VirtualBox

source: vbox/trunk/src/VBox/Additions/WINNT/SharedFolders/driver/vbsf.cpp

Last change on this file was 100519, checked in by vboxsync, 10 months ago

Additions/WINNT/SharedFolders/driver: correct return code. bugref:10480
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 75.2 KB
Line 
1/* $Id: vbsf.cpp 100519 2023-07-11 16:30:49Z vboxsync $ */
2/** @file
3 * VirtualBox Windows Guest Shared Folders - File System Driver initialization and generic routines
4 */
5
6/*
7 * Copyright (C) 2012-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#include "vbsf.h"
33#include <iprt/initterm.h>
34#include <iprt/dbg.h>
35
36
37/*********************************************************************************************************************************
38* Structures and Typedefs *
39*********************************************************************************************************************************/
40/**
41 * The current state of the driver.
42 */
43typedef enum _MRX_VBOX_STATE_
44{
45 MRX_VBOX_STARTABLE,
46 MRX_VBOX_START_IN_PROGRESS,
47 MRX_VBOX_STARTED
48} MRX_VBOX_STATE, *PMRX_VBOX_STATE;
49
50
51/*********************************************************************************************************************************
52* Global Variables *
53*********************************************************************************************************************************/
54static MRX_VBOX_STATE VBoxMRxState = MRX_VBOX_STARTABLE;
55
56/**
57 * The VBoxSF dispatch table.
58 */
59static struct _MINIRDR_DISPATCH VBoxMRxDispatch;
60
61/**
62 * The VBoxSF device object.
63 */
64PRDBSS_DEVICE_OBJECT VBoxMRxDeviceObject;
65
66/** Pointer to CcCoherencyFlushAndPurgeCache if present in ntoskrnl. */
67PFNCCCOHERENCYFLUSHANDPURGECACHE g_pfnCcCoherencyFlushAndPurgeCache;
68
69/** The shared folder service client structure. */
70VBGLSFCLIENT g_SfClient;
71/** VMMDEV_HVF_XXX (set during init). */
72uint32_t g_fHostFeatures = 0;
73/** Last valid shared folders function number. */
74uint32_t g_uSfLastFunction = SHFL_FN_SET_FILE_SIZE;
75/** Shared folders features (SHFL_FEATURE_XXX). */
76uint64_t g_fSfFeatures = 0;
77
78
79static NTSTATUS VBoxMRxFsdDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
80{
81 NTSTATUS Status;
82#ifdef LOG_ENABLED
83 PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
84 Log(("VBOXSF: MRxFsdDispatch: major %d, minor %d: %s\n",
85 IrpSp->MajorFunction, IrpSp->MinorFunction, vbsfNtMajorFunctionName(IrpSp->MajorFunction, IrpSp->MinorFunction)));
86#endif
87
88 if (DeviceObject != (PDEVICE_OBJECT)VBoxMRxDeviceObject)
89 {
90 Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
91 Irp->IoStatus.Information = 0;
92 IoCompleteRequest(Irp, IO_NO_INCREMENT);
93
94 Log(("VBOXSF: MRxFsdDispatch: Invalid device request detected %p %p\n",
95 DeviceObject, (PDEVICE_OBJECT)VBoxMRxDeviceObject));
96
97 return STATUS_INVALID_DEVICE_REQUEST;
98 }
99
100 Status = RxFsdDispatch((PRDBSS_DEVICE_OBJECT)VBoxMRxDeviceObject, Irp);
101 Log(("VBOXSF: MRxFsdDispatch: Returned 0x%X\n", Status));
102 return Status;
103}
104
105static void VBoxMRxUnload(IN PDRIVER_OBJECT DriverObject)
106{
107 NTSTATUS Status;
108 UNICODE_STRING UserModeDeviceName;
109
110 Log(("VBOXSF: MRxUnload\n"));
111
112 if (VBoxMRxDeviceObject)
113 {
114 PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
115 pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)VBoxMRxDeviceObject + sizeof(RDBSS_DEVICE_OBJECT));
116 }
117
118 if (VBoxMRxDeviceObject)
119 {
120 PRX_CONTEXT RxContext;
121 RxContext = RxCreateRxContext(NULL, VBoxMRxDeviceObject, RX_CONTEXT_FLAG_IN_FSP);
122
123 if (RxContext != NULL)
124 {
125 Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
126
127 if (Status == STATUS_SUCCESS)
128 {
129 MRX_VBOX_STATE State;
130
131 State = (MRX_VBOX_STATE)InterlockedCompareExchange((LONG *)&VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
132
133 if (State != MRX_VBOX_STARTABLE)
134 Status = STATUS_REDIRECTOR_STARTED;
135 }
136
137 RxDereferenceAndDeleteRxContext(RxContext);
138 }
139 else
140 Status = STATUS_INSUFFICIENT_RESOURCES;
141
142 RxUnregisterMinirdr(VBoxMRxDeviceObject);
143 }
144
145 RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
146 Status = IoDeleteSymbolicLink(&UserModeDeviceName);
147 if (Status != STATUS_SUCCESS)
148 Log(("VBOXSF: MRxUnload: IoDeleteSymbolicLink Status 0x%08X\n", Status));
149
150 RxUnload(DriverObject);
151
152 VbglR0SfDisconnect(&g_SfClient);
153 VbglR0SfTerm();
154
155 Log(("VBOXSF: MRxUnload: VBoxSF.sys driver object %p almost unloaded, just RTR0Term left...\n", DriverObject));
156 RTR0Term(); /* No logging after this. */
157}
158
159static void vbsfInitMRxDispatch(void)
160{
161 Log(("VBOXSF: vbsfInitMRxDispatch: Called.\n"));
162
163 ZeroAndInitializeNodeType(&VBoxMRxDispatch, RDBSS_NTC_MINIRDR_DISPATCH, sizeof(MINIRDR_DISPATCH));
164
165 VBoxMRxDispatch.MRxFlags = RDBSS_MANAGE_NET_ROOT_EXTENSION | RDBSS_MANAGE_FCB_EXTENSION | RDBSS_MANAGE_FOBX_EXTENSION;
166
167 VBoxMRxDispatch.MRxSrvCallSize = 0;
168 VBoxMRxDispatch.MRxNetRootSize = sizeof(MRX_VBOX_NETROOT_EXTENSION);
169 VBoxMRxDispatch.MRxVNetRootSize = 0;
170 VBoxMRxDispatch.MRxFcbSize = sizeof(VBSFNTFCBEXT);
171 VBoxMRxDispatch.MRxSrvOpenSize = 0;
172 VBoxMRxDispatch.MRxFobxSize = sizeof(MRX_VBOX_FOBX);
173
174 VBoxMRxDispatch.MRxStart = VBoxMRxStart;
175 VBoxMRxDispatch.MRxStop = VBoxMRxStop;
176
177 VBoxMRxDispatch.MRxCreate = VBoxMRxCreate;
178 VBoxMRxDispatch.MRxCollapseOpen = VBoxMRxCollapseOpen;
179 VBoxMRxDispatch.MRxShouldTryToCollapseThisOpen = VBoxMRxShouldTryToCollapseThisOpen;
180 VBoxMRxDispatch.MRxFlush = VBoxMRxFlush;
181 VBoxMRxDispatch.MRxTruncate = VBoxMRxTruncate;
182 VBoxMRxDispatch.MRxCleanupFobx = VBoxMRxCleanupFobx;
183 VBoxMRxDispatch.MRxCloseSrvOpen = VBoxMRxCloseSrvOpen;
184 VBoxMRxDispatch.MRxDeallocateForFcb = VBoxMRxDeallocateForFcb;
185 VBoxMRxDispatch.MRxDeallocateForFobx = VBoxMRxDeallocateForFobx;
186 VBoxMRxDispatch.MRxForceClosed = VBoxMRxForceClosed;
187
188 VBoxMRxDispatch.MRxQueryDirectory = VBoxMRxQueryDirectory;
189 VBoxMRxDispatch.MRxQueryFileInfo = VBoxMRxQueryFileInfo;
190 VBoxMRxDispatch.MRxSetFileInfo = VBoxMRxSetFileInfo;
191 VBoxMRxDispatch.MRxSetFileInfoAtCleanup = VBoxMRxSetFileInfoAtCleanup;
192 VBoxMRxDispatch.MRxQueryEaInfo = VBoxMRxQueryEaInfo;
193 VBoxMRxDispatch.MRxSetEaInfo = VBoxMRxSetEaInfo;
194 VBoxMRxDispatch.MRxQuerySdInfo = VBoxMRxQuerySdInfo;
195 VBoxMRxDispatch.MRxSetSdInfo = VBoxMRxSetSdInfo;
196 VBoxMRxDispatch.MRxQueryVolumeInfo = VBoxMRxQueryVolumeInfo;
197
198 VBoxMRxDispatch.MRxComputeNewBufferingState = VBoxMRxComputeNewBufferingState;
199
200 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_READ] = VBoxMRxRead;
201 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_WRITE] = VBoxMRxWrite;
202 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_SHAREDLOCK] = VBoxMRxLocks;
203 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_EXCLUSIVELOCK] = VBoxMRxLocks;
204 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK] = VBoxMRxLocks;
205 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK_MULTIPLE] = VBoxMRxLocks;
206 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_FSCTL] = VBoxMRxFsCtl;
207 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_IOCTL] = VBoxMRxIoCtl;
208 VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_NOTIFY_CHANGE_DIRECTORY] = VBoxMRxNotifyChangeDirectory;
209
210 VBoxMRxDispatch.MRxExtendForCache = VBoxMRxExtendStub;
211 VBoxMRxDispatch.MRxExtendForNonCache = VBoxMRxExtendStub;
212 VBoxMRxDispatch.MRxCompleteBufferingStateChangeRequest = VBoxMRxCompleteBufferingStateChangeRequest;
213
214 VBoxMRxDispatch.MRxCreateVNetRoot = VBoxMRxCreateVNetRoot;
215 VBoxMRxDispatch.MRxFinalizeVNetRoot = VBoxMRxFinalizeVNetRoot;
216 VBoxMRxDispatch.MRxFinalizeNetRoot = VBoxMRxFinalizeNetRoot;
217 VBoxMRxDispatch.MRxUpdateNetRootState = VBoxMRxUpdateNetRootState;
218 VBoxMRxDispatch.MRxExtractNetRootName = VBoxMRxExtractNetRootName;
219
220 VBoxMRxDispatch.MRxCreateSrvCall = VBoxMRxCreateSrvCall;
221 VBoxMRxDispatch.MRxSrvCallWinnerNotify = VBoxMRxSrvCallWinnerNotify;
222 VBoxMRxDispatch.MRxFinalizeSrvCall = VBoxMRxFinalizeSrvCall;
223
224 VBoxMRxDispatch.MRxDevFcbXXXControlFile = VBoxMRxDevFcbXXXControlFile;
225
226 Log(("VBOXSF: vbsfInitMRxDispatch: Success.\n"));
227 return;
228}
229
230static BOOL vboxIsPrefixOK (const WCHAR *FilePathName, ULONG PathNameLength)
231{
232 BOOL PrefixOK;
233
234 /* The FilePathName here looks like: \vboxsrv\... */
235 if (PathNameLength >= 8 * sizeof (WCHAR)) /* Number of bytes in '\vboxsrv' unicode string. */
236 {
237 PrefixOK = (FilePathName[0] == L'\\');
238 PrefixOK &= (FilePathName[1] == L'V') || (FilePathName[1] == L'v');
239 PrefixOK &= (FilePathName[2] == L'B') || (FilePathName[2] == L'b');
240 PrefixOK &= (FilePathName[3] == L'O') || (FilePathName[3] == L'o');
241 PrefixOK &= (FilePathName[4] == L'X') || (FilePathName[4] == L'x');
242 PrefixOK &= (FilePathName[5] == L'S') || (FilePathName[5] == L's');
243 /* Both vboxsvr & vboxsrv are now accepted */
244 if ((FilePathName[6] == L'V') || (FilePathName[6] == L'v'))
245 {
246 PrefixOK &= (FilePathName[6] == L'V') || (FilePathName[6] == L'v');
247 PrefixOK &= (FilePathName[7] == L'R') || (FilePathName[7] == L'r');
248 }
249 else
250 {
251 PrefixOK &= (FilePathName[6] == L'R') || (FilePathName[6] == L'r');
252 PrefixOK &= (FilePathName[7] == L'V') || (FilePathName[7] == L'v');
253 }
254 if (PathNameLength > 8 * sizeof (WCHAR))
255 {
256 /* There is something after '\vboxsrv'. */
257 PrefixOK &= (FilePathName[8] == L'\\') || (FilePathName[8] == 0);
258 }
259 }
260 else
261 PrefixOK = FALSE;
262
263 return PrefixOK;
264}
265
266static NTSTATUS VBoxMRXDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
267{
268 NTSTATUS Status = STATUS_SUCCESS;
269
270 QUERY_PATH_REQUEST *pReq = NULL;
271 QUERY_PATH_REQUEST_EX *pReqEx = NULL;
272 QUERY_PATH_RESPONSE *pResp = NULL;
273
274 BOOL PrefixOK = FALSE;
275
276 PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
277
278 /* Make a local copy, it will be needed after the Irp completion. */
279 ULONG IoControlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
280
281 PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
282
283 Log(("VBOXSF: MRXDeviceControl: pDevObj %p, pDeviceExtension %p, code %x\n",
284 pDevObj, pDevObj->DeviceExtension, IoControlCode));
285
286 switch (IoControlCode)
287 {
288 case IOCTL_REDIR_QUERY_PATH_EX: /* Vista */
289 case IOCTL_REDIR_QUERY_PATH: /* XP and earlier */
290 {
291 /* This IOCTL is intercepted for 2 reasons:
292 * 1) Claim the vboxsvr and vboxsrv prefixes. All name-based operations for them
293 * will be routed to the VBox provider automatically without any prefix resolution
294 * since the prefix is already in the prefix cache.
295 * 2) Reject other prefixes immediately to speed up the UNC path resolution a bit,
296 * because RDBSS will not be involved then.
297 */
298
299 const WCHAR *FilePathName = NULL;
300 ULONG PathNameLength = 0;
301
302 if (pIrp->RequestorMode != KernelMode)
303 {
304 /* MSDN: Network redirectors should only honor kernel-mode senders of this IOCTL, by verifying
305 * that RequestorMode member of the IRP structure is KernelMode.
306 */
307 Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH(_EX): not kernel mode!!!\n",
308 pStack->Parameters.DeviceIoControl.InputBufferLength));
309 /* Continue to RDBSS. */
310 break;
311 }
312
313 if (IoControlCode == IOCTL_REDIR_QUERY_PATH)
314 {
315 Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: Called (pid %x).\n", IoGetCurrentProcess()));
316
317 if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST))
318 {
319 Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: short input buffer %d.\n",
320 pStack->Parameters.DeviceIoControl.InputBufferLength));
321 /* Continue to RDBSS. */
322 break;
323 }
324
325 pReq = (QUERY_PATH_REQUEST *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
326
327 Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReq->PathNameLength));
328 Log(("VBOXSF: MRxDeviceControl: SecurityContext = %p.\n", pReq->SecurityContext));
329 Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReq->PathNameLength / sizeof (WCHAR), pReq->FilePathName));
330
331 FilePathName = pReq->FilePathName;
332 PathNameLength = pReq->PathNameLength;
333 }
334 else
335 {
336 Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: Called.\n"));
337
338 if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST_EX))
339 {
340 Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: short input buffer %d.\n",
341 pStack->Parameters.DeviceIoControl.InputBufferLength));
342 /* Continue to RDBSS. */
343 break;
344 }
345
346 pReqEx = (QUERY_PATH_REQUEST_EX *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
347
348 Log(("VBOXSF: MRxDeviceControl: pSecurityContext = %p.\n", pReqEx->pSecurityContext));
349 Log(("VBOXSF: MRxDeviceControl: EaLength = %d.\n", pReqEx->EaLength));
350 Log(("VBOXSF: MRxDeviceControl: pEaBuffer = %p.\n", pReqEx->pEaBuffer));
351 Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReqEx->PathName.Length));
352 Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReqEx->PathName.Length / sizeof (WCHAR), pReqEx->PathName.Buffer));
353
354 FilePathName = pReqEx->PathName.Buffer;
355 PathNameLength = pReqEx->PathName.Length;
356 }
357
358 pResp = (QUERY_PATH_RESPONSE *)pIrp->UserBuffer;
359
360 PrefixOK = vboxIsPrefixOK (FilePathName, PathNameLength);
361 Log(("VBOXSF: MRxDeviceControl PrefixOK %d\n", PrefixOK));
362
363 if (!PrefixOK)
364 {
365 /* Immediately fail the IOCTL with STATUS_BAD_NETWORK_NAME as recommended by MSDN.
366 * No need to involve RDBSS.
367 */
368 Status = STATUS_BAD_NETWORK_NAME;
369
370 pIrp->IoStatus.Status = Status;
371 pIrp->IoStatus.Information = 0;
372
373 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
374
375 Log(("VBOXSF: MRxDeviceControl: returned STATUS_BAD_NETWORK_NAME\n"));
376 return Status;
377 }
378
379 Log(("VBOXSF: MRxDeviceControl pResp %p verifying the path.\n", pResp));
380 if (pResp)
381 {
382 /* Always claim entire \vboxsrv prefix. The LengthAccepted initially is equal to entire path.
383 * Here it is assigned to the length of \vboxsrv prefix.
384 */
385 pResp->LengthAccepted = 8 * sizeof (WCHAR);
386
387 Status = STATUS_SUCCESS;
388
389 pIrp->IoStatus.Status = Status;
390 pIrp->IoStatus.Information = 0;
391
392 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
393
394 Log(("VBOXSF: MRxDeviceControl: claiming the path.\n"));
395 return Status;
396 }
397
398 /* No pResp pointer, should not happen. Just a precaution. */
399 Status = STATUS_INVALID_PARAMETER;
400
401 pIrp->IoStatus.Status = Status;
402 pIrp->IoStatus.Information = 0;
403
404 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
405
406 Log(("VBOXSF: MRxDeviceControl: returned STATUS_INVALID_PARAMETER\n"));
407 return Status;
408 }
409
410 default:
411 break;
412 }
413
414 /* Pass the IOCTL to RDBSS. */
415 if (pDeviceExtension && pDeviceExtension->pfnRDBSSDeviceControl)
416 {
417 Log(("VBOXSF: MRxDeviceControl calling RDBSS %p\n", pDeviceExtension->pfnRDBSSDeviceControl));
418 Status = pDeviceExtension->pfnRDBSSDeviceControl (pDevObj, pIrp);
419 Log(("VBOXSF: MRxDeviceControl RDBSS status 0x%08X\n", Status));
420 }
421 else
422 {
423 /* No RDBSS, should not happen. Just a precaution. */
424 Status = STATUS_NOT_IMPLEMENTED;
425
426 pIrp->IoStatus.Status = Status;
427 pIrp->IoStatus.Information = 0;
428
429 IoCompleteRequest(pIrp, IO_NO_INCREMENT);
430
431 Log(("VBOXSF: MRxDeviceControl: returned STATUS_NOT_IMPLEMENTED\n"));
432 }
433
434 return Status;
435}
436
437/**
438 * Intercepts IRP_MJ_CREATE to workaround a RDBSS quirk.
439 *
440 * Our RDBSS library will return STATUS_OBJECT_NAME_INVALID when FILE_NON_DIRECTORY_FILE
441 * is set and the path ends with a slash. NTFS and FAT will fail with
442 * STATUS_OBJECT_NAME_NOT_FOUND if the final component does not exist or isn't a directory,
443 * STATUS_OBJECT_PATH_NOT_FOUND if some path component doesn't exist or isn't a directory,
444 * or STATUS_ACCESS_DENIED if the final component is a directory.
445 *
446 * So, our HACK is to drop the trailing slash and set an unused flag in the ShareAccess
447 * parameter to tell vbsfProcessCreate about it.
448 *
449 */
450static NTSTATUS VBoxHookMjCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
451{
452 PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
453 PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
454 PFILE_OBJECT pFileObj = pStack->FileObject;
455 NTSTATUS rcNt;
456
457 Log(("VBOXSF: VBoxHookMjCreate: pDevObj %p, pDevExt %p, pFileObj %p, options %#x, attr %#x, share %#x, ealength %#x, secctx %p, IrpFlags %#x\n",
458 pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.Create.Options, pStack->Parameters.Create.FileAttributes,
459 pStack->Parameters.Create.ShareAccess, pStack->Parameters.Create.EaLength, pStack->Parameters.Create.SecurityContext, pIrp->Flags));
460 if (pFileObj)
461 Log(("VBOXSF: VBoxHookMjCreate: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
462
463 /*
464 * Check if we need to apply the hack. If we do, we grab a reference to
465 * the file object to be absolutely sure it's around for the cleanup work.
466 */
467 AssertMsg(!(pStack->Parameters.Create.ShareAccess & VBOX_MJ_CREATE_SLASH_HACK), ("%#x\n", pStack->Parameters.Create.ShareAccess));
468 if ( (pStack->Parameters.Create.Options & (FILE_NON_DIRECTORY_FILE | FILE_DIRECTORY_FILE)) == FILE_NON_DIRECTORY_FILE
469 && pFileObj
470 && pFileObj->FileName.Length > 18
471 && pFileObj->FileName.Buffer
472 && pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 1] == '\\'
473 && pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 2] != '\\')
474 {
475 NTSTATUS rcNtRef = ObReferenceObjectByPointer(pFileObj, (ACCESS_MASK)0, *IoFileObjectType, KernelMode);
476 pFileObj->FileName.Length -= 2;
477 pStack->Parameters.Create.ShareAccess |= VBOX_MJ_CREATE_SLASH_HACK; /* secret flag for vbsfProcessCreate */
478
479 rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
480
481 if (rcNt != STATUS_PENDING)
482 pStack->Parameters.Create.ShareAccess &= ~VBOX_MJ_CREATE_SLASH_HACK;
483 if (NT_SUCCESS(rcNtRef))
484 {
485 pFileObj->FileName.Length += 2;
486 ObDereferenceObject(pFileObj);
487 }
488
489 Log(("VBOXSF: VBoxHookMjCreate: returns %#x (hacked; rcNtRef=%#x)\n", rcNt, rcNtRef));
490 }
491 /*
492 * No hack needed.
493 */
494 else
495 {
496 rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
497 Log(("VBOXSF: VBoxHookMjCreate: returns %#x\n", rcNt));
498 }
499 return rcNt;
500}
501
502/**
503 * Intercepts IRP_MJ_SET_INFORMATION to workaround a RDBSS quirk in the
504 * FileEndOfFileInformation handling.
505 *
506 * We will add 4096 to the FileEndOfFileInformation function value and pick it
507 * up in VBoxMRxSetFileInfo after RxCommonSetInformation has done the necessary
508 * locking. If we find that the desired file size matches the cached one, just
509 * issue the call directly, otherwise subtract 4096 and call the
510 * RxSetEndOfFileInfo worker.
511 */
512static NTSTATUS VBoxHookMjSetInformation(PDEVICE_OBJECT pDevObj, PIRP pIrp)
513{
514 PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
515 PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
516 PFILE_OBJECT pFileObj = pStack->FileObject;
517 NTSTATUS rcNt;
518
519 Log(("VBOXSF: VBoxHookMjSetInformation: pDevObj %p, pDevExt %p, pFileObj %p, FileInformationClass %d, Length %#x\n",
520 pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.SetFile.FileInformationClass, pStack->Parameters.SetFile.Length));
521 if (pFileObj)
522 Log2(("VBOXSF: VBoxHookMjSetInformation: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
523
524 /*
525 * Setting EOF info?
526 */
527 if (pStack->Parameters.SetFile.FileInformationClass == FileEndOfFileInformation)
528 {
529#if 0 /* This only works for more recent versions of the RDBSS library, not for the one we're using (WDK 7600.16385.1). */
530 pStack->Parameters.SetFile.FileInformationClass = (FILE_INFORMATION_CLASS)(FileEndOfFileInformation + 4096);
531 rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
532 Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked)\n", rcNt));
533 return rcNt;
534#else
535 /*
536 * For the older WDK, we have to detect the same-size situation up front and hack
537 * it here instead of in VBoxMRxSetFileInfo. This means we need to lock the FCB
538 * before modifying the Fcb.Header.FileSize value and ASSUME the locking is
539 * reentrant and nothing else happens during RDBSS dispatching wrt that...
540 */
541 PMRX_FCB pFcb = (PMRX_FCB)pFileObj->FsContext;
542 if ( (NODE_TYPE_CODE)pFcb->Header.NodeTypeCode == RDBSS_NTC_STORAGE_TYPE_FILE
543 && pIrp->AssociatedIrp.SystemBuffer != NULL
544 && pStack->Parameters.SetFile.Length >= sizeof(FILE_END_OF_FILE_INFORMATION))
545 {
546 LONGLONG cbFileNew = -42;
547 __try
548 {
549 cbFileNew = ((PFILE_END_OF_FILE_INFORMATION)pIrp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart;
550 }
551 __except(EXCEPTION_EXECUTE_HANDLER)
552 {
553 cbFileNew = -42;
554 }
555 if ( cbFileNew >= 0
556 && pFcb->Header.FileSize.QuadPart == cbFileNew
557 && !(pFcb->FcbState & FCB_STATE_PAGING_FILE))
558 {
559 /* Now exclusivly lock the FCB like RxCommonSetInformation would do
560 to reduce chances of races and of anyone else grabbing the value
561 while it's incorrect on purpose. */
562 NTSTATUS rcNtLock = RxAcquireExclusiveFcb(NULL, (PFCB)pFcb);
563 if (NT_SUCCESS(rcNtLock))
564 {
565 if (pFcb->Header.FileSize.QuadPart == cbFileNew)
566 {
567 int64_t const cbHackedSize = cbFileNew ? cbFileNew - 1 : 1;
568 pFcb->Header.FileSize.QuadPart = cbHackedSize;
569 rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
570 if ( !NT_SUCCESS(rcNt)
571 && pFcb->Header.FileSize.QuadPart == cbHackedSize)
572 pFcb->Header.FileSize.QuadPart = cbFileNew;
573# ifdef VBOX_STRICT
574 else
575 {
576 PMRX_FOBX pFobx = (PMRX_FOBX)pFileObj->FsContext2;
577 PMRX_VBOX_FOBX pVBoxFobX = VBoxMRxGetFileObjectExtension(pFobx);
578 Assert( pFcb->Header.FileSize.QuadPart != cbHackedSize
579 || (pVBoxFobX && pVBoxFobX->Info.cbObject == cbHackedSize));
580 }
581# endif
582 RxReleaseFcb(NULL, pFcb);
583 Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked, cbFileNew=%#RX64)\n", rcNt, cbFileNew));
584 return rcNt;
585 }
586 RxReleaseFcb(NULL, pFcb);
587 }
588 }
589 }
590#endif
591 }
592
593 /*
594 * No hack needed.
595 */
596 rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
597 Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x\n", rcNt));
598 return rcNt;
599}
600
601
602NTSTATUS VBoxMRxStart(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
603{
604 NTSTATUS Status;
605 MRX_VBOX_STATE CurrentState;
606 RT_NOREF(RxContext, RxDeviceObject);
607
608 Log(("VBOXSF: MRxStart\n"));
609
610 CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_STARTED, MRX_VBOX_START_IN_PROGRESS);
611
612 if (CurrentState == MRX_VBOX_START_IN_PROGRESS)
613 {
614 Log(("VBOXSF: MRxStart: Start in progress -> started\n"));
615 Status = STATUS_SUCCESS;
616 }
617 else if (VBoxMRxState == MRX_VBOX_STARTED)
618 {
619 Log(("VBOXSF: MRxStart: Already started\n"));
620 Status = STATUS_REDIRECTOR_STARTED;
621 }
622 else
623 {
624 Log(("VBOXSF: MRxStart: Bad state! VBoxMRxState = %d\n", VBoxMRxState));
625 Status = STATUS_UNSUCCESSFUL;
626 }
627
628 return Status;
629}
630
631NTSTATUS VBoxMRxStop(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
632{
633 RT_NOREF(RxContext, RxDeviceObject);
634 Log(("VBOXSF: MRxStop\n"));
635 return STATUS_SUCCESS;
636}
637
638NTSTATUS VBoxMRxIoCtl(IN OUT PRX_CONTEXT RxContext)
639{
640 RT_NOREF(RxContext);
641 Log(("VBOXSF: MRxIoCtl: IoControlCode = 0x%08X\n", RxContext->LowIoContext.ParamsFor.FsCtl.FsControlCode));
642 return STATUS_INVALID_DEVICE_REQUEST;
643}
644
645NTSYSAPI NTSTATUS NTAPI ZwSetSecurityObject(IN HANDLE Handle,
646 IN SECURITY_INFORMATION SecurityInformation,
647 IN PSECURITY_DESCRIPTOR SecurityDescriptor);
648
649NTSTATUS VBoxMRxDevFcbXXXControlFile(IN OUT PRX_CONTEXT RxContext)
650{
651 NTSTATUS Status = STATUS_SUCCESS;
652 RxCaptureFobx;
653 PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
654 PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext;
655
656 Log(("VBOXSF: MRxDevFcbXXXControlFile: MajorFunction = 0x%02X\n",
657 RxContext->MajorFunction));
658
659 switch (RxContext->MajorFunction)
660 {
661 case IRP_MJ_FILE_SYSTEM_CONTROL:
662 {
663 Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MN_USER_FS_REQUEST: 0x%08X\n",
664 LowIoContext->ParamsFor.FsCtl.MinorFunction));
665 Status = STATUS_INVALID_DEVICE_REQUEST;
666 break;
667 }
668
669 case IRP_MJ_DEVICE_CONTROL:
670 {
671 Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MJ_DEVICE_CONTROL: InputBuffer %p/%d, OutputBuffer %p/%d\n",
672 LowIoContext->ParamsFor.IoCtl.pInputBuffer,
673 LowIoContext->ParamsFor.IoCtl.InputBufferLength,
674 LowIoContext->ParamsFor.IoCtl.pOutputBuffer,
675 LowIoContext->ParamsFor.IoCtl.OutputBufferLength));
676
677 switch (LowIoContext->ParamsFor.IoCtl.IoControlCode)
678 {
679 case IOCTL_MRX_VBOX_ADDCONN:
680 {
681 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_ADDCONN\n"));
682 Status = vbsfNtCreateConnection(RxContext, &RxContext->PostRequest);
683 break;
684 }
685
686 case IOCTL_MRX_VBOX_DELCONN:
687 {
688 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_DELCONN\n"));
689 Status = vbsfNtDeleteConnection(RxContext, &RxContext->PostRequest);
690 break;
691 }
692
693 case IOCTL_MRX_VBOX_GETLIST:
694 {
695 ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
696 uint8_t *pu8Out = (uint8_t *)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
697
698 BOOLEAN fLocked = FALSE;
699
700 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST\n"));
701
702 RxContext->InformationToReturn = 0;
703
704 if ( !pDeviceExtension
705 || cbOut < _MRX_MAX_DRIVE_LETTERS)
706 {
707 Status = STATUS_INVALID_PARAMETER;
708 break;
709 }
710
711 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST: Copying local connections\n"));
712
713 fLocked = ExTryToAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
714
715 __try
716 {
717 RtlCopyMemory(pu8Out, pDeviceExtension->cLocalConnections, _MRX_MAX_DRIVE_LETTERS);
718 RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
719 }
720 __except(EXCEPTION_EXECUTE_HANDLER)
721 {
722 Status = STATUS_INVALID_PARAMETER;
723 }
724
725 if (fLocked)
726 {
727 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
728 fLocked = FALSE;
729 }
730
731 break;
732 }
733
734 /*
735 * Returns the root IDs of shared folder mappings.
736 */
737 case IOCTL_MRX_VBOX_GETGLOBALLIST:
738 {
739 ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
740 uint8_t *pu8Out = (uint8_t *)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
741
742 int vrc;
743 SHFLMAPPING mappings[_MRX_MAX_DRIVE_LETTERS];
744 uint32_t cMappings = RT_ELEMENTS(mappings);
745
746 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST\n"));
747
748 RxContext->InformationToReturn = 0;
749
750 if ( !pDeviceExtension
751 || cbOut < _MRX_MAX_DRIVE_LETTERS)
752 {
753 Status = STATUS_INVALID_PARAMETER;
754 break;
755 }
756
757 vrc = VbglR0SfQueryMappings(&g_SfClient, mappings, &cMappings);
758 if (vrc == VINF_SUCCESS)
759 {
760 __try
761 {
762 uint32_t i;
763
764 RtlZeroMemory(pu8Out, _MRX_MAX_DRIVE_LETTERS);
765
766 for (i = 0; i < RT_MIN(cMappings, cbOut); i++)
767 {
768 pu8Out[i] = mappings[i].root;
769 pu8Out[i] |= 0x80; /* mark active */ /** @todo fix properly */
770 }
771
772 RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
773 }
774 __except(EXCEPTION_EXECUTE_HANDLER)
775 {
776 Status = STATUS_INVALID_PARAMETER;
777 }
778 }
779 else
780 {
781 Status = vbsfNtVBoxStatusToNt(vrc);
782 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST failed: 0x%08X\n",
783 Status));
784 }
785
786 break;
787 }
788
789 /*
790 * Translates a local connection name (e.g. drive "S:") to the
791 * corresponding remote name (e.g. \\vboxsrv\share).
792 */
793 case IOCTL_MRX_VBOX_GETCONN:
794 {
795 ULONG cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
796 PWCHAR pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
797 ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
798 PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
799
800 BOOLEAN fMutexAcquired = FALSE;
801
802 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN\n"));
803
804 RxContext->InformationToReturn = 0;
805
806 if ( !pDeviceExtension
807 || cbConnectName < sizeof(WCHAR))
808 {
809 Status = STATUS_INVALID_PARAMETER;
810 break;
811 }
812
813 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Looking up connection name and connections\n"));
814
815 __try
816 {
817 uint32_t idx = *pwcConnectName - L'A';
818
819 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: ConnectName = %.*ls, Len = %d, Index = %d\n",
820 cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName, idx));
821
822 if (idx < RTL_NUMBER_OF(pDeviceExtension->wszLocalConnectionName))
823 {
824 ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
825 fMutexAcquired = TRUE;
826
827 if (pDeviceExtension->wszLocalConnectionName[idx])
828 {
829 ULONG cbLocalConnectionName = pDeviceExtension->wszLocalConnectionName[idx]->Length;
830
831 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName = %.*ls\n",
832 cbLocalConnectionName / sizeof(WCHAR), pDeviceExtension->wszLocalConnectionName[idx]->Buffer));
833
834 if ((pDeviceExtension->cLocalConnections[idx]) && (cbLocalConnectionName <= cbRemoteName))
835 {
836 RtlZeroMemory(pwcRemoteName, cbRemoteName);
837 RtlCopyMemory(pwcRemoteName,
838 pDeviceExtension->wszLocalConnectionName[idx]->Buffer,
839 cbLocalConnectionName);
840
841 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Remote name = %.*ls, Len = %d\n",
842 cbLocalConnectionName / sizeof(WCHAR), pwcRemoteName, cbLocalConnectionName));
843 }
844 else
845 {
846 Status = STATUS_BUFFER_TOO_SMALL;
847 }
848
849 RxContext->InformationToReturn = cbLocalConnectionName;
850 }
851 else
852 {
853 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName is NULL!\n"));
854 Status = STATUS_BAD_NETWORK_NAME;
855 }
856 }
857 else
858 {
859 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Index is invalid!\n"));
860 Status = STATUS_INVALID_PARAMETER;
861 }
862 }
863 __except(EXCEPTION_EXECUTE_HANDLER)
864 {
865 Status = STATUS_INVALID_PARAMETER;
866 }
867
868 if (fMutexAcquired)
869 {
870 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
871 fMutexAcquired = FALSE;
872 }
873
874 break;
875 }
876
877 case IOCTL_MRX_VBOX_GETGLOBALCONN:
878 {
879 ULONG cbConnectId = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
880 uint8_t *pu8ConnectId = (uint8_t *)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
881 ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
882 PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
883
884 int vrc;
885 PSHFLSTRING pString;
886
887 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN\n"));
888
889 RxContext->InformationToReturn = 0;
890
891 if ( !pDeviceExtension
892 || cbConnectId < sizeof(uint8_t))
893 {
894 Status = STATUS_INVALID_PARAMETER;
895 break;
896 }
897
898 /* Allocate empty string where the host can store cbRemoteName bytes. */
899 Status = vbsfNtShflStringFromUnicodeAlloc(&pString, NULL, (uint16_t)cbRemoteName);
900 if (Status != STATUS_SUCCESS)
901 break;
902
903 __try
904 {
905 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Connection ID = %d\n",
906 *pu8ConnectId));
907
908 vrc = VbglR0SfQueryMapName(&g_SfClient,
909 *pu8ConnectId & ~0x80 /** @todo fix properly */,
910 pString, ShflStringSizeOfBuffer(pString));
911 if ( vrc == VINF_SUCCESS
912 && pString->u16Length < cbRemoteName)
913 {
914 RtlCopyMemory(pwcRemoteName, pString->String.ucs2, pString->u16Length);
915 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Returned name = %.*ls, Len = %d\n",
916 pString->u16Length / sizeof(WCHAR), pwcRemoteName, pString->u16Length));
917 RxContext->InformationToReturn = pString->u16Length;
918 }
919 else
920 {
921 Status = STATUS_BAD_NETWORK_NAME;
922 }
923 }
924 __except(EXCEPTION_EXECUTE_HANDLER)
925 {
926 Status = STATUS_INVALID_PARAMETER;
927 }
928
929 vbsfNtFreeNonPagedMem(pString);
930
931 break;
932 }
933
934 case IOCTL_MRX_VBOX_START:
935 {
936 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: capFobx %p\n",
937 capFobx));
938
939 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: process: current 0x%X, RDBSS 0x%X\n",
940 IoGetCurrentProcess(), RxGetRDBSSProcess()));
941
942 switch (VBoxMRxState)
943 {
944 case MRX_VBOX_STARTABLE:
945
946 Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_STARTABLE\n"));
947
948 if (capFobx)
949 {
950 Status = STATUS_INVALID_DEVICE_REQUEST;
951 break;;
952 }
953
954 InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_START_IN_PROGRESS, MRX_VBOX_STARTABLE);
955
956 case MRX_VBOX_START_IN_PROGRESS:
957 Status = RxStartMinirdr(RxContext, &RxContext->PostRequest);
958
959 Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_START_IN_PROGRESS RxStartMiniRdr Status 0x%08X, post %d\n",
960 Status, RxContext->PostRequest));
961
962 if (Status == STATUS_REDIRECTOR_STARTED)
963 {
964 Status = STATUS_SUCCESS;
965 break;
966 }
967
968 if ( Status == STATUS_PENDING
969 && RxContext->PostRequest == TRUE)
970 {
971 /* Will be restarted in RDBSS process. */
972 Status = STATUS_MORE_PROCESSING_REQUIRED;
973 break;
974 }
975
976#if 0 /* 2022-09-07 bird: I've disabled this as it prevents VBoxService from accessing the redirector on Windows XP RTM.
977 *
978 * The default is: Administrators=RWDPO, Everyone=R, LOCAL=RW, RESTRICTED=R, SYSTEM=RWDPO
979 * This changes it to: LOCAL=RW
980 * (R=read, W=write, D=delete, P=Change Permissions, O=Change Owner. WinObj advanced permissions view.)
981 *
982 * I'm not sure if the intention here is to create a NULL DACL, which grants unrestricted access to the device.
983 * However, it's somehow now working for Windows XP RTM. I think an explicit call to RtlSetDaclSecurityDescriptor
984 * is required for that to work, indicating that a DACL is present but NULL.
985 * (See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlsetdaclsecuritydescriptor and
986 * https://docs.microsoft.com/en-us/windows/win32/secauthz/null-dacls-and-empty-dacls for NULL DACL details.)
987 *
988 * If the problem is that RESTRICTED (S-1-5-12) should have RWS access, read the descriptor and modify the ACE
989 * for RESTRICTED to grant them write access.
990 */
991 /* Allow restricted users to use shared folders; works only in XP and Vista. (@@todo hack) */
992 if (Status == STATUS_SUCCESS)
993 {
994 SECURITY_DESCRIPTOR SecurityDescriptor;
995 OBJECT_ATTRIBUTES InitializedAttributes;
996 HANDLE hDevice;
997 IO_STATUS_BLOCK IoStatusBlock;
998 UNICODE_STRING UserModeDeviceName;
999
1000 RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1001
1002 /* Create empty security descriptor */
1003 RtlZeroMemory (&SecurityDescriptor, sizeof (SecurityDescriptor));
1004 Status = RtlCreateSecurityDescriptor(&SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1005 if (Status != STATUS_SUCCESS)
1006 {
1007 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: RtlCreateSecurityDescriptor failed with 0x%08X!\n",
1008 Status));
1009 return Status;
1010 }
1011
1012 RtlZeroMemory (&InitializedAttributes, sizeof (InitializedAttributes));
1013 InitializeObjectAttributes(&InitializedAttributes, &UserModeDeviceName, OBJ_KERNEL_HANDLE, 0, 0);
1014
1015 /* Open our symbolic link device name */
1016 Status = ZwOpenFile(&hDevice, WRITE_DAC, &InitializedAttributes, &IoStatusBlock, 0, 0);
1017 if (Status != STATUS_SUCCESS)
1018 {
1019 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwOpenFile %ls failed with 0x%08X!\n",
1020 DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U, Status));
1021 return Status;
1022 }
1023
1024 /* Override the discretionary access control list (DACL) settings */
1025 Status = ZwSetSecurityObject(hDevice, DACL_SECURITY_INFORMATION, &SecurityDescriptor);
1026 if (Status != STATUS_SUCCESS)
1027 {
1028 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwSetSecurityObject failed with 0x%08X!\n",
1029 Status));
1030 return Status;
1031 }
1032
1033 Status = ZwClose(hDevice);
1034 if (Status != STATUS_SUCCESS)
1035 {
1036 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwClose failed with 0x%08X\n",
1037 Status));
1038 return Status;
1039 }
1040 }
1041#endif
1042 break;
1043
1044 case MRX_VBOX_STARTED:
1045 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_STARTED: Already started\n"));
1046 Status = STATUS_SUCCESS;
1047 break;
1048
1049 default:
1050 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Invalid state (%d)!\n",
1051 VBoxMRxState));
1052 Status = STATUS_INVALID_PARAMETER;
1053 break;
1054 }
1055
1056 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Returned 0x%08X\n",
1057 Status));
1058 break;
1059 }
1060
1061 case IOCTL_MRX_VBOX_STOP:
1062 {
1063 MRX_VBOX_STATE CurrentState;
1064
1065 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: capFobx %p\n",
1066 capFobx));
1067
1068 if (capFobx)
1069 {
1070 Status = STATUS_INVALID_DEVICE_REQUEST;
1071 break;
1072 }
1073
1074 if (RxContext->RxDeviceObject->NumberOfActiveFcbs > 0)
1075 {
1076 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Open handles = %d\n",
1077 RxContext->RxDeviceObject->NumberOfActiveFcbs));
1078 Status = STATUS_REDIRECTOR_HAS_OPEN_HANDLES;
1079 break;
1080 }
1081
1082 CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG) & VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
1083
1084 Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
1085 Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Returned 0x%08X\n",
1086 Status));
1087
1088 if (Status == STATUS_PENDING && RxContext->PostRequest == TRUE)
1089 Status = STATUS_MORE_PROCESSING_REQUIRED;
1090 break;
1091 }
1092
1093 default:
1094 Status = STATUS_INVALID_DEVICE_REQUEST;
1095 break;
1096 }
1097 break;
1098 }
1099
1100 case IRP_MJ_INTERNAL_DEVICE_CONTROL:
1101 {
1102 Status = STATUS_INVALID_DEVICE_REQUEST;
1103 break;
1104 }
1105
1106 default:
1107 Log(("VBOXSF: MRxDevFcbXXXControlFile: unimplemented major function 0x%02X\n",
1108 RxContext->MajorFunction));
1109 Status = STATUS_INVALID_DEVICE_REQUEST;
1110 break;
1111 }
1112
1113 Log(("VBOXSF: MRxDevFcbXXXControlFile: Status = 0x%08X, Info = 0x%08X\n",
1114 Status, RxContext->InformationToReturn));
1115
1116 return Status;
1117}
1118
1119static NTSTATUS vbsfVerifyConnectionName(PUNICODE_STRING ConnectionName)
1120{
1121 /* Check that the connection name is valid:
1122 * "\Device\VBoxMiniRdr\;X:\vboxsvr\sf"
1123 */
1124 NTSTATUS Status = STATUS_BAD_NETWORK_NAME;
1125
1126 static WCHAR const s_wszPrefix[] = L"\\Device\\VBoxMiniRdr\\;";
1127
1128 /* Unicode chars in the string. */
1129 ULONG cConnectionName = ConnectionName->Length / sizeof(WCHAR);
1130 ULONG cRemainingName;
1131
1132 /* Check that the name starts with correct prefix. */
1133 WCHAR const *pwc1 = &s_wszPrefix[0];
1134 WCHAR const *pwc = ConnectionName->Buffer;
1135 ULONG i;
1136 for (i = 0; i < cConnectionName; i++, pwc1++, pwc++)
1137 {
1138 if (*pwc1 == 0 || *pwc == 0 || *pwc1 != *pwc)
1139 break;
1140 }
1141
1142 cRemainingName = cConnectionName - i;
1143
1144 Log(("VBOXSF: vbsfVerifyConnectionName: prefix %d remaining %d [%.*ls]\n",
1145 *pwc1 == 0, cRemainingName, cRemainingName, &ConnectionName->Buffer[i]));
1146
1147 if (*pwc1 == 0)
1148 {
1149 /* pwc should point to a drive letter followed by ':\' that is at least 3 chars more. */
1150 if (cRemainingName >= 3)
1151 {
1152 if ( pwc[0] >= L'A' && pwc[0] <= L'Z'
1153 && pwc[1] == L':')
1154 {
1155 pwc += 2;
1156 cRemainingName -= 2;
1157
1158 /** @todo should also check that the drive letter corresponds to the name. */
1159 if (vboxIsPrefixOK(pwc, cRemainingName * sizeof (WCHAR)))
1160 Status = STATUS_SUCCESS;
1161 }
1162 }
1163 }
1164
1165 return Status;
1166}
1167
1168static HANDLE vbsfOpenConnectionHandle(PUNICODE_STRING ConnectionName, NTSTATUS *prcNt)
1169{
1170 NTSTATUS Status;
1171 IO_STATUS_BLOCK IoStatusBlock;
1172 OBJECT_ATTRIBUTES ObjectAttributes;
1173
1174 HANDLE Handle = INVALID_HANDLE_VALUE;
1175
1176 Log(("VBOXSF: vbsfOpenConnectionHandle: ConnectionName = %.*ls\n",
1177 ConnectionName->Length / sizeof(WCHAR), ConnectionName->Buffer));
1178
1179 Status = vbsfVerifyConnectionName(ConnectionName);
1180
1181 if (NT_SUCCESS(Status))
1182 {
1183 /* Have to create a OBJ_KERNEL_HANDLE. Otherwise the driver verifier on Windows 7 bugchecks. */
1184 InitializeObjectAttributes(&ObjectAttributes,
1185 ConnectionName,
1186 OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE,
1187 NULL,
1188 NULL);
1189
1190 Status = ZwCreateFile(&Handle,
1191 SYNCHRONIZE,
1192 &ObjectAttributes,
1193 &IoStatusBlock,
1194 NULL,
1195 FILE_ATTRIBUTE_NORMAL,
1196 FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
1197 FILE_OPEN_IF,
1198 FILE_CREATE_TREE_CONNECTION | FILE_SYNCHRONOUS_IO_NONALERT,
1199 NULL,
1200 0);
1201 }
1202
1203 if ( Status != STATUS_SUCCESS
1204 || Handle == INVALID_HANDLE_VALUE)
1205 {
1206 Log(("VBOXSF: vbsfOpenConnectionHandle: ZwCreateFile failed status 0x%08X or invalid handle!\n", Status));
1207 if (prcNt)
1208 *prcNt = !NT_SUCCESS(Status) ? Status : STATUS_UNSUCCESSFUL;
1209 Handle = INVALID_HANDLE_VALUE;
1210 }
1211
1212 return Handle;
1213}
1214
1215NTSTATUS vbsfNtCreateConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1216{
1217 NTSTATUS Status = STATUS_SUCCESS;
1218
1219 PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1220
1221 PLOWIO_CONTEXT LowIoContext;
1222 ULONG cbConnectName;
1223 PWCHAR pwcConnectName;
1224
1225 HANDLE Handle;
1226 UNICODE_STRING FileName;
1227
1228 BOOLEAN fMutexAcquired = FALSE;
1229
1230 Log(("VBOXSF: vbsfNtCreateConnection\n"));
1231
1232 if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1233 {
1234 Log(("VBOXSF: vbsfNtCreateConnection: post to file system process\n"));
1235 *PostToFsp = TRUE;
1236 return STATUS_PENDING;
1237 }
1238
1239 pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1240 if (!pDeviceExtension)
1241 return STATUS_INVALID_PARAMETER;
1242
1243 LowIoContext = &RxContext->LowIoContext;
1244 cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1245 pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1246
1247 if (cbConnectName == 0 || !pwcConnectName)
1248 {
1249 Log(("VBOXSF: vbsfNtCreateConnection: Connection name / length is invalid!\n"));
1250 return STATUS_INVALID_PARAMETER;
1251 }
1252
1253 __try
1254 {
1255 Log(("VBOXSF: vbsfNtCreateConnection: Name = %.*ls, Len = %d\n",
1256 cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName));
1257
1258 FileName.Buffer = pwcConnectName;
1259 FileName.Length = (USHORT)cbConnectName;
1260 FileName.MaximumLength = (USHORT)cbConnectName;
1261
1262 Handle = vbsfOpenConnectionHandle(&FileName, NULL);
1263
1264 if (Handle != INVALID_HANDLE_VALUE)
1265 {
1266 PWCHAR pwc;
1267 ULONG i;
1268
1269 ZwClose(Handle);
1270
1271 /* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1272 pwc = pwcConnectName;
1273 for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1274 {
1275 if (*pwc == L':')
1276 break;
1277 pwc++;
1278 }
1279
1280 if (i >= sizeof(WCHAR) && i < cbConnectName)
1281 {
1282 pwc--; /* Go back to the drive letter, "X" for example. */
1283
1284 if (*pwc >= L'A' && *pwc <= L'Z') /* Are we in range? */
1285 {
1286 uint32_t idx = *pwc - L'A'; /* Get the index based on the driver letter numbers (26). */
1287
1288 if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1289 {
1290 Log(("VBOXSF: vbsfNtCreateConnection: Index 0x%x is invalid!\n",
1291 idx));
1292 Status = STATUS_BAD_NETWORK_NAME;
1293 }
1294 else
1295 {
1296 ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1297 fMutexAcquired = TRUE;
1298
1299 if (pDeviceExtension->wszLocalConnectionName[idx] != NULL)
1300 {
1301 Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d is NOT empty!\n",
1302 idx));
1303 }
1304
1305 pDeviceExtension->wszLocalConnectionName[idx] = (PUNICODE_STRING)vbsfNtAllocNonPagedMem(sizeof(UNICODE_STRING) + cbConnectName);
1306
1307 if (!pDeviceExtension->wszLocalConnectionName[idx])
1308 {
1309 Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d NOT allocated!\n",
1310 idx));
1311 Status = STATUS_INSUFFICIENT_RESOURCES;
1312 }
1313 else
1314 {
1315 PUNICODE_STRING pRemoteName = pDeviceExtension->wszLocalConnectionName[idx];
1316
1317 pRemoteName->Buffer = (PWSTR)(pRemoteName + 1);
1318 pRemoteName->Length = (USHORT)(cbConnectName - i - sizeof(WCHAR));
1319 pRemoteName->MaximumLength = pRemoteName->Length;
1320 RtlCopyMemory(&pRemoteName->Buffer[0], pwc+2, pRemoteName->Length);
1321
1322 Log(("VBOXSF: vbsfNtCreateConnection: RemoteName %.*ls, Len = %d\n",
1323 pRemoteName->Length / sizeof(WCHAR), pRemoteName->Buffer, pRemoteName->Length));
1324
1325 pDeviceExtension->cLocalConnections[idx] = TRUE;
1326 }
1327
1328 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1329 fMutexAcquired = FALSE;
1330 }
1331 }
1332 }
1333 else
1334 {
1335 Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1336 Status = STATUS_BAD_NETWORK_NAME;
1337 }
1338 }
1339 else
1340 {
1341 Log(("VBOXSF: vbsfNtCreateConnection: connection was not found\n"));
1342 Status = STATUS_BAD_NETWORK_NAME;
1343 }
1344 }
1345 __except(EXCEPTION_EXECUTE_HANDLER)
1346 {
1347 Status = STATUS_INVALID_PARAMETER;
1348 }
1349
1350 if (fMutexAcquired)
1351 {
1352 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1353 fMutexAcquired = FALSE;
1354 }
1355
1356 return Status;
1357}
1358
1359NTSTATUS vbsfNtDeleteConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1360{
1361 NTSTATUS Status;
1362 UNICODE_STRING FileName;
1363 HANDLE Handle;
1364 PLOWIO_CONTEXT LowIoContext;
1365 PWCHAR pwcConnectName;
1366 ULONG cbConnectName;
1367 PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1368
1369 BOOLEAN fMutexAcquired = FALSE;
1370
1371 Log(("VBOXSF: vbsfNtDeleteConnection\n"));
1372
1373 if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1374 {
1375 Log(("VBOXSF: vbsfNtDeleteConnection: post to file system process\n"));
1376 *PostToFsp = TRUE;
1377 return STATUS_PENDING;
1378 }
1379
1380 LowIoContext = &RxContext->LowIoContext;
1381 pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1382 cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1383
1384 pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1385 if (!pDeviceExtension)
1386 return STATUS_INVALID_PARAMETER;
1387
1388 __try
1389 {
1390 Log(("VBOXSF: vbsfNtDeleteConnection: pwcConnectName = %.*ls\n",
1391 cbConnectName / sizeof(WCHAR), pwcConnectName));
1392
1393 FileName.Buffer = pwcConnectName;
1394 FileName.Length = (USHORT)cbConnectName;
1395 FileName.MaximumLength = (USHORT)cbConnectName;
1396
1397 Handle = vbsfOpenConnectionHandle(&FileName, &Status);
1398 if (Handle != INVALID_HANDLE_VALUE)
1399 {
1400 PFILE_OBJECT pFileObject;
1401 Status = ObReferenceObjectByHandle(Handle, 0L, NULL, KernelMode, (PVOID *)&pFileObject, NULL);
1402
1403 Log(("VBOXSF: vbsfNtDeleteConnection: ObReferenceObjectByHandle Status 0x%08X\n",
1404 Status));
1405
1406 if (NT_SUCCESS(Status))
1407 {
1408 PFOBX Fobx = (PFOBX)pFileObject->FsContext2;
1409 Log(("VBOXSF: vbsfNtDeleteConnection: Fobx %p\n", Fobx));
1410
1411 if (Fobx && NodeType(Fobx) == RDBSS_NTC_V_NETROOT)
1412 {
1413 PV_NET_ROOT VNetRoot = (PV_NET_ROOT)Fobx;
1414
1415#ifdef __cplusplus /* C version points at NET_ROOT, C++ points at MRX_NET_ROOT. Weird. */
1416 Status = RxFinalizeConnection((PNET_ROOT)VNetRoot->pNetRoot, VNetRoot, TRUE);
1417#else
1418 Status = RxFinalizeConnection(VNetRoot->NetRoot, VNetRoot, TRUE);
1419#endif
1420 }
1421 else
1422 {
1423 Log(("VBOXSF: vbsfNtDeleteConnection: wrong FsContext2\n"));
1424 Status = STATUS_INVALID_DEVICE_REQUEST;
1425 }
1426
1427 ObDereferenceObject(pFileObject);
1428 }
1429
1430 ZwClose(Handle);
1431
1432 if (NT_SUCCESS(Status))
1433 {
1434 PWCHAR pwc;
1435 ULONG i;
1436
1437 /* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1438 pwc = pwcConnectName;
1439 for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1440 {
1441 if (*pwc == L':')
1442 {
1443 break;
1444 }
1445 pwc++;
1446 }
1447
1448 if (i >= sizeof(WCHAR) && i < cbConnectName)
1449 {
1450 pwc--;
1451
1452 if (*pwc >= L'A' && *pwc <= L'Z')
1453 {
1454 uint32_t idx = *pwc - L'A';
1455
1456 if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1457 {
1458 Log(("VBOXSF: vbsfNtDeleteConnection: Index 0x%x is invalid!\n",
1459 idx));
1460 Status = STATUS_BAD_NETWORK_NAME;
1461 }
1462 else
1463 {
1464 ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1465 fMutexAcquired = TRUE;
1466
1467 pDeviceExtension->cLocalConnections[idx] = FALSE;
1468
1469 /* Free saved name */
1470 if (pDeviceExtension->wszLocalConnectionName[idx])
1471 {
1472 vbsfNtFreeNonPagedMem(pDeviceExtension->wszLocalConnectionName[idx]);
1473 pDeviceExtension->wszLocalConnectionName[idx] = NULL;
1474 }
1475
1476 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1477 fMutexAcquired = FALSE;
1478
1479 Log(("VBOXSF: vbsfNtDeleteConnection: deleted index 0x%x\n",
1480 idx));
1481 }
1482 }
1483 }
1484 else
1485 {
1486 Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1487 Status = STATUS_BAD_NETWORK_NAME;
1488 }
1489 }
1490 }
1491 }
1492 __except(EXCEPTION_EXECUTE_HANDLER)
1493 {
1494 Status = STATUS_INVALID_PARAMETER;
1495 }
1496
1497 if (fMutexAcquired)
1498 {
1499 ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1500 fMutexAcquired = FALSE;
1501 }
1502
1503 Log(("VBOXSF: vbsfNtDeleteConnection: Status 0x%08X\n", Status));
1504 return Status;
1505}
1506
1507NTSTATUS VBoxMRxQueryEaInfo(IN OUT PRX_CONTEXT RxContext)
1508{
1509 RT_NOREF(RxContext);
1510 Log(("VBOXSF: MRxQueryEaInfo: Ea buffer len remaining is %d\n", RxContext->Info.LengthRemaining));
1511 return STATUS_NOT_SUPPORTED;
1512}
1513
1514NTSTATUS VBoxMRxSetEaInfo(IN OUT PRX_CONTEXT RxContext)
1515{
1516 RT_NOREF(RxContext);
1517 Log(("VBOXSF: MRxSetEaInfo\n"));
1518 return STATUS_NOT_IMPLEMENTED;
1519}
1520
1521NTSTATUS VBoxMRxFsCtl(IN OUT PRX_CONTEXT RxContext)
1522{
1523 RT_NOREF(RxContext);
1524 Log(("VBOXSF: MRxFsCtl\n"));
1525 return STATUS_INVALID_DEVICE_REQUEST;
1526}
1527
1528NTSTATUS VBoxMRxNotifyChangeDirectory(IN OUT PRX_CONTEXT RxContext)
1529{
1530 RT_NOREF(RxContext);
1531 Log(("VBOXSF: MRxNotifyChangeDirectory\n"));
1532 return STATUS_NOT_IMPLEMENTED;
1533}
1534
1535static NTSTATUS vbsfQuerySdInfo(PVOID pvBuffer, ULONG cbBuffer, SECURITY_INFORMATION SecurityInformation, ULONG *pcbOut)
1536{
1537 /* What a public SMB share would return. */
1538 static SID_IDENTIFIER_AUTHORITY sIA = SECURITY_NT_AUTHORITY;
1539 #define SUB_AUTHORITY_COUNT 2
1540 static const ULONG saSubAuthorityOwner[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_USER_RID_GUEST };
1541 static const ULONG saSubAuthorityGroup[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_GROUP_RID_GUESTS };
1542
1543 SECURITY_DESCRIPTOR_RELATIVE *pSD = (SECURITY_DESCRIPTOR_RELATIVE *)pvBuffer;
1544 ULONG cbSD = 0; /* Size of returned security descriptor. */
1545 ULONG cbAdd; /* How many bytes to add to the buffer for each component of the security descriptor. */
1546
1547 cbAdd = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
1548 if (cbSD + cbAdd <= cbBuffer)
1549 {
1550 pSD->Revision = SECURITY_DESCRIPTOR_REVISION1;
1551 pSD->Sbz1 = 0;
1552 pSD->Control = SE_SELF_RELATIVE;
1553 pSD->Owner = 0;
1554 pSD->Group = 0;
1555 pSD->Sacl = 0;
1556 pSD->Dacl = 0;
1557 }
1558 cbSD += cbAdd;
1559
1560 if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1561 {
1562 cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1563 if (cbSD + cbAdd <= cbBuffer)
1564 {
1565 SID *pSID = (SID *)((uint8_t *)pSD + cbSD);
1566 pSID->Revision = 1;
1567 pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1568 pSID->IdentifierAuthority = sIA;
1569 memcpy(pSID->SubAuthority, saSubAuthorityOwner, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1570
1571 pSD->Owner = cbSD;
1572 }
1573 cbSD += cbAdd;
1574 }
1575
1576 if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1577 {
1578 cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1579 if (cbSD + cbAdd <= cbBuffer)
1580 {
1581 SID *pSID = (SID *)((uint8_t *)pSD + cbSD);
1582 pSID->Revision = 1;
1583 pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1584 pSID->IdentifierAuthority = sIA;
1585 memcpy(pSID->SubAuthority, saSubAuthorityGroup, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1586
1587 pSD->Group = cbSD;
1588 }
1589 cbSD += cbAdd;
1590 }
1591
1592 #undef SUB_AUTHORITY_COUNT
1593
1594 *pcbOut = cbSD;
1595 return STATUS_SUCCESS;
1596}
1597
1598NTSTATUS VBoxMRxQuerySdInfo(IN OUT PRX_CONTEXT RxContext)
1599{
1600 NTSTATUS Status;
1601
1602 PVOID pvBuffer = RxContext->Info.Buffer;
1603 ULONG cbBuffer = RxContext->Info.LengthRemaining;
1604 SECURITY_INFORMATION SecurityInformation = RxContext->QuerySecurity.SecurityInformation;
1605
1606 ULONG cbSD = 0;
1607
1608 Log(("VBOXSF: MRxQuerySdInfo: Buffer %p, Length %d, SecurityInformation 0x%x\n",
1609 pvBuffer, cbBuffer, SecurityInformation));
1610
1611 Status = vbsfQuerySdInfo(pvBuffer, cbBuffer, SecurityInformation, &cbSD);
1612 if (NT_SUCCESS(Status))
1613 {
1614 RxContext->InformationToReturn = cbSD;
1615 if (RxContext->InformationToReturn > cbBuffer)
1616 {
1617 Status = STATUS_BUFFER_OVERFLOW;
1618 }
1619 }
1620
1621 Log(("VBOXSF: MRxQuerySdInfo: Status 0x%08X, InformationToReturn %d\n",
1622 Status, RxContext->InformationToReturn));
1623 return Status;
1624}
1625
1626NTSTATUS VBoxMRxSetSdInfo(IN OUT struct _RX_CONTEXT * RxContext)
1627{
1628 RT_NOREF(RxContext);
1629 Log(("VBOXSF: MRxSetSdInfo\n"));
1630 return STATUS_NOT_IMPLEMENTED;
1631}
1632
1633/*
1634 * WML stubs which are referenced by rdbsslib.
1635 */
1636extern "C" NTSTATUS WmlTinySystemControl(IN OUT PVOID pWmiLibInfo, IN PVOID pDevObj, IN PVOID pIrp)
1637{
1638 RT_NOREF(pWmiLibInfo, pDevObj, pIrp);
1639 return STATUS_WMI_GUID_NOT_FOUND;
1640}
1641
1642extern "C" ULONG WmlTrace(IN ULONG ulType, IN PVOID pTraceUuid, IN ULONG64 ullLogger, ...)
1643{
1644 RT_NOREF(ulType, pTraceUuid, ullLogger);
1645 return STATUS_SUCCESS;
1646}
1647
1648
1649/**
1650 * The "main" function for a driver binary.
1651 */
1652extern "C" NTSTATUS NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
1653{
1654 Log(("VBOXSF: DriverEntry: Driver object %p\n", DriverObject));
1655 AssertLogRelReturn(DriverObject, STATUS_UNSUCCESSFUL);
1656
1657 /*
1658 * Initialize IPRT and Vbgl.
1659 */
1660 NTSTATUS rcNt = STATUS_UNSUCCESSFUL;
1661 int vrc = RTR0Init(0);
1662 if (RT_SUCCESS(vrc))
1663 {
1664 vrc = VbglR0SfInit();
1665 if (RT_SUCCESS(vrc))
1666 {
1667 /*
1668 * Connect to the shared folder service on the host.
1669 */
1670 vrc = VbglR0SfConnect(&g_SfClient);
1671 if (RT_SUCCESS(vrc))
1672 {
1673 /*
1674 * Query the features and check that the host does page lists as we need those
1675 * for reading and writing.
1676 */
1677 vrc = VbglR0QueryHostFeatures(&g_fHostFeatures);
1678 if (RT_FAILURE(vrc))
1679 {
1680 LogRel(("vboxsf: VbglR0QueryHostFeatures failed: vrc=%Rrc (ignored)\n", vrc));
1681 g_fHostFeatures = 0;
1682 }
1683 VbglR0SfHostReqQueryFeaturesSimple(&g_fSfFeatures, &g_uSfLastFunction);
1684 LogRel(("VBoxSF: g_fHostFeatures=%#x g_fSfFeatures=%#RX64 g_uSfLastFunction=%u\n",
1685 g_fHostFeatures, g_fSfFeatures, g_uSfLastFunction));
1686
1687 if (VbglR0CanUsePhysPageList())
1688 {
1689 /*
1690 * Tell the host to return windows-style errors (non-fatal).
1691 */
1692 if (g_uSfLastFunction >= SHFL_FN_SET_ERROR_STYLE)
1693 {
1694 vrc = VbglR0SfHostReqSetErrorStyleSimple(kShflErrorStyle_Windows);
1695 if (RT_FAILURE(vrc))
1696 LogRel(("VBoxSF: VbglR0HostReqSetErrorStyleSimple(windows) failed: %Rrc\n", vrc));
1697 }
1698
1699 /*
1700 * Resolve newer kernel APIs we might want to use.
1701 * Note! Because of http://www.osronline.com/article.cfm%5eid=494.htm we cannot
1702 * use MmGetSystemRoutineAddress here as it will crash on xpsp2.
1703 */
1704 RTDBGKRNLINFO hKrnlInfo;
1705 vrc = RTR0DbgKrnlInfoOpen(&hKrnlInfo, 0/*fFlags*/);
1706 AssertLogRelRC(vrc);
1707 if (RT_SUCCESS(vrc))
1708 {
1709 g_pfnCcCoherencyFlushAndPurgeCache
1710 = (PFNCCCOHERENCYFLUSHANDPURGECACHE)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL,
1711 "CcCoherencyFlushAndPurgeCache");
1712 RTR0DbgKrnlInfoRelease(hKrnlInfo);
1713 }
1714
1715 /*
1716 * Init the driver object.
1717 */
1718 DriverObject->DriverUnload = VBoxMRxUnload;
1719 for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
1720 DriverObject->MajorFunction[i] = (PDRIVER_DISPATCH)VBoxMRxFsdDispatch;
1721
1722 /*
1723 * Do RDBSS driver entry processing.
1724 */
1725 rcNt = RxDriverEntry(DriverObject, RegistryPath);
1726 if (rcNt == STATUS_SUCCESS)
1727 {
1728 /*
1729 * Do the mini redirector registration.
1730 * Note! Don't use RX_REGISTERMINI_FLAG_DONT_PROVIDE_UNCS or else UNC
1731 * mappings don't work (including Windows explorer browsing).
1732 */
1733 Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: calling VBoxMRxDeviceObject %p\n", VBoxMRxDeviceObject));
1734 UNICODE_STRING VBoxMRxName;
1735 RtlInitUnicodeString(&VBoxMRxName, DD_MRX_VBOX_FS_DEVICE_NAME_U);
1736 rcNt = RxRegisterMinirdr(&VBoxMRxDeviceObject,
1737 DriverObject,
1738 &VBoxMRxDispatch,
1739 RX_REGISTERMINI_FLAG_DONT_PROVIDE_MAILSLOTS,
1740 &VBoxMRxName,
1741 sizeof(MRX_VBOX_DEVICE_EXTENSION),
1742 FILE_DEVICE_NETWORK_FILE_SYSTEM,
1743 FILE_REMOTE_DEVICE);
1744 Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: returned 0x%08X VBoxMRxDeviceObject %p\n",
1745 rcNt, VBoxMRxDeviceObject));
1746 if (rcNt == STATUS_SUCCESS)
1747 {
1748 /*
1749 * Init the device extension.
1750 *
1751 * Note! The device extension actually points to fields in the RDBSS_DEVICE_OBJECT.
1752 * Our space is past the end of that struct!!
1753 */
1754 PMRX_VBOX_DEVICE_EXTENSION pVBoxDevX = (PMRX_VBOX_DEVICE_EXTENSION)( (PBYTE)VBoxMRxDeviceObject
1755 + sizeof(RDBSS_DEVICE_OBJECT));
1756 pVBoxDevX->pDeviceObject = VBoxMRxDeviceObject;
1757 for (size_t i = 0; i < RT_ELEMENTS(pVBoxDevX->cLocalConnections); i++)
1758 pVBoxDevX->cLocalConnections[i] = FALSE;
1759
1760 /* Mutex for synchronizining our connection list */
1761 ExInitializeFastMutex(&pVBoxDevX->mtxLocalCon);
1762
1763 /*
1764 * The device object has been created. Need to setup a symbolic link
1765 * in the Win32 name space for user mode applications.
1766 */
1767 UNICODE_STRING UserModeDeviceName;
1768 RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1769 Log(("VBOXSF: DriverEntry: Calling IoCreateSymbolicLink\n"));
1770 rcNt = IoCreateSymbolicLink(&UserModeDeviceName, &VBoxMRxName);
1771 if (rcNt == STATUS_SUCCESS)
1772 {
1773 Log(("VBOXSF: DriverEntry: Symbolic link created.\n"));
1774
1775 /*
1776 * Build the dispatch tables for the minirdr
1777 */
1778 vbsfInitMRxDispatch();
1779
1780 /*
1781 * The redirector driver must intercept the IOCTL to avoid VBOXSVR name resolution
1782 * by other redirectors. These additional name resolutions cause long delays.
1783 */
1784 Log(("VBOXSF: DriverEntry: VBoxMRxDeviceObject = %p, rdbss %p, devext %p\n",
1785 VBoxMRxDeviceObject, DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL], pVBoxDevX));
1786 pVBoxDevX->pfnRDBSSDeviceControl = DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
1787 DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = VBoxMRXDeviceControl;
1788
1789 /*
1790 * Intercept IRP_MJ_CREATE to fix incorrect (wrt NTFS, FAT, ++) return
1791 * codes for NtOpenFile("r:\\asdf\\", FILE_NON_DIRECTORY_FILE).
1792 */
1793 pVBoxDevX->pfnRDBSSCreate = DriverObject->MajorFunction[IRP_MJ_CREATE];
1794 DriverObject->MajorFunction[IRP_MJ_CREATE] = VBoxHookMjCreate;
1795
1796 /*
1797 * Intercept IRP_MJ_SET_INFORMATION to ensure we call the host for all
1798 * FileEndOfFileInformation requestes, even if the new size matches the
1799 * old one. We don't know if someone else might have modified the file
1800 * size cached in the FCB since the last time we update it.
1801 */
1802 pVBoxDevX->pfnRDBSSSetInformation = DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION];
1803 DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = VBoxHookMjSetInformation;
1804
1805 /** @todo start the redirector here RxStartMiniRdr. */
1806
1807 Log(("VBOXSF: DriverEntry: Init successful!\n"));
1808 return STATUS_SUCCESS;
1809 }
1810 LogRel(("VBOXSF: DriverEntry: IoCreateSymbolicLink: %#x\n", rcNt));
1811
1812 RxUnregisterMinirdr(VBoxMRxDeviceObject);
1813 VBoxMRxDeviceObject = NULL;
1814 }
1815 else
1816 LogRel(("VBOXSF: DriverEntry: RxRegisterMinirdr failed: %#x\n", rcNt));
1817 }
1818 else
1819 LogRel(("VBOXSF: DriverEntry: RxDriverEntry failed: 0x%08X\n", rcNt));
1820 }
1821 else
1822 LogRel(("VBOXSF: Host does not support physical page lists. Refusing to load!\n"));
1823 VbglR0SfDisconnect(&g_SfClient);
1824 }
1825 else
1826 LogRel(("VBOXSF: DriverEntry: Failed to connect to the host: %Rrc!\n", vrc));
1827 VbglR0SfTerm();
1828 }
1829 else
1830 LogRel(("VBOXSF: DriverEntry: VbglR0SfInit! %Rrc!\n", vrc));
1831 RTR0Term();
1832 }
1833 else
1834 RTLogRelPrintf("VBOXSF: DriverEntry: RTR0Init failed! %Rrc!\n", vrc);
1835 return rcNt;
1836}
1837
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use