeType(pVNetRoot) != RDBSS_NTC_V_NETROOT) {
PUNICODE_STRING AlreadyPrefixedName =
GET_ALREADY_PREFIXED_NAME(capFobx->pSrvOpen,capFcb);
ULONG FcbAlreadyPrefixedNameLength = AlreadyPrefixedName->Length;
ULONG NetRootInnerNamePrefixLength = capFcb->pNetRoot->InnerNamePrefix.Length;
PWCHAR pName = AlreadyPrefixedName->Buffer;
// If an FSCTL is being attempted against the root of a share.
// The AlreadyPrefixedName associated with the FCB is the same as
// the AlreadyPrefixedName length associated with the NET_ROOT instance
// or atmost one character greater than it ( appending a \) try and
// reestablish the connection before attempting the FSCTL.
// This solves thorny issues regarding deletion/creation of shares
// on the server sides, DFS referrals etc.
if ((FcbAlreadyPrefixedNameLength == NetRootInnerNamePrefixLength) ||
((FcbAlreadyPrefixedNameLength == NetRootInnerNamePrefixLength + sizeof(WCHAR)) &&
(*((PCHAR)pName + FcbAlreadyPrefixedNameLength - sizeof(WCHAR)) ==
L'\\'))) {
if (capFobx->pSrvOpen != NULL) {
Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot);
}
}
}
}
if (Status == STATUS_SUCCESS) {
switch (pLowIoContext->ParamsFor.FsCtl.MinorFunction) {
case IRP_MN_USER_FS_REQUEST:
case IRP_MN_TRACK_LINK :
switch (FsControlCode) {
case FSCTL_PIPE_ASSIGN_EVENT :
case FSCTL_PIPE_DISCONNECT :
case FSCTL_PIPE_LISTEN :
case FSCTL_PIPE_PEEK :
case FSCTL_PIPE_QUERY_EVENT :
case FSCTL_PIPE_TRANSCEIVE :
case FSCTL_PIPE_WAIT :
case FSCTL_PIPE_IMPERSONATE :
case FSCTL_PIPE_SET_CLIENT_PROCESS :
case FSCTL_PIPE_QUERY_CLIENT_PROCESS :
Status = MRxSmbNamedPipeFsControl(RxContext);
break;
case FSCTL_MAILSLOT_PEEK :
Status = MRxSmbMailSlotFsControl(RxContext);
break;
case FSCTL_DFS_GET_REFERRALS:
case FSCTL_DFS_REPORT_INCONSISTENCY:
Status = MRxSmbDfsFsControl(RxContext);
break;
case FSCTL_LMR_TRANSACT :
Status = MRxSmbFsCtlUserTransact(RxContext);
break;
case FSCTL_GET_PRINT_ID :
Status = MRxSmbGetPrintJobId(RxContext);
break;
case FSCTL_LMR_QUERY_TARGET_INFO:
Status = MRxSmbQueryTargetInfo(RxContext);
break;
case FSCTL_MOVE_FILE:
case FSCTL_MARK_HANDLE:
case FSCTL_QUERY_RETRIEVAL_POINTERS:
case FSCTL_GET_VOLUME_BITMAP:
case FSCTL_GET_NTFS_FILE_RECORD:
Status = STATUS_NOT_SUPPORTED;
break;
case FSCTL_SET_REPARSE_POINT:
{
ULONG InputBufferLength = 0; // invalid value as we need an input buffer
PREPARSE_DATA_BUFFER prdBuff = (&RxContext->LowIoContext)->ParamsFor.FsCtl.pInputBuffer;
PMRX_SMB_FCB smbFcb = MRxSmbGetFcbExtension(capFcb);
InputBufferLength = (&RxContext->LowIoContext)->ParamsFor.FsCtl.InputBufferLength;
if ((prdBuff == NULL)||
(InputBufferLength < REPARSE_DATA_BUFFER_HEADER_SIZE)||
(InputBufferLength > MAXIMUM_REPARSE_DATA_BUFFER_SIZE))
{
Status = STATUS_IO_REPARSE_DATA_INVALID;
break;
}
//
// Verify that the user buffer and the data length in its header are
// internally consistent. We need to have a REPARSE_DATA_BUFFER or a
// REPARSE_GUID_DATA_BUFFER.
//
if((InputBufferLength != (ULONG)(REPARSE_DATA_BUFFER_HEADER_SIZE + prdBuff->ReparseDataLength))
&&
(InputBufferLength != (ULONG)(REPARSE_GUID_DATA_BUFFER_HEADER_SIZE + prdBuff->ReparseDataLength)))
{
Status = STATUS_IO_REPARSE_DATA_INVALID;
break;
}
}
case FSCTL_GET_REPARSE_POINT:
// absence of break intentional
case FSCTL_MARK_AS_SYSTEM_HIVE :
//
// On a remote boot machine, we need to no-op the MARK_AS_SYSTEM_HIVE
// FSCTL. Local filesystems use this to prevent a volume from being
// dismounted.
//
if (MRxSmbBootedRemotely) {
break;
}
default:
Status = MRxSmbFsControl(RxContext);
break;
}
break;
default :
Status = STATUS_INVALID_DEVICE_REQUEST;
break;
}
}
RxDbgTrace(-1, Dbg, ("MRxSmbFsCtl -> %08lx\n", Status ));
return Status;
}
typedef struct _SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT_ {
LONG ReferenceCount;
PRX_CONTEXT pRxContext;
REQ_NOTIFY_CHANGE NotifyRequest;
SMB_TRANSACTION_OPTIONS Options;
SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext;
} SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT, *PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT;
NTSTATUS
MRxSmbNotifyChangeDirectorySynchronousCompletion(
PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext)
/*++
Routine Description:
This routine is invoked when a directory change notification operation is
completed
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
This routine will always be called. This is true even if the change directory
notification is cancelled. In such cases the memory allocated is freed without
any interaction with the wrapper. In cases of successful directory change
notification completion the appropriate completion routine is invoked and the
RxContext modified to prevent any cancellation from proceeding further.
--*/
{
NTSTATUS Status = STATUS_PENDING;
PMRXSMB_RX_CONTEXT pMRxSmbContext;
PRX_CONTEXT pRxContext;
PSMB_EXCHANGE pExchange = NULL;
BOOLEAN FinalizeNotificationContext = FALSE;
SmbCeAcquireSpinLock();
FinalizeNotificationContext =
(InterlockedDecrement(&pNotificationContext->ReferenceCount) == 0);
if (FinalizeNotificationContext) {
pRxContext = pNotificationContext->pRxContext;
pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext);
pExchange = pMRxSmbContext->pExchange;
Status = pRxContext->StoredStatus;
}
SmbCeReleaseSpinLock();
// Free the associated exchange.
if (FinalizeNotificationContext) {
if (pExchange != NULL) {
SmbCeDereferenceAndDiscardExchange(pExchange);
}
// Free the notification context.
RxFreePool(pNotificationContext);
ASSERT(Status != STATUS_PENDING);
}
return Status;
}
VOID
MRxSmbNotifyChangeDirectoryCompletion(
PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext)
/*++
Routine Description:
This routine is invoked when a directory change notification operation is
completed
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
This routine will always be called. This is true even if the change directory
notification is cancelled. In such cases the memory allocated is freed without
any inteaction with the wrapper. In cases of successful directory change
notification completion the appropriate completion routine is invoked and the
RxContext modified to prevent any cancellation from proceeding further.
--*/
{
NTSTATUS Status;
PMRXSMB_RX_CONTEXT pMRxSmbContext;
PRX_CONTEXT pRxContext;
PSMB_EXCHANGE pExchange = NULL;
BOOLEAN FinalizeNotificationContext = FALSE;
SmbCeAcquireSpinLock();
FinalizeNotificationContext =
(InterlockedDecrement(&pNotificationContext->ReferenceCount) == 0);
pRxContext = pNotificationContext->pRxContext;
if (pRxContext != NULL) {
PSMB_TRANSACT_EXCHANGE pTransactExchange;
pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext);
pExchange = pMRxSmbContext->pExchange;
if (pExchange != NULL) {
PSMBCEDB_SERVER_ENTRY pServerEntry;
pTransactExchange = (PSMB_TRANSACT_EXCHANGE)pExchange;
pServerEntry = SmbCeGetExchangeServerEntry(pExchange);
if ((pNotificationContext->ResumptionContext.FinalStatusFromServer ==
STATUS_NOT_SUPPORTED) ||
(pNotificationContext->ResumptionContext.FinalStatusFromServer ==
STATUS_NOT_IMPLEMENTED)) {
pServerEntry->Server.ChangeNotifyNotSupported = TRUE;
}
pRxContext->InformationToReturn = pTransactExchange->ParamBytesReceived;
} else {
pRxContext->InformationToReturn = 0;
}
pRxContext->StoredStatus =
pNotificationContext->ResumptionContext.FinalStatusFromServer;
if( (pRxContext->InformationToReturn == 0) &&
(pRxContext->StoredStatus == STATUS_SUCCESS) )
{
pRxContext->StoredStatus = STATUS_NOTIFY_ENUM_DIR;
}
}
SmbCeReleaseSpinLock();
if (FinalizeNotificationContext) {
if (pRxContext != NULL) {
RxLowIoCompletion(pRxContext);
}
// Free the associated exchange.
if (pExchange != NULL) {
SmbCeDereferenceAndDiscardExchange(pExchange);
}
// Free the notification context.
RxFreePool(pNotificationContext);
}
}
NTSTATUS
MRxSmbNotifyChangeDirectory(
IN OUT PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine performs a directory change notification operation
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
A directory change notification opertaion is an asychronous operation. It
consists of sending a SMB requesting change notification whose response is
obtained when the desired change is affected on the server.
Some important points to remember are as follows .....
1) The SMB response is not obtained till the desired change is affected on
the server. Therefore an additional MID needs to be reserved on those
connections which permit multiple MID's so that a cancel SMB can be sent to
the server when a change notification is active.
2) The Change notification is typical of a long term ( response time
dictated by factors beyond the servers control). Another example is
the query FSCTL operation in CAIRO. For all these operations we initiate
an asychronous transact exchange.
3) The corresponding LowIo completion routine is invoked asynchronously.
4) This is an example of an operation for which the MINI RDR has to
register a context for handling cancellations initiated locally.
--*/
{
NTSTATUS Status;
RxCaptureFcb;
RxCaptureFobx;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
PSMBCEDB_SERVER_ENTRY pServerEntry;
PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext;
PBYTE pInputParamBuffer = NULL;
PBYTE pOutputParamBuffer = NULL;
PBYTE pInputDataBuffer = NULL;
PBYTE pOutputDataBuffer = NULL;
ULONG InputParamBufferLength = 0;
ULONG OutputParamBufferLength = 0;
ULONG InputDataBufferLength = 0;
ULONG OutputDataBufferLength = 0;
RxDbgTrace(+1, Dbg, ("MRxNotifyChangeDirectory...Entry\n", 0));
pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall);
// if the server entry is in disconnected state, then let CSC do change notify
// If successful, the CSC routine should return a STATUS_PENDING and
// modify the rxcontext in way that is suitable to the underlying implementation
// In the current incarnation, the CSC routine will
// a) remove the irp from the rxconetxt and b) dereference the rxcontext
if (MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)||
SmbCeIsServerInDisconnectedMode(pServerEntry)) {
return MRxSmbCscNotifyChangeDirectory(RxContext);
}
else if (!FlagOn(pServerEntry->Server.DialectFlags,DF_NT_SMBS) ||
pServerEntry->Server.ChangeNotifyNotSupported) {
return STATUS_NOT_SUPPORTED;
}
#if defined(REMOTE_BOOT)
//
// Reject change notify on the remote boot share. This is necessary to
// prevent overloading the server with long-term requests. (There are
// LOTS of change notifies posted on the boot device!)
//
if (MRxSmbBootedRemotely) {
PSMBCE_SESSION pSession;
pSession = &SmbCeGetAssociatedVNetRootContext(capFobx->pSrvOpen->pVNetRoot)->pSessionEntry->Session;
if (FlagOn(pSession->Flags,SMBCE_SESSION_FLAGS_REMOTE_BOOT_SESSION)) {
return STATUS_NOT_SUPPORTED;
}
}
#endif
pNotificationContext =
(PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT)
RxAllocatePoolWithTag(
NonPagedPool,
sizeof(SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT),
MRXSMB_FSCTL_POOLTAG);
if (pNotificationContext != NULL) {
PREQ_NOTIFY_CHANGE pNotifyRequest;
PSMB_TRANSACTION_OPTIONS pTransactionOptions;
PSMB_TRANSACTION_RESUMPTION_CONTEXT pResumptionContext;
PMRX_SMB_SRV_OPEN pSmbSrvOpen;
BOOLEAN FcbAcquired = FALSE;
RxCaptureFobx;
ASSERT (capFobx != NULL);
if (!RxIsFcbAcquiredExclusive(capFcb)) {
// ASSERT(!RxIsFcbAcquiredShared(capFcb));
Status = RxAcquireExclusiveFcbResourceInMRx( capFcb );
FcbAcquired = (Status == STATUS_SUCCESS);
}
if (FcbAcquired) {
if (FlagOn(capFobx->pSrvOpen->Flags,SRVOPEN_FLAG_CLOSED) ||
FlagOn(capFobx->pSrvOpen->Flags,SRVOPEN_FLAG_ORPHANED)) {
Status = STATUS_FILE_CLOSED;
} else {
Status = MRxSmbDeferredCreate(RxContext);
}
RxReleaseFcbResourceInMRx( capFcb );
}
if (Status==STATUS_SUCCESS) {
pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen);
pNotificationContext->pRxContext = RxContext;
// The reference count is set to 2. one for the async completion routine
// and one for the tail completion routine
pNotificationContext->ReferenceCount = 2;
pNotifyRequest = &(pNotificationContext->NotifyRequest);
pTransactionOptions = &(pNotificationContext->Options);
pResumptionContext = &(pNotificationContext->ResumptionContext);
pNotifyRequest->CompletionFilter = pLowIoContext->ParamsFor.NotifyChangeDirectory.CompletionFilter;
pNotifyRequest->Fid = pSmbSrvOpen->Fid;
pNotifyRequest->WatchTree = pLowIoContext->ParamsFor.NotifyChangeDirectory.WatchTree;
pNotifyRequest->Reserved = 0;
OutputParamBufferLength = pLowIoContext->ParamsFor.NotifyChangeDirectory.NotificationBufferLength;
pOutputParamBuffer = pLowIoContext->ParamsFor.NotifyChangeDirectory.pNotificationBuffer;
*pTransactionOptions = RxDefaultTransactionOptions;
pTransactionOptions->NtTransactFunction = NT_TRANSACT_NOTIFY_CHANGE;
pTransactionOptions->TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED;
pTransactionOptions->Flags = SMB_XACT_FLAGS_INDEFINITE_DELAY_IN_RESPONSE;
SmbCeInitializeAsynchronousTransactionResumptionContext(
pResumptionContext,
MRxSmbNotifyChangeDirectoryCompletion,
pNotificationContext);
Status = SmbCeAsynchronousTransact(
RxContext, // the RXContext for the transaction
pTransactionOptions, // transaction options
pNotifyRequest, // the setup buffer
sizeof(REQ_NOTIFY_CHANGE), // setup buffer length
NULL,
0,
pInputParamBuffer, // Input Param Buffer
InputParamBufferLength, // Input param buffer length
pOutputParamBuffer, // Output param buffer
OutputParamBufferLength, // output param buffer length
pInputDataBuffer, // Input data buffer
InputDataBufferLength, // Input data buffer length
pOutputDataBuffer, // output data buffer
OutputDataBufferLength, // output data buffer length
pResumptionContext // the resumption context
);
ASSERT(Status == STATUS_PENDING);
Status = MRxSmbNotifyChangeDirectorySynchronousCompletion(
pNotificationContext);
} else {
NOTHING; //just return the status from the deferred open call
}
} else {
Status = STATUS_INSUFFICIENT_RESOURCES;
}
if (MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)||
SmbCeIsServerInDisconnectedMode(pServerEntry)) {
return MRxSmbCscNotifyChangeDirectory(RxContext);
}
RxDbgTrace(-1, Dbg, ("MRxSmbNotifyChangeDirectory -> %08lx\n", Status ));
return Status;
}
UNICODE_STRING s_NamedPipeTransactionName = { 12,12,L"\\PIPE\\" };
UNICODE_STRING s_MailSlotTransactionName = {20,20,L"\\MAILSLOT\\" };
typedef struct _SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT_ {
LONG ReferenceCount;
PRX_CONTEXT pRxContext;
PWCHAR pTransactionNameBuffer;
SMB_TRANSACTION_OPTIONS Options;
SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext;
} SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT,
*PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT;
VOID
MRxSmbNamedPipeFsControlCompletion(
PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT pFsCtlCompletionContext)
{
PRX_CONTEXT pRxContext = NULL;
PSMB_EXCHANGE pExchange = NULL;
BOOLEAN FinalizeFsCtlCompletionContext = FALSE;
SmbCeAcquireSpinLock();
FinalizeFsCtlCompletionContext =
(InterlockedDecrement(&pFsCtlCompletionContext->ReferenceCount) == 0);
if (FinalizeFsCtlCompletionContext) {
pRxContext = pFsCtlCompletionContext->pRxContext;
if (pRxContext != NULL) {
PMRXSMB_RX_CONTEXT pMRxSmbContext;
pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext);
pExchange = pMRxSmbContext->pExchange;
}
}
SmbCeReleaseSpinLock();
if (FinalizeFsCtlCompletionContext) {
if (pRxContext != NULL) {
pRxContext->StoredStatus =
pFsCtlCompletionContext->ResumptionContext.FinalStatusFromServer;
if (pRxContext->StoredStatus == STATUS_INVALID_HANDLE) {
pRxContext->StoredStatus = STATUS_INVALID_NETWORK_RESPONSE;
}
pRxContext->InformationToReturn =
pFsCtlCompletionContext->ResumptionContext.DataBytesReceived;
RxLowIoCompletion(pRxContext);
}
if (pExchange != NULL) {
SmbCeDereferenceAndDiscardExchange(pExchange);
}
if (pFsCtlCompletionContext->pTransactionNameBuffer != NULL) {
RxFreePool(pFsCtlCompletionContext->pTransactionNameBuffer);
}
RxFreePool(pFsCtlCompletionContext);
}
}
NTSTATUS
MRxSmbNamedPipeFsControl(PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine handles all named pipe related FSCTL's
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
--*/
{
RxCaptureFobx;
RxCaptureFcb;
PMRX_SMB_SRV_OPEN pSmbSrvOpen;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode;
UNICODE_STRING TransactionName;
BOOLEAN ReestablishConnectionIfRequired = FALSE, fTransactioNameBufferAllocated = FALSE;
NTSTATUS Status;
USHORT Setup[2];
PBYTE pInputParamBuffer = NULL;
PBYTE pOutputParamBuffer = NULL;
PBYTE pInputDataBuffer = NULL;
PBYTE pOutputDataBuffer = NULL;
ULONG InputParamBufferLength = 0;
ULONG OutputParamBufferLength = 0;
ULONG InputDataBufferLength = 0;
ULONG OutputDataBufferLength = 0;
ULONG TimeoutIntervalInMilliSeconds;
RESP_PEEK_NMPIPE PeekResponse;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbNamedPipeFsControl...\n", 0));
TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED;
Status = STATUS_MORE_PROCESSING_REQUIRED;
if (NodeType(capFcb) != RDBSS_NTC_STORAGE_TYPE_FILE &&
NodeType(capFcb) != RDBSS_NTC_STORAGE_TYPE_UNKNOWN ||
capFcb->pNetRoot == NULL ||
capFcb->pNetRoot->Type != NET_ROOT_PIPE) {
return STATUS_INVALID_DEVICE_REQUEST;
}
if (capFobx != NULL) {
pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen);
} else {
pSmbSrvOpen = NULL;
}
// The following switch statement serves the dual purpose of validating the parameters
// presented by the user as well as filling in the appropriate information if it is
// available locally.
// Currently there is no local caching strategy in place and consequently a network trip
// is always undertaken.
TransactionName = s_NamedPipeTransactionName;
switch (FsControlCode) {
case FSCTL_PIPE_PEEK :
{
Setup[0] = TRANS_PEEK_NMPIPE;
Setup[1] = pSmbSrvOpen->Fid;
pOutputParamBuffer = (PBYTE)&PeekResponse;
OutputParamBufferLength = sizeof(PeekResponse);
pOutputDataBuffer = (PBYTE)pLowIoContext->ParamsFor.FsCtl.pOutputBuffer +
FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER,Data[0]);
OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength -
FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER,Data[0]);
}
break;
case FSCTL_PIPE_TRANSCEIVE :
{
Setup[0] = TRANS_TRANSACT_NMPIPE;
Setup[1] = pSmbSrvOpen->Fid;
pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
// CODE.IMPROVEMENT -- Currently the semantics of attempting a TRANSCEIVE
// with zero bytes to be written is not very well defined. The Old Redirector
// succeeds without issuing a TRANSACT request. This needs to be resolved and
// till it is done the old semantics will be retained
//if (InputDataBufferLength == 0) {
// Status = STATUS_SUCCESS;
//}
}
break;
case FSCTL_PIPE_WAIT :
{
PFILE_PIPE_WAIT_FOR_BUFFER pWaitBuffer;
ULONG NameLength;
Setup[0] = TRANS_WAIT_NMPIPE;
Setup[1] = 0;
if ((pLowIoContext->ParamsFor.FsCtl.pInputBuffer == NULL) ||
(pLowIoContext->ParamsFor.FsCtl.InputBufferLength <
sizeof(FILE_PIPE_WAIT_FOR_BUFFER))) {
Status = STATUS_INVALID_PARAMETER;
} else {
// Set up the transaction name to reflect the name of the pipe
// on which the wait operation is being performed.
pWaitBuffer = (PFILE_PIPE_WAIT_FOR_BUFFER)pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
if (pWaitBuffer->NameLength + s_NamedPipeTransactionName.Length > MAXUSHORT ||
pWaitBuffer->NameLength - sizeof(WCHAR) >
pLowIoContext->ParamsFor.FsCtl.InputBufferLength - sizeof(FILE_PIPE_WAIT_FOR_BUFFER)) {
// if the name is too long to be put on a UNICIDE string,
// or the name length doesn't match the buffer length
Status = STATUS_INVALID_PARAMETER;
}
}
if (Status == STATUS_MORE_PROCESSING_REQUIRED) {
// In the case of Wait FSCTL a reconnection attempt will be made
// if required
ReestablishConnectionIfRequired = TRUE;
TransactionName.Length = (USHORT)(s_NamedPipeTransactionName.Length +
pWaitBuffer->NameLength);
TransactionName.MaximumLength = TransactionName.Length;
TransactionName.Buffer = (PWCHAR)RxAllocatePool(PagedPool,TransactionName.Length);
if (TransactionName.Buffer != NULL) {
fTransactioNameBufferAllocated = TRUE;
RtlCopyMemory(TransactionName.Buffer,
s_NamedPipeTransactionName.Buffer,
s_NamedPipeTransactionName.Length);
RtlCopyMemory(
(PBYTE)TransactionName.Buffer + s_NamedPipeTransactionName.Length,
pWaitBuffer->Name,
pWaitBuffer->NameLength);
} else {
Status = STATUS_INSUFFICIENT_RESOURCES;
}
if (pWaitBuffer->TimeoutSpecified) {
LARGE_INTEGER TimeWorkspace;
LARGE_INTEGER WaitForever;
WaitForever.LowPart = 0;
WaitForever.HighPart =0x80000000;
// Avoid negate of "WaitForever" since this generates an integer
// overflow exception on some machines.
if (pWaitBuffer->Timeout.QuadPart != WaitForever.QuadPart) {
TimeWorkspace.QuadPart = -pWaitBuffer->Timeout.QuadPart / 10000;
if ( TimeWorkspace.HighPart) {
// Tried to specify a larger timeout than we can select.
// set it to the Maximum we can request
TimeoutIntervalInMilliSeconds = 0xfffffffe;
} else {
TimeoutIntervalInMilliSeconds = TimeWorkspace.LowPart;
}
}
} else {
TimeoutIntervalInMilliSeconds = 0;
}
}
}
break;
case FSCTL_PIPE_ASSIGN_EVENT :
case FSCTL_PIPE_QUERY_EVENT :
case FSCTL_PIPE_IMPERSONATE :
case FSCTL_PIPE_SET_CLIENT_PROCESS :
case FSCTL_PIPE_QUERY_CLIENT_PROCESS :
// These FSCTL's have not been implemented so far in NT. They will be implemented
// in a future release.
Status = STATUS_INVALID_PARAMETER;
RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Unimplemented FS control code\n"));
break;
case FSCTL_PIPE_DISCONNECT :
case FSCTL_PIPE_LISTEN :
Status = STATUS_INVALID_PARAMETER;
RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Invalid FS control code for redirector\n"));
break;
default:
RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Invalid FS control code\n"));
Status = STATUS_INVALID_PARAMETER;
break;
}
if (Status == STATUS_MORE_PROCESSING_REQUIRED) {
if (ReestablishConnectionIfRequired) {
if (capFobx != NULL) {
Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot);
} else {
Status = STATUS_SUCCESS;
}
} else {
Status = STATUS_SUCCESS;
}
if (Status == STATUS_SUCCESS) {
PSMB_TRANSACTION_OPTIONS pTransactionOptions;
PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT pFsCtlCompletionContext;
PSMB_TRANSACTION_RESUMPTION_CONTEXT pResumptionContext;
RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: TransactionName %ws Length %ld\n",
TransactionName.Buffer,TransactionName.Length));
pFsCtlCompletionContext =
(PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT)
RxAllocatePoolWithTag(
NonPagedPool,
sizeof(SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT),
MRXSMB_FSCTL_POOLTAG);
if (pFsCtlCompletionContext != NULL) {
pResumptionContext = &pFsCtlCompletionContext->ResumptionContext;
pTransactionOptions = &(pFsCtlCompletionContext->Options);
if (FsControlCode != FSCTL_PIPE_PEEK) {
// The reference count is set to 2. one for the async
// completion routine and one for the tail completion routine
pFsCtlCompletionContext->pRxContext = RxContext;
pFsCtlCompletionContext->ReferenceCount = 2;
SmbCeInitializeAsynchronousTransactionResumptionContext(
pResumptionContext,
MRxSmbNamedPipeFsControlCompletion,
pFsCtlCompletionContext);
} else {
// Currently PEEK operations are synchronous
pFsCtlCompletionContext->pRxContext = NULL;
pFsCtlCompletionContext->ReferenceCount = 1;
}
*pTransactionOptions = RxDefaultTransactionOptions;
pTransactionOptions->NtTransactFunction = 0; // TRANSACT2/TRANSACT.
pTransactionOptions->pTransactionName = &TransactionName;
pTransactionOptions->Flags = SMB_XACT_FLAGS_FID_NOT_NEEDED;
pTransactionOptions->TimeoutIntervalInMilliSeconds = TimeoutIntervalInMilliSeconds;
if (TransactionName.Buffer != s_NamedPipeTransactionName.Buffer) {
pFsCtlCompletionContext->pTransactionNameBuffer =
TransactionName.Buffer;
} else {
pFsCtlCompletionContext->pTransactionNameBuffer = NULL;
}
if (FsControlCode != FSCTL_PIPE_PEEK) {
Status = SmbCeAsynchronousTransact(
RxContext, // the RXContext for the transaction
pTransactionOptions, // transaction options
Setup, // the setup buffer
sizeof(Setup), // setup buffer length
NULL,
0,
pInputParamBuffer, // Input Param Buffer
InputParamBufferLength, // Input param buffer length
pOutputParamBuffer, // Output param buffer
OutputParamBufferLength, // output param buffer length
pInputDataBuffer, // Input data buffer
InputDataBufferLength, // Input data buffer length
pOutputDataBuffer, // output data buffer
OutputDataBufferLength, // output data buffer length
pResumptionContext // the resumption context
);
if (Status != STATUS_PENDING) {
pFsCtlCompletionContext->ResumptionContext.FinalStatusFromServer
= Status;
}
MRxSmbNamedPipeFsControlCompletion(pFsCtlCompletionContext);
Status = STATUS_PENDING;
} else {
Status = SmbCeTransact(
RxContext, // the RXContext for the transaction
pTransactionOptions, // transaction options
Setup, // the setup buffer
sizeof(Setup), // setup buffer length
NULL,
0,
pInputParamBuffer, // Input Param Buffer
InputParamBufferLength, // Input param buffer length
pOutputParamBuffer, // Output param buffer
OutputParamBufferLength, // output param buffer length
pInputDataBuffer, // Input data buffer
InputDataBufferLength, // Input data buffer length
pOutputDataBuffer, // output data buffer
OutputDataBufferLength, // output data buffer length
pResumptionContext // the resumption context
);
switch (FsControlCode) {
case FSCTL_PIPE_PEEK:
{
// In the case of FSCTL_PIPE_PEEK post processing is required to package the
// results and also handle the idiosyncracies of the different servers.
// e.g.,
// Os/2 servers will allow PeekNamedPipe on closed pipes to succeed
// even if the server side of the pipe is closed.
//
// If we get the status PIPE_STATE_CLOSING from the server, then
// we need to return an error of STATUS_PIPE_DISCONNECTED, as this
// is what NPFS will do.
if (NT_SUCCESS(Status) ||
(Status == RX_MAP_STATUS(BUFFER_OVERFLOW))) {
if (pResumptionContext->ParameterBytesReceived >= sizeof(RESP_PEEK_NMPIPE)) {
if ((SmbGetAlignedUshort(&PeekResponse.NamedPipeState) & PIPE_STATE_CLOSING) &&
(PeekResponse.ReadDataAvailable == 0)) {
Status = STATUS_PIPE_DISCONNECTED;
} else {
PFILE_PIPE_PEEK_BUFFER pPeekBuffer;
pPeekBuffer = (PFILE_PIPE_PEEK_BUFFER)pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
pPeekBuffer->NamedPipeState = (ULONG)SmbGetAlignedUshort(&PeekResponse.NamedPipeState);
pPeekBuffer->ReadDataAvailable = (ULONG)PeekResponse.ReadDataAvailable;
pPeekBuffer->NumberOfMessages = MAXULONG;
pPeekBuffer->MessageLength = (ULONG)PeekResponse.MessageLength;
if (PeekResponse.MessageLength > OutputDataBufferLength) {
Status = STATUS_BUFFER_OVERFLOW;
}
}
}
RxContext->InformationToReturn =
FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0]) +
pResumptionContext->DataBytesReceived;
}
}
break;
default:
RxContext->InformationToReturn =
pResumptionContext->DataBytesReceived;
break;
}
MRxSmbNamedPipeFsControlCompletion(pFsCtlCompletionContext);
}
} else {
if (fTransactioNameBufferAllocated)
{
RxFreePool(TransactionName.Buffer);
}
Status = STATUS_INSUFFICIENT_RESOURCES;
}
}
}
if (!NT_SUCCESS(Status)) {
if (Status == STATUS_INVALID_HANDLE) {
Status = STATUS_INVALID_NETWORK_RESPONSE;
}
RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl(%ld): Failed .. returning %lx\n",FsControlCode,Status));
}
RxDbgTrace(-1, Dbg, ("MRxSmbNamedPipeFsControl exit...st=%08lx\n", Status));
return Status;
}
#ifdef _WIN64
typedef struct _LMR_TRANSACTION_32 {
ULONG Type; // Type of structure
ULONG Size; // Size of fixed portion of structure
ULONG Version; // Structure version.
ULONG NameLength; // Number of bytes in name (in path
// format, e.g., \server\pipe\netapi\4)
ULONG NameOffset; // Offset of name in buffer.
BOOLEAN ResponseExpected; // Should remote system respond?
ULONG Timeout; // Timeout time in milliseconds.
ULONG SetupWords; // Number of trans setup words (may be
// 0). (setup words are input/output.)
ULONG SetupOffset; // Offset of setup (may be 0 for none).
ULONG MaxSetup; // Size of setup word array (may be 0).
ULONG ParmLength; // Input param area length (may be 0).
void * POINTER_32 ParmPtr; // Input parameter area (may be NULL).
ULONG MaxRetParmLength; // Output param. area length (may be 0).
ULONG DataLength; // Input data area length (may be 0).
void * POINTER_32 DataPtr; // Input data area (may be NULL).
ULONG MaxRetDataLength; // Output data area length (may be 0).
void * POINTER_32 RetDataPtr; // Output data area (may be NULL).
} LMR_TRANSACTION_32, *PLMR_TRANSACTION_32;
#endif
NTSTATUS
MRxSmbFsCtlUserTransact(PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine issues what is called a UserTransaction against the server that is serving the
connection for this file. very strange.............
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
--*/
{
RxCaptureFobx;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
UNICODE_STRING TransactionName;
LMR_TRANSACTION InputBuffer;
ULONG InputBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
ULONG SizeOfLmrTransaction = 0;
NTSTATUS Status;
PAGED_CODE();
if( pLowIoContext->ParamsFor.FsCtl.pInputBuffer == NULL )
{
return (Status = STATUS_INVALID_PARAMETER);
}
InputBuffer = *((PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer);
#ifdef _WIN64
if (IoIs32bitProcess(RxContext->CurrentIrp)) {
PLMR_TRANSACTION_32 InputBuffer32 = (PLMR_TRANSACTION_32)pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
InputBuffer.Type = InputBuffer32->Type;
InputBuffer.Size = InputBuffer32->Size;
InputBuffer.Version = InputBuffer32->Version;
InputBuffer.NameLength = InputBuffer32->NameLength;
InputBuffer.NameOffset = InputBuffer32->NameOffset;
InputBuffer.ResponseExpected = InputBuffer32->ResponseExpected;
InputBuffer.Timeout = InputBuffer32->Timeout;
InputBuffer.SetupWords = InputBuffer32->SetupWords;
InputBuffer.SetupOffset = InputBuffer32->SetupOffset;
InputBuffer.MaxSetup = InputBuffer32->MaxSetup;
InputBuffer.ParmLength = InputBuffer32->ParmLength;
InputBuffer.ParmPtr = (PVOID)InputBuffer32->ParmPtr;
InputBuffer.MaxRetParmLength = InputBuffer32->MaxRetParmLength;
InputBuffer.DataLength = InputBuffer32->DataLength;
InputBuffer.DataPtr = (PVOID)InputBuffer32->DataPtr;
InputBuffer.MaxRetDataLength = InputBuffer32->MaxRetDataLength;
InputBuffer.RetDataPtr = (PVOID)InputBuffer32->RetDataPtr;
SizeOfLmrTransaction = sizeof(LMR_TRANSACTION_32);
} else {
SizeOfLmrTransaction = sizeof(LMR_TRANSACTION);
}
#else
SizeOfLmrTransaction = sizeof(LMR_TRANSACTION);
#endif
RxDbgTrace(+1, Dbg, ("MRxSmbFsCtlUserTransact...\n"));
if (InputBufferLength < SizeOfLmrTransaction) {
return(Status = STATUS_INVALID_PARAMETER);
}
if (InputBufferLength - SizeOfLmrTransaction < InputBuffer.NameLength) {
return(Status = STATUS_BUFFER_TOO_SMALL);
}
if ((InputBuffer.Type != TRANSACTION_REQUEST) ||
(InputBuffer.Version != TRANSACTION_VERSION)) {
return(Status = STATUS_INVALID_PARAMETER);
}
if (InputBuffer.NameOffset + InputBuffer.NameLength > InputBufferLength) {
return(Status = STATUS_INVALID_PARAMETER);
}
if (InputBuffer.SetupOffset + InputBuffer.SetupWords > InputBufferLength) {
return(Status = STATUS_INVALID_PARAMETER);
}
if (capFobx != NULL) {
PMRX_V_NET_ROOT pVNetRoot = (PMRX_V_NET_ROOT)capFobx;
if (NodeType(pVNetRoot) == RDBSS_NTC_V_NETROOT) {
Status = SmbCeReconnect(pVNetRoot);
} else {
Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot);
}
if (Status != STATUS_SUCCESS) {
return Status;
}
}
Status = STATUS_MORE_PROCESSING_REQUIRED;
TransactionName.MaximumLength = (USHORT)InputBuffer.NameLength;
TransactionName.Length = (USHORT)InputBuffer.NameLength;
TransactionName.Buffer = (PWSTR)(((PUCHAR)pLowIoContext->ParamsFor.FsCtl.pInputBuffer)+InputBuffer.NameOffset);
if (Status == STATUS_MORE_PROCESSING_REQUIRED) {
SMB_TRANSACTION_SEND_PARAMETERS SendParameters;
SMB_TRANSACTION_RECEIVE_PARAMETERS ReceiveParameters;
SMB_TRANSACTION_OPTIONS TransactionOptions = RxDefaultTransactionOptions;
SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext;
PUCHAR SetupBuffer = NULL;
RxDbgTrace( 0, Dbg, ("MRxSmbFsCtlUserTransact: TransactionName %ws Length %ld\n",
TransactionName.Buffer,TransactionName.Length));
TransactionOptions.NtTransactFunction = 0; // TRANSACT2/TRANSACT.
TransactionOptions.pTransactionName = &TransactionName;
TransactionOptions.Flags = SMB_XACT_FLAGS_FID_NOT_NEEDED;
if (!InputBuffer.ResponseExpected) {
TransactionOptions.Flags |= SMB_TRANSACTION_NO_RESPONSE;
}
TransactionOptions.TimeoutIntervalInMilliSeconds = InputBuffer.Timeout;
SmbCeInitializeTransactionResumptionContext(&ResumptionContext);
try {
if (InputBuffer.SetupOffset){
SetupBuffer = (PUCHAR)pLowIoContext->ParamsFor.FsCtl.pInputBuffer+InputBuffer.SetupOffset;
}
if (SetupBuffer) {
ProbeForWrite(SetupBuffer,InputBuffer.MaxSetup,1);
}
if (InputBuffer.ParmPtr) {
ProbeForWrite(InputBuffer.ParmPtr,InputBuffer.MaxRetParmLength,1);
}
if (InputBuffer.RetDataPtr) {
ProbeForWrite(InputBuffer.RetDataPtr,InputBuffer.MaxRetDataLength,1);
}
} except(EXCEPTION_EXECUTE_HANDLER) {
return STATUS_INVALID_PARAMETER;
}
Status = SmbCeTransact(
RxContext,
&TransactionOptions,
SetupBuffer,
(USHORT)InputBuffer.SetupWords,
SetupBuffer,
InputBuffer.MaxSetup,
InputBuffer.ParmPtr,
InputBuffer.ParmLength,
InputBuffer.ParmPtr, // the buffer for the param information
InputBuffer.MaxRetParmLength,// the length of the param buffer
InputBuffer.DataPtr,
InputBuffer.DataLength,
InputBuffer.RetDataPtr, // the buffer for data
InputBuffer.MaxRetDataLength,// the length of the buffer
&ResumptionContext);
if (NT_SUCCESS(Status)) {
//LowIoContext->ParamsFor.FsCtl.OutputBufferLength = ResumptionContext.DataBytesReceived;
#ifdef _WIN64
if (IoIs32bitProcess(RxContext->CurrentIrp)) {
PLMR_TRANSACTION_32 pInputBuffer = (PLMR_TRANSACTION_32)pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived;
pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived;
pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived;
//this seems like a bad return value for iostatus.information
RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords;
} else {
PLMR_TRANSACTION pInputBuffer = (PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived;
pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived;
pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived;
//this seems like a return value for iostatus.information
RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords;
}
#else
{
PLMR_TRANSACTION pInputBuffer = (PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived;
pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived;
pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived;
//this seems like a return value for iostatus.information
RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords;
}
#endif
}
}
if (!NT_SUCCESS(Status)) {
RxDbgTrace( 0, Dbg, ("MRxSmbFsCtlUserTransact: Failed .. returning %lx\n",Status));
}
RxDbgTrace(-1, Dbg, ("MRxSmbFsCtlUserTransact exit...st=%08lx\n", Status));
return Status;
}
NTSTATUS
MRxSmbMailSlotFsControl(PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine handles all named pipe related FSCTL's
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
--*/
{
PAGED_CODE();
return STATUS_NOT_IMPLEMENTED;
}
NTSTATUS
MRxSmbDfsFsControl(PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine handles all DFS related FSCTL's
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
--*/
{
RxCaptureFobx;
RxCaptureFcb;
PMRX_SMB_SRV_OPEN pSmbSrvOpen;
SMB_TRANSACTION_OPTIONS TransactionOptions = DEFAULT_TRANSACTION_OPTIONS;
SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode;
NTSTATUS Status;
USHORT Setup;
PBYTE pInputParamBuffer = NULL;
PBYTE pOutputParamBuffer = NULL;
PBYTE pInputDataBuffer = NULL;
PBYTE pOutputDataBuffer = NULL;
ULONG InputParamBufferLength = 0;
ULONG OutputParamBufferLength = 0;
ULONG InputDataBufferLength = 0;
ULONG OutputDataBufferLength = 0;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbDfsFsControl...\n", 0));
if (RxContext->CurrentIrp->RequestorMode != KernelMode) {
// these FSCTLS are only su[pported from a kernel mode component
// because of parameter validation issues
return STATUS_INVALID_DEVICE_REQUEST;
}
Status = STATUS_MORE_PROCESSING_REQUIRED;
if (capFobx != NULL) {
pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen);
} else {
pSmbSrvOpen = NULL;
}
pInputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
InputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
switch (FsControlCode) {
case FSCTL_DFS_GET_REFERRALS:
{
pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
}
break;
case FSCTL_DFS_REPORT_INCONSISTENCY:
{
PWCHAR pDfsPathName;
//
// The input buffer from Dfs contains the path name with the inconsistency
// followed by the DFS_REFERRAL_V1 that has the inconsistency. The
// path name is sent in the Parameter section, and the DFS_REFERRAL_V1 is
// passed in the Data section. So, parse these two things out.
//
for (pDfsPathName = (PWCHAR) pInputParamBuffer;
*pDfsPathName != UNICODE_NULL;
pDfsPathName++) {
NOTHING;
}
pDfsPathName++; // Get past the NULL char
InputParamBufferLength = (ULONG) (((PCHAR)pDfsPathName) - ((PCHAR)pInputParamBuffer));
if (InputParamBufferLength >= pLowIoContext->ParamsFor.FsCtl.InputBufferLength) {
Status = STATUS_INVALID_PARAMETER;
} else {
pInputDataBuffer = (PBYTE)pDfsPathName;
InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength -
InputParamBufferLength;
}
}
break;
default:
ASSERT(!"Valid Dfs FSCTL");
}
if (Status == STATUS_MORE_PROCESSING_REQUIRED) {
Setup = TRANS2_GET_DFS_REFERRAL;
TransactionOptions.NtTransactFunction = 0; // TRANSACT2/TRANSACT.
TransactionOptions.pTransactionName = NULL;
TransactionOptions.TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED;
Status = SmbCeTransact(
RxContext, // the RXContext for the transaction
&TransactionOptions, // transaction options
&Setup, // the setup buffer
sizeof(Setup), // setup buffer length
NULL,
0,
pInputParamBuffer, // Input Param Buffer
InputParamBufferLength, // Input param buffer length
pOutputParamBuffer, // Output param buffer
OutputParamBufferLength, // output param buffer length
pInputDataBuffer, // Input data buffer
InputDataBufferLength, // Input data buffer length
pOutputDataBuffer, // output data buffer
OutputDataBufferLength, // output data buffer length
&ResumptionContext // the resumption context
);
if (!NT_SUCCESS(Status)) {
RxDbgTrace( 0, Dbg, ("MRxSmbDfsFsControl(%ld): Failed .. returning %lx\n",FsControlCode,Status));
} else {
RxContext->InformationToReturn = ResumptionContext.DataBytesReceived;
}
}
RxDbgTrace(-1, Dbg, ("MRxSmbDfsFsControl exit...st=%08lx\n", Status));
return Status;
}
NTSTATUS
MRxSmbFsControl(PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine handles all the FSCTL's
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
Remoting of FSCTL's is permitted only to NT servers.
--*/
{
NTSTATUS Status = STATUS_SUCCESS;
RxCaptureFcb;
RxCaptureFobx;
PMRX_SMB_SRV_OPEN pSmbSrvOpen;
PSMBCEDB_SERVER_ENTRY pServerEntry;
PFILE_OBJECT pTargetFileObject = NULL;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode;
REQ_NT_IO_CONTROL FsCtlSetup;
PBYTE pInputParamBuffer = NULL;
PBYTE pOutputParamBuffer = NULL;
PBYTE pInputDataBuffer = NULL;
PBYTE pOutputDataBuffer = NULL;
#ifdef _WIN64
PBYTE pThunkedInputData = NULL;
ULONG ThunkedInputDataLength = 0;
#endif
ULONG InputParamBufferLength = 0;
ULONG OutputParamBufferLength = 0;
ULONG InputDataBufferLength = 0;
ULONG OutputDataBufferLength = 0;
USHORT FileOrTreeId;
SMB_TRANSACTION_OPTIONS TransactionOptions = DEFAULT_TRANSACTION_OPTIONS;
SMB_TRANSACTION_SEND_PARAMETERS SendParameters;
SMB_TRANSACTION_RECEIVE_PARAMETERS ReceiveParameters;
SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext;
PAGED_CODE();
if (NodeType(capFcb) == RDBSS_NTC_DEVICE_FCB) {
return STATUS_INVALID_DEVICE_REQUEST;
}
if ((FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) &&
(RxContext->MinorFunction != IRP_MN_TRACK_LINK)) {
return STATUS_INVALID_DEVICE_REQUEST;
}
pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall);
if (capFobx != NULL &&
MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)) {
return STATUS_NOT_IMPLEMENTED;
}
RxDbgTrace(+1, Dbg, ("MRxSmbFsControl...Entry FsControlCode(%lx)\n", FsControlCode));
FsCtlSetup.IsFlags = 0;
if (capFobx != NULL) {
if (NodeType(capFobx) == RDBSS_NTC_V_NETROOT) {
PMRX_V_NET_ROOT pVNetRoot = (PMRX_V_NET_ROOT)capFobx;
PSMBCE_V_NET_ROOT_CONTEXT pVNetRootContext;
pVNetRootContext = SmbCeGetAssociatedVNetRootContext(pVNetRoot);
// It is a root open the tree id needs to be sent to the server.
FileOrTreeId = pVNetRootContext->TreeId;
} else {
if (FsControlCode != FSCTL_LMR_GET_CONNECTION_INFO)
{
pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen);
if (FlagOn(pSmbSrvOpen->Flags,SMB_SRVOPEN_FLAG_NOT_REALLY_OPEN)) {
BOOLEAN FcbAcquired = FALSE;
if (!RxIsFcbAcquiredExclusive(capFcb)) {
// This assert does not take into account the fact that other threads may
// own the resource shared, in which case we DO want to block and wait for
// the resource.
//ASSERT(!RxIsFcbAcquiredShared(capFcb));
Status = RxAcquireExclusiveFcbResourceInMRx( capFcb );
FcbAcquired = (Status == STATUS_SUCCESS);
} else {
FcbAcquired = TRUE;
}
if (FcbAcquired) {
Status = MRxSmbDeferredCreate(RxContext);
RxReleaseFcbResourceInMRx( capFcb );
}
if (Status!=STATUS_SUCCESS) {
goto FINALLY;
}
}
FileOrTreeId = pSmbSrvOpen->Fid;
}
else {
FileOrTreeId = 0;
}
}
} else {
FileOrTreeId = 0;
}
SmbPutAlignedUshort(&FsCtlSetup.Fid,FileOrTreeId);
SmbPutAlignedUlong(&FsCtlSetup.FunctionCode,FsControlCode);
FsCtlSetup.IsFsctl = TRUE;
TransactionOptions.NtTransactFunction = NT_TRANSACT_IOCTL;
TransactionOptions.pTransactionName = NULL;
Status = STATUS_SUCCESS;
switch (FsControlCode & 3) {
case METHOD_NEITHER:
{
ULONG Device;
// pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
// InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
// pInputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
// InputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
// pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
// OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
// pOutputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
// OutputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
Device = FsControlCode >> 16;
if (Device != FILE_DEVICE_FILE_SYSTEM) {
Status = STATUS_NOT_IMPLEMENTED;
break;
}
}
// fall thru.. for those FSContolcodes that belong to FILE_DEVICE_FILE_SYSTEM
// for which METHOD_NEITHER is specified we treat them as METHOD_BUFFERED
// Not Yet implemented
case METHOD_BUFFERED:
case METHOD_IN_DIRECT:
case METHOD_OUT_DIRECT:
{
pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer;
InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength;
pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
}
break;
default:
ASSERT(!"Valid Method for Fs Control");
Status = STATUS_INVALID_PARAMETER;
break;
}
#ifdef _WIN64
pThunkedInputData = pInputDataBuffer;
ThunkedInputDataLength = InputDataBufferLength;
#endif
// There is one FSCTL for which certain amount of preprocessing is required
// This is because the I/O subsystem passes in the information as a file
// object. The FID for the file object needs to be determined and the
// appropriate FID passed to the server instead of the file object.
if (FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) {
PREMOTE_LINK_TRACKING_INFORMATION pRemoteLinkInformation;
PMRX_FOBX pMRxFobx;
PMRX_SRV_OPEN pSrvOpen;
PMRX_SMB_SRV_OPEN pSmbSrvOpen;
try {
pRemoteLinkInformation =
(PREMOTE_LINK_TRACKING_INFORMATION)pInputDataBuffer;
if (pRemoteLinkInformation != NULL) {
pTargetFileObject = (PFILE_OBJECT)pRemoteLinkInformation->TargetFileObject;
if (pTargetFileObject != NULL) {
// Deduce the FID and substitute it for the File Object before shipping
// the FSCTL to the server.
pMRxFobx = (PMRX_FOBX)pTargetFileObject->FsContext2;
pSrvOpen = pMRxFobx->pSrvOpen;
pSmbSrvOpen = MRxSmbGetSrvOpenExtension(pSrvOpen);
if (pSmbSrvOpen != NULL) {
pRemoteLinkInformation->TargetFileObject =
(PVOID)(pSmbSrvOpen->Fid);
} else {
Status = STATUS_INVALID_PARAMETER;
}
}
#ifdef _WIN64
if( NT_SUCCESS(Status) )
{
ThunkedInputDataLength = InputDataBufferLength;
pThunkedInputData = Smb64ThunkRemoteLinkTrackingInfo( pInputDataBuffer, &ThunkedInputDataLength, &Status );
}
#endif
} else {
Status = STATUS_INVALID_PARAMETER;
}
} except(EXCEPTION_EXECUTE_HANDLER) {
Status=STATUS_INVALID_PARAMETER;
}
}
else if (FsControlCode == FSCTL_LMR_GET_CONNECTION_INFO)
{
PSMBCEDB_SERVER_ENTRY pServerEntry= SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall);
Status = STATUS_INVALID_PARAMETER;
pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer;
OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength;
if (pOutputDataBuffer && (OutputDataBufferLength==sizeof(LMR_CONNECTION_INFO_3)))
{
try
{
ProbeForWrite(
pOutputDataBuffer,
OutputDataBufferLength,
1);
if (!memcmp(pOutputDataBuffer,EA_NAME_CSCAGENT,sizeof(EA_NAME_CSCAGENT)))
{
MRxSmbGetConnectInfoLevel3Fields(
(PLMR_CONNECTION_INFO_3)(pOutputDataBuffer),
pServerEntry,
TRUE);
Status = STATUS_SUCCESS;
}
}
except(EXCEPTION_EXECUTE_HANDLER)
{
Status=STATUS_INVALID_PARAMETER;
}
}
goto FINALLY;
}
if (NT_SUCCESS(Status)) {
#ifdef _WIN64
ASSERT( !( (FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) &&
(pThunkedInputData == NULL) ) );
#endif
Status = SmbCeTransact(
RxContext,
&TransactionOptions,
&FsCtlSetup,
sizeof(FsCtlSetup),
&FsCtlSetup,
sizeof(FsCtlSetup),
pInputParamBuffer,
InputParamBufferLength,
pOutputParamBuffer,
OutputParamBufferLength,
#ifndef _WIN64
pInputDataBuffer,
InputDataBufferLength,
#else
pThunkedInputData,
ThunkedInputDataLength,
#endif
pOutputDataBuffer,
OutputDataBufferLength,
&ResumptionContext);
RxContext->InformationToReturn = ResumptionContext.DataBytesReceived;
if (NT_SUCCESS(Status)) {
PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
PMRX_SMB_SRV_OPEN smbSrvOpen = MRxSmbGetSrvOpenExtension(SrvOpen);
// invalidate the name based file info cache since it could change the attribute
// of the file on the server, i.e. FILE_ATTRIBUTE_COMPRESSED.
MRxSmbInvalidateFileInfoCache(RxContext);
// update the Fcb in case of reuse since the time stamp may have changed
ClearFlag(capFcb->FcbState,FCB_STATE_TIME_AND_SIZE_ALREADY_SET);
if( RxContext->InformationToReturn > OutputDataBufferLength ) {
Status = STATUS_BUFFER_TOO_SMALL;
}
}
if( !NT_SUCCESS( Status ) ) {
// RxContext->InformationToReturn = 0;
RxDbgTrace(0,Dbg,("MRxSmbFsControl: Transaction Request Completion Status %lx\n",Status));
}
}
FINALLY:
if( FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION )
{
#ifdef _WIN64
Smb64ReleaseThunkData( pThunkedInputData );
#endif
if( pTargetFileObject != NULL )
{
PREMOTE_LINK_TRACKING_INFORMATION pRemoteLinkInformation;
pRemoteLinkInformation =
(PREMOTE_LINK_TRACKING_INFORMATION)pInputDataBuffer;
pRemoteLinkInformation->TargetFileObject = pTargetFileObject;
}
}
RxDbgTrace(-1, Dbg, ("MRxSmbFsControl...Exit\n"));
return Status;
}
#if DBG
NTSTATUS
MRxSmbTestForLowIoIoctl(
IN PRX_CONTEXT RxContext
)
{
NTSTATUS Status = STATUS_SUCCESS;
RxCaptureFcb;RxCaptureFobx;
PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext;
PSZ Buffer = (PSZ)(LowIoContext->ParamsFor.IoCtl.pInputBuffer);
ULONG OutputBufferLength = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
ULONG InputBufferLength = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
UNICODE_STRING u;
PUNICODE_STRING FileName = GET_ALREADY_PREFIXED_NAME(capFobx->pSrvOpen,capFcb);
ULONG ReturnLength;
PAGED_CODE();
ReturnLength = OutputBufferLength;
if (ReturnLength > FileName->Length) {
ReturnLength = FileName->Length;
}
RxDbgTrace(0, Dbg,
("Here in MRxSmbTestForLowIoIoctl %s, obl = %08lx, rl=%08lx\n", Buffer, OutputBufferLength, ReturnLength));
// return an obvious string to make sure that darryl is copying the results out correctly
// need to check the lengths i.e. need outputl<=inputl; also need to check that count and buffer
// are aligned for wchar
RtlCopyMemory(Buffer,FileName->Buffer,ReturnLength);
u.Buffer = (PWCHAR)(Buffer);
u.Length = u.MaximumLength = (USHORT)ReturnLength;
RtlUpcaseUnicodeString(&u,&u,FALSE);
RxContext->InformationToReturn =
//LowIoContext->ParamsFor.IoCtl.OutputBufferLength =
ReturnLength;
return(Status);
}
#endif //if DBG
NTSTATUS
MRxSmbIoCtl(
IN OUT PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine performs an IOCTL operation. Currently, no calls are remoted; in
fact, the only call accepted is for debugging.
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
--*/
{
NTSTATUS Status = STATUS_INVALID_DEVICE_REQUEST;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG IoControlCode = pLowIoContext->ParamsFor.IoCtl.IoControlCode;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbIoCtl...\n", 0));
RxDbgTrace( 0, Dbg, ("MRxSmbIoCtl = %08lx\n", IoControlCode));
switch (IoControlCode) {
#if DBG
case IOCTL_LMMR_TESTLOWIO:
Status = MRxSmbTestForLowIoIoctl(RxContext);
break;
#endif //if DBG
default:
break;
}
RxDbgTrace(-1, Dbg, ("MRxSmbIoCtl -> %08lx\n", Status ));
return Status;
}
NTSTATUS
MRxSmbGetPrintJobId(
IN OUT PRX_CONTEXT RxContext)
/*++
Routine Description:
This routine performs an FSCTL operation (remote) on a file across the network
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
The FSCTL's handled by a mini rdr can be classified into one of two categories.
In the first category are those FSCTL's whose implementation are shared between
RDBSS and the mini rdr's and in the second category are those FSCTL's which
are totally implemented by the mini rdr's. To this a third category can be
added, i.e., those FSCTL's which should never be seen by the mini rdr's. The
third category is solely intended as a debugging aid.
The FSCTL's handled by a mini rdr can be classified based on functionality
--*/
{
NTSTATUS Status;
BOOLEAN FinalizationComplete;
PSMB_PSE_ORDINARY_EXCHANGE OrdinaryExchange = NULL;
PSMBSTUFFER_BUFFER_STATE StufferState;
RxCaptureFobx;
RxCaptureFcb;
PIO_STACK_LOCATION IrpSp = RxContext->CurrentIrpSp;
PSMBCEDB_SERVER_ENTRY pServerEntry;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbGetPrintJobId\n", 0 ));
if (capFcb == NULL || capFobx == NULL) {
return STATUS_INVALID_PARAMETER;
}
if (NodeType(capFcb) == RDBSS_NTC_DEVICE_FCB) {
return STATUS_INVALID_DEVICE_REQUEST;
}
pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall);
if (FlagOn(pServerEntry->Server.DialectFlags,DF_NT_SMBS)) {
Status = MRxSmbFsControl(RxContext);
goto FINALLY;
}
if (IrpSp->Parameters.FileSystemControl.OutputBufferLength < sizeof(QUERY_PRINT_JOB_INFO) ) {
Status = STATUS_BUFFER_TOO_SMALL;
goto FINALLY;
}
Status= SmbPseCreateOrdinaryExchange(
RxContext,
capFobx->pSrvOpen->pVNetRoot,
SMBPSE_OE_FROM_GETPRINTJOBID,
MRxSmbCoreIoCtl,
&OrdinaryExchange
);
if (Status != STATUS_SUCCESS) {
RxDbgTrace(-1, Dbg, ("Couldn't get the smb buf!\n"));
goto FINALLY;
}
OrdinaryExchange->AssociatedStufferState.CurrentCommand = SMB_COM_NO_ANDX_COMMAND;
StufferState = &OrdinaryExchange->AssociatedStufferState;
MRxSmbSetInitialSMB(StufferState STUFFERTRACE(Dbg,'FC'));
Status = SmbPseInitiateOrdinaryExchange(OrdinaryExchange);
FinalizationComplete = SmbPseFinalizeOrdinaryExchange(OrdinaryExchange);
ASSERT(FinalizationComplete);
FINALLY:
RxDbgTrace(-1, Dbg, ("MRxSmbIsValidDirectory exit with status=%08lx\n", Status ));
return(Status);
}
#define SPOOLER_DEVICE 0x53
#define GET_PRINTER_ID 0x60
typedef struct _SMB_RESP_PRINT_JOB_ID {
USHORT JobId;
UCHAR ServerName[LM20_CNLEN+1];
UCHAR QueueName[LM20_QNLEN+1];
UCHAR Padding; // Unknown what this padding is..
} SMB_RESP_PRINT_JOB_ID, *PSMB_RESP_PRINT_JOB_ID;
NTSTATUS
MRxSmbCoreIoCtl(
SMBPSE_ORDINARY_EXCHANGE_ARGUMENT_SIGNATURE
)
/*++
Routine Description:
This is the start routine for SMB IOCTL. This initiates the construction of the
appropriate SMB.
Arguments:
pExchange - the exchange instance
Return Value:
NTSTATUS - The return status for the operation
--*/
{
NTSTATUS Status = RX_MAP_STATUS(NOT_IMPLEMENTED);
PSMBSTUFFER_BUFFER_STATE StufferState = &OrdinaryExchange->AssociatedStufferState;
RxCaptureFcb; RxCaptureFobx;
PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
PMRX_SMB_SRV_OPEN smbSrvOpen = MRxSmbGetSrvOpenExtension(SrvOpen);
PMRX_SMB_FOBX smbFobx = MRxSmbGetFileObjectExtension(capFobx);
PSMBCE_SERVER pServer = SmbCeGetExchangeServer(OrdinaryExchange);
ULONG SmbLength;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbCoreIoCtl\n", 0 ));
switch (OrdinaryExchange->EntryPoint) {
case SMBPSE_OE_FROM_GETPRINTJOBID:
COVERED_CALL(
MRxSmbStartSMBCommand(
StufferState,
SetInitialSMB_ForReuse,
SMB_COM_IOCTL,
SMB_REQUEST_SIZE(IOCTL),
NO_EXTRA_DATA,
SMB_BEST_ALIGNMENT(1,0),
RESPONSE_HEADER_SIZE_NOT_SPECIFIED,
0,0,0,0 STUFFERTRACE(Dbg,'FC'))
);
MRxSmbDumpStufferState (1100,"SMB w/ GFA before stuffing",StufferState);
//CODE.IMPROVEMENT if this is truly core, we have to copy the name since its in UNICODE
// otherwise, we don't need to copy the name here, we can just Mdl like in writes
MRxSmbStuffSMB (StufferState,
"0wwwwwwwwwwwwwwB!",
// 0 UCHAR WordCount; // Count of parameter words = 8
smbSrvOpen->Fid, // w _USHORT( Fid ); // File handle
SPOOLER_DEVICE, // w _USHORT( Category);
GET_PRINTER_ID, // w _USHORT( Function ); // Device function
0, // w _USHORT( TotalParameterCount ); // Total parameter bytes being sent
0, // w _USHORT( TotalDataCount ); // Total data bytes being sent
0, // w _USHORT( MaxParameterCount ); // Max parameter bytes to return
0, // w _USHORT( MaxDataCount ); // Max data bytes to return
0, // w _ULONG ( Timeout );
0, // w _USHORT( Reserved );
0, // w _USHORT( ParameterCount ); // Parameter bytes sent this buffer
0, // w _USHORT( ParameterOffset ); // Offset (from header start) to params
0, // w _USHORT( DataCount ); // Data bytes sent this buffer
0, // w _USHORT( DataOffset ); // Offset (from header start) to data
0, // w _USHORT( ByteCount ); // Count of data bytes
SMB_WCT_CHECK(14) 0 // _USHORT( ByteCount ); // Count of data bytes; min = 0
// UCHAR Buffer[1]; // Reserved buffer
);
break;
default:
Status = STATUS_NOT_IMPLEMENTED;
}
if (Status == STATUS_SUCCESS) {
MRxSmbDumpStufferState (700,"SMB w/ GFA after stuffing",StufferState);
Status = SmbPseOrdinaryExchange(
SMBPSE_ORDINARY_EXCHANGE_ARGUMENTS,
SMBPSE_OETYPE_IOCTL
);
}
FINALLY:
RxDbgTrace(-1, Dbg, ("MRxSmbSynchronousGetFileAttributes exiting.......OE=%08lx, st=%08lx\n",OrdinaryExchange,Status));
return(Status);
}
NTSTATUS
MRxSmbFinishCoreIoCtl(
PSMB_PSE_ORDINARY_EXCHANGE OrdinaryExchange,
PRESP_IOCTL Response
)
/*++
Routine Description:
This routine copies the print job ID and server and queue name to the user buffer.
Arguments:
OrdinaryExchange - the exchange instance
Response - the response
Return Value:
RXSTATUS - The return status for the operation
--*/
{
NTSTATUS Status = RX_MAP_STATUS(SUCCESS);
PRX_CONTEXT RxContext = OrdinaryExchange->RxContext;
PIRP Irp = RxContext->CurrentIrp;
PIO_STACK_LOCATION IrpSp = RxContext->CurrentIrpSp;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbFinishCoreIoCtl\n", 0 ));
SmbPseOEAssertConsistentLinkageFromOE("MRxSmbFinishCoreIoCtl:");
switch (OrdinaryExchange->EntryPoint) {
case SMBPSE_OE_FROM_GETPRINTJOBID:
if (Response->WordCount != 8 ||
SmbGetUshort(&Response->DataCount) != sizeof(SMB_RESP_PRINT_JOB_ID)) {
Status = STATUS_INVALID_NETWORK_RESPONSE;
OrdinaryExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
} else {
OEM_STRING OemString;
UNICODE_STRING UnicodeString;
PQUERY_PRINT_JOB_INFO OutputBuffer = Irp->UserBuffer;
PSMB_RESP_PRINT_JOB_ID RespPrintJobId = (PSMB_RESP_PRINT_JOB_ID)((PUCHAR)Response+(Response->DataOffset-sizeof(SMB_HEADER)));
OutputBuffer->JobId = RespPrintJobId->JobId;
RtlInitAnsiString(&OemString, RespPrintJobId->ServerName);
UnicodeString.Buffer = OutputBuffer->ServerName;
UnicodeString.MaximumLength = sizeof(OutputBuffer->ServerName);
Status = RtlOemStringToUnicodeString(&UnicodeString, &OemString, FALSE);
if (Status == STATUS_SUCCESS) {
RtlInitAnsiString(&OemString, RespPrintJobId->QueueName);
UnicodeString.Buffer = OutputBuffer->QueueName;
UnicodeString.MaximumLength = sizeof(OutputBuffer->QueueName);
Status = RtlOemStringToUnicodeString(&UnicodeString, &OemString, FALSE);
IrpSp->Parameters.FileSystemControl.InputBufferLength = sizeof(QUERY_PRINT_JOB_INFO);
}
}
break;
default:
ASSERT(FALSE);
Status = STATUS_INVALID_NETWORK_RESPONSE;
OrdinaryExchange->Status = STATUS_INVALID_NETWORK_RESPONSE;
}
RxDbgTrace(-1, Dbg, ("MRxSmbFinishCoreIoCtl returning %08lx\n", Status ));
return Status;
}
typedef struct _SecPkgContext_TargetInformation
{
unsigned long MarshalledTargetInfoLength;
unsigned char SEC_FAR * MarshalledTargetInfo;
} SecPkgContext_TargetInformation, SEC_FAR * PSecPkgContext_TargetInformation;
NTSTATUS
MRxSmbQueryTargetInfo(
PRX_CONTEXT RxContext
)
/*++
Routine Description:
This routine performs a query target information operation against a connection
Arguments:
RxContext - the RDBSS context
Return Value:
RXSTATUS - The return status for the operation
Notes:
RDR gets the target information based on the security context of the connection and
returns the marshalled target information on the output buffer.
--*/
{
PMRX_V_NET_ROOT pVNetRoot = NULL;
PSMBCE_V_NET_ROOT_CONTEXT pVNetRootContext = NULL;
NTSTATUS Status = STATUS_SUCCESS;
SECURITY_STATUS SecStatus;
SecPkgContext_TargetInformation SecTargetInfo;
PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext;
ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode;
PLMR_QUERY_TARGET_INFO LmrQueryTargetInfo = RxContext->CurrentIrp->UserBuffer;
PAGED_CODE();
RxDbgTrace(+1, Dbg, ("MRxSmbQueryTargetInfo...\n", 0));
RxDbgTrace( 0, Dbg, ("MRxSmbQueryTargetInfo = %08lx\n", FsControlCode));
if (RxContext->CurrentIrp->RequestorMode != KernelMode) {
// this FSCTLS is only supported from a kernel mode component
return STATUS_INVALID_DEVICE_REQUEST;
}
if (LmrQueryTargetInfo == NULL) {
return STATUS_INVALID_PARAMETER;
}
if (RxContext->pRelevantSrvOpen == NULL) {
return STATUS_INVALID_PARAMETER;
}
pVNetRoot = (PMRX_V_NET_ROOT)RxContext->pRelevantSrvOpen->pVNetRoot;
if (NodeType(pVNetRoot) != RDBSS_NTC_V_NETROOT) {
return STATUS_INVALID_PARAMETER;
}
pVNetRootContext = (PSMBCE_V_NET_ROOT_CONTEXT)pVNetRoot->Context;
SecStatus = QueryContextAttributesW(
&pVNetRootContext->pSessionEntry->Session.SecurityContextHandle,
SECPKG_ATTR_TARGET_INFORMATION,
&SecTargetInfo);
Status = MapSecurityError( SecStatus );
if (Status == STATUS_SUCCESS) {
if (SecTargetInfo.MarshalledTargetInfoLength+sizeof(LMR_QUERY_TARGET_INFO) > LmrQueryTargetInfo->BufferLength) {
LmrQueryTargetInfo->BufferLength = SecTargetInfo.MarshalledTargetInfoLength + sizeof(LMR_QUERY_TARGET_INFO);
Status = STATUS_BUFFER_TOO_SMALL;
} else {
RtlCopyMemory(LmrQueryTargetInfo->TargetInfoMarshalled,
SecTargetInfo.MarshalledTargetInfo,
SecTargetInfo.MarshalledTargetInfoLength);
LmrQueryTargetInfo->BufferLength = SecTargetInfo.MarshalledTargetInfoLength;
}
{
SIZE_T MarshalledTargetInfoLength_SizeT;
MarshalledTargetInfoLength_SizeT = SecTargetInfo.MarshalledTargetInfoLength;
ZwFreeVirtualMemory(
NtCurrentProcess(),
&SecTargetInfo.MarshalledTargetInfo,
&MarshalledTargetInfoLength_SizeT,
MEM_RELEASE);
ASSERT(MarshalledTargetInfoLength_SizeT <= MAXULONG);
SecTargetInfo.MarshalledTargetInfoLength = (ULONG)MarshalledTargetInfoLength_SizeT;
}
}
return Status;
}
Reference in a new issue Copy permalink