/*++ Copyright (c) 1989 Microsoft Corporation Module Name: fsctl.c Abstract: This module implements the mini redirector call down routines pertaining to file system control(FSCTL) and Io Device Control (IOCTL) operations on file system objects. Author: Balan Sethu Raman [SethuR] 7-March-1995 Revision History: Joe Linn [JoeLi] -- Implemented FSCTL's --*/ #include "precomp.h" #pragma hdrstop #include #include #include #include #ifdef ALLOC_PRAGMA #pragma alloc_text(PAGE, MRxSmbFsCtl) #pragma alloc_text(PAGE, MRxSmbNotifyChangeDirectory) #pragma alloc_text(PAGE, MRxSmbNamedPipeFsControl) #pragma alloc_text(PAGE, MRxSmbFsCtlUserTransact) #pragma alloc_text(PAGE, MRxSmbMailSlotFsControl) #pragma alloc_text(PAGE, MRxSmbFsControl) #pragma alloc_text(PAGE, MRxSmbIoCtl) #endif // // The local debug trace level // RXDT_DefineCategory(FSCTRL); #define Dbg (DEBUG_TRACE_FSCTRL) extern NTSTATUS MRxSmbNamedPipeFsControl(IN OUT PRX_CONTEXT RxContext); extern NTSTATUS MRxSmbMailSlotFsControl(IN OUT PRX_CONTEXT RxContext); extern NTSTATUS MRxSmbDfsFsControl(IN OUT PRX_CONTEXT RxContext); extern NTSTATUS MRxSmbFsControl(IN OUT PRX_CONTEXT RxContext); extern NTSTATUS MRxSmbFsCtlUserTransact(IN OUT PRX_CONTEXT RxContext); NTSTATUS MRxSmbGetPrintJobId( IN OUT PRX_CONTEXT RxContext); NTSTATUS MRxSmbCoreIoCtl( SMBPSE_ORDINARY_EXCHANGE_ARGUMENT_SIGNATURE); NTSTATUS MRxSmbQueryTargetInfo( PRX_CONTEXT RxContext ); NTSTATUS MRxSmbFsCtl( IN OUT PRX_CONTEXT RxContext) /*++ Routine Description: This routine performs an FSCTL operation (remote) on a file across the network Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: The FSCTL's handled by a mini rdr can be classified into one of two categories. In the first category are those FSCTL's whose implementation are shared between RDBSS and the mini rdr's and in the second category are those FSCTL's which are totally implemented by the mini rdr's. To this a third category can be added, i.e., those FSCTL's which should never be seen by the mini rdr's. The third category is solely intended as a debugging aid. The FSCTL's handled by a mini rdr can be classified based on functionality --*/ { RxCaptureFobx; RxCaptureFcb; NTSTATUS Status = STATUS_SUCCESS; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbFsCtl...\n", 0)); RxDbgTrace( 0, Dbg, ("MRxSmbFsCtl = %08lx\n", FsControlCode)); if (capFobx != NULL) { PMRX_V_NET_ROOT pVNetRoot; // Avoid device opens for which the FOBX is the VNET_ROOT instance pVNetRoot = (PMRX_V_NET_ROOT)capFobx; if (NodeType(pVNetRoot) != RDBSS_NTC_V_NETROOT) { PUNICODE_STRING AlreadyPrefixedName = GET_ALREADY_PREFIXED_NAME(capFobx->pSrvOpen,capFcb); ULONG FcbAlreadyPrefixedNameLength = AlreadyPrefixedName->Length; ULONG NetRootInnerNamePrefixLength = capFcb->pNetRoot->InnerNamePrefix.Length; PWCHAR pName = AlreadyPrefixedName->Buffer; // If an FSCTL is being attempted against the root of a share. // The AlreadyPrefixedName associated with the FCB is the same as // the AlreadyPrefixedName length associated with the NET_ROOT instance // or atmost one character greater than it ( appending a \) try and // reestablish the connection before attempting the FSCTL. // This solves thorny issues regarding deletion/creation of shares // on the server sides, DFS referrals etc. if ((FcbAlreadyPrefixedNameLength == NetRootInnerNamePrefixLength) || ((FcbAlreadyPrefixedNameLength == NetRootInnerNamePrefixLength + sizeof(WCHAR)) && (*((PCHAR)pName + FcbAlreadyPrefixedNameLength - sizeof(WCHAR)) == L'\\'))) { if (capFobx->pSrvOpen != NULL) { Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot); } } } } if (Status == STATUS_SUCCESS) { switch (pLowIoContext->ParamsFor.FsCtl.MinorFunction) { case IRP_MN_USER_FS_REQUEST: case IRP_MN_TRACK_LINK : switch (FsControlCode) { case FSCTL_PIPE_ASSIGN_EVENT : case FSCTL_PIPE_DISCONNECT : case FSCTL_PIPE_LISTEN : case FSCTL_PIPE_PEEK : case FSCTL_PIPE_QUERY_EVENT : case FSCTL_PIPE_TRANSCEIVE : case FSCTL_PIPE_WAIT : case FSCTL_PIPE_IMPERSONATE : case FSCTL_PIPE_SET_CLIENT_PROCESS : case FSCTL_PIPE_QUERY_CLIENT_PROCESS : Status = MRxSmbNamedPipeFsControl(RxContext); break; case FSCTL_MAILSLOT_PEEK : Status = MRxSmbMailSlotFsControl(RxContext); break; case FSCTL_DFS_GET_REFERRALS: case FSCTL_DFS_REPORT_INCONSISTENCY: Status = MRxSmbDfsFsControl(RxContext); break; case FSCTL_LMR_TRANSACT : Status = MRxSmbFsCtlUserTransact(RxContext); break; case FSCTL_GET_PRINT_ID : Status = MRxSmbGetPrintJobId(RxContext); break; case FSCTL_LMR_QUERY_TARGET_INFO: Status = MRxSmbQueryTargetInfo(RxContext); break; case FSCTL_MOVE_FILE: case FSCTL_MARK_HANDLE: case FSCTL_QUERY_RETRIEVAL_POINTERS: case FSCTL_GET_VOLUME_BITMAP: case FSCTL_GET_NTFS_FILE_RECORD: Status = STATUS_NOT_SUPPORTED; break; case FSCTL_SET_REPARSE_POINT: { ULONG InputBufferLength = 0; // invalid value as we need an input buffer PREPARSE_DATA_BUFFER prdBuff = (&RxContext->LowIoContext)->ParamsFor.FsCtl.pInputBuffer; PMRX_SMB_FCB smbFcb = MRxSmbGetFcbExtension(capFcb); InputBufferLength = (&RxContext->LowIoContext)->ParamsFor.FsCtl.InputBufferLength; if ((prdBuff == NULL)|| (InputBufferLength < REPARSE_DATA_BUFFER_HEADER_SIZE)|| (InputBufferLength > MAXIMUM_REPARSE_DATA_BUFFER_SIZE)) { Status = STATUS_IO_REPARSE_DATA_INVALID; break; } // // Verify that the user buffer and the data length in its header are // internally consistent. We need to have a REPARSE_DATA_BUFFER or a // REPARSE_GUID_DATA_BUFFER. // if((InputBufferLength != (ULONG)(REPARSE_DATA_BUFFER_HEADER_SIZE + prdBuff->ReparseDataLength)) && (InputBufferLength != (ULONG)(REPARSE_GUID_DATA_BUFFER_HEADER_SIZE + prdBuff->ReparseDataLength))) { Status = STATUS_IO_REPARSE_DATA_INVALID; break; } } case FSCTL_GET_REPARSE_POINT: // absence of break intentional case FSCTL_MARK_AS_SYSTEM_HIVE : // // On a remote boot machine, we need to no-op the MARK_AS_SYSTEM_HIVE // FSCTL. Local filesystems use this to prevent a volume from being // dismounted. // if (MRxSmbBootedRemotely) { break; } default: Status = MRxSmbFsControl(RxContext); break; } break; default : Status = STATUS_INVALID_DEVICE_REQUEST; break; } } RxDbgTrace(-1, Dbg, ("MRxSmbFsCtl -> %08lx\n", Status )); return Status; } typedef struct _SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT_ { LONG ReferenceCount; PRX_CONTEXT pRxContext; REQ_NOTIFY_CHANGE NotifyRequest; SMB_TRANSACTION_OPTIONS Options; SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext; } SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT, *PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT; NTSTATUS MRxSmbNotifyChangeDirectorySynchronousCompletion( PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext) /*++ Routine Description: This routine is invoked when a directory change notification operation is completed Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: This routine will always be called. This is true even if the change directory notification is cancelled. In such cases the memory allocated is freed without any interaction with the wrapper. In cases of successful directory change notification completion the appropriate completion routine is invoked and the RxContext modified to prevent any cancellation from proceeding further. --*/ { NTSTATUS Status = STATUS_PENDING; PMRXSMB_RX_CONTEXT pMRxSmbContext; PRX_CONTEXT pRxContext; PSMB_EXCHANGE pExchange = NULL; BOOLEAN FinalizeNotificationContext = FALSE; SmbCeAcquireSpinLock(); FinalizeNotificationContext = (InterlockedDecrement(&pNotificationContext->ReferenceCount) == 0); if (FinalizeNotificationContext) { pRxContext = pNotificationContext->pRxContext; pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext); pExchange = pMRxSmbContext->pExchange; Status = pRxContext->StoredStatus; } SmbCeReleaseSpinLock(); // Free the associated exchange. if (FinalizeNotificationContext) { if (pExchange != NULL) { SmbCeDereferenceAndDiscardExchange(pExchange); } // Free the notification context. RxFreePool(pNotificationContext); ASSERT(Status != STATUS_PENDING); } return Status; } VOID MRxSmbNotifyChangeDirectoryCompletion( PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext) /*++ Routine Description: This routine is invoked when a directory change notification operation is completed Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: This routine will always be called. This is true even if the change directory notification is cancelled. In such cases the memory allocated is freed without any inteaction with the wrapper. In cases of successful directory change notification completion the appropriate completion routine is invoked and the RxContext modified to prevent any cancellation from proceeding further. --*/ { NTSTATUS Status; PMRXSMB_RX_CONTEXT pMRxSmbContext; PRX_CONTEXT pRxContext; PSMB_EXCHANGE pExchange = NULL; BOOLEAN FinalizeNotificationContext = FALSE; SmbCeAcquireSpinLock(); FinalizeNotificationContext = (InterlockedDecrement(&pNotificationContext->ReferenceCount) == 0); pRxContext = pNotificationContext->pRxContext; if (pRxContext != NULL) { PSMB_TRANSACT_EXCHANGE pTransactExchange; pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext); pExchange = pMRxSmbContext->pExchange; if (pExchange != NULL) { PSMBCEDB_SERVER_ENTRY pServerEntry; pTransactExchange = (PSMB_TRANSACT_EXCHANGE)pExchange; pServerEntry = SmbCeGetExchangeServerEntry(pExchange); if ((pNotificationContext->ResumptionContext.FinalStatusFromServer == STATUS_NOT_SUPPORTED) || (pNotificationContext->ResumptionContext.FinalStatusFromServer == STATUS_NOT_IMPLEMENTED)) { pServerEntry->Server.ChangeNotifyNotSupported = TRUE; } pRxContext->InformationToReturn = pTransactExchange->ParamBytesReceived; } else { pRxContext->InformationToReturn = 0; } pRxContext->StoredStatus = pNotificationContext->ResumptionContext.FinalStatusFromServer; if( (pRxContext->InformationToReturn == 0) && (pRxContext->StoredStatus == STATUS_SUCCESS) ) { pRxContext->StoredStatus = STATUS_NOTIFY_ENUM_DIR; } } SmbCeReleaseSpinLock(); if (FinalizeNotificationContext) { if (pRxContext != NULL) { RxLowIoCompletion(pRxContext); } // Free the associated exchange. if (pExchange != NULL) { SmbCeDereferenceAndDiscardExchange(pExchange); } // Free the notification context. RxFreePool(pNotificationContext); } } NTSTATUS MRxSmbNotifyChangeDirectory( IN OUT PRX_CONTEXT RxContext) /*++ Routine Description: This routine performs a directory change notification operation Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: A directory change notification opertaion is an asychronous operation. It consists of sending a SMB requesting change notification whose response is obtained when the desired change is affected on the server. Some important points to remember are as follows ..... 1) The SMB response is not obtained till the desired change is affected on the server. Therefore an additional MID needs to be reserved on those connections which permit multiple MID's so that a cancel SMB can be sent to the server when a change notification is active. 2) The Change notification is typical of a long term ( response time dictated by factors beyond the servers control). Another example is the query FSCTL operation in CAIRO. For all these operations we initiate an asychronous transact exchange. 3) The corresponding LowIo completion routine is invoked asynchronously. 4) This is an example of an operation for which the MINI RDR has to register a context for handling cancellations initiated locally. --*/ { NTSTATUS Status; RxCaptureFcb; RxCaptureFobx; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; PSMBCEDB_SERVER_ENTRY pServerEntry; PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT pNotificationContext; PBYTE pInputParamBuffer = NULL; PBYTE pOutputParamBuffer = NULL; PBYTE pInputDataBuffer = NULL; PBYTE pOutputDataBuffer = NULL; ULONG InputParamBufferLength = 0; ULONG OutputParamBufferLength = 0; ULONG InputDataBufferLength = 0; ULONG OutputDataBufferLength = 0; RxDbgTrace(+1, Dbg, ("MRxNotifyChangeDirectory...Entry\n", 0)); pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall); // if the server entry is in disconnected state, then let CSC do change notify // If successful, the CSC routine should return a STATUS_PENDING and // modify the rxcontext in way that is suitable to the underlying implementation // In the current incarnation, the CSC routine will // a) remove the irp from the rxconetxt and b) dereference the rxcontext if (MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)|| SmbCeIsServerInDisconnectedMode(pServerEntry)) { return MRxSmbCscNotifyChangeDirectory(RxContext); } else if (!FlagOn(pServerEntry->Server.DialectFlags,DF_NT_SMBS) || pServerEntry->Server.ChangeNotifyNotSupported) { return STATUS_NOT_SUPPORTED; } #if defined(REMOTE_BOOT) // // Reject change notify on the remote boot share. This is necessary to // prevent overloading the server with long-term requests. (There are // LOTS of change notifies posted on the boot device!) // if (MRxSmbBootedRemotely) { PSMBCE_SESSION pSession; pSession = &SmbCeGetAssociatedVNetRootContext(capFobx->pSrvOpen->pVNetRoot)->pSessionEntry->Session; if (FlagOn(pSession->Flags,SMBCE_SESSION_FLAGS_REMOTE_BOOT_SESSION)) { return STATUS_NOT_SUPPORTED; } } #endif pNotificationContext = (PSMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT) RxAllocatePoolWithTag( NonPagedPool, sizeof(SMB_NOTIFY_CHANGE_DIRECTORY_CONTEXT), MRXSMB_FSCTL_POOLTAG); if (pNotificationContext != NULL) { PREQ_NOTIFY_CHANGE pNotifyRequest; PSMB_TRANSACTION_OPTIONS pTransactionOptions; PSMB_TRANSACTION_RESUMPTION_CONTEXT pResumptionContext; PMRX_SMB_SRV_OPEN pSmbSrvOpen; BOOLEAN FcbAcquired = FALSE; RxCaptureFobx; ASSERT (capFobx != NULL); if (!RxIsFcbAcquiredExclusive(capFcb)) { // ASSERT(!RxIsFcbAcquiredShared(capFcb)); Status = RxAcquireExclusiveFcbResourceInMRx( capFcb ); FcbAcquired = (Status == STATUS_SUCCESS); } if (FcbAcquired) { if (FlagOn(capFobx->pSrvOpen->Flags,SRVOPEN_FLAG_CLOSED) || FlagOn(capFobx->pSrvOpen->Flags,SRVOPEN_FLAG_ORPHANED)) { Status = STATUS_FILE_CLOSED; } else { Status = MRxSmbDeferredCreate(RxContext); } RxReleaseFcbResourceInMRx( capFcb ); } if (Status==STATUS_SUCCESS) { pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen); pNotificationContext->pRxContext = RxContext; // The reference count is set to 2. one for the async completion routine // and one for the tail completion routine pNotificationContext->ReferenceCount = 2; pNotifyRequest = &(pNotificationContext->NotifyRequest); pTransactionOptions = &(pNotificationContext->Options); pResumptionContext = &(pNotificationContext->ResumptionContext); pNotifyRequest->CompletionFilter = pLowIoContext->ParamsFor.NotifyChangeDirectory.CompletionFilter; pNotifyRequest->Fid = pSmbSrvOpen->Fid; pNotifyRequest->WatchTree = pLowIoContext->ParamsFor.NotifyChangeDirectory.WatchTree; pNotifyRequest->Reserved = 0; OutputParamBufferLength = pLowIoContext->ParamsFor.NotifyChangeDirectory.NotificationBufferLength; pOutputParamBuffer = pLowIoContext->ParamsFor.NotifyChangeDirectory.pNotificationBuffer; *pTransactionOptions = RxDefaultTransactionOptions; pTransactionOptions->NtTransactFunction = NT_TRANSACT_NOTIFY_CHANGE; pTransactionOptions->TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED; pTransactionOptions->Flags = SMB_XACT_FLAGS_INDEFINITE_DELAY_IN_RESPONSE; SmbCeInitializeAsynchronousTransactionResumptionContext( pResumptionContext, MRxSmbNotifyChangeDirectoryCompletion, pNotificationContext); Status = SmbCeAsynchronousTransact( RxContext, // the RXContext for the transaction pTransactionOptions, // transaction options pNotifyRequest, // the setup buffer sizeof(REQ_NOTIFY_CHANGE), // setup buffer length NULL, 0, pInputParamBuffer, // Input Param Buffer InputParamBufferLength, // Input param buffer length pOutputParamBuffer, // Output param buffer OutputParamBufferLength, // output param buffer length pInputDataBuffer, // Input data buffer InputDataBufferLength, // Input data buffer length pOutputDataBuffer, // output data buffer OutputDataBufferLength, // output data buffer length pResumptionContext // the resumption context ); ASSERT(Status == STATUS_PENDING); Status = MRxSmbNotifyChangeDirectorySynchronousCompletion( pNotificationContext); } else { NOTHING; //just return the status from the deferred open call } } else { Status = STATUS_INSUFFICIENT_RESOURCES; } if (MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)|| SmbCeIsServerInDisconnectedMode(pServerEntry)) { return MRxSmbCscNotifyChangeDirectory(RxContext); } RxDbgTrace(-1, Dbg, ("MRxSmbNotifyChangeDirectory -> %08lx\n", Status )); return Status; } UNICODE_STRING s_NamedPipeTransactionName = { 12,12,L"\\PIPE\\" }; UNICODE_STRING s_MailSlotTransactionName = {20,20,L"\\MAILSLOT\\" }; typedef struct _SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT_ { LONG ReferenceCount; PRX_CONTEXT pRxContext; PWCHAR pTransactionNameBuffer; SMB_TRANSACTION_OPTIONS Options; SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext; } SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT, *PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT; VOID MRxSmbNamedPipeFsControlCompletion( PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT pFsCtlCompletionContext) { PRX_CONTEXT pRxContext = NULL; PSMB_EXCHANGE pExchange = NULL; BOOLEAN FinalizeFsCtlCompletionContext = FALSE; SmbCeAcquireSpinLock(); FinalizeFsCtlCompletionContext = (InterlockedDecrement(&pFsCtlCompletionContext->ReferenceCount) == 0); if (FinalizeFsCtlCompletionContext) { pRxContext = pFsCtlCompletionContext->pRxContext; if (pRxContext != NULL) { PMRXSMB_RX_CONTEXT pMRxSmbContext; pMRxSmbContext = MRxSmbGetMinirdrContext(pRxContext); pExchange = pMRxSmbContext->pExchange; } } SmbCeReleaseSpinLock(); if (FinalizeFsCtlCompletionContext) { if (pRxContext != NULL) { pRxContext->StoredStatus = pFsCtlCompletionContext->ResumptionContext.FinalStatusFromServer; if (pRxContext->StoredStatus == STATUS_INVALID_HANDLE) { pRxContext->StoredStatus = STATUS_INVALID_NETWORK_RESPONSE; } pRxContext->InformationToReturn = pFsCtlCompletionContext->ResumptionContext.DataBytesReceived; RxLowIoCompletion(pRxContext); } if (pExchange != NULL) { SmbCeDereferenceAndDiscardExchange(pExchange); } if (pFsCtlCompletionContext->pTransactionNameBuffer != NULL) { RxFreePool(pFsCtlCompletionContext->pTransactionNameBuffer); } RxFreePool(pFsCtlCompletionContext); } } NTSTATUS MRxSmbNamedPipeFsControl(PRX_CONTEXT RxContext) /*++ Routine Description: This routine handles all named pipe related FSCTL's Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation --*/ { RxCaptureFobx; RxCaptureFcb; PMRX_SMB_SRV_OPEN pSmbSrvOpen; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode; UNICODE_STRING TransactionName; BOOLEAN ReestablishConnectionIfRequired = FALSE, fTransactioNameBufferAllocated = FALSE; NTSTATUS Status; USHORT Setup[2]; PBYTE pInputParamBuffer = NULL; PBYTE pOutputParamBuffer = NULL; PBYTE pInputDataBuffer = NULL; PBYTE pOutputDataBuffer = NULL; ULONG InputParamBufferLength = 0; ULONG OutputParamBufferLength = 0; ULONG InputDataBufferLength = 0; ULONG OutputDataBufferLength = 0; ULONG TimeoutIntervalInMilliSeconds; RESP_PEEK_NMPIPE PeekResponse; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbNamedPipeFsControl...\n", 0)); TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED; Status = STATUS_MORE_PROCESSING_REQUIRED; if (NodeType(capFcb) != RDBSS_NTC_STORAGE_TYPE_FILE && NodeType(capFcb) != RDBSS_NTC_STORAGE_TYPE_UNKNOWN || capFcb->pNetRoot == NULL || capFcb->pNetRoot->Type != NET_ROOT_PIPE) { return STATUS_INVALID_DEVICE_REQUEST; } if (capFobx != NULL) { pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen); } else { pSmbSrvOpen = NULL; } // The following switch statement serves the dual purpose of validating the parameters // presented by the user as well as filling in the appropriate information if it is // available locally. // Currently there is no local caching strategy in place and consequently a network trip // is always undertaken. TransactionName = s_NamedPipeTransactionName; switch (FsControlCode) { case FSCTL_PIPE_PEEK : { Setup[0] = TRANS_PEEK_NMPIPE; Setup[1] = pSmbSrvOpen->Fid; pOutputParamBuffer = (PBYTE)&PeekResponse; OutputParamBufferLength = sizeof(PeekResponse); pOutputDataBuffer = (PBYTE)pLowIoContext->ParamsFor.FsCtl.pOutputBuffer + FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER,Data[0]); OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength - FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER,Data[0]); } break; case FSCTL_PIPE_TRANSCEIVE : { Setup[0] = TRANS_TRANSACT_NMPIPE; Setup[1] = pSmbSrvOpen->Fid; pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer; InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; // CODE.IMPROVEMENT -- Currently the semantics of attempting a TRANSCEIVE // with zero bytes to be written is not very well defined. The Old Redirector // succeeds without issuing a TRANSACT request. This needs to be resolved and // till it is done the old semantics will be retained //if (InputDataBufferLength == 0) { // Status = STATUS_SUCCESS; //} } break; case FSCTL_PIPE_WAIT : { PFILE_PIPE_WAIT_FOR_BUFFER pWaitBuffer; ULONG NameLength; Setup[0] = TRANS_WAIT_NMPIPE; Setup[1] = 0; if ((pLowIoContext->ParamsFor.FsCtl.pInputBuffer == NULL) || (pLowIoContext->ParamsFor.FsCtl.InputBufferLength < sizeof(FILE_PIPE_WAIT_FOR_BUFFER))) { Status = STATUS_INVALID_PARAMETER; } else { // Set up the transaction name to reflect the name of the pipe // on which the wait operation is being performed. pWaitBuffer = (PFILE_PIPE_WAIT_FOR_BUFFER)pLowIoContext->ParamsFor.FsCtl.pInputBuffer; if (pWaitBuffer->NameLength + s_NamedPipeTransactionName.Length > MAXUSHORT || pWaitBuffer->NameLength - sizeof(WCHAR) > pLowIoContext->ParamsFor.FsCtl.InputBufferLength - sizeof(FILE_PIPE_WAIT_FOR_BUFFER)) { // if the name is too long to be put on a UNICIDE string, // or the name length doesn't match the buffer length Status = STATUS_INVALID_PARAMETER; } } if (Status == STATUS_MORE_PROCESSING_REQUIRED) { // In the case of Wait FSCTL a reconnection attempt will be made // if required ReestablishConnectionIfRequired = TRUE; TransactionName.Length = (USHORT)(s_NamedPipeTransactionName.Length + pWaitBuffer->NameLength); TransactionName.MaximumLength = TransactionName.Length; TransactionName.Buffer = (PWCHAR)RxAllocatePool(PagedPool,TransactionName.Length); if (TransactionName.Buffer != NULL) { fTransactioNameBufferAllocated = TRUE; RtlCopyMemory(TransactionName.Buffer, s_NamedPipeTransactionName.Buffer, s_NamedPipeTransactionName.Length); RtlCopyMemory( (PBYTE)TransactionName.Buffer + s_NamedPipeTransactionName.Length, pWaitBuffer->Name, pWaitBuffer->NameLength); } else { Status = STATUS_INSUFFICIENT_RESOURCES; } if (pWaitBuffer->TimeoutSpecified) { LARGE_INTEGER TimeWorkspace; LARGE_INTEGER WaitForever; WaitForever.LowPart = 0; WaitForever.HighPart =0x80000000; // Avoid negate of "WaitForever" since this generates an integer // overflow exception on some machines. if (pWaitBuffer->Timeout.QuadPart != WaitForever.QuadPart) { TimeWorkspace.QuadPart = -pWaitBuffer->Timeout.QuadPart / 10000; if ( TimeWorkspace.HighPart) { // Tried to specify a larger timeout than we can select. // set it to the Maximum we can request TimeoutIntervalInMilliSeconds = 0xfffffffe; } else { TimeoutIntervalInMilliSeconds = TimeWorkspace.LowPart; } } } else { TimeoutIntervalInMilliSeconds = 0; } } } break; case FSCTL_PIPE_ASSIGN_EVENT : case FSCTL_PIPE_QUERY_EVENT : case FSCTL_PIPE_IMPERSONATE : case FSCTL_PIPE_SET_CLIENT_PROCESS : case FSCTL_PIPE_QUERY_CLIENT_PROCESS : // These FSCTL's have not been implemented so far in NT. They will be implemented // in a future release. Status = STATUS_INVALID_PARAMETER; RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Unimplemented FS control code\n")); break; case FSCTL_PIPE_DISCONNECT : case FSCTL_PIPE_LISTEN : Status = STATUS_INVALID_PARAMETER; RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Invalid FS control code for redirector\n")); break; default: RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: Invalid FS control code\n")); Status = STATUS_INVALID_PARAMETER; break; } if (Status == STATUS_MORE_PROCESSING_REQUIRED) { if (ReestablishConnectionIfRequired) { if (capFobx != NULL) { Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot); } else { Status = STATUS_SUCCESS; } } else { Status = STATUS_SUCCESS; } if (Status == STATUS_SUCCESS) { PSMB_TRANSACTION_OPTIONS pTransactionOptions; PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT pFsCtlCompletionContext; PSMB_TRANSACTION_RESUMPTION_CONTEXT pResumptionContext; RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl: TransactionName %ws Length %ld\n", TransactionName.Buffer,TransactionName.Length)); pFsCtlCompletionContext = (PSMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT) RxAllocatePoolWithTag( NonPagedPool, sizeof(SMB_NAMED_PIPE_FSCTL_COMPLETION_CONTEXT), MRXSMB_FSCTL_POOLTAG); if (pFsCtlCompletionContext != NULL) { pResumptionContext = &pFsCtlCompletionContext->ResumptionContext; pTransactionOptions = &(pFsCtlCompletionContext->Options); if (FsControlCode != FSCTL_PIPE_PEEK) { // The reference count is set to 2. one for the async // completion routine and one for the tail completion routine pFsCtlCompletionContext->pRxContext = RxContext; pFsCtlCompletionContext->ReferenceCount = 2; SmbCeInitializeAsynchronousTransactionResumptionContext( pResumptionContext, MRxSmbNamedPipeFsControlCompletion, pFsCtlCompletionContext); } else { // Currently PEEK operations are synchronous pFsCtlCompletionContext->pRxContext = NULL; pFsCtlCompletionContext->ReferenceCount = 1; } *pTransactionOptions = RxDefaultTransactionOptions; pTransactionOptions->NtTransactFunction = 0; // TRANSACT2/TRANSACT. pTransactionOptions->pTransactionName = &TransactionName; pTransactionOptions->Flags = SMB_XACT_FLAGS_FID_NOT_NEEDED; pTransactionOptions->TimeoutIntervalInMilliSeconds = TimeoutIntervalInMilliSeconds; if (TransactionName.Buffer != s_NamedPipeTransactionName.Buffer) { pFsCtlCompletionContext->pTransactionNameBuffer = TransactionName.Buffer; } else { pFsCtlCompletionContext->pTransactionNameBuffer = NULL; } if (FsControlCode != FSCTL_PIPE_PEEK) { Status = SmbCeAsynchronousTransact( RxContext, // the RXContext for the transaction pTransactionOptions, // transaction options Setup, // the setup buffer sizeof(Setup), // setup buffer length NULL, 0, pInputParamBuffer, // Input Param Buffer InputParamBufferLength, // Input param buffer length pOutputParamBuffer, // Output param buffer OutputParamBufferLength, // output param buffer length pInputDataBuffer, // Input data buffer InputDataBufferLength, // Input data buffer length pOutputDataBuffer, // output data buffer OutputDataBufferLength, // output data buffer length pResumptionContext // the resumption context ); if (Status != STATUS_PENDING) { pFsCtlCompletionContext->ResumptionContext.FinalStatusFromServer = Status; } MRxSmbNamedPipeFsControlCompletion(pFsCtlCompletionContext); Status = STATUS_PENDING; } else { Status = SmbCeTransact( RxContext, // the RXContext for the transaction pTransactionOptions, // transaction options Setup, // the setup buffer sizeof(Setup), // setup buffer length NULL, 0, pInputParamBuffer, // Input Param Buffer InputParamBufferLength, // Input param buffer length pOutputParamBuffer, // Output param buffer OutputParamBufferLength, // output param buffer length pInputDataBuffer, // Input data buffer InputDataBufferLength, // Input data buffer length pOutputDataBuffer, // output data buffer OutputDataBufferLength, // output data buffer length pResumptionContext // the resumption context ); switch (FsControlCode) { case FSCTL_PIPE_PEEK: { // In the case of FSCTL_PIPE_PEEK post processing is required to package the // results and also handle the idiosyncracies of the different servers. // e.g., // Os/2 servers will allow PeekNamedPipe on closed pipes to succeed // even if the server side of the pipe is closed. // // If we get the status PIPE_STATE_CLOSING from the server, then // we need to return an error of STATUS_PIPE_DISCONNECTED, as this // is what NPFS will do. if (NT_SUCCESS(Status) || (Status == RX_MAP_STATUS(BUFFER_OVERFLOW))) { if (pResumptionContext->ParameterBytesReceived >= sizeof(RESP_PEEK_NMPIPE)) { if ((SmbGetAlignedUshort(&PeekResponse.NamedPipeState) & PIPE_STATE_CLOSING) && (PeekResponse.ReadDataAvailable == 0)) { Status = STATUS_PIPE_DISCONNECTED; } else { PFILE_PIPE_PEEK_BUFFER pPeekBuffer; pPeekBuffer = (PFILE_PIPE_PEEK_BUFFER)pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; pPeekBuffer->NamedPipeState = (ULONG)SmbGetAlignedUshort(&PeekResponse.NamedPipeState); pPeekBuffer->ReadDataAvailable = (ULONG)PeekResponse.ReadDataAvailable; pPeekBuffer->NumberOfMessages = MAXULONG; pPeekBuffer->MessageLength = (ULONG)PeekResponse.MessageLength; if (PeekResponse.MessageLength > OutputDataBufferLength) { Status = STATUS_BUFFER_OVERFLOW; } } } RxContext->InformationToReturn = FIELD_OFFSET(FILE_PIPE_PEEK_BUFFER, Data[0]) + pResumptionContext->DataBytesReceived; } } break; default: RxContext->InformationToReturn = pResumptionContext->DataBytesReceived; break; } MRxSmbNamedPipeFsControlCompletion(pFsCtlCompletionContext); } } else { if (fTransactioNameBufferAllocated) { RxFreePool(TransactionName.Buffer); } Status = STATUS_INSUFFICIENT_RESOURCES; } } } if (!NT_SUCCESS(Status)) { if (Status == STATUS_INVALID_HANDLE) { Status = STATUS_INVALID_NETWORK_RESPONSE; } RxDbgTrace( 0, Dbg, ("MRxSmbNamedPipeFsControl(%ld): Failed .. returning %lx\n",FsControlCode,Status)); } RxDbgTrace(-1, Dbg, ("MRxSmbNamedPipeFsControl exit...st=%08lx\n", Status)); return Status; } #ifdef _WIN64 typedef struct _LMR_TRANSACTION_32 { ULONG Type; // Type of structure ULONG Size; // Size of fixed portion of structure ULONG Version; // Structure version. ULONG NameLength; // Number of bytes in name (in path // format, e.g., \server\pipe\netapi\4) ULONG NameOffset; // Offset of name in buffer. BOOLEAN ResponseExpected; // Should remote system respond? ULONG Timeout; // Timeout time in milliseconds. ULONG SetupWords; // Number of trans setup words (may be // 0). (setup words are input/output.) ULONG SetupOffset; // Offset of setup (may be 0 for none). ULONG MaxSetup; // Size of setup word array (may be 0). ULONG ParmLength; // Input param area length (may be 0). void * POINTER_32 ParmPtr; // Input parameter area (may be NULL). ULONG MaxRetParmLength; // Output param. area length (may be 0). ULONG DataLength; // Input data area length (may be 0). void * POINTER_32 DataPtr; // Input data area (may be NULL). ULONG MaxRetDataLength; // Output data area length (may be 0). void * POINTER_32 RetDataPtr; // Output data area (may be NULL). } LMR_TRANSACTION_32, *PLMR_TRANSACTION_32; #endif NTSTATUS MRxSmbFsCtlUserTransact(PRX_CONTEXT RxContext) /*++ Routine Description: This routine issues what is called a UserTransaction against the server that is serving the connection for this file. very strange............. Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation --*/ { RxCaptureFobx; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; UNICODE_STRING TransactionName; LMR_TRANSACTION InputBuffer; ULONG InputBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; ULONG SizeOfLmrTransaction = 0; NTSTATUS Status; PAGED_CODE(); if( pLowIoContext->ParamsFor.FsCtl.pInputBuffer == NULL ) { return (Status = STATUS_INVALID_PARAMETER); } InputBuffer = *((PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer); #ifdef _WIN64 if (IoIs32bitProcess(RxContext->CurrentIrp)) { PLMR_TRANSACTION_32 InputBuffer32 = (PLMR_TRANSACTION_32)pLowIoContext->ParamsFor.FsCtl.pInputBuffer; InputBuffer.Type = InputBuffer32->Type; InputBuffer.Size = InputBuffer32->Size; InputBuffer.Version = InputBuffer32->Version; InputBuffer.NameLength = InputBuffer32->NameLength; InputBuffer.NameOffset = InputBuffer32->NameOffset; InputBuffer.ResponseExpected = InputBuffer32->ResponseExpected; InputBuffer.Timeout = InputBuffer32->Timeout; InputBuffer.SetupWords = InputBuffer32->SetupWords; InputBuffer.SetupOffset = InputBuffer32->SetupOffset; InputBuffer.MaxSetup = InputBuffer32->MaxSetup; InputBuffer.ParmLength = InputBuffer32->ParmLength; InputBuffer.ParmPtr = (PVOID)InputBuffer32->ParmPtr; InputBuffer.MaxRetParmLength = InputBuffer32->MaxRetParmLength; InputBuffer.DataLength = InputBuffer32->DataLength; InputBuffer.DataPtr = (PVOID)InputBuffer32->DataPtr; InputBuffer.MaxRetDataLength = InputBuffer32->MaxRetDataLength; InputBuffer.RetDataPtr = (PVOID)InputBuffer32->RetDataPtr; SizeOfLmrTransaction = sizeof(LMR_TRANSACTION_32); } else { SizeOfLmrTransaction = sizeof(LMR_TRANSACTION); } #else SizeOfLmrTransaction = sizeof(LMR_TRANSACTION); #endif RxDbgTrace(+1, Dbg, ("MRxSmbFsCtlUserTransact...\n")); if (InputBufferLength < SizeOfLmrTransaction) { return(Status = STATUS_INVALID_PARAMETER); } if (InputBufferLength - SizeOfLmrTransaction < InputBuffer.NameLength) { return(Status = STATUS_BUFFER_TOO_SMALL); } if ((InputBuffer.Type != TRANSACTION_REQUEST) || (InputBuffer.Version != TRANSACTION_VERSION)) { return(Status = STATUS_INVALID_PARAMETER); } if (InputBuffer.NameOffset + InputBuffer.NameLength > InputBufferLength) { return(Status = STATUS_INVALID_PARAMETER); } if (InputBuffer.SetupOffset + InputBuffer.SetupWords > InputBufferLength) { return(Status = STATUS_INVALID_PARAMETER); } if (capFobx != NULL) { PMRX_V_NET_ROOT pVNetRoot = (PMRX_V_NET_ROOT)capFobx; if (NodeType(pVNetRoot) == RDBSS_NTC_V_NETROOT) { Status = SmbCeReconnect(pVNetRoot); } else { Status = SmbCeReconnect(capFobx->pSrvOpen->pVNetRoot); } if (Status != STATUS_SUCCESS) { return Status; } } Status = STATUS_MORE_PROCESSING_REQUIRED; TransactionName.MaximumLength = (USHORT)InputBuffer.NameLength; TransactionName.Length = (USHORT)InputBuffer.NameLength; TransactionName.Buffer = (PWSTR)(((PUCHAR)pLowIoContext->ParamsFor.FsCtl.pInputBuffer)+InputBuffer.NameOffset); if (Status == STATUS_MORE_PROCESSING_REQUIRED) { SMB_TRANSACTION_SEND_PARAMETERS SendParameters; SMB_TRANSACTION_RECEIVE_PARAMETERS ReceiveParameters; SMB_TRANSACTION_OPTIONS TransactionOptions = RxDefaultTransactionOptions; SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext; PUCHAR SetupBuffer = NULL; RxDbgTrace( 0, Dbg, ("MRxSmbFsCtlUserTransact: TransactionName %ws Length %ld\n", TransactionName.Buffer,TransactionName.Length)); TransactionOptions.NtTransactFunction = 0; // TRANSACT2/TRANSACT. TransactionOptions.pTransactionName = &TransactionName; TransactionOptions.Flags = SMB_XACT_FLAGS_FID_NOT_NEEDED; if (!InputBuffer.ResponseExpected) { TransactionOptions.Flags |= SMB_TRANSACTION_NO_RESPONSE; } TransactionOptions.TimeoutIntervalInMilliSeconds = InputBuffer.Timeout; SmbCeInitializeTransactionResumptionContext(&ResumptionContext); try { if (InputBuffer.SetupOffset){ SetupBuffer = (PUCHAR)pLowIoContext->ParamsFor.FsCtl.pInputBuffer+InputBuffer.SetupOffset; } if (SetupBuffer) { ProbeForWrite(SetupBuffer,InputBuffer.MaxSetup,1); } if (InputBuffer.ParmPtr) { ProbeForWrite(InputBuffer.ParmPtr,InputBuffer.MaxRetParmLength,1); } if (InputBuffer.RetDataPtr) { ProbeForWrite(InputBuffer.RetDataPtr,InputBuffer.MaxRetDataLength,1); } } except(EXCEPTION_EXECUTE_HANDLER) { return STATUS_INVALID_PARAMETER; } Status = SmbCeTransact( RxContext, &TransactionOptions, SetupBuffer, (USHORT)InputBuffer.SetupWords, SetupBuffer, InputBuffer.MaxSetup, InputBuffer.ParmPtr, InputBuffer.ParmLength, InputBuffer.ParmPtr, // the buffer for the param information InputBuffer.MaxRetParmLength,// the length of the param buffer InputBuffer.DataPtr, InputBuffer.DataLength, InputBuffer.RetDataPtr, // the buffer for data InputBuffer.MaxRetDataLength,// the length of the buffer &ResumptionContext); if (NT_SUCCESS(Status)) { //LowIoContext->ParamsFor.FsCtl.OutputBufferLength = ResumptionContext.DataBytesReceived; #ifdef _WIN64 if (IoIs32bitProcess(RxContext->CurrentIrp)) { PLMR_TRANSACTION_32 pInputBuffer = (PLMR_TRANSACTION_32)pLowIoContext->ParamsFor.FsCtl.pInputBuffer; pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived; pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived; pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived; //this seems like a bad return value for iostatus.information RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords; } else { PLMR_TRANSACTION pInputBuffer = (PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer; pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived; pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived; pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived; //this seems like a return value for iostatus.information RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords; } #else { PLMR_TRANSACTION pInputBuffer = (PLMR_TRANSACTION)pLowIoContext->ParamsFor.FsCtl.pInputBuffer; pInputBuffer->MaxRetParmLength = ResumptionContext.ParameterBytesReceived; pInputBuffer->MaxRetDataLength = ResumptionContext.DataBytesReceived; pInputBuffer->MaxSetup = ResumptionContext.SetupBytesReceived; //this seems like a return value for iostatus.information RxContext->InformationToReturn = SizeOfLmrTransaction + pInputBuffer->SetupWords; } #endif } } if (!NT_SUCCESS(Status)) { RxDbgTrace( 0, Dbg, ("MRxSmbFsCtlUserTransact: Failed .. returning %lx\n",Status)); } RxDbgTrace(-1, Dbg, ("MRxSmbFsCtlUserTransact exit...st=%08lx\n", Status)); return Status; } NTSTATUS MRxSmbMailSlotFsControl(PRX_CONTEXT RxContext) /*++ Routine Description: This routine handles all named pipe related FSCTL's Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation --*/ { PAGED_CODE(); return STATUS_NOT_IMPLEMENTED; } NTSTATUS MRxSmbDfsFsControl(PRX_CONTEXT RxContext) /*++ Routine Description: This routine handles all DFS related FSCTL's Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation --*/ { RxCaptureFobx; RxCaptureFcb; PMRX_SMB_SRV_OPEN pSmbSrvOpen; SMB_TRANSACTION_OPTIONS TransactionOptions = DEFAULT_TRANSACTION_OPTIONS; SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode; NTSTATUS Status; USHORT Setup; PBYTE pInputParamBuffer = NULL; PBYTE pOutputParamBuffer = NULL; PBYTE pInputDataBuffer = NULL; PBYTE pOutputDataBuffer = NULL; ULONG InputParamBufferLength = 0; ULONG OutputParamBufferLength = 0; ULONG InputDataBufferLength = 0; ULONG OutputDataBufferLength = 0; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbDfsFsControl...\n", 0)); if (RxContext->CurrentIrp->RequestorMode != KernelMode) { // these FSCTLS are only su[pported from a kernel mode component // because of parameter validation issues return STATUS_INVALID_DEVICE_REQUEST; } Status = STATUS_MORE_PROCESSING_REQUIRED; if (capFobx != NULL) { pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen); } else { pSmbSrvOpen = NULL; } pInputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer; InputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; switch (FsControlCode) { case FSCTL_DFS_GET_REFERRALS: { pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; } break; case FSCTL_DFS_REPORT_INCONSISTENCY: { PWCHAR pDfsPathName; // // The input buffer from Dfs contains the path name with the inconsistency // followed by the DFS_REFERRAL_V1 that has the inconsistency. The // path name is sent in the Parameter section, and the DFS_REFERRAL_V1 is // passed in the Data section. So, parse these two things out. // for (pDfsPathName = (PWCHAR) pInputParamBuffer; *pDfsPathName != UNICODE_NULL; pDfsPathName++) { NOTHING; } pDfsPathName++; // Get past the NULL char InputParamBufferLength = (ULONG) (((PCHAR)pDfsPathName) - ((PCHAR)pInputParamBuffer)); if (InputParamBufferLength >= pLowIoContext->ParamsFor.FsCtl.InputBufferLength) { Status = STATUS_INVALID_PARAMETER; } else { pInputDataBuffer = (PBYTE)pDfsPathName; InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength - InputParamBufferLength; } } break; default: ASSERT(!"Valid Dfs FSCTL"); } if (Status == STATUS_MORE_PROCESSING_REQUIRED) { Setup = TRANS2_GET_DFS_REFERRAL; TransactionOptions.NtTransactFunction = 0; // TRANSACT2/TRANSACT. TransactionOptions.pTransactionName = NULL; TransactionOptions.TimeoutIntervalInMilliSeconds = SMBCE_TRANSACTION_TIMEOUT_NOT_USED; Status = SmbCeTransact( RxContext, // the RXContext for the transaction &TransactionOptions, // transaction options &Setup, // the setup buffer sizeof(Setup), // setup buffer length NULL, 0, pInputParamBuffer, // Input Param Buffer InputParamBufferLength, // Input param buffer length pOutputParamBuffer, // Output param buffer OutputParamBufferLength, // output param buffer length pInputDataBuffer, // Input data buffer InputDataBufferLength, // Input data buffer length pOutputDataBuffer, // output data buffer OutputDataBufferLength, // output data buffer length &ResumptionContext // the resumption context ); if (!NT_SUCCESS(Status)) { RxDbgTrace( 0, Dbg, ("MRxSmbDfsFsControl(%ld): Failed .. returning %lx\n",FsControlCode,Status)); } else { RxContext->InformationToReturn = ResumptionContext.DataBytesReceived; } } RxDbgTrace(-1, Dbg, ("MRxSmbDfsFsControl exit...st=%08lx\n", Status)); return Status; } NTSTATUS MRxSmbFsControl(PRX_CONTEXT RxContext) /*++ Routine Description: This routine handles all the FSCTL's Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: Remoting of FSCTL's is permitted only to NT servers. --*/ { NTSTATUS Status = STATUS_SUCCESS; RxCaptureFcb; RxCaptureFobx; PMRX_SMB_SRV_OPEN pSmbSrvOpen; PSMBCEDB_SERVER_ENTRY pServerEntry; PFILE_OBJECT pTargetFileObject = NULL; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode; REQ_NT_IO_CONTROL FsCtlSetup; PBYTE pInputParamBuffer = NULL; PBYTE pOutputParamBuffer = NULL; PBYTE pInputDataBuffer = NULL; PBYTE pOutputDataBuffer = NULL; #ifdef _WIN64 PBYTE pThunkedInputData = NULL; ULONG ThunkedInputDataLength = 0; #endif ULONG InputParamBufferLength = 0; ULONG OutputParamBufferLength = 0; ULONG InputDataBufferLength = 0; ULONG OutputDataBufferLength = 0; USHORT FileOrTreeId; SMB_TRANSACTION_OPTIONS TransactionOptions = DEFAULT_TRANSACTION_OPTIONS; SMB_TRANSACTION_SEND_PARAMETERS SendParameters; SMB_TRANSACTION_RECEIVE_PARAMETERS ReceiveParameters; SMB_TRANSACTION_RESUMPTION_CONTEXT ResumptionContext; PAGED_CODE(); if (NodeType(capFcb) == RDBSS_NTC_DEVICE_FCB) { return STATUS_INVALID_DEVICE_REQUEST; } if ((FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) && (RxContext->MinorFunction != IRP_MN_TRACK_LINK)) { return STATUS_INVALID_DEVICE_REQUEST; } pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall); if (capFobx != NULL && MRxSmbIsThisADisconnectedOpen(capFobx->pSrvOpen)) { return STATUS_NOT_IMPLEMENTED; } RxDbgTrace(+1, Dbg, ("MRxSmbFsControl...Entry FsControlCode(%lx)\n", FsControlCode)); FsCtlSetup.IsFlags = 0; if (capFobx != NULL) { if (NodeType(capFobx) == RDBSS_NTC_V_NETROOT) { PMRX_V_NET_ROOT pVNetRoot = (PMRX_V_NET_ROOT)capFobx; PSMBCE_V_NET_ROOT_CONTEXT pVNetRootContext; pVNetRootContext = SmbCeGetAssociatedVNetRootContext(pVNetRoot); // It is a root open the tree id needs to be sent to the server. FileOrTreeId = pVNetRootContext->TreeId; } else { if (FsControlCode != FSCTL_LMR_GET_CONNECTION_INFO) { pSmbSrvOpen = MRxSmbGetSrvOpenExtension(capFobx->pSrvOpen); if (FlagOn(pSmbSrvOpen->Flags,SMB_SRVOPEN_FLAG_NOT_REALLY_OPEN)) { BOOLEAN FcbAcquired = FALSE; if (!RxIsFcbAcquiredExclusive(capFcb)) { // This assert does not take into account the fact that other threads may // own the resource shared, in which case we DO want to block and wait for // the resource. //ASSERT(!RxIsFcbAcquiredShared(capFcb)); Status = RxAcquireExclusiveFcbResourceInMRx( capFcb ); FcbAcquired = (Status == STATUS_SUCCESS); } else { FcbAcquired = TRUE; } if (FcbAcquired) { Status = MRxSmbDeferredCreate(RxContext); RxReleaseFcbResourceInMRx( capFcb ); } if (Status!=STATUS_SUCCESS) { goto FINALLY; } } FileOrTreeId = pSmbSrvOpen->Fid; } else { FileOrTreeId = 0; } } } else { FileOrTreeId = 0; } SmbPutAlignedUshort(&FsCtlSetup.Fid,FileOrTreeId); SmbPutAlignedUlong(&FsCtlSetup.FunctionCode,FsControlCode); FsCtlSetup.IsFsctl = TRUE; TransactionOptions.NtTransactFunction = NT_TRANSACT_IOCTL; TransactionOptions.pTransactionName = NULL; Status = STATUS_SUCCESS; switch (FsControlCode & 3) { case METHOD_NEITHER: { ULONG Device; // pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; // InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; // pInputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer; // InputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; // pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; // OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; // pOutputParamBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer; // OutputParamBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; Device = FsControlCode >> 16; if (Device != FILE_DEVICE_FILE_SYSTEM) { Status = STATUS_NOT_IMPLEMENTED; break; } } // fall thru.. for those FSContolcodes that belong to FILE_DEVICE_FILE_SYSTEM // for which METHOD_NEITHER is specified we treat them as METHOD_BUFFERED // Not Yet implemented case METHOD_BUFFERED: case METHOD_IN_DIRECT: case METHOD_OUT_DIRECT: { pInputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pInputBuffer; InputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.InputBufferLength; pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; } break; default: ASSERT(!"Valid Method for Fs Control"); Status = STATUS_INVALID_PARAMETER; break; } #ifdef _WIN64 pThunkedInputData = pInputDataBuffer; ThunkedInputDataLength = InputDataBufferLength; #endif // There is one FSCTL for which certain amount of preprocessing is required // This is because the I/O subsystem passes in the information as a file // object. The FID for the file object needs to be determined and the // appropriate FID passed to the server instead of the file object. if (FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) { PREMOTE_LINK_TRACKING_INFORMATION pRemoteLinkInformation; PMRX_FOBX pMRxFobx; PMRX_SRV_OPEN pSrvOpen; PMRX_SMB_SRV_OPEN pSmbSrvOpen; try { pRemoteLinkInformation = (PREMOTE_LINK_TRACKING_INFORMATION)pInputDataBuffer; if (pRemoteLinkInformation != NULL) { pTargetFileObject = (PFILE_OBJECT)pRemoteLinkInformation->TargetFileObject; if (pTargetFileObject != NULL) { // Deduce the FID and substitute it for the File Object before shipping // the FSCTL to the server. pMRxFobx = (PMRX_FOBX)pTargetFileObject->FsContext2; pSrvOpen = pMRxFobx->pSrvOpen; pSmbSrvOpen = MRxSmbGetSrvOpenExtension(pSrvOpen); if (pSmbSrvOpen != NULL) { pRemoteLinkInformation->TargetFileObject = (PVOID)(pSmbSrvOpen->Fid); } else { Status = STATUS_INVALID_PARAMETER; } } #ifdef _WIN64 if( NT_SUCCESS(Status) ) { ThunkedInputDataLength = InputDataBufferLength; pThunkedInputData = Smb64ThunkRemoteLinkTrackingInfo( pInputDataBuffer, &ThunkedInputDataLength, &Status ); } #endif } else { Status = STATUS_INVALID_PARAMETER; } } except(EXCEPTION_EXECUTE_HANDLER) { Status=STATUS_INVALID_PARAMETER; } } else if (FsControlCode == FSCTL_LMR_GET_CONNECTION_INFO) { PSMBCEDB_SERVER_ENTRY pServerEntry= SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall); Status = STATUS_INVALID_PARAMETER; pOutputDataBuffer = pLowIoContext->ParamsFor.FsCtl.pOutputBuffer; OutputDataBufferLength = pLowIoContext->ParamsFor.FsCtl.OutputBufferLength; if (pOutputDataBuffer && (OutputDataBufferLength==sizeof(LMR_CONNECTION_INFO_3))) { try { ProbeForWrite( pOutputDataBuffer, OutputDataBufferLength, 1); if (!memcmp(pOutputDataBuffer,EA_NAME_CSCAGENT,sizeof(EA_NAME_CSCAGENT))) { MRxSmbGetConnectInfoLevel3Fields( (PLMR_CONNECTION_INFO_3)(pOutputDataBuffer), pServerEntry, TRUE); Status = STATUS_SUCCESS; } } except(EXCEPTION_EXECUTE_HANDLER) { Status=STATUS_INVALID_PARAMETER; } } goto FINALLY; } if (NT_SUCCESS(Status)) { #ifdef _WIN64 ASSERT( !( (FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION) && (pThunkedInputData == NULL) ) ); #endif Status = SmbCeTransact( RxContext, &TransactionOptions, &FsCtlSetup, sizeof(FsCtlSetup), &FsCtlSetup, sizeof(FsCtlSetup), pInputParamBuffer, InputParamBufferLength, pOutputParamBuffer, OutputParamBufferLength, #ifndef _WIN64 pInputDataBuffer, InputDataBufferLength, #else pThunkedInputData, ThunkedInputDataLength, #endif pOutputDataBuffer, OutputDataBufferLength, &ResumptionContext); RxContext->InformationToReturn = ResumptionContext.DataBytesReceived; if (NT_SUCCESS(Status)) { PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen; PMRX_SMB_SRV_OPEN smbSrvOpen = MRxSmbGetSrvOpenExtension(SrvOpen); // invalidate the name based file info cache since it could change the attribute // of the file on the server, i.e. FILE_ATTRIBUTE_COMPRESSED. MRxSmbInvalidateFileInfoCache(RxContext); // update the Fcb in case of reuse since the time stamp may have changed ClearFlag(capFcb->FcbState,FCB_STATE_TIME_AND_SIZE_ALREADY_SET); if( RxContext->InformationToReturn > OutputDataBufferLength ) { Status = STATUS_BUFFER_TOO_SMALL; } } if( !NT_SUCCESS( Status ) ) { // RxContext->InformationToReturn = 0; RxDbgTrace(0,Dbg,("MRxSmbFsControl: Transaction Request Completion Status %lx\n",Status)); } } FINALLY: if( FsControlCode == FSCTL_LMR_SET_LINK_TRACKING_INFORMATION ) { #ifdef _WIN64 Smb64ReleaseThunkData( pThunkedInputData ); #endif if( pTargetFileObject != NULL ) { PREMOTE_LINK_TRACKING_INFORMATION pRemoteLinkInformation; pRemoteLinkInformation = (PREMOTE_LINK_TRACKING_INFORMATION)pInputDataBuffer; pRemoteLinkInformation->TargetFileObject = pTargetFileObject; } } RxDbgTrace(-1, Dbg, ("MRxSmbFsControl...Exit\n")); return Status; } #if DBG NTSTATUS MRxSmbTestForLowIoIoctl( IN PRX_CONTEXT RxContext ) { NTSTATUS Status = STATUS_SUCCESS; RxCaptureFcb;RxCaptureFobx; PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext; PSZ Buffer = (PSZ)(LowIoContext->ParamsFor.IoCtl.pInputBuffer); ULONG OutputBufferLength = LowIoContext->ParamsFor.IoCtl.OutputBufferLength; ULONG InputBufferLength = LowIoContext->ParamsFor.IoCtl.InputBufferLength; UNICODE_STRING u; PUNICODE_STRING FileName = GET_ALREADY_PREFIXED_NAME(capFobx->pSrvOpen,capFcb); ULONG ReturnLength; PAGED_CODE(); ReturnLength = OutputBufferLength; if (ReturnLength > FileName->Length) { ReturnLength = FileName->Length; } RxDbgTrace(0, Dbg, ("Here in MRxSmbTestForLowIoIoctl %s, obl = %08lx, rl=%08lx\n", Buffer, OutputBufferLength, ReturnLength)); // return an obvious string to make sure that darryl is copying the results out correctly // need to check the lengths i.e. need outputl<=inputl; also need to check that count and buffer // are aligned for wchar RtlCopyMemory(Buffer,FileName->Buffer,ReturnLength); u.Buffer = (PWCHAR)(Buffer); u.Length = u.MaximumLength = (USHORT)ReturnLength; RtlUpcaseUnicodeString(&u,&u,FALSE); RxContext->InformationToReturn = //LowIoContext->ParamsFor.IoCtl.OutputBufferLength = ReturnLength; return(Status); } #endif //if DBG NTSTATUS MRxSmbIoCtl( IN OUT PRX_CONTEXT RxContext) /*++ Routine Description: This routine performs an IOCTL operation. Currently, no calls are remoted; in fact, the only call accepted is for debugging. Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: --*/ { NTSTATUS Status = STATUS_INVALID_DEVICE_REQUEST; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG IoControlCode = pLowIoContext->ParamsFor.IoCtl.IoControlCode; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbIoCtl...\n", 0)); RxDbgTrace( 0, Dbg, ("MRxSmbIoCtl = %08lx\n", IoControlCode)); switch (IoControlCode) { #if DBG case IOCTL_LMMR_TESTLOWIO: Status = MRxSmbTestForLowIoIoctl(RxContext); break; #endif //if DBG default: break; } RxDbgTrace(-1, Dbg, ("MRxSmbIoCtl -> %08lx\n", Status )); return Status; } NTSTATUS MRxSmbGetPrintJobId( IN OUT PRX_CONTEXT RxContext) /*++ Routine Description: This routine performs an FSCTL operation (remote) on a file across the network Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: The FSCTL's handled by a mini rdr can be classified into one of two categories. In the first category are those FSCTL's whose implementation are shared between RDBSS and the mini rdr's and in the second category are those FSCTL's which are totally implemented by the mini rdr's. To this a third category can be added, i.e., those FSCTL's which should never be seen by the mini rdr's. The third category is solely intended as a debugging aid. The FSCTL's handled by a mini rdr can be classified based on functionality --*/ { NTSTATUS Status; BOOLEAN FinalizationComplete; PSMB_PSE_ORDINARY_EXCHANGE OrdinaryExchange = NULL; PSMBSTUFFER_BUFFER_STATE StufferState; RxCaptureFobx; RxCaptureFcb; PIO_STACK_LOCATION IrpSp = RxContext->CurrentIrpSp; PSMBCEDB_SERVER_ENTRY pServerEntry; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbGetPrintJobId\n", 0 )); if (capFcb == NULL || capFobx == NULL) { return STATUS_INVALID_PARAMETER; } if (NodeType(capFcb) == RDBSS_NTC_DEVICE_FCB) { return STATUS_INVALID_DEVICE_REQUEST; } pServerEntry = SmbCeGetAssociatedServerEntry(capFcb->pNetRoot->pSrvCall); if (FlagOn(pServerEntry->Server.DialectFlags,DF_NT_SMBS)) { Status = MRxSmbFsControl(RxContext); goto FINALLY; } if (IrpSp->Parameters.FileSystemControl.OutputBufferLength < sizeof(QUERY_PRINT_JOB_INFO) ) { Status = STATUS_BUFFER_TOO_SMALL; goto FINALLY; } Status= SmbPseCreateOrdinaryExchange( RxContext, capFobx->pSrvOpen->pVNetRoot, SMBPSE_OE_FROM_GETPRINTJOBID, MRxSmbCoreIoCtl, &OrdinaryExchange ); if (Status != STATUS_SUCCESS) { RxDbgTrace(-1, Dbg, ("Couldn't get the smb buf!\n")); goto FINALLY; } OrdinaryExchange->AssociatedStufferState.CurrentCommand = SMB_COM_NO_ANDX_COMMAND; StufferState = &OrdinaryExchange->AssociatedStufferState; MRxSmbSetInitialSMB(StufferState STUFFERTRACE(Dbg,'FC')); Status = SmbPseInitiateOrdinaryExchange(OrdinaryExchange); FinalizationComplete = SmbPseFinalizeOrdinaryExchange(OrdinaryExchange); ASSERT(FinalizationComplete); FINALLY: RxDbgTrace(-1, Dbg, ("MRxSmbIsValidDirectory exit with status=%08lx\n", Status )); return(Status); } #define SPOOLER_DEVICE 0x53 #define GET_PRINTER_ID 0x60 typedef struct _SMB_RESP_PRINT_JOB_ID { USHORT JobId; UCHAR ServerName[LM20_CNLEN+1]; UCHAR QueueName[LM20_QNLEN+1]; UCHAR Padding; // Unknown what this padding is.. } SMB_RESP_PRINT_JOB_ID, *PSMB_RESP_PRINT_JOB_ID; NTSTATUS MRxSmbCoreIoCtl( SMBPSE_ORDINARY_EXCHANGE_ARGUMENT_SIGNATURE ) /*++ Routine Description: This is the start routine for SMB IOCTL. This initiates the construction of the appropriate SMB. Arguments: pExchange - the exchange instance Return Value: NTSTATUS - The return status for the operation --*/ { NTSTATUS Status = RX_MAP_STATUS(NOT_IMPLEMENTED); PSMBSTUFFER_BUFFER_STATE StufferState = &OrdinaryExchange->AssociatedStufferState; RxCaptureFcb; RxCaptureFobx; PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen; PMRX_SMB_SRV_OPEN smbSrvOpen = MRxSmbGetSrvOpenExtension(SrvOpen); PMRX_SMB_FOBX smbFobx = MRxSmbGetFileObjectExtension(capFobx); PSMBCE_SERVER pServer = SmbCeGetExchangeServer(OrdinaryExchange); ULONG SmbLength; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbCoreIoCtl\n", 0 )); switch (OrdinaryExchange->EntryPoint) { case SMBPSE_OE_FROM_GETPRINTJOBID: COVERED_CALL( MRxSmbStartSMBCommand( StufferState, SetInitialSMB_ForReuse, SMB_COM_IOCTL, SMB_REQUEST_SIZE(IOCTL), NO_EXTRA_DATA, SMB_BEST_ALIGNMENT(1,0), RESPONSE_HEADER_SIZE_NOT_SPECIFIED, 0,0,0,0 STUFFERTRACE(Dbg,'FC')) ); MRxSmbDumpStufferState (1100,"SMB w/ GFA before stuffing",StufferState); //CODE.IMPROVEMENT if this is truly core, we have to copy the name since its in UNICODE // otherwise, we don't need to copy the name here, we can just Mdl like in writes MRxSmbStuffSMB (StufferState, "0wwwwwwwwwwwwwwB!", // 0 UCHAR WordCount; // Count of parameter words = 8 smbSrvOpen->Fid, // w _USHORT( Fid ); // File handle SPOOLER_DEVICE, // w _USHORT( Category); GET_PRINTER_ID, // w _USHORT( Function ); // Device function 0, // w _USHORT( TotalParameterCount ); // Total parameter bytes being sent 0, // w _USHORT( TotalDataCount ); // Total data bytes being sent 0, // w _USHORT( MaxParameterCount ); // Max parameter bytes to return 0, // w _USHORT( MaxDataCount ); // Max data bytes to return 0, // w _ULONG ( Timeout ); 0, // w _USHORT( Reserved ); 0, // w _USHORT( ParameterCount ); // Parameter bytes sent this buffer 0, // w _USHORT( ParameterOffset ); // Offset (from header start) to params 0, // w _USHORT( DataCount ); // Data bytes sent this buffer 0, // w _USHORT( DataOffset ); // Offset (from header start) to data 0, // w _USHORT( ByteCount ); // Count of data bytes SMB_WCT_CHECK(14) 0 // _USHORT( ByteCount ); // Count of data bytes; min = 0 // UCHAR Buffer[1]; // Reserved buffer ); break; default: Status = STATUS_NOT_IMPLEMENTED; } if (Status == STATUS_SUCCESS) { MRxSmbDumpStufferState (700,"SMB w/ GFA after stuffing",StufferState); Status = SmbPseOrdinaryExchange( SMBPSE_ORDINARY_EXCHANGE_ARGUMENTS, SMBPSE_OETYPE_IOCTL ); } FINALLY: RxDbgTrace(-1, Dbg, ("MRxSmbSynchronousGetFileAttributes exiting.......OE=%08lx, st=%08lx\n",OrdinaryExchange,Status)); return(Status); } NTSTATUS MRxSmbFinishCoreIoCtl( PSMB_PSE_ORDINARY_EXCHANGE OrdinaryExchange, PRESP_IOCTL Response ) /*++ Routine Description: This routine copies the print job ID and server and queue name to the user buffer. Arguments: OrdinaryExchange - the exchange instance Response - the response Return Value: RXSTATUS - The return status for the operation --*/ { NTSTATUS Status = RX_MAP_STATUS(SUCCESS); PRX_CONTEXT RxContext = OrdinaryExchange->RxContext; PIRP Irp = RxContext->CurrentIrp; PIO_STACK_LOCATION IrpSp = RxContext->CurrentIrpSp; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbFinishCoreIoCtl\n", 0 )); SmbPseOEAssertConsistentLinkageFromOE("MRxSmbFinishCoreIoCtl:"); switch (OrdinaryExchange->EntryPoint) { case SMBPSE_OE_FROM_GETPRINTJOBID: if (Response->WordCount != 8 || SmbGetUshort(&Response->DataCount) != sizeof(SMB_RESP_PRINT_JOB_ID)) { Status = STATUS_INVALID_NETWORK_RESPONSE; OrdinaryExchange->Status = STATUS_INVALID_NETWORK_RESPONSE; } else { OEM_STRING OemString; UNICODE_STRING UnicodeString; PQUERY_PRINT_JOB_INFO OutputBuffer = Irp->UserBuffer; PSMB_RESP_PRINT_JOB_ID RespPrintJobId = (PSMB_RESP_PRINT_JOB_ID)((PUCHAR)Response+(Response->DataOffset-sizeof(SMB_HEADER))); OutputBuffer->JobId = RespPrintJobId->JobId; RtlInitAnsiString(&OemString, RespPrintJobId->ServerName); UnicodeString.Buffer = OutputBuffer->ServerName; UnicodeString.MaximumLength = sizeof(OutputBuffer->ServerName); Status = RtlOemStringToUnicodeString(&UnicodeString, &OemString, FALSE); if (Status == STATUS_SUCCESS) { RtlInitAnsiString(&OemString, RespPrintJobId->QueueName); UnicodeString.Buffer = OutputBuffer->QueueName; UnicodeString.MaximumLength = sizeof(OutputBuffer->QueueName); Status = RtlOemStringToUnicodeString(&UnicodeString, &OemString, FALSE); IrpSp->Parameters.FileSystemControl.InputBufferLength = sizeof(QUERY_PRINT_JOB_INFO); } } break; default: ASSERT(FALSE); Status = STATUS_INVALID_NETWORK_RESPONSE; OrdinaryExchange->Status = STATUS_INVALID_NETWORK_RESPONSE; } RxDbgTrace(-1, Dbg, ("MRxSmbFinishCoreIoCtl returning %08lx\n", Status )); return Status; } typedef struct _SecPkgContext_TargetInformation { unsigned long MarshalledTargetInfoLength; unsigned char SEC_FAR * MarshalledTargetInfo; } SecPkgContext_TargetInformation, SEC_FAR * PSecPkgContext_TargetInformation; NTSTATUS MRxSmbQueryTargetInfo( PRX_CONTEXT RxContext ) /*++ Routine Description: This routine performs a query target information operation against a connection Arguments: RxContext - the RDBSS context Return Value: RXSTATUS - The return status for the operation Notes: RDR gets the target information based on the security context of the connection and returns the marshalled target information on the output buffer. --*/ { PMRX_V_NET_ROOT pVNetRoot = NULL; PSMBCE_V_NET_ROOT_CONTEXT pVNetRootContext = NULL; NTSTATUS Status = STATUS_SUCCESS; SECURITY_STATUS SecStatus; SecPkgContext_TargetInformation SecTargetInfo; PLOWIO_CONTEXT pLowIoContext = &RxContext->LowIoContext; ULONG FsControlCode = pLowIoContext->ParamsFor.FsCtl.FsControlCode; PLMR_QUERY_TARGET_INFO LmrQueryTargetInfo = RxContext->CurrentIrp->UserBuffer; PAGED_CODE(); RxDbgTrace(+1, Dbg, ("MRxSmbQueryTargetInfo...\n", 0)); RxDbgTrace( 0, Dbg, ("MRxSmbQueryTargetInfo = %08lx\n", FsControlCode)); if (RxContext->CurrentIrp->RequestorMode != KernelMode) { // this FSCTLS is only supported from a kernel mode component return STATUS_INVALID_DEVICE_REQUEST; } if (LmrQueryTargetInfo == NULL) { return STATUS_INVALID_PARAMETER; } if (RxContext->pRelevantSrvOpen == NULL) { return STATUS_INVALID_PARAMETER; } pVNetRoot = (PMRX_V_NET_ROOT)RxContext->pRelevantSrvOpen->pVNetRoot; if (NodeType(pVNetRoot) != RDBSS_NTC_V_NETROOT) { return STATUS_INVALID_PARAMETER; } pVNetRootContext = (PSMBCE_V_NET_ROOT_CONTEXT)pVNetRoot->Context; SecStatus = QueryContextAttributesW( &pVNetRootContext->pSessionEntry->Session.SecurityContextHandle, SECPKG_ATTR_TARGET_INFORMATION, &SecTargetInfo); Status = MapSecurityError( SecStatus ); if (Status == STATUS_SUCCESS) { if (SecTargetInfo.MarshalledTargetInfoLength+sizeof(LMR_QUERY_TARGET_INFO) > LmrQueryTargetInfo->BufferLength) { LmrQueryTargetInfo->BufferLength = SecTargetInfo.MarshalledTargetInfoLength + sizeof(LMR_QUERY_TARGET_INFO); Status = STATUS_BUFFER_TOO_SMALL; } else { RtlCopyMemory(LmrQueryTargetInfo->TargetInfoMarshalled, SecTargetInfo.MarshalledTargetInfo, SecTargetInfo.MarshalledTargetInfoLength); LmrQueryTargetInfo->BufferLength = SecTargetInfo.MarshalledTargetInfoLength; } { SIZE_T MarshalledTargetInfoLength_SizeT; MarshalledTargetInfoLength_SizeT = SecTargetInfo.MarshalledTargetInfoLength; ZwFreeVirtualMemory( NtCurrentProcess(), &SecTargetInfo.MarshalledTargetInfo, &MarshalledTargetInfoLength_SizeT, MEM_RELEASE); ASSERT(MarshalledTargetInfoLength_SizeT <= MAXULONG); SecTargetInfo.MarshalledTargetInfoLength = (ULONG)MarshalledTargetInfoLength_SizeT; } } return Status; }