vbsf.cpp@ 96686

Last change on this file since 96686 was 96631, checked in by vboxsync, 2 years ago
Add/Nt/Shfl: Some additional info.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 75.2 KB

Line
1	/* $Id: vbsf.cpp 96631 2022-09-07 14:08:12Z vboxsync $ */
2	/** @file
3	* VirtualBox Windows Guest Shared Folders - File System Driver initialization and generic routines
4	*/
5
6	/*
7	* Copyright (C) 2012-2022 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#include "vbsf.h"
33	#include <iprt/initterm.h>
34	#include <iprt/dbg.h>
35
36
37	/*********************************************************************************************************************************
38	* Structures and Typedefs *
39	*********************************************************************************************************************************/
40	/**
41	* The current state of the driver.
42	*/
43	typedef enum _MRX_VBOX_STATE_
44	{
45	MRX_VBOX_STARTABLE,
46	MRX_VBOX_START_IN_PROGRESS,
47	MRX_VBOX_STARTED
48	} MRX_VBOX_STATE, *PMRX_VBOX_STATE;
49
50
51	/*********************************************************************************************************************************
52	* Global Variables *
53	*********************************************************************************************************************************/
54	static MRX_VBOX_STATE VBoxMRxState = MRX_VBOX_STARTABLE;
55
56	/**
57	* The VBoxSF dispatch table.
58	*/
59	static struct _MINIRDR_DISPATCH VBoxMRxDispatch;
60
61	/**
62	* The VBoxSF device object.
63	*/
64	PRDBSS_DEVICE_OBJECT VBoxMRxDeviceObject;
65
66	/** Pointer to CcCoherencyFlushAndPurgeCache if present in ntoskrnl. */
67	PFNCCCOHERENCYFLUSHANDPURGECACHE g_pfnCcCoherencyFlushAndPurgeCache;
68
69	/** The shared folder service client structure. */
70	VBGLSFCLIENT g_SfClient;
71	/** VMMDEV_HVF_XXX (set during init). */
72	uint32_t g_fHostFeatures = 0;
73	/** Last valid shared folders function number. */
74	uint32_t g_uSfLastFunction = SHFL_FN_SET_FILE_SIZE;
75	/** Shared folders features (SHFL_FEATURE_XXX). */
76	uint64_t g_fSfFeatures = 0;
77
78
79	static NTSTATUS VBoxMRxFsdDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
80	{
81	NTSTATUS Status;
82	#ifdef LOG_ENABLED
83	PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
84	Log(("VBOXSF: MRxFsdDispatch: major %d, minor %d: %s\n",
85	IrpSp->MajorFunction, IrpSp->MinorFunction, vbsfNtMajorFunctionName(IrpSp->MajorFunction, IrpSp->MinorFunction)));
86	#endif
87
88	if (DeviceObject != (PDEVICE_OBJECT)VBoxMRxDeviceObject)
89	{
90	Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
91	Irp->IoStatus.Information = 0;
92	IoCompleteRequest(Irp, IO_NO_INCREMENT);
93
94	Log(("VBOXSF: MRxFsdDispatch: Invalid device request detected %p %p\n",
95	DeviceObject, (PDEVICE_OBJECT)VBoxMRxDeviceObject));
96
97	return STATUS_INVALID_DEVICE_REQUEST;
98	}
99
100	Status = RxFsdDispatch((PRDBSS_DEVICE_OBJECT)VBoxMRxDeviceObject, Irp);
101	Log(("VBOXSF: MRxFsdDispatch: Returned 0x%X\n", Status));
102	return Status;
103	}
104
105	static void VBoxMRxUnload(IN PDRIVER_OBJECT DriverObject)
106	{
107	NTSTATUS Status;
108	UNICODE_STRING UserModeDeviceName;
109
110	Log(("VBOXSF: MRxUnload\n"));
111
112	if (VBoxMRxDeviceObject)
113	{
114	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
115	pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)VBoxMRxDeviceObject + sizeof(RDBSS_DEVICE_OBJECT));
116	}
117
118	if (VBoxMRxDeviceObject)
119	{
120	PRX_CONTEXT RxContext;
121	RxContext = RxCreateRxContext(NULL, VBoxMRxDeviceObject, RX_CONTEXT_FLAG_IN_FSP);
122
123	if (RxContext != NULL)
124	{
125	Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
126
127	if (Status == STATUS_SUCCESS)
128	{
129	MRX_VBOX_STATE State;
130
131	State = (MRX_VBOX_STATE)InterlockedCompareExchange((LONG *)&VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
132
133	if (State != MRX_VBOX_STARTABLE)
134	Status = STATUS_REDIRECTOR_STARTED;
135	}
136
137	RxDereferenceAndDeleteRxContext(RxContext);
138	}
139	else
140	Status = STATUS_INSUFFICIENT_RESOURCES;
141
142	RxUnregisterMinirdr(VBoxMRxDeviceObject);
143	}
144
145	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
146	Status = IoDeleteSymbolicLink(&UserModeDeviceName);
147	if (Status != STATUS_SUCCESS)
148	Log(("VBOXSF: MRxUnload: IoDeleteSymbolicLink Status 0x%08X\n", Status));
149
150	RxUnload(DriverObject);
151
152	VbglR0SfDisconnect(&g_SfClient);
153	VbglR0SfTerm();
154
155	Log(("VBOXSF: MRxUnload: VBoxSF.sys driver object %p almost unloaded, just RTR0Term left...\n", DriverObject));
156	RTR0Term(); /* No logging after this. */
157	}
158
159	static void vbsfInitMRxDispatch(void)
160	{
161	Log(("VBOXSF: vbsfInitMRxDispatch: Called.\n"));
162
163	ZeroAndInitializeNodeType(&VBoxMRxDispatch, RDBSS_NTC_MINIRDR_DISPATCH, sizeof(MINIRDR_DISPATCH));
164
165	VBoxMRxDispatch.MRxFlags = RDBSS_MANAGE_NET_ROOT_EXTENSION \| RDBSS_MANAGE_FCB_EXTENSION \| RDBSS_MANAGE_FOBX_EXTENSION;
166
167	VBoxMRxDispatch.MRxSrvCallSize = 0;
168	VBoxMRxDispatch.MRxNetRootSize = sizeof(MRX_VBOX_NETROOT_EXTENSION);
169	VBoxMRxDispatch.MRxVNetRootSize = 0;
170	VBoxMRxDispatch.MRxFcbSize = sizeof(VBSFNTFCBEXT);
171	VBoxMRxDispatch.MRxSrvOpenSize = 0;
172	VBoxMRxDispatch.MRxFobxSize = sizeof(MRX_VBOX_FOBX);
173
174	VBoxMRxDispatch.MRxStart = VBoxMRxStart;
175	VBoxMRxDispatch.MRxStop = VBoxMRxStop;
176
177	VBoxMRxDispatch.MRxCreate = VBoxMRxCreate;
178	VBoxMRxDispatch.MRxCollapseOpen = VBoxMRxCollapseOpen;
179	VBoxMRxDispatch.MRxShouldTryToCollapseThisOpen = VBoxMRxShouldTryToCollapseThisOpen;
180	VBoxMRxDispatch.MRxFlush = VBoxMRxFlush;
181	VBoxMRxDispatch.MRxTruncate = VBoxMRxTruncate;
182	VBoxMRxDispatch.MRxCleanupFobx = VBoxMRxCleanupFobx;
183	VBoxMRxDispatch.MRxCloseSrvOpen = VBoxMRxCloseSrvOpen;
184	VBoxMRxDispatch.MRxDeallocateForFcb = VBoxMRxDeallocateForFcb;
185	VBoxMRxDispatch.MRxDeallocateForFobx = VBoxMRxDeallocateForFobx;
186	VBoxMRxDispatch.MRxForceClosed = VBoxMRxForceClosed;
187
188	VBoxMRxDispatch.MRxQueryDirectory = VBoxMRxQueryDirectory;
189	VBoxMRxDispatch.MRxQueryFileInfo = VBoxMRxQueryFileInfo;
190	VBoxMRxDispatch.MRxSetFileInfo = VBoxMRxSetFileInfo;
191	VBoxMRxDispatch.MRxSetFileInfoAtCleanup = VBoxMRxSetFileInfoAtCleanup;
192	VBoxMRxDispatch.MRxQueryEaInfo = VBoxMRxQueryEaInfo;
193	VBoxMRxDispatch.MRxSetEaInfo = VBoxMRxSetEaInfo;
194	VBoxMRxDispatch.MRxQuerySdInfo = VBoxMRxQuerySdInfo;
195	VBoxMRxDispatch.MRxSetSdInfo = VBoxMRxSetSdInfo;
196	VBoxMRxDispatch.MRxQueryVolumeInfo = VBoxMRxQueryVolumeInfo;
197
198	VBoxMRxDispatch.MRxComputeNewBufferingState = VBoxMRxComputeNewBufferingState;
199
200	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_READ] = VBoxMRxRead;
201	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_WRITE] = VBoxMRxWrite;
202	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_SHAREDLOCK] = VBoxMRxLocks;
203	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_EXCLUSIVELOCK] = VBoxMRxLocks;
204	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK] = VBoxMRxLocks;
205	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK_MULTIPLE] = VBoxMRxLocks;
206	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_FSCTL] = VBoxMRxFsCtl;
207	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_IOCTL] = VBoxMRxIoCtl;
208	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_NOTIFY_CHANGE_DIRECTORY] = VBoxMRxNotifyChangeDirectory;
209
210	VBoxMRxDispatch.MRxExtendForCache = VBoxMRxExtendStub;
211	VBoxMRxDispatch.MRxExtendForNonCache = VBoxMRxExtendStub;
212	VBoxMRxDispatch.MRxCompleteBufferingStateChangeRequest = VBoxMRxCompleteBufferingStateChangeRequest;
213
214	VBoxMRxDispatch.MRxCreateVNetRoot = VBoxMRxCreateVNetRoot;
215	VBoxMRxDispatch.MRxFinalizeVNetRoot = VBoxMRxFinalizeVNetRoot;
216	VBoxMRxDispatch.MRxFinalizeNetRoot = VBoxMRxFinalizeNetRoot;
217	VBoxMRxDispatch.MRxUpdateNetRootState = VBoxMRxUpdateNetRootState;
218	VBoxMRxDispatch.MRxExtractNetRootName = VBoxMRxExtractNetRootName;
219
220	VBoxMRxDispatch.MRxCreateSrvCall = VBoxMRxCreateSrvCall;
221	VBoxMRxDispatch.MRxSrvCallWinnerNotify = VBoxMRxSrvCallWinnerNotify;
222	VBoxMRxDispatch.MRxFinalizeSrvCall = VBoxMRxFinalizeSrvCall;
223
224	VBoxMRxDispatch.MRxDevFcbXXXControlFile = VBoxMRxDevFcbXXXControlFile;
225
226	Log(("VBOXSF: vbsfInitMRxDispatch: Success.\n"));
227	return;
228	}
229
230	static BOOL vboxIsPrefixOK (const WCHAR *FilePathName, ULONG PathNameLength)
231	{
232	BOOL PrefixOK;
233
234	/* The FilePathName here looks like: \vboxsrv\... */
235	if (PathNameLength >= 8 * sizeof (WCHAR)) /* Number of bytes in '\vboxsrv' unicode string. */
236	{
237	PrefixOK = (FilePathName[0] == L'\\');
238	PrefixOK &= (FilePathName[1] == L'V') \|\| (FilePathName[1] == L'v');
239	PrefixOK &= (FilePathName[2] == L'B') \|\| (FilePathName[2] == L'b');
240	PrefixOK &= (FilePathName[3] == L'O') \|\| (FilePathName[3] == L'o');
241	PrefixOK &= (FilePathName[4] == L'X') \|\| (FilePathName[4] == L'x');
242	PrefixOK &= (FilePathName[5] == L'S') \|\| (FilePathName[5] == L's');
243	/* Both vboxsvr & vboxsrv are now accepted */
244	if ((FilePathName[6] == L'V') \|\| (FilePathName[6] == L'v'))
245	{
246	PrefixOK &= (FilePathName[6] == L'V') \|\| (FilePathName[6] == L'v');
247	PrefixOK &= (FilePathName[7] == L'R') \|\| (FilePathName[7] == L'r');
248	}
249	else
250	{
251	PrefixOK &= (FilePathName[6] == L'R') \|\| (FilePathName[6] == L'r');
252	PrefixOK &= (FilePathName[7] == L'V') \|\| (FilePathName[7] == L'v');
253	}
254	if (PathNameLength > 8 * sizeof (WCHAR))
255	{
256	/* There is something after '\vboxsrv'. */
257	PrefixOK &= (FilePathName[8] == L'\\') \|\| (FilePathName[8] == 0);
258	}
259	}
260	else
261	PrefixOK = FALSE;
262
263	return PrefixOK;
264	}
265
266	static NTSTATUS VBoxMRXDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
267	{
268	NTSTATUS Status = STATUS_SUCCESS;
269
270	QUERY_PATH_REQUEST *pReq = NULL;
271	QUERY_PATH_REQUEST_EX *pReqEx = NULL;
272	QUERY_PATH_RESPONSE *pResp = NULL;
273
274	BOOL PrefixOK = FALSE;
275
276	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
277
278	/* Make a local copy, it will be needed after the Irp completion. */
279	ULONG IoControlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
280
281	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
282
283	Log(("VBOXSF: MRXDeviceControl: pDevObj %p, pDeviceExtension %p, code %x\n",
284	pDevObj, pDevObj->DeviceExtension, IoControlCode));
285
286	switch (IoControlCode)
287	{
288	case IOCTL_REDIR_QUERY_PATH_EX: /* Vista */
289	case IOCTL_REDIR_QUERY_PATH: /* XP and earlier */
290	{
291	/* This IOCTL is intercepted for 2 reasons:
292	* 1) Claim the vboxsvr and vboxsrv prefixes. All name-based operations for them
293	* will be routed to the VBox provider automatically without any prefix resolution
294	* since the prefix is already in the prefix cache.
295	* 2) Reject other prefixes immediately to speed up the UNC path resolution a bit,
296	* because RDBSS will not be involved then.
297	*/
298
299	const WCHAR *FilePathName = NULL;
300	ULONG PathNameLength = 0;
301
302	if (pIrp->RequestorMode != KernelMode)
303	{
304	/* MSDN: Network redirectors should only honor kernel-mode senders of this IOCTL, by verifying
305	* that RequestorMode member of the IRP structure is KernelMode.
306	*/
307	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH(_EX): not kernel mode!!!\n",
308	pStack->Parameters.DeviceIoControl.InputBufferLength));
309	/* Continue to RDBSS. */
310	break;
311	}
312
313	if (IoControlCode == IOCTL_REDIR_QUERY_PATH)
314	{
315	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: Called (pid %x).\n", IoGetCurrentProcess()));
316
317	if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST))
318	{
319	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: short input buffer %d.\n",
320	pStack->Parameters.DeviceIoControl.InputBufferLength));
321	/* Continue to RDBSS. */
322	break;
323	}
324
325	pReq = (QUERY_PATH_REQUEST *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
326
327	Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReq->PathNameLength));
328	Log(("VBOXSF: MRxDeviceControl: SecurityContext = %p.\n", pReq->SecurityContext));
329	Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReq->PathNameLength / sizeof (WCHAR), pReq->FilePathName));
330
331	FilePathName = pReq->FilePathName;
332	PathNameLength = pReq->PathNameLength;
333	}
334	else
335	{
336	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: Called.\n"));
337
338	if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST_EX))
339	{
340	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: short input buffer %d.\n",
341	pStack->Parameters.DeviceIoControl.InputBufferLength));
342	/* Continue to RDBSS. */
343	break;
344	}
345
346	pReqEx = (QUERY_PATH_REQUEST_EX *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
347
348	Log(("VBOXSF: MRxDeviceControl: pSecurityContext = %p.\n", pReqEx->pSecurityContext));
349	Log(("VBOXSF: MRxDeviceControl: EaLength = %d.\n", pReqEx->EaLength));
350	Log(("VBOXSF: MRxDeviceControl: pEaBuffer = %p.\n", pReqEx->pEaBuffer));
351	Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReqEx->PathName.Length));
352	Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReqEx->PathName.Length / sizeof (WCHAR), pReqEx->PathName.Buffer));
353
354	FilePathName = pReqEx->PathName.Buffer;
355	PathNameLength = pReqEx->PathName.Length;
356	}
357
358	pResp = (QUERY_PATH_RESPONSE *)pIrp->UserBuffer;
359
360	PrefixOK = vboxIsPrefixOK (FilePathName, PathNameLength);
361	Log(("VBOXSF: MRxDeviceControl PrefixOK %d\n", PrefixOK));
362
363	if (!PrefixOK)
364	{
365	/* Immediately fail the IOCTL with STATUS_BAD_NETWORK_NAME as recommended by MSDN.
366	* No need to involve RDBSS.
367	*/
368	Status = STATUS_BAD_NETWORK_NAME;
369
370	pIrp->IoStatus.Status = Status;
371	pIrp->IoStatus.Information = 0;
372
373	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
374
375	Log(("VBOXSF: MRxDeviceControl: returned STATUS_BAD_NETWORK_NAME\n"));
376	return Status;
377	}
378
379	Log(("VBOXSF: MRxDeviceControl pResp %p verifying the path.\n", pResp));
380	if (pResp)
381	{
382	/* Always claim entire \vboxsrv prefix. The LengthAccepted initially is equal to entire path.
383	* Here it is assigned to the length of \vboxsrv prefix.
384	*/
385	pResp->LengthAccepted = 8 * sizeof (WCHAR);
386
387	Status = STATUS_SUCCESS;
388
389	pIrp->IoStatus.Status = Status;
390	pIrp->IoStatus.Information = 0;
391
392	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
393
394	Log(("VBOXSF: MRxDeviceControl: claiming the path.\n"));
395	return Status;
396	}
397
398	/* No pResp pointer, should not happen. Just a precaution. */
399	Status = STATUS_INVALID_PARAMETER;
400
401	pIrp->IoStatus.Status = Status;
402	pIrp->IoStatus.Information = 0;
403
404	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
405
406	Log(("VBOXSF: MRxDeviceControl: returned STATUS_INVALID_PARAMETER\n"));
407	return Status;
408	}
409
410	default:
411	break;
412	}
413
414	/* Pass the IOCTL to RDBSS. */
415	if (pDeviceExtension && pDeviceExtension->pfnRDBSSDeviceControl)
416	{
417	Log(("VBOXSF: MRxDeviceControl calling RDBSS %p\n", pDeviceExtension->pfnRDBSSDeviceControl));
418	Status = pDeviceExtension->pfnRDBSSDeviceControl (pDevObj, pIrp);
419	Log(("VBOXSF: MRxDeviceControl RDBSS status 0x%08X\n", Status));
420	}
421	else
422	{
423	/* No RDBSS, should not happen. Just a precaution. */
424	Status = STATUS_NOT_IMPLEMENTED;
425
426	pIrp->IoStatus.Status = Status;
427	pIrp->IoStatus.Information = 0;
428
429	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
430
431	Log(("VBOXSF: MRxDeviceControl: returned STATUS_NOT_IMPLEMENTED\n"));
432	}
433
434	return Status;
435	}
436
437	/**
438	* Intercepts IRP_MJ_CREATE to workaround a RDBSS quirk.
439	*
440	* Our RDBSS library will return STATUS_OBJECT_NAME_INVALID when FILE_NON_DIRECTORY_FILE
441	* is set and the path ends with a slash. NTFS and FAT will fail with
442	* STATUS_OBJECT_NAME_NOT_FOUND if the final component does not exist or isn't a directory,
443	* STATUS_OBJECT_PATH_NOT_FOUND if some path component doesn't exist or isn't a directory,
444	* or STATUS_ACCESS_DENIED if the final component is a directory.
445	*
446	* So, our HACK is to drop the trailing slash and set an unused flag in the ShareAccess
447	* parameter to tell vbsfProcessCreate about it.
448	*
449	*/
450	static NTSTATUS VBoxHookMjCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
451	{
452	PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
453	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
454	PFILE_OBJECT pFileObj = pStack->FileObject;
455	NTSTATUS rcNt;
456
457	Log(("VBOXSF: VBoxHookMjCreate: pDevObj %p, pDevExt %p, pFileObj %p, options %#x, attr %#x, share %#x, ealength %#x, secctx %p, IrpFlags %#x\n",
458	pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.Create.Options, pStack->Parameters.Create.FileAttributes,
459	pStack->Parameters.Create.ShareAccess, pStack->Parameters.Create.EaLength, pStack->Parameters.Create.SecurityContext, pIrp->Flags));
460	if (pFileObj)
461	Log(("VBOXSF: VBoxHookMjCreate: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
462
463	/*
464	* Check if we need to apply the hack. If we do, we grab a reference to
465	* the file object to be absolutely sure it's around for the cleanup work.
466	*/
467	AssertMsg(!(pStack->Parameters.Create.ShareAccess & VBOX_MJ_CREATE_SLASH_HACK), ("%#x\n", pStack->Parameters.Create.ShareAccess));
468	if ( (pStack->Parameters.Create.Options & (FILE_NON_DIRECTORY_FILE \| FILE_DIRECTORY_FILE)) == FILE_NON_DIRECTORY_FILE
469	&& pFileObj
470	&& pFileObj->FileName.Length > 18
471	&& pFileObj->FileName.Buffer
472	&& pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 1] == '\\'
473	&& pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 2] != '\\')
474	{
475	NTSTATUS rcNtRef = ObReferenceObjectByPointer(pFileObj, (ACCESS_MASK)0, *IoFileObjectType, KernelMode);
476	pFileObj->FileName.Length -= 2;
477	pStack->Parameters.Create.ShareAccess \|= VBOX_MJ_CREATE_SLASH_HACK; /* secret flag for vbsfProcessCreate */
478
479	rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
480
481	if (rcNt != STATUS_PENDING)
482	pStack->Parameters.Create.ShareAccess &= ~VBOX_MJ_CREATE_SLASH_HACK;
483	if (NT_SUCCESS(rcNtRef))
484	{
485	pFileObj->FileName.Length += 2;
486	ObDereferenceObject(pFileObj);
487	}
488
489	Log(("VBOXSF: VBoxHookMjCreate: returns %#x (hacked; rcNtRef=%#x)\n", rcNt, rcNtRef));
490	}
491	/*
492	* No hack needed.
493	*/
494	else
495	{
496	rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
497	Log(("VBOXSF: VBoxHookMjCreate: returns %#x\n", rcNt));
498	}
499	return rcNt;
500	}
501
502	/**
503	* Intercepts IRP_MJ_SET_INFORMATION to workaround a RDBSS quirk in the
504	* FileEndOfFileInformation handling.
505	*
506	* We will add 4096 to the FileEndOfFileInformation function value and pick it
507	* up in VBoxMRxSetFileInfo after RxCommonSetInformation has done the necessary
508	* locking. If we find that the desired file size matches the cached one, just
509	* issue the call directly, otherwise subtract 4096 and call the
510	* RxSetEndOfFileInfo worker.
511	*/
512	static NTSTATUS VBoxHookMjSetInformation(PDEVICE_OBJECT pDevObj, PIRP pIrp)
513	{
514	PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
515	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
516	PFILE_OBJECT pFileObj = pStack->FileObject;
517	NTSTATUS rcNt;
518
519	Log(("VBOXSF: VBoxHookMjSetInformation: pDevObj %p, pDevExt %p, pFileObj %p, FileInformationClass %d, Length %#x\n",
520	pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.SetFile.FileInformationClass, pStack->Parameters.SetFile.Length));
521	if (pFileObj)
522	Log2(("VBOXSF: VBoxHookMjSetInformation: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
523
524	/*
525	* Setting EOF info?
526	*/
527	if (pStack->Parameters.SetFile.FileInformationClass == FileEndOfFileInformation)
528	{
529	#if 0 /* This only works for more recent versions of the RDBSS library, not for the one we're using (WDK 7600.16385.1). */
530	pStack->Parameters.SetFile.FileInformationClass = (FILE_INFORMATION_CLASS)(FileEndOfFileInformation + 4096);
531	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
532	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked)\n", rcNt));
533	return rcNt;
534	#else
535	/*
536	* For the older WDK, we have to detect the same-size situation up front and hack
537	* it here instead of in VBoxMRxSetFileInfo. This means we need to lock the FCB
538	* before modifying the Fcb.Header.FileSize value and ASSUME the locking is
539	* reentrant and nothing else happens during RDBSS dispatching wrt that...
540	*/
541	PMRX_FCB pFcb = (PMRX_FCB)pFileObj->FsContext;
542	if ( (NODE_TYPE_CODE)pFcb->Header.NodeTypeCode == RDBSS_NTC_STORAGE_TYPE_FILE
543	&& pIrp->AssociatedIrp.SystemBuffer != NULL
544	&& pStack->Parameters.SetFile.Length >= sizeof(FILE_END_OF_FILE_INFORMATION))
545	{
546	LONGLONG cbFileNew = -42;
547	__try
548	{
549	cbFileNew = ((PFILE_END_OF_FILE_INFORMATION)pIrp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart;
550	}
551	__except(EXCEPTION_EXECUTE_HANDLER)
552	{
553	cbFileNew = -42;
554	}
555	if ( cbFileNew >= 0
556	&& pFcb->Header.FileSize.QuadPart == cbFileNew
557	&& !(pFcb->FcbState & FCB_STATE_PAGING_FILE))
558	{
559	/* Now exclusivly lock the FCB like RxCommonSetInformation would do
560	to reduce chances of races and of anyone else grabbing the value
561	while it's incorrect on purpose. */
562	NTSTATUS rcNtLock = RxAcquireExclusiveFcb(NULL, (PFCB)pFcb);
563	if (NT_SUCCESS(rcNtLock))
564	{
565	if (pFcb->Header.FileSize.QuadPart == cbFileNew)
566	{
567	int64_t const cbHackedSize = cbFileNew ? cbFileNew - 1 : 1;
568	pFcb->Header.FileSize.QuadPart = cbHackedSize;
569	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
570	if ( !NT_SUCCESS(rcNt)
571	&& pFcb->Header.FileSize.QuadPart == cbHackedSize)
572	pFcb->Header.FileSize.QuadPart = cbFileNew;
573	# ifdef VBOX_STRICT
574	else
575	{
576	PMRX_FOBX pFobx = (PMRX_FOBX)pFileObj->FsContext2;
577	PMRX_VBOX_FOBX pVBoxFobX = VBoxMRxGetFileObjectExtension(pFobx);
578	Assert( pFcb->Header.FileSize.QuadPart != cbHackedSize
579	\|\| (pVBoxFobX && pVBoxFobX->Info.cbObject == cbHackedSize));
580	}
581	# endif
582	RxReleaseFcb(NULL, pFcb);
583	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked, cbFileNew=%#RX64)\n", rcNt, cbFileNew));
584	return rcNt;
585	}
586	RxReleaseFcb(NULL, pFcb);
587	}
588	}
589	}
590	#endif
591	}
592
593	/*
594	* No hack needed.
595	*/
596	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
597	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x\n", rcNt));
598	return rcNt;
599	}
600
601
602	NTSTATUS VBoxMRxStart(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
603	{
604	NTSTATUS Status;
605	MRX_VBOX_STATE CurrentState;
606	RT_NOREF(RxContext, RxDeviceObject);
607
608	Log(("VBOXSF: MRxStart\n"));
609
610	CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_STARTED, MRX_VBOX_START_IN_PROGRESS);
611
612	if (CurrentState == MRX_VBOX_START_IN_PROGRESS)
613	{
614	Log(("VBOXSF: MRxStart: Start in progress -> started\n"));
615	Status = STATUS_SUCCESS;
616	}
617	else if (VBoxMRxState == MRX_VBOX_STARTED)
618	{
619	Log(("VBOXSF: MRxStart: Already started\n"));
620	Status = STATUS_REDIRECTOR_STARTED;
621	}
622	else
623	{
624	Log(("VBOXSF: MRxStart: Bad state! VBoxMRxState = %d\n", VBoxMRxState));
625	Status = STATUS_UNSUCCESSFUL;
626	}
627
628	return Status;
629	}
630
631	NTSTATUS VBoxMRxStop(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
632	{
633	RT_NOREF(RxContext, RxDeviceObject);
634	Log(("VBOXSF: MRxStop\n"));
635	return STATUS_SUCCESS;
636	}
637
638	NTSTATUS VBoxMRxIoCtl(IN OUT PRX_CONTEXT RxContext)
639	{
640	RT_NOREF(RxContext);
641	Log(("VBOXSF: MRxIoCtl: IoControlCode = 0x%08X\n", RxContext->LowIoContext.ParamsFor.FsCtl.FsControlCode));
642	return STATUS_INVALID_DEVICE_REQUEST;
643	}
644
645	NTSYSAPI NTSTATUS NTAPI ZwSetSecurityObject(IN HANDLE Handle,
646	IN SECURITY_INFORMATION SecurityInformation,
647	IN PSECURITY_DESCRIPTOR SecurityDescriptor);
648
649	NTSTATUS VBoxMRxDevFcbXXXControlFile(IN OUT PRX_CONTEXT RxContext)
650	{
651	NTSTATUS Status = STATUS_SUCCESS;
652	RxCaptureFobx;
653	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
654	PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext;
655
656	Log(("VBOXSF: MRxDevFcbXXXControlFile: MajorFunction = 0x%02X\n",
657	RxContext->MajorFunction));
658
659	switch (RxContext->MajorFunction)
660	{
661	case IRP_MJ_FILE_SYSTEM_CONTROL:
662	{
663	Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MN_USER_FS_REQUEST: 0x%08X\n",
664	LowIoContext->ParamsFor.FsCtl.MinorFunction));
665	Status = STATUS_INVALID_DEVICE_REQUEST;
666	break;
667	}
668
669	case IRP_MJ_DEVICE_CONTROL:
670	{
671	Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MJ_DEVICE_CONTROL: InputBuffer %p/%d, OutputBuffer %p/%d\n",
672	LowIoContext->ParamsFor.IoCtl.pInputBuffer,
673	LowIoContext->ParamsFor.IoCtl.InputBufferLength,
674	LowIoContext->ParamsFor.IoCtl.pOutputBuffer,
675	LowIoContext->ParamsFor.IoCtl.OutputBufferLength));
676
677	switch (LowIoContext->ParamsFor.IoCtl.IoControlCode)
678	{
679	case IOCTL_MRX_VBOX_ADDCONN:
680	{
681	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_ADDCONN\n"));
682	Status = vbsfNtCreateConnection(RxContext, &RxContext->PostRequest);
683	break;
684	}
685
686	case IOCTL_MRX_VBOX_DELCONN:
687	{
688	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_DELCONN\n"));
689	Status = vbsfNtDeleteConnection(RxContext, &RxContext->PostRequest);
690	break;
691	}
692
693	case IOCTL_MRX_VBOX_GETLIST:
694	{
695	ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
696	uint8_t pu8Out = (uint8_t )LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
697
698	BOOLEAN fLocked = FALSE;
699
700	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST\n"));
701
702	RxContext->InformationToReturn = 0;
703
704	if ( !pDeviceExtension
705	\|\| cbOut < _MRX_MAX_DRIVE_LETTERS)
706	{
707	Status = STATUS_INVALID_PARAMETER;
708	break;
709	}
710
711	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST: Copying local connections\n"));
712
713	fLocked = ExTryToAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
714
715	__try
716	{
717	RtlCopyMemory(pu8Out, pDeviceExtension->cLocalConnections, _MRX_MAX_DRIVE_LETTERS);
718	RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
719	}
720	__except(EXCEPTION_EXECUTE_HANDLER)
721	{
722	Status = STATUS_INVALID_PARAMETER;
723	}
724
725	if (fLocked)
726	{
727	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
728	fLocked = FALSE;
729	}
730
731	break;
732	}
733
734	/*
735	* Returns the root IDs of shared folder mappings.
736	*/
737	case IOCTL_MRX_VBOX_GETGLOBALLIST:
738	{
739	ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
740	uint8_t pu8Out = (uint8_t )LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
741
742	int vrc;
743	SHFLMAPPING mappings[_MRX_MAX_DRIVE_LETTERS];
744	uint32_t cMappings = RT_ELEMENTS(mappings);
745
746	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST\n"));
747
748	RxContext->InformationToReturn = 0;
749
750	if ( !pDeviceExtension
751	\|\| cbOut < _MRX_MAX_DRIVE_LETTERS)
752	{
753	Status = STATUS_INVALID_PARAMETER;
754	break;
755	}
756
757	vrc = VbglR0SfQueryMappings(&g_SfClient, mappings, &cMappings);
758	if (vrc == VINF_SUCCESS)
759	{
760	__try
761	{
762	uint32_t i;
763
764	RtlZeroMemory(pu8Out, _MRX_MAX_DRIVE_LETTERS);
765
766	for (i = 0; i < RT_MIN(cMappings, cbOut); i++)
767	{
768	pu8Out[i] = mappings[i].root;
769	pu8Out[i] \|= 0x80; /* mark active / /* @todo fix properly */
770	}
771
772	RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
773	}
774	__except(EXCEPTION_EXECUTE_HANDLER)
775	{
776	Status = STATUS_INVALID_PARAMETER;
777	}
778	}
779	else
780	{
781	Status = vbsfNtVBoxStatusToNt(vrc);
782	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST failed: 0x%08X\n",
783	Status));
784	}
785
786	break;
787	}
788
789	/*
790	* Translates a local connection name (e.g. drive "S:") to the
791	* corresponding remote name (e.g. \\vboxsrv\share).
792	*/
793	case IOCTL_MRX_VBOX_GETCONN:
794	{
795	ULONG cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
796	PWCHAR pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
797	ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
798	PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
799
800	BOOLEAN fMutexAcquired = FALSE;
801
802	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN\n"));
803
804	RxContext->InformationToReturn = 0;
805
806	if ( !pDeviceExtension
807	\|\| cbConnectName < sizeof(WCHAR))
808	{
809	Status = STATUS_INVALID_PARAMETER;
810	break;
811	}
812
813	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Looking up connection name and connections\n"));
814
815	__try
816	{
817	uint32_t idx = *pwcConnectName - L'A';
818
819	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: ConnectName = %.*ls, Len = %d, Index = %d\n",
820	cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName, idx));
821
822	if (idx < RTL_NUMBER_OF(pDeviceExtension->wszLocalConnectionName))
823	{
824	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
825	fMutexAcquired = TRUE;
826
827	if (pDeviceExtension->wszLocalConnectionName[idx])
828	{
829	ULONG cbLocalConnectionName = pDeviceExtension->wszLocalConnectionName[idx]->Length;
830
831	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName = %.*ls\n",
832	cbLocalConnectionName / sizeof(WCHAR), pDeviceExtension->wszLocalConnectionName[idx]->Buffer));
833
834	if ((pDeviceExtension->cLocalConnections[idx]) && (cbLocalConnectionName <= cbRemoteName))
835	{
836	RtlZeroMemory(pwcRemoteName, cbRemoteName);
837	RtlCopyMemory(pwcRemoteName,
838	pDeviceExtension->wszLocalConnectionName[idx]->Buffer,
839	cbLocalConnectionName);
840
841	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Remote name = %.*ls, Len = %d\n",
842	cbLocalConnectionName / sizeof(WCHAR), pwcRemoteName, cbLocalConnectionName));
843	}
844	else
845	{
846	Status = STATUS_BUFFER_TOO_SMALL;
847	}
848
849	RxContext->InformationToReturn = cbLocalConnectionName;
850	}
851	else
852	{
853	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName is NULL!\n"));
854	Status = STATUS_BAD_NETWORK_NAME;
855	}
856	}
857	else
858	{
859	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Index is invalid!\n"));
860	Status = STATUS_INVALID_PARAMETER;
861	}
862	}
863	__except(EXCEPTION_EXECUTE_HANDLER)
864	{
865	Status = STATUS_INVALID_PARAMETER;
866	}
867
868	if (fMutexAcquired)
869	{
870	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
871	fMutexAcquired = FALSE;
872	}
873
874	break;
875	}
876
877	case IOCTL_MRX_VBOX_GETGLOBALCONN:
878	{
879	ULONG cbConnectId = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
880	uint8_t pu8ConnectId = (uint8_t )LowIoContext->ParamsFor.IoCtl.pInputBuffer;
881	ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
882	PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
883
884	int vrc;
885	PSHFLSTRING pString;
886
887	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN\n"));
888
889	RxContext->InformationToReturn = 0;
890
891	if ( !pDeviceExtension
892	\|\| cbConnectId < sizeof(uint8_t))
893	{
894	Status = STATUS_INVALID_PARAMETER;
895	break;
896	}
897
898	/* Allocate empty string where the host can store cbRemoteName bytes. */
899	Status = vbsfNtShflStringFromUnicodeAlloc(&pString, NULL, (uint16_t)cbRemoteName);
900	if (Status != STATUS_SUCCESS)
901	break;
902
903	__try
904	{
905	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Connection ID = %d\n",
906	*pu8ConnectId));
907
908	vrc = VbglR0SfQueryMapName(&g_SfClient,
909	pu8ConnectId & ~0x80 /* @todo fix properly */,
910	pString, ShflStringSizeOfBuffer(pString));
911	if ( vrc == VINF_SUCCESS
912	&& pString->u16Length < cbRemoteName)
913	{
914	RtlCopyMemory(pwcRemoteName, pString->String.ucs2, pString->u16Length);
915	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Returned name = %.*ls, Len = %d\n",
916	pString->u16Length / sizeof(WCHAR), pwcRemoteName, pString->u16Length));
917	RxContext->InformationToReturn = pString->u16Length;
918	}
919	else
920	{
921	Status = STATUS_BAD_NETWORK_NAME;
922	}
923	}
924	__except(EXCEPTION_EXECUTE_HANDLER)
925	{
926	Status = STATUS_INVALID_PARAMETER;
927	}
928
929	vbsfNtFreeNonPagedMem(pString);
930
931	break;
932	}
933
934	case IOCTL_MRX_VBOX_START:
935	{
936	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: capFobx %p\n",
937	capFobx));
938
939	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: process: current 0x%X, RDBSS 0x%X\n",
940	IoGetCurrentProcess(), RxGetRDBSSProcess()));
941
942	switch (VBoxMRxState)
943	{
944	case MRX_VBOX_STARTABLE:
945
946	Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_STARTABLE\n"));
947
948	if (capFobx)
949	{
950	Status = STATUS_INVALID_DEVICE_REQUEST;
951	break;;
952	}
953
954	InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_START_IN_PROGRESS, MRX_VBOX_STARTABLE);
955
956	case MRX_VBOX_START_IN_PROGRESS:
957	Status = RxStartMinirdr(RxContext, &RxContext->PostRequest);
958
959	Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_START_IN_PROGRESS RxStartMiniRdr Status 0x%08X, post %d\n",
960	Status, RxContext->PostRequest));
961
962	if (Status == STATUS_REDIRECTOR_STARTED)
963	{
964	Status = STATUS_SUCCESS;
965	break;
966	}
967
968	if ( Status == STATUS_PENDING
969	&& RxContext->PostRequest == TRUE)
970	{
971	/* Will be restarted in RDBSS process. */
972	Status = STATUS_MORE_PROCESSING_REQUIRED;
973	break;
974	}
975
976	#if 0 /* 2022-09-07 bird: I've disabled this as it prevents VBoxService from accessing the redirector on Windows XP RTM.
977	*
978	* The default is: Administrators=RWDPO, Everyone=R, LOCAL=RW, RESTRICTED=R, SYSTEM=RWDPO
979	* This changes it to: LOCAL=RW
980	* (R=read, W=write, D=delete, P=Change Permissions, O=Change Owner. WinObj advanced permissions view.)
981	*
982	* I'm not sure if the intention here is to create a NULL DACL, which grants unrestricted access to the device.
983	* However, it's somehow now working for Windows XP RTM. I think an explicit call to RtlSetDaclSecurityDescriptor
984	* is required for that to work, indicating that a DACL is present but NULL.
985	* (See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlsetdaclsecuritydescriptor and
986	* https://docs.microsoft.com/en-us/windows/win32/secauthz/null-dacls-and-empty-dacls for NULL DACL details.)
987	*
988	* If the problem is that RESTRICTED (S-1-5-12) should have RWS access, read the descriptor and modify the ACE
989	* for RESTRICTED to grant them write access.
990	*/
991	/* Allow restricted users to use shared folders; works only in XP and Vista. (@@todo hack) */
992	if (Status == STATUS_SUCCESS)
993	{
994	SECURITY_DESCRIPTOR SecurityDescriptor;
995	OBJECT_ATTRIBUTES InitializedAttributes;
996	HANDLE hDevice;
997	IO_STATUS_BLOCK IoStatusBlock;
998	UNICODE_STRING UserModeDeviceName;
999
1000	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1001
1002	/* Create empty security descriptor */
1003	RtlZeroMemory (&SecurityDescriptor, sizeof (SecurityDescriptor));
1004	Status = RtlCreateSecurityDescriptor(&SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1005	if (Status != STATUS_SUCCESS)
1006	{
1007	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: RtlCreateSecurityDescriptor failed with 0x%08X!\n",
1008	Status));
1009	return Status;
1010	}
1011
1012	RtlZeroMemory (&InitializedAttributes, sizeof (InitializedAttributes));
1013	InitializeObjectAttributes(&InitializedAttributes, &UserModeDeviceName, OBJ_KERNEL_HANDLE, 0, 0);
1014
1015	/* Open our symbolic link device name */
1016	Status = ZwOpenFile(&hDevice, WRITE_DAC, &InitializedAttributes, &IoStatusBlock, 0, 0);
1017	if (Status != STATUS_SUCCESS)
1018	{
1019	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwOpenFile %ls failed with 0x%08X!\n",
1020	DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U, Status));
1021	return Status;
1022	}
1023
1024	/* Override the discretionary access control list (DACL) settings */
1025	Status = ZwSetSecurityObject(hDevice, DACL_SECURITY_INFORMATION, &SecurityDescriptor);
1026	if (Status != STATUS_SUCCESS)
1027	{
1028	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwSetSecurityObject failed with 0x%08X!\n",
1029	Status));
1030	return Status;
1031	}
1032
1033	Status = ZwClose(hDevice);
1034	if (Status != STATUS_SUCCESS)
1035	{
1036	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwClose failed with 0x%08X\n",
1037	Status));
1038	return Status;
1039	}
1040	}
1041	#endif
1042	break;
1043
1044	case MRX_VBOX_STARTED:
1045	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_STARTED: Already started\n"));
1046	Status = STATUS_SUCCESS;
1047	break;
1048
1049	default:
1050	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Invalid state (%d)!\n",
1051	VBoxMRxState));
1052	Status = STATUS_INVALID_PARAMETER;
1053	break;
1054	}
1055
1056	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Returned 0x%08X\n",
1057	Status));
1058	break;
1059	}
1060
1061	case IOCTL_MRX_VBOX_STOP:
1062	{
1063	MRX_VBOX_STATE CurrentState;
1064
1065	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: capFobx %p\n",
1066	capFobx));
1067
1068	if (capFobx)
1069	{
1070	Status = STATUS_INVALID_DEVICE_REQUEST;
1071	break;
1072	}
1073
1074	if (RxContext->RxDeviceObject->NumberOfActiveFcbs > 0)
1075	{
1076	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Open handles = %d\n",
1077	RxContext->RxDeviceObject->NumberOfActiveFcbs));
1078	Status = STATUS_REDIRECTOR_HAS_OPEN_HANDLES;
1079	break;
1080	}
1081
1082	CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG) & VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
1083
1084	Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
1085	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Returned 0x%08X\n",
1086	Status));
1087
1088	if (Status == STATUS_PENDING && RxContext->PostRequest == TRUE)
1089	Status = STATUS_MORE_PROCESSING_REQUIRED;
1090	break;
1091	}
1092
1093	default:
1094	Status = STATUS_INVALID_DEVICE_REQUEST;
1095	break;
1096	}
1097	break;
1098	}
1099
1100	case IRP_MJ_INTERNAL_DEVICE_CONTROL:
1101	{
1102	Status = STATUS_INVALID_DEVICE_REQUEST;
1103	break;
1104	}
1105
1106	default:
1107	Log(("VBOXSF: MRxDevFcbXXXControlFile: unimplemented major function 0x%02X\n",
1108	RxContext->MajorFunction));
1109	Status = STATUS_INVALID_DEVICE_REQUEST;
1110	break;
1111	}
1112
1113	Log(("VBOXSF: MRxDevFcbXXXControlFile: Status = 0x%08X, Info = 0x%08X\n",
1114	Status, RxContext->InformationToReturn));
1115
1116	return Status;
1117	}
1118
1119	static NTSTATUS vbsfVerifyConnectionName(PUNICODE_STRING ConnectionName)
1120	{
1121	/* Check that the connection name is valid:
1122	* "\Device\VBoxMiniRdr\;X:\vboxsvr\sf"
1123	*/
1124	NTSTATUS Status = STATUS_BAD_NETWORK_NAME;
1125
1126	ULONG i;
1127	PWCHAR pwc;
1128	PWCHAR pwc1;
1129
1130	static PWCHAR spwszPrefix = L"\\Device\\VBoxMiniRdr\\;";
1131
1132	/* Unicode chars in the string. */
1133	ULONG cConnectionName = ConnectionName->Length / sizeof(WCHAR);
1134	ULONG cRemainingName;
1135
1136	/* Check that the name starts with correct prefix. */
1137	pwc1 = &spwszPrefix[0];
1138	pwc = ConnectionName->Buffer;
1139	for (i = 0; i < cConnectionName; i++, pwc1++, pwc++)
1140	{
1141	if (pwc1 == 0 \|\| pwc == 0 \|\| pwc1 != pwc)
1142	break;
1143	}
1144
1145	cRemainingName = cConnectionName - i;
1146
1147	Log(("VBOXSF: vbsfVerifyConnectionName: prefix %d remaining %d [%.*ls]\n",
1148	*pwc1 == 0, cRemainingName, cRemainingName, &ConnectionName->Buffer[i]));
1149
1150	if (*pwc1 == 0)
1151	{
1152	/* pwc should point to a drive letter followed by ':\' that is at least 3 chars more. */
1153	if (cRemainingName >= 3)
1154	{
1155	if ( pwc[0] >= L'A' && pwc[0] <= L'Z'
1156	&& pwc[1] == L':')
1157	{
1158	pwc += 2;
1159	cRemainingName -= 2;
1160
1161	/** @todo should also check that the drive letter corresponds to the name. */
1162	if (vboxIsPrefixOK(pwc, cRemainingName * sizeof (WCHAR)))
1163	Status = STATUS_SUCCESS;
1164	}
1165	}
1166	}
1167
1168	return Status;
1169	}
1170
1171	static HANDLE vbsfOpenConnectionHandle(PUNICODE_STRING ConnectionName, NTSTATUS *prcNt)
1172	{
1173	NTSTATUS Status;
1174	IO_STATUS_BLOCK IoStatusBlock;
1175	OBJECT_ATTRIBUTES ObjectAttributes;
1176
1177	HANDLE Handle = INVALID_HANDLE_VALUE;
1178
1179	Log(("VBOXSF: vbsfOpenConnectionHandle: ConnectionName = %.*ls\n",
1180	ConnectionName->Length / sizeof(WCHAR), ConnectionName->Buffer));
1181
1182	Status = vbsfVerifyConnectionName(ConnectionName);
1183
1184	if (NT_SUCCESS(Status))
1185	{
1186	/* Have to create a OBJ_KERNEL_HANDLE. Otherwise the driver verifier on Windows 7 bugchecks. */
1187	InitializeObjectAttributes(&ObjectAttributes,
1188	ConnectionName,
1189	OBJ_CASE_INSENSITIVE \| OBJ_KERNEL_HANDLE,
1190	NULL,
1191	NULL);
1192
1193	Status = ZwCreateFile(&Handle,
1194	SYNCHRONIZE,
1195	&ObjectAttributes,
1196	&IoStatusBlock,
1197	NULL,
1198	FILE_ATTRIBUTE_NORMAL,
1199	FILE_SHARE_READ \| FILE_SHARE_WRITE \| FILE_SHARE_DELETE,
1200	FILE_OPEN_IF,
1201	FILE_CREATE_TREE_CONNECTION \| FILE_SYNCHRONOUS_IO_NONALERT,
1202	NULL,
1203	0);
1204	}
1205
1206	if ( Status != STATUS_SUCCESS
1207	\|\| Handle == INVALID_HANDLE_VALUE)
1208	{
1209	Log(("VBOXSF: vbsfOpenConnectionHandle: ZwCreateFile failed status 0x%08X or invalid handle!\n", Status));
1210	if (prcNt)
1211	*prcNt = !NT_SUCCESS(Status) ? Status : STATUS_UNSUCCESSFUL;
1212	Handle = INVALID_HANDLE_VALUE;
1213	}
1214
1215	return Handle;
1216	}
1217
1218	NTSTATUS vbsfNtCreateConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1219	{
1220	NTSTATUS Status = STATUS_SUCCESS;
1221
1222	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1223
1224	PLOWIO_CONTEXT LowIoContext;
1225	ULONG cbConnectName;
1226	PWCHAR pwcConnectName;
1227
1228	HANDLE Handle;
1229	UNICODE_STRING FileName;
1230
1231	BOOLEAN fMutexAcquired = FALSE;
1232
1233	Log(("VBOXSF: vbsfNtCreateConnection\n"));
1234
1235	if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1236	{
1237	Log(("VBOXSF: vbsfNtCreateConnection: post to file system process\n"));
1238	*PostToFsp = TRUE;
1239	return STATUS_PENDING;
1240	}
1241
1242	pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1243	if (!pDeviceExtension)
1244	return STATUS_INVALID_PARAMETER;
1245
1246	LowIoContext = &RxContext->LowIoContext;
1247	cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1248	pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1249
1250	if (cbConnectName == 0 \|\| !pwcConnectName)
1251	{
1252	Log(("VBOXSF: vbsfNtCreateConnection: Connection name / length is invalid!\n"));
1253	return STATUS_INVALID_PARAMETER;
1254	}
1255
1256	__try
1257	{
1258	Log(("VBOXSF: vbsfNtCreateConnection: Name = %.*ls, Len = %d\n",
1259	cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName));
1260
1261	FileName.Buffer = pwcConnectName;
1262	FileName.Length = (USHORT)cbConnectName;
1263	FileName.MaximumLength = (USHORT)cbConnectName;
1264
1265	Handle = vbsfOpenConnectionHandle(&FileName, NULL);
1266
1267	if (Handle != INVALID_HANDLE_VALUE)
1268	{
1269	PWCHAR pwc;
1270	ULONG i;
1271
1272	ZwClose(Handle);
1273
1274	/* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1275	pwc = pwcConnectName;
1276	for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1277	{
1278	if (*pwc == L':')
1279	break;
1280	pwc++;
1281	}
1282
1283	if (i >= sizeof(WCHAR) && i < cbConnectName)
1284	{
1285	pwc--; /* Go back to the drive letter, "X" for example. */
1286
1287	if (pwc >= L'A' && pwc <= L'Z') /* Are we in range? */
1288	{
1289	uint32_t idx = pwc - L'A'; / Get the index based on the driver letter numbers (26). */
1290
1291	if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1292	{
1293	Log(("VBOXSF: vbsfNtCreateConnection: Index 0x%x is invalid!\n",
1294	idx));
1295	Status = STATUS_BAD_NETWORK_NAME;
1296	}
1297	else
1298	{
1299	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1300	fMutexAcquired = TRUE;
1301
1302	if (pDeviceExtension->wszLocalConnectionName[idx] != NULL)
1303	{
1304	Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d is NOT empty!\n",
1305	idx));
1306	}
1307
1308	pDeviceExtension->wszLocalConnectionName[idx] = (PUNICODE_STRING)vbsfNtAllocNonPagedMem(sizeof(UNICODE_STRING) + cbConnectName);
1309
1310	if (!pDeviceExtension->wszLocalConnectionName[idx])
1311	{
1312	Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d NOT allocated!\n",
1313	idx));
1314	Status = STATUS_INSUFFICIENT_RESOURCES;
1315	}
1316	else
1317	{
1318	PUNICODE_STRING pRemoteName = pDeviceExtension->wszLocalConnectionName[idx];
1319
1320	pRemoteName->Buffer = (PWSTR)(pRemoteName + 1);
1321	pRemoteName->Length = (USHORT)(cbConnectName - i - sizeof(WCHAR));
1322	pRemoteName->MaximumLength = pRemoteName->Length;
1323	RtlCopyMemory(&pRemoteName->Buffer[0], pwc+2, pRemoteName->Length);
1324
1325	Log(("VBOXSF: vbsfNtCreateConnection: RemoteName %.*ls, Len = %d\n",
1326	pRemoteName->Length / sizeof(WCHAR), pRemoteName->Buffer, pRemoteName->Length));
1327
1328	pDeviceExtension->cLocalConnections[idx] = TRUE;
1329	}
1330
1331	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1332	fMutexAcquired = FALSE;
1333	}
1334	}
1335	}
1336	else
1337	{
1338	Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1339	Status = STATUS_BAD_NETWORK_NAME;
1340	}
1341	}
1342	else
1343	{
1344	Log(("VBOXSF: vbsfNtCreateConnection: connection was not found\n"));
1345	Status = STATUS_BAD_NETWORK_NAME;
1346	}
1347	}
1348	__except(EXCEPTION_EXECUTE_HANDLER)
1349	{
1350	Status = STATUS_INVALID_PARAMETER;
1351	}
1352
1353	if (fMutexAcquired)
1354	{
1355	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1356	fMutexAcquired = FALSE;
1357	}
1358
1359	return Status;
1360	}
1361
1362	NTSTATUS vbsfNtDeleteConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1363	{
1364	NTSTATUS Status;
1365	UNICODE_STRING FileName;
1366	HANDLE Handle;
1367	PLOWIO_CONTEXT LowIoContext;
1368	PWCHAR pwcConnectName;
1369	ULONG cbConnectName;
1370	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1371
1372	BOOLEAN fMutexAcquired = FALSE;
1373
1374	Log(("VBOXSF: vbsfNtDeleteConnection\n"));
1375
1376	if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1377	{
1378	Log(("VBOXSF: vbsfNtDeleteConnection: post to file system process\n"));
1379	*PostToFsp = TRUE;
1380	return STATUS_PENDING;
1381	}
1382
1383	LowIoContext = &RxContext->LowIoContext;
1384	pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1385	cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1386
1387	pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1388	if (!pDeviceExtension)
1389	return STATUS_INVALID_PARAMETER;
1390
1391	__try
1392	{
1393	Log(("VBOXSF: vbsfNtDeleteConnection: pwcConnectName = %.*ls\n",
1394	cbConnectName / sizeof(WCHAR), pwcConnectName));
1395
1396	FileName.Buffer = pwcConnectName;
1397	FileName.Length = (USHORT)cbConnectName;
1398	FileName.MaximumLength = (USHORT)cbConnectName;
1399
1400	Handle = vbsfOpenConnectionHandle(&FileName, &Status);
1401	if (Handle != INVALID_HANDLE_VALUE)
1402	{
1403	PFILE_OBJECT pFileObject;
1404	Status = ObReferenceObjectByHandle(Handle, 0L, NULL, KernelMode, (PVOID *)&pFileObject, NULL);
1405
1406	Log(("VBOXSF: vbsfNtDeleteConnection: ObReferenceObjectByHandle Status 0x%08X\n",
1407	Status));
1408
1409	if (NT_SUCCESS(Status))
1410	{
1411	PFOBX Fobx = (PFOBX)pFileObject->FsContext2;
1412	Log(("VBOXSF: vbsfNtDeleteConnection: Fobx %p\n", Fobx));
1413
1414	if (Fobx && NodeType(Fobx) == RDBSS_NTC_V_NETROOT)
1415	{
1416	PV_NET_ROOT VNetRoot = (PV_NET_ROOT)Fobx;
1417
1418	#ifdef __cplusplus /* C version points at NET_ROOT, C++ points at MRX_NET_ROOT. Weird. */
1419	Status = RxFinalizeConnection((PNET_ROOT)VNetRoot->pNetRoot, VNetRoot, TRUE);
1420	#else
1421	Status = RxFinalizeConnection(VNetRoot->NetRoot, VNetRoot, TRUE);
1422	#endif
1423	}
1424	else
1425	{
1426	Log(("VBOXSF: vbsfNtDeleteConnection: wrong FsContext2\n"));
1427	Status = STATUS_INVALID_DEVICE_REQUEST;
1428	}
1429
1430	ObDereferenceObject(pFileObject);
1431	}
1432
1433	ZwClose(Handle);
1434
1435	if (NT_SUCCESS(Status))
1436	{
1437	PWCHAR pwc;
1438	ULONG i;
1439
1440	/* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1441	pwc = pwcConnectName;
1442	for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1443	{
1444	if (*pwc == L':')
1445	{
1446	break;
1447	}
1448	pwc++;
1449	}
1450
1451	if (i >= sizeof(WCHAR) && i < cbConnectName)
1452	{
1453	pwc--;
1454
1455	if (pwc >= L'A' && pwc <= L'Z')
1456	{
1457	uint32_t idx = *pwc - L'A';
1458
1459	if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1460	{
1461	Log(("VBOXSF: vbsfNtDeleteConnection: Index 0x%x is invalid!\n",
1462	idx));
1463	Status = STATUS_BAD_NETWORK_NAME;
1464	}
1465	else
1466	{
1467	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1468	fMutexAcquired = TRUE;
1469
1470	pDeviceExtension->cLocalConnections[idx] = FALSE;
1471
1472	/* Free saved name */
1473	if (pDeviceExtension->wszLocalConnectionName[idx])
1474	{
1475	vbsfNtFreeNonPagedMem(pDeviceExtension->wszLocalConnectionName[idx]);
1476	pDeviceExtension->wszLocalConnectionName[idx] = NULL;
1477	}
1478
1479	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1480	fMutexAcquired = FALSE;
1481
1482	Log(("VBOXSF: vbsfNtDeleteConnection: deleted index 0x%x\n",
1483	idx));
1484	}
1485	}
1486	}
1487	else
1488	{
1489	Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1490	Status = STATUS_BAD_NETWORK_NAME;
1491	}
1492	}
1493	}
1494	}
1495	__except(EXCEPTION_EXECUTE_HANDLER)
1496	{
1497	Status = STATUS_INVALID_PARAMETER;
1498	}
1499
1500	if (fMutexAcquired)
1501	{
1502	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1503	fMutexAcquired = FALSE;
1504	}
1505
1506	Log(("VBOXSF: vbsfNtDeleteConnection: Status 0x%08X\n", Status));
1507	return Status;
1508	}
1509
1510	NTSTATUS VBoxMRxQueryEaInfo(IN OUT PRX_CONTEXT RxContext)
1511	{
1512	RT_NOREF(RxContext);
1513	Log(("VBOXSF: MRxQueryEaInfo: Ea buffer len remaining is %d\n", RxContext->Info.LengthRemaining));
1514	return STATUS_SUCCESS;
1515	}
1516
1517	NTSTATUS VBoxMRxSetEaInfo(IN OUT PRX_CONTEXT RxContext)
1518	{
1519	RT_NOREF(RxContext);
1520	Log(("VBOXSF: MRxSetEaInfo\n"));
1521	return STATUS_NOT_IMPLEMENTED;
1522	}
1523
1524	NTSTATUS VBoxMRxFsCtl(IN OUT PRX_CONTEXT RxContext)
1525	{
1526	RT_NOREF(RxContext);
1527	Log(("VBOXSF: MRxFsCtl\n"));
1528	return STATUS_INVALID_DEVICE_REQUEST;
1529	}
1530
1531	NTSTATUS VBoxMRxNotifyChangeDirectory(IN OUT PRX_CONTEXT RxContext)
1532	{
1533	RT_NOREF(RxContext);
1534	Log(("VBOXSF: MRxNotifyChangeDirectory\n"));
1535	return STATUS_NOT_IMPLEMENTED;
1536	}
1537
1538	static NTSTATUS vbsfQuerySdInfo(PVOID pvBuffer, ULONG cbBuffer, SECURITY_INFORMATION SecurityInformation, ULONG *pcbOut)
1539	{
1540	/* What a public SMB share would return. */
1541	static SID_IDENTIFIER_AUTHORITY sIA = SECURITY_NT_AUTHORITY;
1542	#define SUB_AUTHORITY_COUNT 2
1543	static const ULONG saSubAuthorityOwner[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_USER_RID_GUEST };
1544	static const ULONG saSubAuthorityGroup[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_GROUP_RID_GUESTS };
1545
1546	SECURITY_DESCRIPTOR_RELATIVE pSD = (SECURITY_DESCRIPTOR_RELATIVE )pvBuffer;
1547	ULONG cbSD = 0; /* Size of returned security descriptor. */
1548	ULONG cbAdd; /* How many bytes to add to the buffer for each component of the security descriptor. */
1549
1550	cbAdd = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
1551	if (cbSD + cbAdd <= cbBuffer)
1552	{
1553	pSD->Revision = SECURITY_DESCRIPTOR_REVISION1;
1554	pSD->Sbz1 = 0;
1555	pSD->Control = SE_SELF_RELATIVE;
1556	pSD->Owner = 0;
1557	pSD->Group = 0;
1558	pSD->Sacl = 0;
1559	pSD->Dacl = 0;
1560	}
1561	cbSD += cbAdd;
1562
1563	if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1564	{
1565	cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1566	if (cbSD + cbAdd <= cbBuffer)
1567	{
1568	SID pSID = (SID )((uint8_t *)pSD + cbSD);
1569	pSID->Revision = 1;
1570	pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1571	pSID->IdentifierAuthority = sIA;
1572	memcpy(pSID->SubAuthority, saSubAuthorityOwner, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1573
1574	pSD->Owner = cbSD;
1575	}
1576	cbSD += cbAdd;
1577	}
1578
1579	if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1580	{
1581	cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1582	if (cbSD + cbAdd <= cbBuffer)
1583	{
1584	SID pSID = (SID )((uint8_t *)pSD + cbSD);
1585	pSID->Revision = 1;
1586	pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1587	pSID->IdentifierAuthority = sIA;
1588	memcpy(pSID->SubAuthority, saSubAuthorityGroup, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1589
1590	pSD->Group = cbSD;
1591	}
1592	cbSD += cbAdd;
1593	}
1594
1595	#undef SUB_AUTHORITY_COUNT
1596
1597	*pcbOut = cbSD;
1598	return STATUS_SUCCESS;
1599	}
1600
1601	NTSTATUS VBoxMRxQuerySdInfo(IN OUT PRX_CONTEXT RxContext)
1602	{
1603	NTSTATUS Status;
1604
1605	PVOID pvBuffer = RxContext->Info.Buffer;
1606	ULONG cbBuffer = RxContext->Info.LengthRemaining;
1607	SECURITY_INFORMATION SecurityInformation = RxContext->QuerySecurity.SecurityInformation;
1608
1609	ULONG cbSD = 0;
1610
1611	Log(("VBOXSF: MRxQuerySdInfo: Buffer %p, Length %d, SecurityInformation 0x%x\n",
1612	pvBuffer, cbBuffer, SecurityInformation));
1613
1614	Status = vbsfQuerySdInfo(pvBuffer, cbBuffer, SecurityInformation, &cbSD);
1615	if (NT_SUCCESS(Status))
1616	{
1617	RxContext->InformationToReturn = cbSD;
1618	if (RxContext->InformationToReturn > cbBuffer)
1619	{
1620	Status = STATUS_BUFFER_OVERFLOW;
1621	}
1622	}
1623
1624	Log(("VBOXSF: MRxQuerySdInfo: Status 0x%08X, InformationToReturn %d\n",
1625	Status, RxContext->InformationToReturn));
1626	return Status;
1627	}
1628
1629	NTSTATUS VBoxMRxSetSdInfo(IN OUT struct _RX_CONTEXT * RxContext)
1630	{
1631	RT_NOREF(RxContext);
1632	Log(("VBOXSF: MRxSetSdInfo\n"));
1633	return STATUS_NOT_IMPLEMENTED;
1634	}
1635
1636	/*
1637	* WML stubs which are referenced by rdbsslib.
1638	*/
1639	extern "C" NTSTATUS WmlTinySystemControl(IN OUT PVOID pWmiLibInfo, IN PVOID pDevObj, IN PVOID pIrp)
1640	{
1641	RT_NOREF(pWmiLibInfo, pDevObj, pIrp);
1642	return STATUS_WMI_GUID_NOT_FOUND;
1643	}
1644
1645	extern "C" ULONG WmlTrace(IN ULONG ulType, IN PVOID pTraceUuid, IN ULONG64 ullLogger, ...)
1646	{
1647	RT_NOREF(ulType, pTraceUuid, ullLogger);
1648	return STATUS_SUCCESS;
1649	}
1650
1651
1652	/**
1653	* The "main" function for a driver binary.
1654	*/
1655	extern "C" NTSTATUS NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
1656	{
1657	Log(("VBOXSF: DriverEntry: Driver object %p\n", DriverObject));
1658	AssertLogRelReturn(DriverObject, STATUS_UNSUCCESSFUL);
1659
1660	/*
1661	* Initialize IPRT and Vbgl.
1662	*/
1663	NTSTATUS rcNt = STATUS_UNSUCCESSFUL;
1664	int vrc = RTR0Init(0);
1665	if (RT_SUCCESS(vrc))
1666	{
1667	vrc = VbglR0SfInit();
1668	if (RT_SUCCESS(vrc))
1669	{
1670	/*
1671	* Connect to the shared folder service on the host.
1672	*/
1673	vrc = VbglR0SfConnect(&g_SfClient);
1674	if (RT_SUCCESS(vrc))
1675	{
1676	/*
1677	* Query the features and check that the host does page lists as we need those
1678	* for reading and writing.
1679	*/
1680	vrc = VbglR0QueryHostFeatures(&g_fHostFeatures);
1681	if (RT_FAILURE(vrc))
1682	{
1683	LogRel(("vboxsf: VbglR0QueryHostFeatures failed: vrc=%Rrc (ignored)\n", vrc));
1684	g_fHostFeatures = 0;
1685	}
1686	VbglR0SfHostReqQueryFeaturesSimple(&g_fSfFeatures, &g_uSfLastFunction);
1687	LogRel(("VBoxSF: g_fHostFeatures=%#x g_fSfFeatures=%#RX64 g_uSfLastFunction=%u\n",
1688	g_fHostFeatures, g_fSfFeatures, g_uSfLastFunction));
1689
1690	if (VbglR0CanUsePhysPageList())
1691	{
1692	/*
1693	* Tell the host to return windows-style errors (non-fatal).
1694	*/
1695	if (g_uSfLastFunction >= SHFL_FN_SET_ERROR_STYLE)
1696	{
1697	vrc = VbglR0SfHostReqSetErrorStyleSimple(kShflErrorStyle_Windows);
1698	if (RT_FAILURE(vrc))
1699	LogRel(("VBoxSF: VbglR0HostReqSetErrorStyleSimple(windows) failed: %Rrc\n", vrc));
1700	}
1701
1702	/*
1703	* Resolve newer kernel APIs we might want to use.
1704	* Note! Because of http://www.osronline.com/article.cfm%5eid=494.htm we cannot
1705	* use MmGetSystemRoutineAddress here as it will crash on xpsp2.
1706	*/
1707	RTDBGKRNLINFO hKrnlInfo;
1708	vrc = RTR0DbgKrnlInfoOpen(&hKrnlInfo, 0/fFlags/);
1709	AssertLogRelRC(vrc);
1710	if (RT_SUCCESS(vrc))
1711	{
1712	g_pfnCcCoherencyFlushAndPurgeCache
1713	= (PFNCCCOHERENCYFLUSHANDPURGECACHE)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL,
1714	"CcCoherencyFlushAndPurgeCache");
1715	RTR0DbgKrnlInfoRelease(hKrnlInfo);
1716	}
1717
1718	/*
1719	* Init the driver object.
1720	*/
1721	DriverObject->DriverUnload = VBoxMRxUnload;
1722	for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
1723	DriverObject->MajorFunction[i] = (PDRIVER_DISPATCH)VBoxMRxFsdDispatch;
1724
1725	/*
1726	* Do RDBSS driver entry processing.
1727	*/
1728	rcNt = RxDriverEntry(DriverObject, RegistryPath);
1729	if (rcNt == STATUS_SUCCESS)
1730	{
1731	/*
1732	* Do the mini redirector registration.
1733	* Note! Don't use RX_REGISTERMINI_FLAG_DONT_PROVIDE_UNCS or else UNC
1734	* mappings don't work (including Windows explorer browsing).
1735	*/
1736	Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: calling VBoxMRxDeviceObject %p\n", VBoxMRxDeviceObject));
1737	UNICODE_STRING VBoxMRxName;
1738	RtlInitUnicodeString(&VBoxMRxName, DD_MRX_VBOX_FS_DEVICE_NAME_U);
1739	rcNt = RxRegisterMinirdr(&VBoxMRxDeviceObject,
1740	DriverObject,
1741	&VBoxMRxDispatch,
1742	RX_REGISTERMINI_FLAG_DONT_PROVIDE_MAILSLOTS,
1743	&VBoxMRxName,
1744	sizeof(MRX_VBOX_DEVICE_EXTENSION),
1745	FILE_DEVICE_NETWORK_FILE_SYSTEM,
1746	FILE_REMOTE_DEVICE);
1747	Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: returned 0x%08X VBoxMRxDeviceObject %p\n",
1748	rcNt, VBoxMRxDeviceObject));
1749	if (rcNt == STATUS_SUCCESS)
1750	{
1751	/*
1752	* Init the device extension.
1753	*
1754	* Note! The device extension actually points to fields in the RDBSS_DEVICE_OBJECT.
1755	* Our space is past the end of that struct!!
1756	*/
1757	PMRX_VBOX_DEVICE_EXTENSION pVBoxDevX = (PMRX_VBOX_DEVICE_EXTENSION)( (PBYTE)VBoxMRxDeviceObject
1758	+ sizeof(RDBSS_DEVICE_OBJECT));
1759	pVBoxDevX->pDeviceObject = VBoxMRxDeviceObject;
1760	for (size_t i = 0; i < RT_ELEMENTS(pVBoxDevX->cLocalConnections); i++)
1761	pVBoxDevX->cLocalConnections[i] = FALSE;
1762
1763	/* Mutex for synchronizining our connection list */
1764	ExInitializeFastMutex(&pVBoxDevX->mtxLocalCon);
1765
1766	/*
1767	* The device object has been created. Need to setup a symbolic link
1768	* in the Win32 name space for user mode applications.
1769	*/
1770	UNICODE_STRING UserModeDeviceName;
1771	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1772	Log(("VBOXSF: DriverEntry: Calling IoCreateSymbolicLink\n"));
1773	rcNt = IoCreateSymbolicLink(&UserModeDeviceName, &VBoxMRxName);
1774	if (rcNt == STATUS_SUCCESS)
1775	{
1776	Log(("VBOXSF: DriverEntry: Symbolic link created.\n"));
1777
1778	/*
1779	* Build the dispatch tables for the minirdr
1780	*/
1781	vbsfInitMRxDispatch();
1782
1783	/*
1784	* The redirector driver must intercept the IOCTL to avoid VBOXSVR name resolution
1785	* by other redirectors. These additional name resolutions cause long delays.
1786	*/
1787	Log(("VBOXSF: DriverEntry: VBoxMRxDeviceObject = %p, rdbss %p, devext %p\n",
1788	VBoxMRxDeviceObject, DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL], pVBoxDevX));
1789	pVBoxDevX->pfnRDBSSDeviceControl = DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
1790	DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = VBoxMRXDeviceControl;
1791
1792	/*
1793	* Intercept IRP_MJ_CREATE to fix incorrect (wrt NTFS, FAT, ++) return
1794	* codes for NtOpenFile("r:\\asdf\\", FILE_NON_DIRECTORY_FILE).
1795	*/
1796	pVBoxDevX->pfnRDBSSCreate = DriverObject->MajorFunction[IRP_MJ_CREATE];
1797	DriverObject->MajorFunction[IRP_MJ_CREATE] = VBoxHookMjCreate;
1798
1799	/*
1800	* Intercept IRP_MJ_SET_INFORMATION to ensure we call the host for all
1801	* FileEndOfFileInformation requestes, even if the new size matches the
1802	* old one. We don't know if someone else might have modified the file
1803	* size cached in the FCB since the last time we update it.
1804	*/
1805	pVBoxDevX->pfnRDBSSSetInformation = DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION];
1806	DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = VBoxHookMjSetInformation;
1807
1808	/** @todo start the redirector here RxStartMiniRdr. */
1809
1810	Log(("VBOXSF: DriverEntry: Init successful!\n"));
1811	return STATUS_SUCCESS;
1812	}
1813	LogRel(("VBOXSF: DriverEntry: IoCreateSymbolicLink: %#x\n", rcNt));
1814
1815	RxUnregisterMinirdr(VBoxMRxDeviceObject);
1816	VBoxMRxDeviceObject = NULL;
1817	}
1818	else
1819	LogRel(("VBOXSF: DriverEntry: RxRegisterMinirdr failed: %#x\n", rcNt));
1820	}
1821	else
1822	LogRel(("VBOXSF: DriverEntry: RxDriverEntry failed: 0x%08X\n", rcNt));
1823	}
1824	else
1825	LogRel(("VBOXSF: Host does not support physical page lists. Refusing to load!\n"));
1826	VbglR0SfDisconnect(&g_SfClient);
1827	}
1828	else
1829	LogRel(("VBOXSF: DriverEntry: Failed to connect to the host: %Rrc!\n", vrc));
1830	VbglR0SfTerm();
1831	}
1832	else
1833	LogRel(("VBOXSF: DriverEntry: VbglR0SfInit! %Rrc!\n", vrc));
1834	RTR0Term();
1835	}
1836	else
1837	RTLogRelPrintf("VBOXSF: DriverEntry: RTR0Init failed! %Rrc!\n", vrc);
1838	return rcNt;
1839	}
1840

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Additions/WINNT/SharedFolders/driver/vbsf.cpp@ 96686

Download in other formats: