vbsf.cpp@ 100519

Last change on this file since 100519 was 100519, checked in by vboxsync, 17 months ago
Additions/WINNT/SharedFolders/driver: correct return code. bugref:10480
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 75.2 KB

Line
1	/* $Id: vbsf.cpp 100519 2023-07-11 16:30:49Z vboxsync $ */
2	/** @file
3	* VirtualBox Windows Guest Shared Folders - File System Driver initialization and generic routines
4	*/
5
6	/*
7	* Copyright (C) 2012-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#include "vbsf.h"
33	#include <iprt/initterm.h>
34	#include <iprt/dbg.h>
35
36
37	/*********************************************************************************************************************************
38	* Structures and Typedefs *
39	*********************************************************************************************************************************/
40	/**
41	* The current state of the driver.
42	*/
43	typedef enum _MRX_VBOX_STATE_
44	{
45	MRX_VBOX_STARTABLE,
46	MRX_VBOX_START_IN_PROGRESS,
47	MRX_VBOX_STARTED
48	} MRX_VBOX_STATE, *PMRX_VBOX_STATE;
49
50
51	/*********************************************************************************************************************************
52	* Global Variables *
53	*********************************************************************************************************************************/
54	static MRX_VBOX_STATE VBoxMRxState = MRX_VBOX_STARTABLE;
55
56	/**
57	* The VBoxSF dispatch table.
58	*/
59	static struct _MINIRDR_DISPATCH VBoxMRxDispatch;
60
61	/**
62	* The VBoxSF device object.
63	*/
64	PRDBSS_DEVICE_OBJECT VBoxMRxDeviceObject;
65
66	/** Pointer to CcCoherencyFlushAndPurgeCache if present in ntoskrnl. */
67	PFNCCCOHERENCYFLUSHANDPURGECACHE g_pfnCcCoherencyFlushAndPurgeCache;
68
69	/** The shared folder service client structure. */
70	VBGLSFCLIENT g_SfClient;
71	/** VMMDEV_HVF_XXX (set during init). */
72	uint32_t g_fHostFeatures = 0;
73	/** Last valid shared folders function number. */
74	uint32_t g_uSfLastFunction = SHFL_FN_SET_FILE_SIZE;
75	/** Shared folders features (SHFL_FEATURE_XXX). */
76	uint64_t g_fSfFeatures = 0;
77
78
79	static NTSTATUS VBoxMRxFsdDispatch(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
80	{
81	NTSTATUS Status;
82	#ifdef LOG_ENABLED
83	PIO_STACK_LOCATION IrpSp = IoGetCurrentIrpStackLocation(Irp);
84	Log(("VBOXSF: MRxFsdDispatch: major %d, minor %d: %s\n",
85	IrpSp->MajorFunction, IrpSp->MinorFunction, vbsfNtMajorFunctionName(IrpSp->MajorFunction, IrpSp->MinorFunction)));
86	#endif
87
88	if (DeviceObject != (PDEVICE_OBJECT)VBoxMRxDeviceObject)
89	{
90	Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
91	Irp->IoStatus.Information = 0;
92	IoCompleteRequest(Irp, IO_NO_INCREMENT);
93
94	Log(("VBOXSF: MRxFsdDispatch: Invalid device request detected %p %p\n",
95	DeviceObject, (PDEVICE_OBJECT)VBoxMRxDeviceObject));
96
97	return STATUS_INVALID_DEVICE_REQUEST;
98	}
99
100	Status = RxFsdDispatch((PRDBSS_DEVICE_OBJECT)VBoxMRxDeviceObject, Irp);
101	Log(("VBOXSF: MRxFsdDispatch: Returned 0x%X\n", Status));
102	return Status;
103	}
104
105	static void VBoxMRxUnload(IN PDRIVER_OBJECT DriverObject)
106	{
107	NTSTATUS Status;
108	UNICODE_STRING UserModeDeviceName;
109
110	Log(("VBOXSF: MRxUnload\n"));
111
112	if (VBoxMRxDeviceObject)
113	{
114	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
115	pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)VBoxMRxDeviceObject + sizeof(RDBSS_DEVICE_OBJECT));
116	}
117
118	if (VBoxMRxDeviceObject)
119	{
120	PRX_CONTEXT RxContext;
121	RxContext = RxCreateRxContext(NULL, VBoxMRxDeviceObject, RX_CONTEXT_FLAG_IN_FSP);
122
123	if (RxContext != NULL)
124	{
125	Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
126
127	if (Status == STATUS_SUCCESS)
128	{
129	MRX_VBOX_STATE State;
130
131	State = (MRX_VBOX_STATE)InterlockedCompareExchange((LONG *)&VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
132
133	if (State != MRX_VBOX_STARTABLE)
134	Status = STATUS_REDIRECTOR_STARTED;
135	}
136
137	RxDereferenceAndDeleteRxContext(RxContext);
138	}
139	else
140	Status = STATUS_INSUFFICIENT_RESOURCES;
141
142	RxUnregisterMinirdr(VBoxMRxDeviceObject);
143	}
144
145	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
146	Status = IoDeleteSymbolicLink(&UserModeDeviceName);
147	if (Status != STATUS_SUCCESS)
148	Log(("VBOXSF: MRxUnload: IoDeleteSymbolicLink Status 0x%08X\n", Status));
149
150	RxUnload(DriverObject);
151
152	VbglR0SfDisconnect(&g_SfClient);
153	VbglR0SfTerm();
154
155	Log(("VBOXSF: MRxUnload: VBoxSF.sys driver object %p almost unloaded, just RTR0Term left...\n", DriverObject));
156	RTR0Term(); /* No logging after this. */
157	}
158
159	static void vbsfInitMRxDispatch(void)
160	{
161	Log(("VBOXSF: vbsfInitMRxDispatch: Called.\n"));
162
163	ZeroAndInitializeNodeType(&VBoxMRxDispatch, RDBSS_NTC_MINIRDR_DISPATCH, sizeof(MINIRDR_DISPATCH));
164
165	VBoxMRxDispatch.MRxFlags = RDBSS_MANAGE_NET_ROOT_EXTENSION \| RDBSS_MANAGE_FCB_EXTENSION \| RDBSS_MANAGE_FOBX_EXTENSION;
166
167	VBoxMRxDispatch.MRxSrvCallSize = 0;
168	VBoxMRxDispatch.MRxNetRootSize = sizeof(MRX_VBOX_NETROOT_EXTENSION);
169	VBoxMRxDispatch.MRxVNetRootSize = 0;
170	VBoxMRxDispatch.MRxFcbSize = sizeof(VBSFNTFCBEXT);
171	VBoxMRxDispatch.MRxSrvOpenSize = 0;
172	VBoxMRxDispatch.MRxFobxSize = sizeof(MRX_VBOX_FOBX);
173
174	VBoxMRxDispatch.MRxStart = VBoxMRxStart;
175	VBoxMRxDispatch.MRxStop = VBoxMRxStop;
176
177	VBoxMRxDispatch.MRxCreate = VBoxMRxCreate;
178	VBoxMRxDispatch.MRxCollapseOpen = VBoxMRxCollapseOpen;
179	VBoxMRxDispatch.MRxShouldTryToCollapseThisOpen = VBoxMRxShouldTryToCollapseThisOpen;
180	VBoxMRxDispatch.MRxFlush = VBoxMRxFlush;
181	VBoxMRxDispatch.MRxTruncate = VBoxMRxTruncate;
182	VBoxMRxDispatch.MRxCleanupFobx = VBoxMRxCleanupFobx;
183	VBoxMRxDispatch.MRxCloseSrvOpen = VBoxMRxCloseSrvOpen;
184	VBoxMRxDispatch.MRxDeallocateForFcb = VBoxMRxDeallocateForFcb;
185	VBoxMRxDispatch.MRxDeallocateForFobx = VBoxMRxDeallocateForFobx;
186	VBoxMRxDispatch.MRxForceClosed = VBoxMRxForceClosed;
187
188	VBoxMRxDispatch.MRxQueryDirectory = VBoxMRxQueryDirectory;
189	VBoxMRxDispatch.MRxQueryFileInfo = VBoxMRxQueryFileInfo;
190	VBoxMRxDispatch.MRxSetFileInfo = VBoxMRxSetFileInfo;
191	VBoxMRxDispatch.MRxSetFileInfoAtCleanup = VBoxMRxSetFileInfoAtCleanup;
192	VBoxMRxDispatch.MRxQueryEaInfo = VBoxMRxQueryEaInfo;
193	VBoxMRxDispatch.MRxSetEaInfo = VBoxMRxSetEaInfo;
194	VBoxMRxDispatch.MRxQuerySdInfo = VBoxMRxQuerySdInfo;
195	VBoxMRxDispatch.MRxSetSdInfo = VBoxMRxSetSdInfo;
196	VBoxMRxDispatch.MRxQueryVolumeInfo = VBoxMRxQueryVolumeInfo;
197
198	VBoxMRxDispatch.MRxComputeNewBufferingState = VBoxMRxComputeNewBufferingState;
199
200	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_READ] = VBoxMRxRead;
201	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_WRITE] = VBoxMRxWrite;
202	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_SHAREDLOCK] = VBoxMRxLocks;
203	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_EXCLUSIVELOCK] = VBoxMRxLocks;
204	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK] = VBoxMRxLocks;
205	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_UNLOCK_MULTIPLE] = VBoxMRxLocks;
206	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_FSCTL] = VBoxMRxFsCtl;
207	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_IOCTL] = VBoxMRxIoCtl;
208	VBoxMRxDispatch.MRxLowIOSubmit[LOWIO_OP_NOTIFY_CHANGE_DIRECTORY] = VBoxMRxNotifyChangeDirectory;
209
210	VBoxMRxDispatch.MRxExtendForCache = VBoxMRxExtendStub;
211	VBoxMRxDispatch.MRxExtendForNonCache = VBoxMRxExtendStub;
212	VBoxMRxDispatch.MRxCompleteBufferingStateChangeRequest = VBoxMRxCompleteBufferingStateChangeRequest;
213
214	VBoxMRxDispatch.MRxCreateVNetRoot = VBoxMRxCreateVNetRoot;
215	VBoxMRxDispatch.MRxFinalizeVNetRoot = VBoxMRxFinalizeVNetRoot;
216	VBoxMRxDispatch.MRxFinalizeNetRoot = VBoxMRxFinalizeNetRoot;
217	VBoxMRxDispatch.MRxUpdateNetRootState = VBoxMRxUpdateNetRootState;
218	VBoxMRxDispatch.MRxExtractNetRootName = VBoxMRxExtractNetRootName;
219
220	VBoxMRxDispatch.MRxCreateSrvCall = VBoxMRxCreateSrvCall;
221	VBoxMRxDispatch.MRxSrvCallWinnerNotify = VBoxMRxSrvCallWinnerNotify;
222	VBoxMRxDispatch.MRxFinalizeSrvCall = VBoxMRxFinalizeSrvCall;
223
224	VBoxMRxDispatch.MRxDevFcbXXXControlFile = VBoxMRxDevFcbXXXControlFile;
225
226	Log(("VBOXSF: vbsfInitMRxDispatch: Success.\n"));
227	return;
228	}
229
230	static BOOL vboxIsPrefixOK (const WCHAR *FilePathName, ULONG PathNameLength)
231	{
232	BOOL PrefixOK;
233
234	/* The FilePathName here looks like: \vboxsrv\... */
235	if (PathNameLength >= 8 * sizeof (WCHAR)) /* Number of bytes in '\vboxsrv' unicode string. */
236	{
237	PrefixOK = (FilePathName[0] == L'\\');
238	PrefixOK &= (FilePathName[1] == L'V') \|\| (FilePathName[1] == L'v');
239	PrefixOK &= (FilePathName[2] == L'B') \|\| (FilePathName[2] == L'b');
240	PrefixOK &= (FilePathName[3] == L'O') \|\| (FilePathName[3] == L'o');
241	PrefixOK &= (FilePathName[4] == L'X') \|\| (FilePathName[4] == L'x');
242	PrefixOK &= (FilePathName[5] == L'S') \|\| (FilePathName[5] == L's');
243	/* Both vboxsvr & vboxsrv are now accepted */
244	if ((FilePathName[6] == L'V') \|\| (FilePathName[6] == L'v'))
245	{
246	PrefixOK &= (FilePathName[6] == L'V') \|\| (FilePathName[6] == L'v');
247	PrefixOK &= (FilePathName[7] == L'R') \|\| (FilePathName[7] == L'r');
248	}
249	else
250	{
251	PrefixOK &= (FilePathName[6] == L'R') \|\| (FilePathName[6] == L'r');
252	PrefixOK &= (FilePathName[7] == L'V') \|\| (FilePathName[7] == L'v');
253	}
254	if (PathNameLength > 8 * sizeof (WCHAR))
255	{
256	/* There is something after '\vboxsrv'. */
257	PrefixOK &= (FilePathName[8] == L'\\') \|\| (FilePathName[8] == 0);
258	}
259	}
260	else
261	PrefixOK = FALSE;
262
263	return PrefixOK;
264	}
265
266	static NTSTATUS VBoxMRXDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
267	{
268	NTSTATUS Status = STATUS_SUCCESS;
269
270	QUERY_PATH_REQUEST *pReq = NULL;
271	QUERY_PATH_REQUEST_EX *pReqEx = NULL;
272	QUERY_PATH_RESPONSE *pResp = NULL;
273
274	BOOL PrefixOK = FALSE;
275
276	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
277
278	/* Make a local copy, it will be needed after the Irp completion. */
279	ULONG IoControlCode = pStack->Parameters.DeviceIoControl.IoControlCode;
280
281	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
282
283	Log(("VBOXSF: MRXDeviceControl: pDevObj %p, pDeviceExtension %p, code %x\n",
284	pDevObj, pDevObj->DeviceExtension, IoControlCode));
285
286	switch (IoControlCode)
287	{
288	case IOCTL_REDIR_QUERY_PATH_EX: /* Vista */
289	case IOCTL_REDIR_QUERY_PATH: /* XP and earlier */
290	{
291	/* This IOCTL is intercepted for 2 reasons:
292	* 1) Claim the vboxsvr and vboxsrv prefixes. All name-based operations for them
293	* will be routed to the VBox provider automatically without any prefix resolution
294	* since the prefix is already in the prefix cache.
295	* 2) Reject other prefixes immediately to speed up the UNC path resolution a bit,
296	* because RDBSS will not be involved then.
297	*/
298
299	const WCHAR *FilePathName = NULL;
300	ULONG PathNameLength = 0;
301
302	if (pIrp->RequestorMode != KernelMode)
303	{
304	/* MSDN: Network redirectors should only honor kernel-mode senders of this IOCTL, by verifying
305	* that RequestorMode member of the IRP structure is KernelMode.
306	*/
307	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH(_EX): not kernel mode!!!\n",
308	pStack->Parameters.DeviceIoControl.InputBufferLength));
309	/* Continue to RDBSS. */
310	break;
311	}
312
313	if (IoControlCode == IOCTL_REDIR_QUERY_PATH)
314	{
315	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: Called (pid %x).\n", IoGetCurrentProcess()));
316
317	if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST))
318	{
319	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH: short input buffer %d.\n",
320	pStack->Parameters.DeviceIoControl.InputBufferLength));
321	/* Continue to RDBSS. */
322	break;
323	}
324
325	pReq = (QUERY_PATH_REQUEST *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
326
327	Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReq->PathNameLength));
328	Log(("VBOXSF: MRxDeviceControl: SecurityContext = %p.\n", pReq->SecurityContext));
329	Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReq->PathNameLength / sizeof (WCHAR), pReq->FilePathName));
330
331	FilePathName = pReq->FilePathName;
332	PathNameLength = pReq->PathNameLength;
333	}
334	else
335	{
336	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: Called.\n"));
337
338	if (pStack->Parameters.DeviceIoControl.InputBufferLength < sizeof(QUERY_PATH_REQUEST_EX))
339	{
340	Log(("VBOXSF: MRxDeviceControl: IOCTL_REDIR_QUERY_PATH_EX: short input buffer %d.\n",
341	pStack->Parameters.DeviceIoControl.InputBufferLength));
342	/* Continue to RDBSS. */
343	break;
344	}
345
346	pReqEx = (QUERY_PATH_REQUEST_EX *)pStack->Parameters.DeviceIoControl.Type3InputBuffer;
347
348	Log(("VBOXSF: MRxDeviceControl: pSecurityContext = %p.\n", pReqEx->pSecurityContext));
349	Log(("VBOXSF: MRxDeviceControl: EaLength = %d.\n", pReqEx->EaLength));
350	Log(("VBOXSF: MRxDeviceControl: pEaBuffer = %p.\n", pReqEx->pEaBuffer));
351	Log(("VBOXSF: MRxDeviceControl: PathNameLength = %d.\n", pReqEx->PathName.Length));
352	Log(("VBOXSF: MRxDeviceControl: FilePathName = %.*ls.\n", pReqEx->PathName.Length / sizeof (WCHAR), pReqEx->PathName.Buffer));
353
354	FilePathName = pReqEx->PathName.Buffer;
355	PathNameLength = pReqEx->PathName.Length;
356	}
357
358	pResp = (QUERY_PATH_RESPONSE *)pIrp->UserBuffer;
359
360	PrefixOK = vboxIsPrefixOK (FilePathName, PathNameLength);
361	Log(("VBOXSF: MRxDeviceControl PrefixOK %d\n", PrefixOK));
362
363	if (!PrefixOK)
364	{
365	/* Immediately fail the IOCTL with STATUS_BAD_NETWORK_NAME as recommended by MSDN.
366	* No need to involve RDBSS.
367	*/
368	Status = STATUS_BAD_NETWORK_NAME;
369
370	pIrp->IoStatus.Status = Status;
371	pIrp->IoStatus.Information = 0;
372
373	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
374
375	Log(("VBOXSF: MRxDeviceControl: returned STATUS_BAD_NETWORK_NAME\n"));
376	return Status;
377	}
378
379	Log(("VBOXSF: MRxDeviceControl pResp %p verifying the path.\n", pResp));
380	if (pResp)
381	{
382	/* Always claim entire \vboxsrv prefix. The LengthAccepted initially is equal to entire path.
383	* Here it is assigned to the length of \vboxsrv prefix.
384	*/
385	pResp->LengthAccepted = 8 * sizeof (WCHAR);
386
387	Status = STATUS_SUCCESS;
388
389	pIrp->IoStatus.Status = Status;
390	pIrp->IoStatus.Information = 0;
391
392	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
393
394	Log(("VBOXSF: MRxDeviceControl: claiming the path.\n"));
395	return Status;
396	}
397
398	/* No pResp pointer, should not happen. Just a precaution. */
399	Status = STATUS_INVALID_PARAMETER;
400
401	pIrp->IoStatus.Status = Status;
402	pIrp->IoStatus.Information = 0;
403
404	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
405
406	Log(("VBOXSF: MRxDeviceControl: returned STATUS_INVALID_PARAMETER\n"));
407	return Status;
408	}
409
410	default:
411	break;
412	}
413
414	/* Pass the IOCTL to RDBSS. */
415	if (pDeviceExtension && pDeviceExtension->pfnRDBSSDeviceControl)
416	{
417	Log(("VBOXSF: MRxDeviceControl calling RDBSS %p\n", pDeviceExtension->pfnRDBSSDeviceControl));
418	Status = pDeviceExtension->pfnRDBSSDeviceControl (pDevObj, pIrp);
419	Log(("VBOXSF: MRxDeviceControl RDBSS status 0x%08X\n", Status));
420	}
421	else
422	{
423	/* No RDBSS, should not happen. Just a precaution. */
424	Status = STATUS_NOT_IMPLEMENTED;
425
426	pIrp->IoStatus.Status = Status;
427	pIrp->IoStatus.Information = 0;
428
429	IoCompleteRequest(pIrp, IO_NO_INCREMENT);
430
431	Log(("VBOXSF: MRxDeviceControl: returned STATUS_NOT_IMPLEMENTED\n"));
432	}
433
434	return Status;
435	}
436
437	/**
438	* Intercepts IRP_MJ_CREATE to workaround a RDBSS quirk.
439	*
440	* Our RDBSS library will return STATUS_OBJECT_NAME_INVALID when FILE_NON_DIRECTORY_FILE
441	* is set and the path ends with a slash. NTFS and FAT will fail with
442	* STATUS_OBJECT_NAME_NOT_FOUND if the final component does not exist or isn't a directory,
443	* STATUS_OBJECT_PATH_NOT_FOUND if some path component doesn't exist or isn't a directory,
444	* or STATUS_ACCESS_DENIED if the final component is a directory.
445	*
446	* So, our HACK is to drop the trailing slash and set an unused flag in the ShareAccess
447	* parameter to tell vbsfProcessCreate about it.
448	*
449	*/
450	static NTSTATUS VBoxHookMjCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
451	{
452	PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
453	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
454	PFILE_OBJECT pFileObj = pStack->FileObject;
455	NTSTATUS rcNt;
456
457	Log(("VBOXSF: VBoxHookMjCreate: pDevObj %p, pDevExt %p, pFileObj %p, options %#x, attr %#x, share %#x, ealength %#x, secctx %p, IrpFlags %#x\n",
458	pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.Create.Options, pStack->Parameters.Create.FileAttributes,
459	pStack->Parameters.Create.ShareAccess, pStack->Parameters.Create.EaLength, pStack->Parameters.Create.SecurityContext, pIrp->Flags));
460	if (pFileObj)
461	Log(("VBOXSF: VBoxHookMjCreate: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
462
463	/*
464	* Check if we need to apply the hack. If we do, we grab a reference to
465	* the file object to be absolutely sure it's around for the cleanup work.
466	*/
467	AssertMsg(!(pStack->Parameters.Create.ShareAccess & VBOX_MJ_CREATE_SLASH_HACK), ("%#x\n", pStack->Parameters.Create.ShareAccess));
468	if ( (pStack->Parameters.Create.Options & (FILE_NON_DIRECTORY_FILE \| FILE_DIRECTORY_FILE)) == FILE_NON_DIRECTORY_FILE
469	&& pFileObj
470	&& pFileObj->FileName.Length > 18
471	&& pFileObj->FileName.Buffer
472	&& pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 1] == '\\'
473	&& pFileObj->FileName.Buffer[pFileObj->FileName.Length / sizeof(WCHAR) - 2] != '\\')
474	{
475	NTSTATUS rcNtRef = ObReferenceObjectByPointer(pFileObj, (ACCESS_MASK)0, *IoFileObjectType, KernelMode);
476	pFileObj->FileName.Length -= 2;
477	pStack->Parameters.Create.ShareAccess \|= VBOX_MJ_CREATE_SLASH_HACK; /* secret flag for vbsfProcessCreate */
478
479	rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
480
481	if (rcNt != STATUS_PENDING)
482	pStack->Parameters.Create.ShareAccess &= ~VBOX_MJ_CREATE_SLASH_HACK;
483	if (NT_SUCCESS(rcNtRef))
484	{
485	pFileObj->FileName.Length += 2;
486	ObDereferenceObject(pFileObj);
487	}
488
489	Log(("VBOXSF: VBoxHookMjCreate: returns %#x (hacked; rcNtRef=%#x)\n", rcNt, rcNtRef));
490	}
491	/*
492	* No hack needed.
493	*/
494	else
495	{
496	rcNt = pDevExt->pfnRDBSSCreate(pDevObj, pIrp);
497	Log(("VBOXSF: VBoxHookMjCreate: returns %#x\n", rcNt));
498	}
499	return rcNt;
500	}
501
502	/**
503	* Intercepts IRP_MJ_SET_INFORMATION to workaround a RDBSS quirk in the
504	* FileEndOfFileInformation handling.
505	*
506	* We will add 4096 to the FileEndOfFileInformation function value and pick it
507	* up in VBoxMRxSetFileInfo after RxCommonSetInformation has done the necessary
508	* locking. If we find that the desired file size matches the cached one, just
509	* issue the call directly, otherwise subtract 4096 and call the
510	* RxSetEndOfFileInfo worker.
511	*/
512	static NTSTATUS VBoxHookMjSetInformation(PDEVICE_OBJECT pDevObj, PIRP pIrp)
513	{
514	PMRX_VBOX_DEVICE_EXTENSION pDevExt = (PMRX_VBOX_DEVICE_EXTENSION)((PBYTE)pDevObj + sizeof(RDBSS_DEVICE_OBJECT));
515	PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
516	PFILE_OBJECT pFileObj = pStack->FileObject;
517	NTSTATUS rcNt;
518
519	Log(("VBOXSF: VBoxHookMjSetInformation: pDevObj %p, pDevExt %p, pFileObj %p, FileInformationClass %d, Length %#x\n",
520	pDevObj, pDevObj->DeviceExtension, pFileObj, pStack->Parameters.SetFile.FileInformationClass, pStack->Parameters.SetFile.Length));
521	if (pFileObj)
522	Log2(("VBOXSF: VBoxHookMjSetInformation: FileName=%.*ls\n", pFileObj->FileName.Length / sizeof(WCHAR), pFileObj->FileName.Buffer));
523
524	/*
525	* Setting EOF info?
526	*/
527	if (pStack->Parameters.SetFile.FileInformationClass == FileEndOfFileInformation)
528	{
529	#if 0 /* This only works for more recent versions of the RDBSS library, not for the one we're using (WDK 7600.16385.1). */
530	pStack->Parameters.SetFile.FileInformationClass = (FILE_INFORMATION_CLASS)(FileEndOfFileInformation + 4096);
531	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
532	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked)\n", rcNt));
533	return rcNt;
534	#else
535	/*
536	* For the older WDK, we have to detect the same-size situation up front and hack
537	* it here instead of in VBoxMRxSetFileInfo. This means we need to lock the FCB
538	* before modifying the Fcb.Header.FileSize value and ASSUME the locking is
539	* reentrant and nothing else happens during RDBSS dispatching wrt that...
540	*/
541	PMRX_FCB pFcb = (PMRX_FCB)pFileObj->FsContext;
542	if ( (NODE_TYPE_CODE)pFcb->Header.NodeTypeCode == RDBSS_NTC_STORAGE_TYPE_FILE
543	&& pIrp->AssociatedIrp.SystemBuffer != NULL
544	&& pStack->Parameters.SetFile.Length >= sizeof(FILE_END_OF_FILE_INFORMATION))
545	{
546	LONGLONG cbFileNew = -42;
547	__try
548	{
549	cbFileNew = ((PFILE_END_OF_FILE_INFORMATION)pIrp->AssociatedIrp.SystemBuffer)->EndOfFile.QuadPart;
550	}
551	__except(EXCEPTION_EXECUTE_HANDLER)
552	{
553	cbFileNew = -42;
554	}
555	if ( cbFileNew >= 0
556	&& pFcb->Header.FileSize.QuadPart == cbFileNew
557	&& !(pFcb->FcbState & FCB_STATE_PAGING_FILE))
558	{
559	/* Now exclusivly lock the FCB like RxCommonSetInformation would do
560	to reduce chances of races and of anyone else grabbing the value
561	while it's incorrect on purpose. */
562	NTSTATUS rcNtLock = RxAcquireExclusiveFcb(NULL, (PFCB)pFcb);
563	if (NT_SUCCESS(rcNtLock))
564	{
565	if (pFcb->Header.FileSize.QuadPart == cbFileNew)
566	{
567	int64_t const cbHackedSize = cbFileNew ? cbFileNew - 1 : 1;
568	pFcb->Header.FileSize.QuadPart = cbHackedSize;
569	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
570	if ( !NT_SUCCESS(rcNt)
571	&& pFcb->Header.FileSize.QuadPart == cbHackedSize)
572	pFcb->Header.FileSize.QuadPart = cbFileNew;
573	# ifdef VBOX_STRICT
574	else
575	{
576	PMRX_FOBX pFobx = (PMRX_FOBX)pFileObj->FsContext2;
577	PMRX_VBOX_FOBX pVBoxFobX = VBoxMRxGetFileObjectExtension(pFobx);
578	Assert( pFcb->Header.FileSize.QuadPart != cbHackedSize
579	\|\| (pVBoxFobX && pVBoxFobX->Info.cbObject == cbHackedSize));
580	}
581	# endif
582	RxReleaseFcb(NULL, pFcb);
583	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x (hacked, cbFileNew=%#RX64)\n", rcNt, cbFileNew));
584	return rcNt;
585	}
586	RxReleaseFcb(NULL, pFcb);
587	}
588	}
589	}
590	#endif
591	}
592
593	/*
594	* No hack needed.
595	*/
596	rcNt = pDevExt->pfnRDBSSSetInformation(pDevObj, pIrp);
597	Log(("VBOXSF: VBoxHookMjSetInformation: returns %#x\n", rcNt));
598	return rcNt;
599	}
600
601
602	NTSTATUS VBoxMRxStart(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
603	{
604	NTSTATUS Status;
605	MRX_VBOX_STATE CurrentState;
606	RT_NOREF(RxContext, RxDeviceObject);
607
608	Log(("VBOXSF: MRxStart\n"));
609
610	CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_STARTED, MRX_VBOX_START_IN_PROGRESS);
611
612	if (CurrentState == MRX_VBOX_START_IN_PROGRESS)
613	{
614	Log(("VBOXSF: MRxStart: Start in progress -> started\n"));
615	Status = STATUS_SUCCESS;
616	}
617	else if (VBoxMRxState == MRX_VBOX_STARTED)
618	{
619	Log(("VBOXSF: MRxStart: Already started\n"));
620	Status = STATUS_REDIRECTOR_STARTED;
621	}
622	else
623	{
624	Log(("VBOXSF: MRxStart: Bad state! VBoxMRxState = %d\n", VBoxMRxState));
625	Status = STATUS_UNSUCCESSFUL;
626	}
627
628	return Status;
629	}
630
631	NTSTATUS VBoxMRxStop(PRX_CONTEXT RxContext, IN OUT PRDBSS_DEVICE_OBJECT RxDeviceObject)
632	{
633	RT_NOREF(RxContext, RxDeviceObject);
634	Log(("VBOXSF: MRxStop\n"));
635	return STATUS_SUCCESS;
636	}
637
638	NTSTATUS VBoxMRxIoCtl(IN OUT PRX_CONTEXT RxContext)
639	{
640	RT_NOREF(RxContext);
641	Log(("VBOXSF: MRxIoCtl: IoControlCode = 0x%08X\n", RxContext->LowIoContext.ParamsFor.FsCtl.FsControlCode));
642	return STATUS_INVALID_DEVICE_REQUEST;
643	}
644
645	NTSYSAPI NTSTATUS NTAPI ZwSetSecurityObject(IN HANDLE Handle,
646	IN SECURITY_INFORMATION SecurityInformation,
647	IN PSECURITY_DESCRIPTOR SecurityDescriptor);
648
649	NTSTATUS VBoxMRxDevFcbXXXControlFile(IN OUT PRX_CONTEXT RxContext)
650	{
651	NTSTATUS Status = STATUS_SUCCESS;
652	RxCaptureFobx;
653	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
654	PLOWIO_CONTEXT LowIoContext = &RxContext->LowIoContext;
655
656	Log(("VBOXSF: MRxDevFcbXXXControlFile: MajorFunction = 0x%02X\n",
657	RxContext->MajorFunction));
658
659	switch (RxContext->MajorFunction)
660	{
661	case IRP_MJ_FILE_SYSTEM_CONTROL:
662	{
663	Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MN_USER_FS_REQUEST: 0x%08X\n",
664	LowIoContext->ParamsFor.FsCtl.MinorFunction));
665	Status = STATUS_INVALID_DEVICE_REQUEST;
666	break;
667	}
668
669	case IRP_MJ_DEVICE_CONTROL:
670	{
671	Log(("VBOXSF: MRxDevFcbXXXControlFile: IRP_MJ_DEVICE_CONTROL: InputBuffer %p/%d, OutputBuffer %p/%d\n",
672	LowIoContext->ParamsFor.IoCtl.pInputBuffer,
673	LowIoContext->ParamsFor.IoCtl.InputBufferLength,
674	LowIoContext->ParamsFor.IoCtl.pOutputBuffer,
675	LowIoContext->ParamsFor.IoCtl.OutputBufferLength));
676
677	switch (LowIoContext->ParamsFor.IoCtl.IoControlCode)
678	{
679	case IOCTL_MRX_VBOX_ADDCONN:
680	{
681	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_ADDCONN\n"));
682	Status = vbsfNtCreateConnection(RxContext, &RxContext->PostRequest);
683	break;
684	}
685
686	case IOCTL_MRX_VBOX_DELCONN:
687	{
688	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_DELCONN\n"));
689	Status = vbsfNtDeleteConnection(RxContext, &RxContext->PostRequest);
690	break;
691	}
692
693	case IOCTL_MRX_VBOX_GETLIST:
694	{
695	ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
696	uint8_t pu8Out = (uint8_t )LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
697
698	BOOLEAN fLocked = FALSE;
699
700	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST\n"));
701
702	RxContext->InformationToReturn = 0;
703
704	if ( !pDeviceExtension
705	\|\| cbOut < _MRX_MAX_DRIVE_LETTERS)
706	{
707	Status = STATUS_INVALID_PARAMETER;
708	break;
709	}
710
711	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETLIST: Copying local connections\n"));
712
713	fLocked = ExTryToAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
714
715	__try
716	{
717	RtlCopyMemory(pu8Out, pDeviceExtension->cLocalConnections, _MRX_MAX_DRIVE_LETTERS);
718	RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
719	}
720	__except(EXCEPTION_EXECUTE_HANDLER)
721	{
722	Status = STATUS_INVALID_PARAMETER;
723	}
724
725	if (fLocked)
726	{
727	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
728	fLocked = FALSE;
729	}
730
731	break;
732	}
733
734	/*
735	* Returns the root IDs of shared folder mappings.
736	*/
737	case IOCTL_MRX_VBOX_GETGLOBALLIST:
738	{
739	ULONG cbOut = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
740	uint8_t pu8Out = (uint8_t )LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
741
742	int vrc;
743	SHFLMAPPING mappings[_MRX_MAX_DRIVE_LETTERS];
744	uint32_t cMappings = RT_ELEMENTS(mappings);
745
746	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST\n"));
747
748	RxContext->InformationToReturn = 0;
749
750	if ( !pDeviceExtension
751	\|\| cbOut < _MRX_MAX_DRIVE_LETTERS)
752	{
753	Status = STATUS_INVALID_PARAMETER;
754	break;
755	}
756
757	vrc = VbglR0SfQueryMappings(&g_SfClient, mappings, &cMappings);
758	if (vrc == VINF_SUCCESS)
759	{
760	__try
761	{
762	uint32_t i;
763
764	RtlZeroMemory(pu8Out, _MRX_MAX_DRIVE_LETTERS);
765
766	for (i = 0; i < RT_MIN(cMappings, cbOut); i++)
767	{
768	pu8Out[i] = mappings[i].root;
769	pu8Out[i] \|= 0x80; /* mark active / /* @todo fix properly */
770	}
771
772	RxContext->InformationToReturn = _MRX_MAX_DRIVE_LETTERS;
773	}
774	__except(EXCEPTION_EXECUTE_HANDLER)
775	{
776	Status = STATUS_INVALID_PARAMETER;
777	}
778	}
779	else
780	{
781	Status = vbsfNtVBoxStatusToNt(vrc);
782	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALLIST failed: 0x%08X\n",
783	Status));
784	}
785
786	break;
787	}
788
789	/*
790	* Translates a local connection name (e.g. drive "S:") to the
791	* corresponding remote name (e.g. \\vboxsrv\share).
792	*/
793	case IOCTL_MRX_VBOX_GETCONN:
794	{
795	ULONG cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
796	PWCHAR pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
797	ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
798	PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
799
800	BOOLEAN fMutexAcquired = FALSE;
801
802	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN\n"));
803
804	RxContext->InformationToReturn = 0;
805
806	if ( !pDeviceExtension
807	\|\| cbConnectName < sizeof(WCHAR))
808	{
809	Status = STATUS_INVALID_PARAMETER;
810	break;
811	}
812
813	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Looking up connection name and connections\n"));
814
815	__try
816	{
817	uint32_t idx = *pwcConnectName - L'A';
818
819	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: ConnectName = %.*ls, Len = %d, Index = %d\n",
820	cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName, idx));
821
822	if (idx < RTL_NUMBER_OF(pDeviceExtension->wszLocalConnectionName))
823	{
824	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
825	fMutexAcquired = TRUE;
826
827	if (pDeviceExtension->wszLocalConnectionName[idx])
828	{
829	ULONG cbLocalConnectionName = pDeviceExtension->wszLocalConnectionName[idx]->Length;
830
831	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName = %.*ls\n",
832	cbLocalConnectionName / sizeof(WCHAR), pDeviceExtension->wszLocalConnectionName[idx]->Buffer));
833
834	if ((pDeviceExtension->cLocalConnections[idx]) && (cbLocalConnectionName <= cbRemoteName))
835	{
836	RtlZeroMemory(pwcRemoteName, cbRemoteName);
837	RtlCopyMemory(pwcRemoteName,
838	pDeviceExtension->wszLocalConnectionName[idx]->Buffer,
839	cbLocalConnectionName);
840
841	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Remote name = %.*ls, Len = %d\n",
842	cbLocalConnectionName / sizeof(WCHAR), pwcRemoteName, cbLocalConnectionName));
843	}
844	else
845	{
846	Status = STATUS_BUFFER_TOO_SMALL;
847	}
848
849	RxContext->InformationToReturn = cbLocalConnectionName;
850	}
851	else
852	{
853	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: LocalConnectionName is NULL!\n"));
854	Status = STATUS_BAD_NETWORK_NAME;
855	}
856	}
857	else
858	{
859	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETCONN: Index is invalid!\n"));
860	Status = STATUS_INVALID_PARAMETER;
861	}
862	}
863	__except(EXCEPTION_EXECUTE_HANDLER)
864	{
865	Status = STATUS_INVALID_PARAMETER;
866	}
867
868	if (fMutexAcquired)
869	{
870	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
871	fMutexAcquired = FALSE;
872	}
873
874	break;
875	}
876
877	case IOCTL_MRX_VBOX_GETGLOBALCONN:
878	{
879	ULONG cbConnectId = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
880	uint8_t pu8ConnectId = (uint8_t )LowIoContext->ParamsFor.IoCtl.pInputBuffer;
881	ULONG cbRemoteName = LowIoContext->ParamsFor.IoCtl.OutputBufferLength;
882	PWCHAR pwcRemoteName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pOutputBuffer;
883
884	int vrc;
885	PSHFLSTRING pString;
886
887	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN\n"));
888
889	RxContext->InformationToReturn = 0;
890
891	if ( !pDeviceExtension
892	\|\| cbConnectId < sizeof(uint8_t))
893	{
894	Status = STATUS_INVALID_PARAMETER;
895	break;
896	}
897
898	/* Allocate empty string where the host can store cbRemoteName bytes. */
899	Status = vbsfNtShflStringFromUnicodeAlloc(&pString, NULL, (uint16_t)cbRemoteName);
900	if (Status != STATUS_SUCCESS)
901	break;
902
903	__try
904	{
905	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Connection ID = %d\n",
906	*pu8ConnectId));
907
908	vrc = VbglR0SfQueryMapName(&g_SfClient,
909	pu8ConnectId & ~0x80 /* @todo fix properly */,
910	pString, ShflStringSizeOfBuffer(pString));
911	if ( vrc == VINF_SUCCESS
912	&& pString->u16Length < cbRemoteName)
913	{
914	RtlCopyMemory(pwcRemoteName, pString->String.ucs2, pString->u16Length);
915	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_GETGLOBALCONN: Returned name = %.*ls, Len = %d\n",
916	pString->u16Length / sizeof(WCHAR), pwcRemoteName, pString->u16Length));
917	RxContext->InformationToReturn = pString->u16Length;
918	}
919	else
920	{
921	Status = STATUS_BAD_NETWORK_NAME;
922	}
923	}
924	__except(EXCEPTION_EXECUTE_HANDLER)
925	{
926	Status = STATUS_INVALID_PARAMETER;
927	}
928
929	vbsfNtFreeNonPagedMem(pString);
930
931	break;
932	}
933
934	case IOCTL_MRX_VBOX_START:
935	{
936	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: capFobx %p\n",
937	capFobx));
938
939	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: process: current 0x%X, RDBSS 0x%X\n",
940	IoGetCurrentProcess(), RxGetRDBSSProcess()));
941
942	switch (VBoxMRxState)
943	{
944	case MRX_VBOX_STARTABLE:
945
946	Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_STARTABLE\n"));
947
948	if (capFobx)
949	{
950	Status = STATUS_INVALID_DEVICE_REQUEST;
951	break;;
952	}
953
954	InterlockedCompareExchange((PLONG)&VBoxMRxState, MRX_VBOX_START_IN_PROGRESS, MRX_VBOX_STARTABLE);
955
956	case MRX_VBOX_START_IN_PROGRESS:
957	Status = RxStartMinirdr(RxContext, &RxContext->PostRequest);
958
959	Log(("VBOXSF: MRxDevFcbXXXControlFile: MRX_VBOX_START_IN_PROGRESS RxStartMiniRdr Status 0x%08X, post %d\n",
960	Status, RxContext->PostRequest));
961
962	if (Status == STATUS_REDIRECTOR_STARTED)
963	{
964	Status = STATUS_SUCCESS;
965	break;
966	}
967
968	if ( Status == STATUS_PENDING
969	&& RxContext->PostRequest == TRUE)
970	{
971	/* Will be restarted in RDBSS process. */
972	Status = STATUS_MORE_PROCESSING_REQUIRED;
973	break;
974	}
975
976	#if 0 /* 2022-09-07 bird: I've disabled this as it prevents VBoxService from accessing the redirector on Windows XP RTM.
977	*
978	* The default is: Administrators=RWDPO, Everyone=R, LOCAL=RW, RESTRICTED=R, SYSTEM=RWDPO
979	* This changes it to: LOCAL=RW
980	* (R=read, W=write, D=delete, P=Change Permissions, O=Change Owner. WinObj advanced permissions view.)
981	*
982	* I'm not sure if the intention here is to create a NULL DACL, which grants unrestricted access to the device.
983	* However, it's somehow now working for Windows XP RTM. I think an explicit call to RtlSetDaclSecurityDescriptor
984	* is required for that to work, indicating that a DACL is present but NULL.
985	* (See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-rtlsetdaclsecuritydescriptor and
986	* https://docs.microsoft.com/en-us/windows/win32/secauthz/null-dacls-and-empty-dacls for NULL DACL details.)
987	*
988	* If the problem is that RESTRICTED (S-1-5-12) should have RWS access, read the descriptor and modify the ACE
989	* for RESTRICTED to grant them write access.
990	*/
991	/* Allow restricted users to use shared folders; works only in XP and Vista. (@@todo hack) */
992	if (Status == STATUS_SUCCESS)
993	{
994	SECURITY_DESCRIPTOR SecurityDescriptor;
995	OBJECT_ATTRIBUTES InitializedAttributes;
996	HANDLE hDevice;
997	IO_STATUS_BLOCK IoStatusBlock;
998	UNICODE_STRING UserModeDeviceName;
999
1000	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1001
1002	/* Create empty security descriptor */
1003	RtlZeroMemory (&SecurityDescriptor, sizeof (SecurityDescriptor));
1004	Status = RtlCreateSecurityDescriptor(&SecurityDescriptor, SECURITY_DESCRIPTOR_REVISION);
1005	if (Status != STATUS_SUCCESS)
1006	{
1007	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: RtlCreateSecurityDescriptor failed with 0x%08X!\n",
1008	Status));
1009	return Status;
1010	}
1011
1012	RtlZeroMemory (&InitializedAttributes, sizeof (InitializedAttributes));
1013	InitializeObjectAttributes(&InitializedAttributes, &UserModeDeviceName, OBJ_KERNEL_HANDLE, 0, 0);
1014
1015	/* Open our symbolic link device name */
1016	Status = ZwOpenFile(&hDevice, WRITE_DAC, &InitializedAttributes, &IoStatusBlock, 0, 0);
1017	if (Status != STATUS_SUCCESS)
1018	{
1019	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwOpenFile %ls failed with 0x%08X!\n",
1020	DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U, Status));
1021	return Status;
1022	}
1023
1024	/* Override the discretionary access control list (DACL) settings */
1025	Status = ZwSetSecurityObject(hDevice, DACL_SECURITY_INFORMATION, &SecurityDescriptor);
1026	if (Status != STATUS_SUCCESS)
1027	{
1028	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwSetSecurityObject failed with 0x%08X!\n",
1029	Status));
1030	return Status;
1031	}
1032
1033	Status = ZwClose(hDevice);
1034	if (Status != STATUS_SUCCESS)
1035	{
1036	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_START_IN_PROGRESS: ZwClose failed with 0x%08X\n",
1037	Status));
1038	return Status;
1039	}
1040	}
1041	#endif
1042	break;
1043
1044	case MRX_VBOX_STARTED:
1045	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: MRX_VBOX_STARTED: Already started\n"));
1046	Status = STATUS_SUCCESS;
1047	break;
1048
1049	default:
1050	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Invalid state (%d)!\n",
1051	VBoxMRxState));
1052	Status = STATUS_INVALID_PARAMETER;
1053	break;
1054	}
1055
1056	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_START: Returned 0x%08X\n",
1057	Status));
1058	break;
1059	}
1060
1061	case IOCTL_MRX_VBOX_STOP:
1062	{
1063	MRX_VBOX_STATE CurrentState;
1064
1065	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: capFobx %p\n",
1066	capFobx));
1067
1068	if (capFobx)
1069	{
1070	Status = STATUS_INVALID_DEVICE_REQUEST;
1071	break;
1072	}
1073
1074	if (RxContext->RxDeviceObject->NumberOfActiveFcbs > 0)
1075	{
1076	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Open handles = %d\n",
1077	RxContext->RxDeviceObject->NumberOfActiveFcbs));
1078	Status = STATUS_REDIRECTOR_HAS_OPEN_HANDLES;
1079	break;
1080	}
1081
1082	CurrentState = (MRX_VBOX_STATE)InterlockedCompareExchange((PLONG) & VBoxMRxState, MRX_VBOX_STARTABLE, MRX_VBOX_STARTED);
1083
1084	Status = RxStopMinirdr(RxContext, &RxContext->PostRequest);
1085	Log(("VBOXSF: MRxDevFcbXXXControlFile: IOCTL_MRX_VBOX_STOP: Returned 0x%08X\n",
1086	Status));
1087
1088	if (Status == STATUS_PENDING && RxContext->PostRequest == TRUE)
1089	Status = STATUS_MORE_PROCESSING_REQUIRED;
1090	break;
1091	}
1092
1093	default:
1094	Status = STATUS_INVALID_DEVICE_REQUEST;
1095	break;
1096	}
1097	break;
1098	}
1099
1100	case IRP_MJ_INTERNAL_DEVICE_CONTROL:
1101	{
1102	Status = STATUS_INVALID_DEVICE_REQUEST;
1103	break;
1104	}
1105
1106	default:
1107	Log(("VBOXSF: MRxDevFcbXXXControlFile: unimplemented major function 0x%02X\n",
1108	RxContext->MajorFunction));
1109	Status = STATUS_INVALID_DEVICE_REQUEST;
1110	break;
1111	}
1112
1113	Log(("VBOXSF: MRxDevFcbXXXControlFile: Status = 0x%08X, Info = 0x%08X\n",
1114	Status, RxContext->InformationToReturn));
1115
1116	return Status;
1117	}
1118
1119	static NTSTATUS vbsfVerifyConnectionName(PUNICODE_STRING ConnectionName)
1120	{
1121	/* Check that the connection name is valid:
1122	* "\Device\VBoxMiniRdr\;X:\vboxsvr\sf"
1123	*/
1124	NTSTATUS Status = STATUS_BAD_NETWORK_NAME;
1125
1126	static WCHAR const s_wszPrefix[] = L"\\Device\\VBoxMiniRdr\\;";
1127
1128	/* Unicode chars in the string. */
1129	ULONG cConnectionName = ConnectionName->Length / sizeof(WCHAR);
1130	ULONG cRemainingName;
1131
1132	/* Check that the name starts with correct prefix. */
1133	WCHAR const *pwc1 = &s_wszPrefix[0];
1134	WCHAR const *pwc = ConnectionName->Buffer;
1135	ULONG i;
1136	for (i = 0; i < cConnectionName; i++, pwc1++, pwc++)
1137	{
1138	if (pwc1 == 0 \|\| pwc == 0 \|\| pwc1 != pwc)
1139	break;
1140	}
1141
1142	cRemainingName = cConnectionName - i;
1143
1144	Log(("VBOXSF: vbsfVerifyConnectionName: prefix %d remaining %d [%.*ls]\n",
1145	*pwc1 == 0, cRemainingName, cRemainingName, &ConnectionName->Buffer[i]));
1146
1147	if (*pwc1 == 0)
1148	{
1149	/* pwc should point to a drive letter followed by ':\' that is at least 3 chars more. */
1150	if (cRemainingName >= 3)
1151	{
1152	if ( pwc[0] >= L'A' && pwc[0] <= L'Z'
1153	&& pwc[1] == L':')
1154	{
1155	pwc += 2;
1156	cRemainingName -= 2;
1157
1158	/** @todo should also check that the drive letter corresponds to the name. */
1159	if (vboxIsPrefixOK(pwc, cRemainingName * sizeof (WCHAR)))
1160	Status = STATUS_SUCCESS;
1161	}
1162	}
1163	}
1164
1165	return Status;
1166	}
1167
1168	static HANDLE vbsfOpenConnectionHandle(PUNICODE_STRING ConnectionName, NTSTATUS *prcNt)
1169	{
1170	NTSTATUS Status;
1171	IO_STATUS_BLOCK IoStatusBlock;
1172	OBJECT_ATTRIBUTES ObjectAttributes;
1173
1174	HANDLE Handle = INVALID_HANDLE_VALUE;
1175
1176	Log(("VBOXSF: vbsfOpenConnectionHandle: ConnectionName = %.*ls\n",
1177	ConnectionName->Length / sizeof(WCHAR), ConnectionName->Buffer));
1178
1179	Status = vbsfVerifyConnectionName(ConnectionName);
1180
1181	if (NT_SUCCESS(Status))
1182	{
1183	/* Have to create a OBJ_KERNEL_HANDLE. Otherwise the driver verifier on Windows 7 bugchecks. */
1184	InitializeObjectAttributes(&ObjectAttributes,
1185	ConnectionName,
1186	OBJ_CASE_INSENSITIVE \| OBJ_KERNEL_HANDLE,
1187	NULL,
1188	NULL);
1189
1190	Status = ZwCreateFile(&Handle,
1191	SYNCHRONIZE,
1192	&ObjectAttributes,
1193	&IoStatusBlock,
1194	NULL,
1195	FILE_ATTRIBUTE_NORMAL,
1196	FILE_SHARE_READ \| FILE_SHARE_WRITE \| FILE_SHARE_DELETE,
1197	FILE_OPEN_IF,
1198	FILE_CREATE_TREE_CONNECTION \| FILE_SYNCHRONOUS_IO_NONALERT,
1199	NULL,
1200	0);
1201	}
1202
1203	if ( Status != STATUS_SUCCESS
1204	\|\| Handle == INVALID_HANDLE_VALUE)
1205	{
1206	Log(("VBOXSF: vbsfOpenConnectionHandle: ZwCreateFile failed status 0x%08X or invalid handle!\n", Status));
1207	if (prcNt)
1208	*prcNt = !NT_SUCCESS(Status) ? Status : STATUS_UNSUCCESSFUL;
1209	Handle = INVALID_HANDLE_VALUE;
1210	}
1211
1212	return Handle;
1213	}
1214
1215	NTSTATUS vbsfNtCreateConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1216	{
1217	NTSTATUS Status = STATUS_SUCCESS;
1218
1219	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1220
1221	PLOWIO_CONTEXT LowIoContext;
1222	ULONG cbConnectName;
1223	PWCHAR pwcConnectName;
1224
1225	HANDLE Handle;
1226	UNICODE_STRING FileName;
1227
1228	BOOLEAN fMutexAcquired = FALSE;
1229
1230	Log(("VBOXSF: vbsfNtCreateConnection\n"));
1231
1232	if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1233	{
1234	Log(("VBOXSF: vbsfNtCreateConnection: post to file system process\n"));
1235	*PostToFsp = TRUE;
1236	return STATUS_PENDING;
1237	}
1238
1239	pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1240	if (!pDeviceExtension)
1241	return STATUS_INVALID_PARAMETER;
1242
1243	LowIoContext = &RxContext->LowIoContext;
1244	cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1245	pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1246
1247	if (cbConnectName == 0 \|\| !pwcConnectName)
1248	{
1249	Log(("VBOXSF: vbsfNtCreateConnection: Connection name / length is invalid!\n"));
1250	return STATUS_INVALID_PARAMETER;
1251	}
1252
1253	__try
1254	{
1255	Log(("VBOXSF: vbsfNtCreateConnection: Name = %.*ls, Len = %d\n",
1256	cbConnectName / sizeof(WCHAR), pwcConnectName, cbConnectName));
1257
1258	FileName.Buffer = pwcConnectName;
1259	FileName.Length = (USHORT)cbConnectName;
1260	FileName.MaximumLength = (USHORT)cbConnectName;
1261
1262	Handle = vbsfOpenConnectionHandle(&FileName, NULL);
1263
1264	if (Handle != INVALID_HANDLE_VALUE)
1265	{
1266	PWCHAR pwc;
1267	ULONG i;
1268
1269	ZwClose(Handle);
1270
1271	/* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1272	pwc = pwcConnectName;
1273	for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1274	{
1275	if (*pwc == L':')
1276	break;
1277	pwc++;
1278	}
1279
1280	if (i >= sizeof(WCHAR) && i < cbConnectName)
1281	{
1282	pwc--; /* Go back to the drive letter, "X" for example. */
1283
1284	if (pwc >= L'A' && pwc <= L'Z') /* Are we in range? */
1285	{
1286	uint32_t idx = pwc - L'A'; / Get the index based on the driver letter numbers (26). */
1287
1288	if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1289	{
1290	Log(("VBOXSF: vbsfNtCreateConnection: Index 0x%x is invalid!\n",
1291	idx));
1292	Status = STATUS_BAD_NETWORK_NAME;
1293	}
1294	else
1295	{
1296	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1297	fMutexAcquired = TRUE;
1298
1299	if (pDeviceExtension->wszLocalConnectionName[idx] != NULL)
1300	{
1301	Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d is NOT empty!\n",
1302	idx));
1303	}
1304
1305	pDeviceExtension->wszLocalConnectionName[idx] = (PUNICODE_STRING)vbsfNtAllocNonPagedMem(sizeof(UNICODE_STRING) + cbConnectName);
1306
1307	if (!pDeviceExtension->wszLocalConnectionName[idx])
1308	{
1309	Log(("VBOXSF: vbsfNtCreateConnection: LocalConnectionName at index %d NOT allocated!\n",
1310	idx));
1311	Status = STATUS_INSUFFICIENT_RESOURCES;
1312	}
1313	else
1314	{
1315	PUNICODE_STRING pRemoteName = pDeviceExtension->wszLocalConnectionName[idx];
1316
1317	pRemoteName->Buffer = (PWSTR)(pRemoteName + 1);
1318	pRemoteName->Length = (USHORT)(cbConnectName - i - sizeof(WCHAR));
1319	pRemoteName->MaximumLength = pRemoteName->Length;
1320	RtlCopyMemory(&pRemoteName->Buffer[0], pwc+2, pRemoteName->Length);
1321
1322	Log(("VBOXSF: vbsfNtCreateConnection: RemoteName %.*ls, Len = %d\n",
1323	pRemoteName->Length / sizeof(WCHAR), pRemoteName->Buffer, pRemoteName->Length));
1324
1325	pDeviceExtension->cLocalConnections[idx] = TRUE;
1326	}
1327
1328	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1329	fMutexAcquired = FALSE;
1330	}
1331	}
1332	}
1333	else
1334	{
1335	Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1336	Status = STATUS_BAD_NETWORK_NAME;
1337	}
1338	}
1339	else
1340	{
1341	Log(("VBOXSF: vbsfNtCreateConnection: connection was not found\n"));
1342	Status = STATUS_BAD_NETWORK_NAME;
1343	}
1344	}
1345	__except(EXCEPTION_EXECUTE_HANDLER)
1346	{
1347	Status = STATUS_INVALID_PARAMETER;
1348	}
1349
1350	if (fMutexAcquired)
1351	{
1352	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1353	fMutexAcquired = FALSE;
1354	}
1355
1356	return Status;
1357	}
1358
1359	NTSTATUS vbsfNtDeleteConnection(IN PRX_CONTEXT RxContext, OUT PBOOLEAN PostToFsp)
1360	{
1361	NTSTATUS Status;
1362	UNICODE_STRING FileName;
1363	HANDLE Handle;
1364	PLOWIO_CONTEXT LowIoContext;
1365	PWCHAR pwcConnectName;
1366	ULONG cbConnectName;
1367	PMRX_VBOX_DEVICE_EXTENSION pDeviceExtension;
1368
1369	BOOLEAN fMutexAcquired = FALSE;
1370
1371	Log(("VBOXSF: vbsfNtDeleteConnection\n"));
1372
1373	if (!BooleanFlagOn(RxContext->Flags, RX_CONTEXT_FLAG_WAIT))
1374	{
1375	Log(("VBOXSF: vbsfNtDeleteConnection: post to file system process\n"));
1376	*PostToFsp = TRUE;
1377	return STATUS_PENDING;
1378	}
1379
1380	LowIoContext = &RxContext->LowIoContext;
1381	pwcConnectName = (PWCHAR)LowIoContext->ParamsFor.IoCtl.pInputBuffer;
1382	cbConnectName = LowIoContext->ParamsFor.IoCtl.InputBufferLength;
1383
1384	pDeviceExtension = VBoxMRxGetDeviceExtension(RxContext);
1385	if (!pDeviceExtension)
1386	return STATUS_INVALID_PARAMETER;
1387
1388	__try
1389	{
1390	Log(("VBOXSF: vbsfNtDeleteConnection: pwcConnectName = %.*ls\n",
1391	cbConnectName / sizeof(WCHAR), pwcConnectName));
1392
1393	FileName.Buffer = pwcConnectName;
1394	FileName.Length = (USHORT)cbConnectName;
1395	FileName.MaximumLength = (USHORT)cbConnectName;
1396
1397	Handle = vbsfOpenConnectionHandle(&FileName, &Status);
1398	if (Handle != INVALID_HANDLE_VALUE)
1399	{
1400	PFILE_OBJECT pFileObject;
1401	Status = ObReferenceObjectByHandle(Handle, 0L, NULL, KernelMode, (PVOID *)&pFileObject, NULL);
1402
1403	Log(("VBOXSF: vbsfNtDeleteConnection: ObReferenceObjectByHandle Status 0x%08X\n",
1404	Status));
1405
1406	if (NT_SUCCESS(Status))
1407	{
1408	PFOBX Fobx = (PFOBX)pFileObject->FsContext2;
1409	Log(("VBOXSF: vbsfNtDeleteConnection: Fobx %p\n", Fobx));
1410
1411	if (Fobx && NodeType(Fobx) == RDBSS_NTC_V_NETROOT)
1412	{
1413	PV_NET_ROOT VNetRoot = (PV_NET_ROOT)Fobx;
1414
1415	#ifdef __cplusplus /* C version points at NET_ROOT, C++ points at MRX_NET_ROOT. Weird. */
1416	Status = RxFinalizeConnection((PNET_ROOT)VNetRoot->pNetRoot, VNetRoot, TRUE);
1417	#else
1418	Status = RxFinalizeConnection(VNetRoot->NetRoot, VNetRoot, TRUE);
1419	#endif
1420	}
1421	else
1422	{
1423	Log(("VBOXSF: vbsfNtDeleteConnection: wrong FsContext2\n"));
1424	Status = STATUS_INVALID_DEVICE_REQUEST;
1425	}
1426
1427	ObDereferenceObject(pFileObject);
1428	}
1429
1430	ZwClose(Handle);
1431
1432	if (NT_SUCCESS(Status))
1433	{
1434	PWCHAR pwc;
1435	ULONG i;
1436
1437	/* Skip the "\Device\VBoxMiniRdr\;X:" of the string "\Device\VBoxMiniRdr\;X:\vboxsrv\sf" */
1438	pwc = pwcConnectName;
1439	for (i = 0; i < cbConnectName; i += sizeof(WCHAR))
1440	{
1441	if (*pwc == L':')
1442	{
1443	break;
1444	}
1445	pwc++;
1446	}
1447
1448	if (i >= sizeof(WCHAR) && i < cbConnectName)
1449	{
1450	pwc--;
1451
1452	if (pwc >= L'A' && pwc <= L'Z')
1453	{
1454	uint32_t idx = *pwc - L'A';
1455
1456	if (idx >= RTL_NUMBER_OF(pDeviceExtension->cLocalConnections))
1457	{
1458	Log(("VBOXSF: vbsfNtDeleteConnection: Index 0x%x is invalid!\n",
1459	idx));
1460	Status = STATUS_BAD_NETWORK_NAME;
1461	}
1462	else
1463	{
1464	ExAcquireFastMutex(&pDeviceExtension->mtxLocalCon);
1465	fMutexAcquired = TRUE;
1466
1467	pDeviceExtension->cLocalConnections[idx] = FALSE;
1468
1469	/* Free saved name */
1470	if (pDeviceExtension->wszLocalConnectionName[idx])
1471	{
1472	vbsfNtFreeNonPagedMem(pDeviceExtension->wszLocalConnectionName[idx]);
1473	pDeviceExtension->wszLocalConnectionName[idx] = NULL;
1474	}
1475
1476	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1477	fMutexAcquired = FALSE;
1478
1479	Log(("VBOXSF: vbsfNtDeleteConnection: deleted index 0x%x\n",
1480	idx));
1481	}
1482	}
1483	}
1484	else
1485	{
1486	Log(("VBOXSF: vbsfNtCreateConnection: bad format\n"));
1487	Status = STATUS_BAD_NETWORK_NAME;
1488	}
1489	}
1490	}
1491	}
1492	__except(EXCEPTION_EXECUTE_HANDLER)
1493	{
1494	Status = STATUS_INVALID_PARAMETER;
1495	}
1496
1497	if (fMutexAcquired)
1498	{
1499	ExReleaseFastMutex(&pDeviceExtension->mtxLocalCon);
1500	fMutexAcquired = FALSE;
1501	}
1502
1503	Log(("VBOXSF: vbsfNtDeleteConnection: Status 0x%08X\n", Status));
1504	return Status;
1505	}
1506
1507	NTSTATUS VBoxMRxQueryEaInfo(IN OUT PRX_CONTEXT RxContext)
1508	{
1509	RT_NOREF(RxContext);
1510	Log(("VBOXSF: MRxQueryEaInfo: Ea buffer len remaining is %d\n", RxContext->Info.LengthRemaining));
1511	return STATUS_NOT_SUPPORTED;
1512	}
1513
1514	NTSTATUS VBoxMRxSetEaInfo(IN OUT PRX_CONTEXT RxContext)
1515	{
1516	RT_NOREF(RxContext);
1517	Log(("VBOXSF: MRxSetEaInfo\n"));
1518	return STATUS_NOT_IMPLEMENTED;
1519	}
1520
1521	NTSTATUS VBoxMRxFsCtl(IN OUT PRX_CONTEXT RxContext)
1522	{
1523	RT_NOREF(RxContext);
1524	Log(("VBOXSF: MRxFsCtl\n"));
1525	return STATUS_INVALID_DEVICE_REQUEST;
1526	}
1527
1528	NTSTATUS VBoxMRxNotifyChangeDirectory(IN OUT PRX_CONTEXT RxContext)
1529	{
1530	RT_NOREF(RxContext);
1531	Log(("VBOXSF: MRxNotifyChangeDirectory\n"));
1532	return STATUS_NOT_IMPLEMENTED;
1533	}
1534
1535	static NTSTATUS vbsfQuerySdInfo(PVOID pvBuffer, ULONG cbBuffer, SECURITY_INFORMATION SecurityInformation, ULONG *pcbOut)
1536	{
1537	/* What a public SMB share would return. */
1538	static SID_IDENTIFIER_AUTHORITY sIA = SECURITY_NT_AUTHORITY;
1539	#define SUB_AUTHORITY_COUNT 2
1540	static const ULONG saSubAuthorityOwner[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_USER_RID_GUEST };
1541	static const ULONG saSubAuthorityGroup[] = { SECURITY_NT_NON_UNIQUE, DOMAIN_GROUP_RID_GUESTS };
1542
1543	SECURITY_DESCRIPTOR_RELATIVE pSD = (SECURITY_DESCRIPTOR_RELATIVE )pvBuffer;
1544	ULONG cbSD = 0; /* Size of returned security descriptor. */
1545	ULONG cbAdd; /* How many bytes to add to the buffer for each component of the security descriptor. */
1546
1547	cbAdd = sizeof(SECURITY_DESCRIPTOR_RELATIVE);
1548	if (cbSD + cbAdd <= cbBuffer)
1549	{
1550	pSD->Revision = SECURITY_DESCRIPTOR_REVISION1;
1551	pSD->Sbz1 = 0;
1552	pSD->Control = SE_SELF_RELATIVE;
1553	pSD->Owner = 0;
1554	pSD->Group = 0;
1555	pSD->Sacl = 0;
1556	pSD->Dacl = 0;
1557	}
1558	cbSD += cbAdd;
1559
1560	if (SecurityInformation & OWNER_SECURITY_INFORMATION)
1561	{
1562	cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1563	if (cbSD + cbAdd <= cbBuffer)
1564	{
1565	SID pSID = (SID )((uint8_t *)pSD + cbSD);
1566	pSID->Revision = 1;
1567	pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1568	pSID->IdentifierAuthority = sIA;
1569	memcpy(pSID->SubAuthority, saSubAuthorityOwner, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1570
1571	pSD->Owner = cbSD;
1572	}
1573	cbSD += cbAdd;
1574	}
1575
1576	if (SecurityInformation & GROUP_SECURITY_INFORMATION)
1577	{
1578	cbAdd = RT_UOFFSETOF(SID, SubAuthority) + SUB_AUTHORITY_COUNT * sizeof(ULONG);
1579	if (cbSD + cbAdd <= cbBuffer)
1580	{
1581	SID pSID = (SID )((uint8_t *)pSD + cbSD);
1582	pSID->Revision = 1;
1583	pSID->SubAuthorityCount = SUB_AUTHORITY_COUNT;
1584	pSID->IdentifierAuthority = sIA;
1585	memcpy(pSID->SubAuthority, saSubAuthorityGroup, SUB_AUTHORITY_COUNT * sizeof(ULONG));
1586
1587	pSD->Group = cbSD;
1588	}
1589	cbSD += cbAdd;
1590	}
1591
1592	#undef SUB_AUTHORITY_COUNT
1593
1594	*pcbOut = cbSD;
1595	return STATUS_SUCCESS;
1596	}
1597
1598	NTSTATUS VBoxMRxQuerySdInfo(IN OUT PRX_CONTEXT RxContext)
1599	{
1600	NTSTATUS Status;
1601
1602	PVOID pvBuffer = RxContext->Info.Buffer;
1603	ULONG cbBuffer = RxContext->Info.LengthRemaining;
1604	SECURITY_INFORMATION SecurityInformation = RxContext->QuerySecurity.SecurityInformation;
1605
1606	ULONG cbSD = 0;
1607
1608	Log(("VBOXSF: MRxQuerySdInfo: Buffer %p, Length %d, SecurityInformation 0x%x\n",
1609	pvBuffer, cbBuffer, SecurityInformation));
1610
1611	Status = vbsfQuerySdInfo(pvBuffer, cbBuffer, SecurityInformation, &cbSD);
1612	if (NT_SUCCESS(Status))
1613	{
1614	RxContext->InformationToReturn = cbSD;
1615	if (RxContext->InformationToReturn > cbBuffer)
1616	{
1617	Status = STATUS_BUFFER_OVERFLOW;
1618	}
1619	}
1620
1621	Log(("VBOXSF: MRxQuerySdInfo: Status 0x%08X, InformationToReturn %d\n",
1622	Status, RxContext->InformationToReturn));
1623	return Status;
1624	}
1625
1626	NTSTATUS VBoxMRxSetSdInfo(IN OUT struct _RX_CONTEXT * RxContext)
1627	{
1628	RT_NOREF(RxContext);
1629	Log(("VBOXSF: MRxSetSdInfo\n"));
1630	return STATUS_NOT_IMPLEMENTED;
1631	}
1632
1633	/*
1634	* WML stubs which are referenced by rdbsslib.
1635	*/
1636	extern "C" NTSTATUS WmlTinySystemControl(IN OUT PVOID pWmiLibInfo, IN PVOID pDevObj, IN PVOID pIrp)
1637	{
1638	RT_NOREF(pWmiLibInfo, pDevObj, pIrp);
1639	return STATUS_WMI_GUID_NOT_FOUND;
1640	}
1641
1642	extern "C" ULONG WmlTrace(IN ULONG ulType, IN PVOID pTraceUuid, IN ULONG64 ullLogger, ...)
1643	{
1644	RT_NOREF(ulType, pTraceUuid, ullLogger);
1645	return STATUS_SUCCESS;
1646	}
1647
1648
1649	/**
1650	* The "main" function for a driver binary.
1651	*/
1652	extern "C" NTSTATUS NTAPI DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath)
1653	{
1654	Log(("VBOXSF: DriverEntry: Driver object %p\n", DriverObject));
1655	AssertLogRelReturn(DriverObject, STATUS_UNSUCCESSFUL);
1656
1657	/*
1658	* Initialize IPRT and Vbgl.
1659	*/
1660	NTSTATUS rcNt = STATUS_UNSUCCESSFUL;
1661	int vrc = RTR0Init(0);
1662	if (RT_SUCCESS(vrc))
1663	{
1664	vrc = VbglR0SfInit();
1665	if (RT_SUCCESS(vrc))
1666	{
1667	/*
1668	* Connect to the shared folder service on the host.
1669	*/
1670	vrc = VbglR0SfConnect(&g_SfClient);
1671	if (RT_SUCCESS(vrc))
1672	{
1673	/*
1674	* Query the features and check that the host does page lists as we need those
1675	* for reading and writing.
1676	*/
1677	vrc = VbglR0QueryHostFeatures(&g_fHostFeatures);
1678	if (RT_FAILURE(vrc))
1679	{
1680	LogRel(("vboxsf: VbglR0QueryHostFeatures failed: vrc=%Rrc (ignored)\n", vrc));
1681	g_fHostFeatures = 0;
1682	}
1683	VbglR0SfHostReqQueryFeaturesSimple(&g_fSfFeatures, &g_uSfLastFunction);
1684	LogRel(("VBoxSF: g_fHostFeatures=%#x g_fSfFeatures=%#RX64 g_uSfLastFunction=%u\n",
1685	g_fHostFeatures, g_fSfFeatures, g_uSfLastFunction));
1686
1687	if (VbglR0CanUsePhysPageList())
1688	{
1689	/*
1690	* Tell the host to return windows-style errors (non-fatal).
1691	*/
1692	if (g_uSfLastFunction >= SHFL_FN_SET_ERROR_STYLE)
1693	{
1694	vrc = VbglR0SfHostReqSetErrorStyleSimple(kShflErrorStyle_Windows);
1695	if (RT_FAILURE(vrc))
1696	LogRel(("VBoxSF: VbglR0HostReqSetErrorStyleSimple(windows) failed: %Rrc\n", vrc));
1697	}
1698
1699	/*
1700	* Resolve newer kernel APIs we might want to use.
1701	* Note! Because of http://www.osronline.com/article.cfm%5eid=494.htm we cannot
1702	* use MmGetSystemRoutineAddress here as it will crash on xpsp2.
1703	*/
1704	RTDBGKRNLINFO hKrnlInfo;
1705	vrc = RTR0DbgKrnlInfoOpen(&hKrnlInfo, 0/fFlags/);
1706	AssertLogRelRC(vrc);
1707	if (RT_SUCCESS(vrc))
1708	{
1709	g_pfnCcCoherencyFlushAndPurgeCache
1710	= (PFNCCCOHERENCYFLUSHANDPURGECACHE)RTR0DbgKrnlInfoGetSymbol(hKrnlInfo, NULL,
1711	"CcCoherencyFlushAndPurgeCache");
1712	RTR0DbgKrnlInfoRelease(hKrnlInfo);
1713	}
1714
1715	/*
1716	* Init the driver object.
1717	*/
1718	DriverObject->DriverUnload = VBoxMRxUnload;
1719	for (size_t i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
1720	DriverObject->MajorFunction[i] = (PDRIVER_DISPATCH)VBoxMRxFsdDispatch;
1721
1722	/*
1723	* Do RDBSS driver entry processing.
1724	*/
1725	rcNt = RxDriverEntry(DriverObject, RegistryPath);
1726	if (rcNt == STATUS_SUCCESS)
1727	{
1728	/*
1729	* Do the mini redirector registration.
1730	* Note! Don't use RX_REGISTERMINI_FLAG_DONT_PROVIDE_UNCS or else UNC
1731	* mappings don't work (including Windows explorer browsing).
1732	*/
1733	Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: calling VBoxMRxDeviceObject %p\n", VBoxMRxDeviceObject));
1734	UNICODE_STRING VBoxMRxName;
1735	RtlInitUnicodeString(&VBoxMRxName, DD_MRX_VBOX_FS_DEVICE_NAME_U);
1736	rcNt = RxRegisterMinirdr(&VBoxMRxDeviceObject,
1737	DriverObject,
1738	&VBoxMRxDispatch,
1739	RX_REGISTERMINI_FLAG_DONT_PROVIDE_MAILSLOTS,
1740	&VBoxMRxName,
1741	sizeof(MRX_VBOX_DEVICE_EXTENSION),
1742	FILE_DEVICE_NETWORK_FILE_SYSTEM,
1743	FILE_REMOTE_DEVICE);
1744	Log(("VBOXSF: DriverEntry: RxRegisterMinirdr: returned 0x%08X VBoxMRxDeviceObject %p\n",
1745	rcNt, VBoxMRxDeviceObject));
1746	if (rcNt == STATUS_SUCCESS)
1747	{
1748	/*
1749	* Init the device extension.
1750	*
1751	* Note! The device extension actually points to fields in the RDBSS_DEVICE_OBJECT.
1752	* Our space is past the end of that struct!!
1753	*/
1754	PMRX_VBOX_DEVICE_EXTENSION pVBoxDevX = (PMRX_VBOX_DEVICE_EXTENSION)( (PBYTE)VBoxMRxDeviceObject
1755	+ sizeof(RDBSS_DEVICE_OBJECT));
1756	pVBoxDevX->pDeviceObject = VBoxMRxDeviceObject;
1757	for (size_t i = 0; i < RT_ELEMENTS(pVBoxDevX->cLocalConnections); i++)
1758	pVBoxDevX->cLocalConnections[i] = FALSE;
1759
1760	/* Mutex for synchronizining our connection list */
1761	ExInitializeFastMutex(&pVBoxDevX->mtxLocalCon);
1762
1763	/*
1764	* The device object has been created. Need to setup a symbolic link
1765	* in the Win32 name space for user mode applications.
1766	*/
1767	UNICODE_STRING UserModeDeviceName;
1768	RtlInitUnicodeString(&UserModeDeviceName, DD_MRX_VBOX_USERMODE_SHADOW_DEV_NAME_U);
1769	Log(("VBOXSF: DriverEntry: Calling IoCreateSymbolicLink\n"));
1770	rcNt = IoCreateSymbolicLink(&UserModeDeviceName, &VBoxMRxName);
1771	if (rcNt == STATUS_SUCCESS)
1772	{
1773	Log(("VBOXSF: DriverEntry: Symbolic link created.\n"));
1774
1775	/*
1776	* Build the dispatch tables for the minirdr
1777	*/
1778	vbsfInitMRxDispatch();
1779
1780	/*
1781	* The redirector driver must intercept the IOCTL to avoid VBOXSVR name resolution
1782	* by other redirectors. These additional name resolutions cause long delays.
1783	*/
1784	Log(("VBOXSF: DriverEntry: VBoxMRxDeviceObject = %p, rdbss %p, devext %p\n",
1785	VBoxMRxDeviceObject, DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL], pVBoxDevX));
1786	pVBoxDevX->pfnRDBSSDeviceControl = DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL];
1787	DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = VBoxMRXDeviceControl;
1788
1789	/*
1790	* Intercept IRP_MJ_CREATE to fix incorrect (wrt NTFS, FAT, ++) return
1791	* codes for NtOpenFile("r:\\asdf\\", FILE_NON_DIRECTORY_FILE).
1792	*/
1793	pVBoxDevX->pfnRDBSSCreate = DriverObject->MajorFunction[IRP_MJ_CREATE];
1794	DriverObject->MajorFunction[IRP_MJ_CREATE] = VBoxHookMjCreate;
1795
1796	/*
1797	* Intercept IRP_MJ_SET_INFORMATION to ensure we call the host for all
1798	* FileEndOfFileInformation requestes, even if the new size matches the
1799	* old one. We don't know if someone else might have modified the file
1800	* size cached in the FCB since the last time we update it.
1801	*/
1802	pVBoxDevX->pfnRDBSSSetInformation = DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION];
1803	DriverObject->MajorFunction[IRP_MJ_SET_INFORMATION] = VBoxHookMjSetInformation;
1804
1805	/** @todo start the redirector here RxStartMiniRdr. */
1806
1807	Log(("VBOXSF: DriverEntry: Init successful!\n"));
1808	return STATUS_SUCCESS;
1809	}
1810	LogRel(("VBOXSF: DriverEntry: IoCreateSymbolicLink: %#x\n", rcNt));
1811
1812	RxUnregisterMinirdr(VBoxMRxDeviceObject);
1813	VBoxMRxDeviceObject = NULL;
1814	}
1815	else
1816	LogRel(("VBOXSF: DriverEntry: RxRegisterMinirdr failed: %#x\n", rcNt));
1817	}
1818	else
1819	LogRel(("VBOXSF: DriverEntry: RxDriverEntry failed: 0x%08X\n", rcNt));
1820	}
1821	else
1822	LogRel(("VBOXSF: Host does not support physical page lists. Refusing to load!\n"));
1823	VbglR0SfDisconnect(&g_SfClient);
1824	}
1825	else
1826	LogRel(("VBOXSF: DriverEntry: Failed to connect to the host: %Rrc!\n", vrc));
1827	VbglR0SfTerm();
1828	}
1829	else
1830	LogRel(("VBOXSF: DriverEntry: VbglR0SfInit! %Rrc!\n", vrc));
1831	RTR0Term();
1832	}
1833	else
1834	RTLogRelPrintf("VBOXSF: DriverEntry: RTR0Init failed! %Rrc!\n", vrc);
1835	return rcNt;
1836	}
1837

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Additions/WINNT/SharedFolders/driver/vbsf.cpp@ 100519

Download in other formats: