/*++

Copyright (c) 1989  Microsoft Corporation

Module Name:

    smbmisc.c

Abstract:

    This module contains routines for processing MISC class SMBs:
        Echo
        Query FS Information
        Set FS Information
        Query Disk Information

Author:

    Chuck Lenzmeier (chuckl) 9-Nov-1989
    David Treadwell (davidtr)

Revision History:

--*/

#include "precomp.h"
#pragma hdrstop

#define BugCheckFileId SRV_FILE_SMBMISC

STATIC
ULONG QueryVolumeInformation[] = {
         SMB_QUERY_FS_LABEL_INFO,  // Base level
         FileFsLabelInformation,   // Mapping for base level
         FileFsVolumeInformation,
         FileFsSizeInformation,
         FileFsDeviceInformation,
         FileFsAttributeInformation
};

STATIC
VOID SRVFASTCALL
RestartEcho (
    IN OUT PWORK_CONTEXT WorkContext
    );

#ifdef ALLOC_PRAGMA
#pragma alloc_text( PAGE, SrvSmbEcho )
#pragma alloc_text( PAGE, RestartEcho )
#pragma alloc_text( PAGE, SrvSmbQueryFsInformation )
#pragma alloc_text( PAGE, SrvSmbSetFsInformation )
#pragma alloc_text( PAGE, SrvSmbQueryInformationDisk )
#pragma alloc_text( PAGE, SrvSmbSetSecurityDescriptor )
#pragma alloc_text( PAGE, SrvSmbQuerySecurityDescriptor )
#endif
#if 0
NOT PAGEABLE -- SrvSmbNtCancel
#endif


SMB_PROCESSOR_RETURN_TYPE
SrvSmbEcho (
    SMB_PROCESSOR_PARAMETERS
    )

/*++

Routine Description:

    Processes an Echo SMB.  It sends the first echo, if any, specifying
    RestartEcho as the restart routine.  That routine sends the
    remaining echoes.

Arguments:

    SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
        of the parameters to SMB processor routines.

Return Value:

    SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h

--*/

{
    PREQ_ECHO request;
    PRESP_ECHO response;

    PAGED_CODE( );

    request = (PREQ_ECHO)WorkContext->RequestParameters;
    response = (PRESP_ECHO)WorkContext->ResponseParameters;

    //
    // If the echo count is 0, there are no echoes to send.
    //

    if ( SmbGetUshort( &request->EchoCount ) == 0 ) {

        return SmbStatusNoResponse;

    }

    //
    // The echo count is not zero.  Save it in the work context, then
    // send the first echo.
    //
    // *** This code depends on the response buffer being the same as
    //     the request buffer.  It does not copy the echo data from the
    //     request to the response.  It does not update the DataLength
    //     of the response buffer.
    //
    // !!! Need to put in code to verify the requested TID, if any.
    //

    SrvReleaseContext( WorkContext );

    WorkContext->Parameters.RemainingEchoCount =
        (USHORT)(SmbGetUshort( &request->EchoCount ) - 1);

    ASSERT( WorkContext->ResponseHeader == WorkContext->RequestHeader );

    SmbPutUshort( &response->SequenceNumber, 1 );

    //
    // Set the bit in the SMB that indicates this is a response from the
    // server.
    //

    WorkContext->ResponseHeader->Flags |= SMB_FLAGS_SERVER_TO_REDIR;

    //
    // Send the echo.  Notice that the smb statistics will be updated
    // here.  Instead of measuring the time to finish all the echos,
    // we just measure the time to respond to the first.  This will
    // save us the trouble of storing the timestamp somewhere.
    //

    SRV_START_SEND_2(
        WorkContext,
        SrvQueueWorkToFspAtSendCompletion,
        NULL,
        RestartEcho
        );

    //
    // The echo has been started.  Tell the main SMB processor not to
    // do anything more with the current SMB.
    //

    return SmbStatusInProgress;

} // SrvSmbEcho


VOID SRVFASTCALL
RestartEcho (
    IN PWORK_CONTEXT WorkContext
    )

/*++

Routine Description:

    Processes send completion for an Echo.  If more echoes are required,
    it sends the next one.

Arguments:

    WorkContext - Supplies a pointer to the work context block
        describing server-specific context for the request.

Return Value:

    None.

--*/

{
    PCONNECTION connection;

    PAGED_CODE( );

    IF_DEBUG(WORKER1) SrvPrint0( " - RestartEcho\n" );

    //
    // Get the connection pointer.  The connection pointer is a
    // referenced pointer.  (The endpoint is valid because the
    // connection references the endpoint.)
    //

    connection = WorkContext->Connection;
    IF_DEBUG(TRACE2) SrvPrint2( "  connection %lx, endpoint %lx\n",
                                        connection, WorkContext->Endpoint );

    //
    // If the I/O request failed or was canceled, or if the connection
    // is no longer active, clean up.  (The connection is marked as
    // closing when it is disconnected or when the endpoint is closed.)
    //
    // !!! If I/O failure, should we drop the connection?
    //

    if ( WorkContext->Irp->Cancel ||
         !NT_SUCCESS(WorkContext->Irp->IoStatus.Status) ||
         (GET_BLOCK_STATE(connection) != BlockStateActive) ) {

        IF_DEBUG(TRACE2) {
            if ( WorkContext->Irp->Cancel ) {
                SrvPrint0( "  I/O canceled\n" );
            } else if ( !NT_SUCCESS(WorkContext->Irp->IoStatus.Status) ) {
                SrvPrint1( "  I/O failed: %X\n",
                            WorkContext->Irp->IoStatus.Status );
            } else {
                SrvPrint0( "  Connection no longer active\n" );
            }
        }

        //
        // Indicate that SMB processing is complete.
        //

        SrvEndSmbProcessing( WorkContext, SmbStatusNoResponse );

        IF_DEBUG(TRACE2) SrvPrint0( "RestartEcho complete\n" );
        return;

    }

    //
    // The request was successful, and the connection is still active.
    // If there are no more echoes to be sent, indicate that SMB
    // processing is complete.
    //

    if ( WorkContext->Parameters.RemainingEchoCount == 0 ) {

        SrvEndSmbProcessing( WorkContext, SmbStatusNoResponse );

        IF_DEBUG(TRACE2) SrvPrint0( "RestartEcho complete\n" );
        return;

    }

    --WorkContext->Parameters.RemainingEchoCount;

    //
    // There are more echoes to be sent.  Increment the sequence number
    // in the response SMB, and send another echo.
    //

    SmbPutUshort(
        &((PRESP_ECHO)WorkContext->ResponseParameters)->SequenceNumber,
        (USHORT)(SmbGetUshort(
            &((PRESP_ECHO)WorkContext->ResponseParameters)->SequenceNumber
            ) + 1)
        );

    //
    // Don't do smb statistics a second time.
    //

    WorkContext->StartTime = 0;

    //
    // Send the echo.  (Note that the response bit has already been
    // set.)
    //

    SRV_START_SEND_2(
        WorkContext,
        SrvQueueWorkToFspAtSendCompletion,
        NULL,
        RestartEcho
        );

    IF_DEBUG(TRACE2) SrvPrint0( "RestartEcho complete\n" );
    return;

} // RestartEcho


SMB_TRANS_STATUS
SrvSmbQueryFsInformation (
    IN OUT PWORK_CONTEXT WorkContext
    )

/*++

Routine Description:

    Processes the Query FS Information request.  This request arrives
    in a Transaction2 SMB.  Query FS Information corresponds to the
    OS/2 DosQFSInfo service.

Arguments:

    WorkContext - Supplies the address of a Work Context Block
        describing the current request.  See smbtypes.h for a more
        complete description of the valid fields.

Return Value:

    SMB_TRANS_STATUS - Indicates whether an error occurred, and, if so,
        whether data should be returned to the client.  See smbtypes.h
        for a more complete description.

--*/

{
    NTSTATUS status;
    IO_STATUS_BLOCK ioStatusBlock;
    PTRANSACTION transaction;
    USHORT informationLevel;

    USHORT trans2code;
    HANDLE fileHandle;
    BOOLEAN isRootDirectoryHandle;

    FILE_FS_SIZE_INFORMATION fsSizeInfo;
    PFSALLOCATE fsAllocate;

    PFILE_FS_VOLUME_INFORMATION fsVolumeInfo;
    ULONG fsVolumeInfoLength;
    PFSINFO fsInfo;
    ULONG lengthVolumeLabel;
    BOOLEAN isUnicode;
    PREQ_QUERY_FS_INFORMATION request;

    PAGED_CODE( );

    isUnicode = SMB_IS_UNICODE( WorkContext );
    transaction = WorkContext->Parameters.Transaction;
    IF_SMB_DEBUG(MISC1) {
        SrvPrint1( "Query FS Information entered; transaction 0x%lx\n",
                    transaction );
    }

    //
    // Verify that enough parameter bytes were sent and that we're allowed
    // to return enough parameter bytes.  Query FS information has no
    // response parameters.
    //


    if ( (transaction->ParameterCount < sizeof(REQ_QUERY_FS_INFORMATION)) ) {

        //
        // Not enough parameter bytes were sent.
        //

        IF_DEBUG(SMB_ERRORS) {
            SrvPrint2( "SrvSmbQueryFSInformation: bad parameter byte "
                        "counts: %ld %ld\n",
                        transaction->ParameterCount,
                        transaction->MaxParameterCount );
        }

        SrvLogInvalidSmb( WorkContext );

        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // See if a non-admin user is trying to access information on an Administrative share
    //
    status = SrvIsAllowedOnAdminShare( WorkContext, WorkContext->TreeConnect->Share );

    if( !NT_SUCCESS( status ) ) {
        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;
    }

    trans2code = SmbGetAlignedUshort(transaction->InSetup);
    IF_SMB_DEBUG(MISC1) {
        SrvPrint1("SrvSmbQueryFSInformation: Trans2 function = %x\n", trans2code);
    }

    request = (PREQ_QUERY_FS_INFORMATION) transaction->InParameters;

    ASSERT( trans2code == TRANS2_QUERY_FS_INFORMATION );

    informationLevel = SmbGetUshort( &request->InformationLevel );

    //
    // *** The share handle is used to get the allocation
    //     information.  This is a "storage channel," and as a
    //     result could allow people to get information to which
    //     they are not entitled.  For a B2 security rating this may
    //     need to be changed.
    //

    status = SrvGetShareRootHandle( WorkContext->TreeConnect->Share );

    if (!NT_SUCCESS(status)) {

        IF_DEBUG(ERRORS) {
            SrvPrint1( "SrvSmbQueryFsInformation: SrvGetShareRootHandle failed %x.\n",
                        status );
        }

        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;

    }

    fileHandle = WorkContext->TreeConnect->Share->RootDirectoryHandle;
    isRootDirectoryHandle = TRUE;

    IF_SMB_DEBUG(MISC1) {
        SrvPrint0("SrvSmbQueryFSInformation: Using share root handle\n");
    }

    switch ( informationLevel ) {

    case SMB_INFO_ALLOCATION:

        //
        // Return information about the disk.
        //

        fsAllocate = (PFSALLOCATE)transaction->OutData;

        if ( transaction->MaxDataCount < sizeof(FSALLOCATE) ) {
            SrvSetSmbError( WorkContext, STATUS_BUFFER_OVERFLOW );
            return SmbTransStatusErrorWithoutData;
        }


        //
        // *** The share handle is used to get the allocation
        //     information.  This is a "storage channel," and as a
        //     result could allow people to get information to which
        //     they are not entitled.  For a B2 security rating this may
        //     need to be changed.
        //

        status = NtQueryVolumeInformationFile(
                     fileHandle,
                     &ioStatusBlock,
                     &fsSizeInfo,
                     sizeof(FILE_FS_SIZE_INFORMATION),
                     FileFsSizeInformation
                     );

        //
        // Release the share root handle if device is removable
        //

        if ( isRootDirectoryHandle ) {
            SrvReleaseShareRootHandle( WorkContext->TreeConnect->Share );
        }

        if ( !NT_SUCCESS(status) ) {
            INTERNAL_ERROR(
                ERROR_LEVEL_UNEXPECTED,
                "SrvSmbQueryFsInformation: NtQueryVolumeInformationFile "
                    "returned %X",
                status,
                NULL
                );

            SrvLogServiceFailure( SRV_SVC_NT_QUERY_VOL_INFO_FILE, status );

            SrvSetSmbError( WorkContext, status );
            return SmbTransStatusErrorWithoutData;
        }

        SmbPutAlignedUlong( &fsAllocate->idFileSystem, 0 );
        SmbPutAlignedUlong(
            &fsAllocate->cSectorUnit,
            fsSizeInfo.SectorsPerAllocationUnit
            );

        //
        // *** If .HighPart is non-zero, there is a problem, as we can
        //     only return 32 bits for the volume size.  In this case,
        //     we return the largest value that will fit.
        //

        SmbPutAlignedUlong(
            &fsAllocate->cUnit,
            fsSizeInfo.TotalAllocationUnits.HighPart == 0 ?
                fsSizeInfo.TotalAllocationUnits.LowPart :
                0xffffffff
            );
        SmbPutAlignedUlong(
            &fsAllocate->cUnitAvail,
            fsSizeInfo.AvailableAllocationUnits.HighPart == 0 ?
                fsSizeInfo.AvailableAllocationUnits.LowPart :
                0xffffffff
            );

        SmbPutAlignedUshort(
            &fsAllocate->cbSector,
            (USHORT)fsSizeInfo.BytesPerSector );

        transaction->DataCount = sizeof(FSALLOCATE);

        break;

    case SMB_INFO_VOLUME:

        //
        // Query the volume label.
        //

        fsInfo = (PFSINFO)transaction->OutData;

        //
        // The maximum volume label length we are able to return, given
        // the VOLUMELABEL structure (1 byte describes length of label),
        // is 255 characters.  Therefore, allocate a buffer large enough
        // to hold a label that size, and if the label is longer then we
        // will get STATUS_BUFFER_OVERFLOW from NtQueryVolumeInformationFile.
        //

        fsVolumeInfoLength = FIELD_OFFSET(FILE_FS_VOLUME_INFORMATION, VolumeLabel ) +
                             255 * sizeof(WCHAR);
        fsVolumeInfo = ALLOCATE_HEAP( fsVolumeInfoLength, BlockTypeDataBuffer );

        if ( fsVolumeInfo == NULL ) {
            SrvSetSmbError( WorkContext, STATUS_INSUFF_SERVER_RESOURCES );
            return SmbTransStatusErrorWithoutData;
        }


        //
        // Get the label information.
        //

        status = NtQueryVolumeInformationFile(
                     fileHandle,
                     &ioStatusBlock,
                     fsVolumeInfo,
                     fsVolumeInfoLength,
                     FileFsVolumeInformation
                     );

        //
        // Release the share root handle if device is removable
        //

        if ( isRootDirectoryHandle ) {
            SrvReleaseShareRootHandle( WorkContext->TreeConnect->Share );
        }

        if ( !NT_SUCCESS(status) ) {
            INTERNAL_ERROR(
                ERROR_LEVEL_UNEXPECTED,
                "SrvSmbQueryFSInformation: NtQueryVolumeInformationFile "
                    "returned %X",
                status,
                NULL
                );

            FREE_HEAP( fsVolumeInfo );

            SrvLogServiceFailure( SRV_SVC_NT_QUERY_VOL_INFO_FILE, status );

            SrvSetSmbError( WorkContext, status );
            return SmbTransStatusErrorWithoutData;
        }

        lengthVolumeLabel = fsVolumeInfo->VolumeLabelLength;

        //
        // Make sure that the client can accept enough data.  The volume
        // label length is limited to 13 characters (8 + '.' + 3 + zero
        // terminator) in OS/2, so return STATUS_BUFFER_OVERFLOW if the
        // label is too long.
        //

        if ( !isUnicode &&
                !IS_NT_DIALECT( WorkContext->Connection->SmbDialect ) ) {

            //
            // For a non-NT client, we truncate the volume label in case
            // it is longer than 11+1 characters.
            //

            if ( lengthVolumeLabel > 11 * sizeof(WCHAR) ) {
                lengthVolumeLabel = 11 * sizeof(WCHAR);
            }

            //
            // Wedge a '.' into the name if it's longer than 8 characters long
            //
            if( lengthVolumeLabel > 8 * sizeof( WCHAR ) ) {

                LPWSTR p = &fsVolumeInfo->VolumeLabel[11];

                *p = *(p-1);        // VolumeLabel[11] = VolumeLabel[10]
                --p;
                *p = *(p-1);        // VolumeLabel[10] = VolumeLabel[9]
                --p;
                *p = *(p-1);        // VolumeLabel[9] = VolumeLabel[8]
                --p;
                *p = L'.';          // VolumeLabel[8] = '.'

            }

        }

        if ( (ULONG)transaction->MaxDataCount <
                 ( sizeof(FSINFO) - sizeof(VOLUMELABEL) +
                   lengthVolumeLabel / (isUnicode ? 1 : sizeof(WCHAR)) ) ) {

            FREE_HEAP( fsVolumeInfo );
            SrvSetSmbError( WorkContext, STATUS_BUFFER_OVERFLOW );
            return SmbTransStatusErrorWithoutData;

        }


        SmbPutUlong( &fsInfo->ulVsn, fsVolumeInfo->VolumeSerialNumber );


        //
        // Put the label in the SMB in Unicode or OEM, depending on what
        // was negotiated.
        //

        if ( isUnicode ) {

            RtlCopyMemory(
                fsInfo->vol.szVolLabel,
                fsVolumeInfo->VolumeLabel,
                lengthVolumeLabel
                );

            transaction->DataCount = sizeof(FSINFO) -
                                sizeof(VOLUMELABEL) + lengthVolumeLabel;

            fsInfo->vol.cch = (UCHAR)lengthVolumeLabel;

        } else {

            ULONG i;
            OEM_STRING oemString;
            UNICODE_STRING unicodeString;

            if ( lengthVolumeLabel != 0 ) {

                oemString.Buffer = fsInfo->vol.szVolLabel;
                oemString.MaximumLength = 12;

                unicodeString.Buffer = (PWCH)fsVolumeInfo->VolumeLabel;
                unicodeString.Length = (USHORT) lengthVolumeLabel;
                unicodeString.MaximumLength = (USHORT) lengthVolumeLabel;

                status = RtlUnicodeStringToOemString(
                             &oemString,
                             &unicodeString,
                             FALSE
                             );
                ASSERT( NT_SUCCESS(status) );
            }

            fsInfo->vol.cch = (UCHAR) (lengthVolumeLabel / sizeof(WCHAR));

            //
            // Pad the end of the volume name with zeros to fill 12
            // characters.
            //

            for ( i = fsInfo->vol.cch + 1 ; i < 12; i++ ) {
                fsInfo->vol.szVolLabel[i] = '\0';
            }

            transaction->DataCount = sizeof(FSINFO);
        }

        IF_SMB_DEBUG(MISC1) {
            SrvPrint2( "volume label length is %d and label is %s\n",
                          fsInfo->vol.cch, fsInfo->vol.szVolLabel );
        }

        FREE_HEAP( fsVolumeInfo );

        break;

    case SMB_QUERY_FS_VOLUME_INFO:
    case SMB_QUERY_FS_SIZE_INFO:
    case SMB_QUERY_FS_DEVICE_INFO:
    case SMB_QUERY_FS_ATTRIBUTE_INFO:

        //
        // These are NT infolevels.  We always return unicode.
        //  Except for the fact that NEXUS on WFW calls through here and is
        //  not unicode (isaache)
        //
        // ASSERT( isUnicode );


        status = NtQueryVolumeInformationFile(
                     fileHandle,
                     &ioStatusBlock,
                     transaction->OutData,
                     transaction->MaxDataCount,
                     MAP_SMB_INFO_TYPE_TO_NT(
                         QueryVolumeInformation,
                         informationLevel
                         )
                     );

        //
        // Release the share root handle if device is removable
        //

        if ( isRootDirectoryHandle ) {
            SrvReleaseShareRootHandle( WorkContext->TreeConnect->Share );
        }

        if ( NT_SUCCESS( status ) ) {
            transaction->DataCount = ioStatusBlock.Information;
        } else {
            SrvSetSmbError( WorkContext, status );
            return SmbTransStatusErrorWithoutData;
        }

        break;

    default:

        //
        // An invalid information level was passed.
        //

        SrvSetSmbError( WorkContext, STATUS_OS2_INVALID_LEVEL );
        return SmbTransStatusErrorWithoutData;
    }

    transaction->SetupCount = 0;
    transaction->ParameterCount = 0;

    return SmbTransStatusSuccess;

} // SrvSmbQueryFsInformation


SMB_TRANS_STATUS
SrvSmbSetFsInformation (
    IN OUT PWORK_CONTEXT WorkContext
    )

/*++

Routine Description:

    Processes the Set FS Information request.  This request arrives
    in a Transaction2 SMB.  Set FS Information corresponds to the
    OS/2 DosSetFSInfo service.

Arguments:

    WorkContext - Supplies the address of a Work Context Block
        describing the current request.  See smbtypes.h for a more
        complete description of the valid fields.

Return Value:

    SMB_TRANS_STATUS - Indicates whether an error occurred, and, if so,
        whether data should be returned to the client.  See smbtypes.h
        for a more complete description.

--*/

{
    PAGED_CODE( );

    //
    // It seems that the 2.0 redirector never sends this SMB, and it is
    // difficult to do this without special support from the file
    // system--what volume name should be opened?  It is not like Query,
    // where we can use the share handle to do the
    // NtQueryVolumeInformationFile--Set must have an actual volume
    // handle.
    //
    // The #if'ed out code would work if a good volume handle were
    // used.
    //

    SrvSetSmbError( WorkContext, STATUS_SMB_NO_SUPPORT );
    return SmbTransStatusErrorWithoutData;

#if 0
    PREQ_SET_FS_INFORMATION request;

    NTSTATUS status;
    IO_STATUS_BLOCK ioStatusBlock;
    PTRANSACTION transaction;
    USHORT informationLevel;

    OEM_STRING oemLabelString;
    UNICODE_STRING labelString;

    PVOLUMELABEL volumeLabel;
    PFILE_FS_LABEL_INFORMATION fsLabelInfo;
    ULONG fsLabelInfoLength;

    transaction = WorkContext->Parameters.Transaction;
    IF_SMB_DEBUG(MISC1) {
        SrvPrint1( "Set FS Information entered; transaction 0x%lx\n",
                    transaction );
    }

    //
    // Verify that enough parameter bytes were sent and that we're allowed
    // to return enough parameter bytes.  Set FS information has no
    // response parameters.
    //

    request = (PREQ_SET_FS_INFORMATION)transaction->InParameters;

    if ( (transaction->ParameterCount < sizeof(REQ_SET_FS_INFORMATION)) ) {

        //
        // Not enough parameter bytes were sent.
        //

        IF_SMB_DEBUG(SMB_ERRORS) {
            SrvPrint2( "SrvSmbSetFSInformation: bad parameter byte "
                        "counts: %ld %ld\n",
                        transaction->ParameterCount,
                        transaction->MaxParameterCount );
        }

        SrvLogInvalidSmb( WorkContext );

        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Confirm that the information level is legitimate.
    //

    informationLevel = SmbGetUshort( &request->InformationLevel );

    if ( informationLevel != SMB_INFO_VOLUME ) {
        SrvSetSmbError( WorkContext, STATUS_OS2_INVALID_LEVEL );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Make sure the client is allowed to do this, if we have an Admin share
    //
    status = SrvIsAllowedOnAdminShare( WorkContext, WorkContext->TreeConnect->Share );

    if( !NT_SUCCESS( status ) ) {
        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Make sure that the client passed enough data bytes to account for
    // the entire length of the volume label.  The +2 accounts for the
    // zero terminator and the cch field of the VOLUMELABEL structure.
    //

    volumeLabel = (PVOLUMELABEL)transaction->InData;

    if ( transaction->DataCount < (CLONG)(volumeLabel->cch+2) ) {
        IF_DEBUG(SMB_ERRORS) {
            SrvPrint1( "SrvSmbSetFSInformation: cch count too large: %ld\n",
                          volumeLabel->cch );
        }

        SrvLogInvalidSmb( WorkContext );

        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbTransStatusErrorWithoutData;
    }

    oemString.Length = volumeLabel->cch;
    oemString.Buffer = volumeLabel->szVolumeLabel;
    unicodeString.MaximumLength =
                    (USHORT)RtlOemStringToUnicodeSize( &oemString );

    fsLabelInfoLength = FIELD_OFFSET( FILE_FS_LABEL_INFORMATION, VolumeLabel ) +
                        unicodeString.MaximumLength;
    fsLabelInfo = ALLOCATE_HEAP( fsLabelInfoLength, BlockTypeDataBuffer );

    if ( fsLabelInfo == NULL ) {
        SrvSetSmbError( WorkContext, STATUS_INSUFF_SERVER_RESOURCES );
        return SmbTransStatusErrorWithoutData;
    }

    unicodeString.Buffer = fsLabelInfo.VolumeLabel;
    RtlOemStringToUnicodeString( &unicodeString, &oemString, FALSE );
    fsLabelInfo->VolumeLabelLength = unicodeString.Length;

    //
    // Get the Share root handle.
    //

    status = SrvGetShareRootHandle( WorkContext->TreeConnect->Share );

    if ( !NT_SUCCESS(status) ) {

        IF_DEBUG(ERRORS) {
            SrvPrint1( "SrvSmbSetFsInformation: SrvGetShareRootHandle failed %x.\n",
                        status );
        }

        FREE_HEAP( fsLabelInfo );
        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Set the label on the volume.
    //
    // !!! Need to convert the input string to Unicode

    status = NtSetVolumeInformationFile(
                 WorkContext->TreeConnect->Share->RootDirectoryHandle,
                 &ioStatusBlock,
                 fsLabelInfo,
                 fsLabelInfoLength,
                 FileFsLabelInformation
                 );

    FREE_HEAP( fsLabelInfo );

    //
    // Release the share root handle if device is removable
    //

    SrvReleaseShareRootHandle( WorkContext->TreeConnect->Share );

    if ( !NT_SUCCESS(status) ) {
        INTERNAL_ERROR(
            ERROR_LEVEL_UNEXPECTED,
            "SrvSmbSetFSInformation: NtSetVolumeInformationFile returned %X",
            status,
            NULL
            );

        SrvLogServiceFailure( SRV_SVC_NT_SET_VOL_INFO_FILE, status );

        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;
    }

    transaction->SetupCount = 0;
    transaction->ParameterCount = 0;
    transaction->DataCount = 0;

    return SmbTransStatusSuccess;
#endif

} // SrvSmbSetFsInformation


SMB_PROCESSOR_RETURN_TYPE
SrvSmbQueryInformationDisk (
    SMB_PROCESSOR_PARAMETERS
    )

/*++

Routine Description:

    This routine processes the Query Information Disk SMB.

Arguments:

    SMB_PROCESSOR_PARAMETERS - See smbtypes.h for a description
        of the parameters to SMB processor routines.

Return Value:

    SMB_PROCESSOR_RETURN_TYPE - See smbtypes.h

--*/

{
    PREQ_QUERY_INFORMATION_DISK request;
    PRESP_QUERY_INFORMATION_DISK response;

    NTSTATUS status;
    IO_STATUS_BLOCK ioStatusBlock;
    FILE_FS_SIZE_INFORMATION fsSizeInfo;

    PSESSION session;
    PTREE_CONNECT treeConnect;

    USHORT totalUnits, freeUnits;
    ULONG sectorsPerUnit, bytesPerSector;
    LARGE_INTEGER result;
    BOOLEAN highpart;
    ULONG searchword;
    CCHAR highbit, extrabits;

    BOOLEAN isDos;

    PAGED_CODE( );

    IF_SMB_DEBUG(MISC1) {
        SrvPrint2( "Query Information Disk request header at 0x%lx, "
                    "response header at 0x%lx\n",
                    WorkContext->RequestHeader,
                    WorkContext->ResponseHeader );
        SrvPrint2( "Query Information Disk request params at 0x%lx, "
                    "response params%lx\n",
                    WorkContext->RequestParameters,
                    WorkContext->ResponseParameters );
    }

    request = (PREQ_QUERY_INFORMATION_DISK)WorkContext->RequestParameters;
    response = (PRESP_QUERY_INFORMATION_DISK)WorkContext->ResponseParameters;

    //
    // If a session block has not already been assigned to the current
    // work context , verify the UID.  If verified, the address of the
    // session block corresponding to this user is stored in the WorkContext
    // block and the session block is referenced.
    //
    // Find tree connect corresponding to given TID if a tree connect
    // pointer has not already been put in the WorkContext block by an
    // AndX command.
    //

    status = SrvVerifyUidAndTid(
                WorkContext,
                &session,
                &treeConnect,
                ShareTypeDisk
                );

    if ( !NT_SUCCESS(status) ) {
        IF_DEBUG(SMB_ERRORS) {
            SrvPrint0( "SrvSmbQueryInformationDisk: Invalid UID or TID\n" );
        }
        SrvSetSmbError( WorkContext, status );
        return SmbStatusSendResponse;
    }

    //
    // Make sure the client is allowed to do this, if we have an Admin share
    //
    status = SrvIsAllowedOnAdminShare( WorkContext, treeConnect->Share );
    if( !NT_SUCCESS( status ) ) {
        SrvSetSmbError( WorkContext, status );
        return SmbStatusSendResponse;
    }
    //
    // Get the Share root handle.
    //

    status = SrvGetShareRootHandle( treeConnect->Share );

    if ( !NT_SUCCESS(status) ) {

        IF_DEBUG(ERRORS) {
            SrvPrint1( "SrvSmbQueryInformationDisk: SrvGetShareRootHandle failed %x.\n",
                        status );
        }

        SrvSetSmbError( WorkContext, status );
        return SmbStatusSendResponse;
    }

    //
    // *** The share handle is used to get the allocation information.
    //     This is a "storage channel," and as a result could allow
    //     people to get information to which they are not entitled.
    //     For a B2 security rating this may need to be changed.
    //

    status = NtQueryVolumeInformationFile(
                 treeConnect->Share->RootDirectoryHandle,
                 &ioStatusBlock,
                 &fsSizeInfo,
                 sizeof(FILE_FS_SIZE_INFORMATION),
                 FileFsSizeInformation
                 );

    //
    // Release the share root handle if device is removable
    //

    SrvReleaseShareRootHandle( treeConnect->Share );

    if ( !NT_SUCCESS(status) ) {
        INTERNAL_ERROR(
            ERROR_LEVEL_UNEXPECTED,
            "SrvSmbQueryInformationDisk: NtQueryVolumeInformationFile"
                "returned %X",
            status,
            NULL
            );

        SrvLogServiceFailure( SRV_SVC_NT_SET_VOL_INFO_FILE, status );

        SrvSetSmbError( WorkContext, status );
        return SmbStatusSendResponse;
    }

    //
    // *** Problem.
    //
    // This SMB only return 16 bits of information for each field, but we
    // may need to return large numbers.  In particular TotalAllocationUnits
    // is commonly > 64K.
    //
    // Fortunately, it turns out the all the client cares about is the total
    // disk size, in bytes, and the free space, in bytes.  So - if one number
    // is too big adjust it and adjust the other numbers so that the totals
    // come out the same.
    //
    // If after all adjustment, the number are still too high, return the
    // largest possible value for TotalUnit or FreeUnits (i.e. 0xFFFF).
    //
    // A caveat here is that some DOS apps (like the command interpreter!)
    // assume that the cluster size (bytes per sector times sectors per
    // cluster) will fit in 16 bits, and will calculate bogus geometry if
    // it doesn't.  So the first thing we do is ensure that the real
    // cluster size is less than 0x10000, if the client is a DOS client.
    // This may make the TotalUnits or FreeUnits counts too big, so we'll
    // have to round them down, but that's life.
    //
    // Since we use shifts to adjust the numbers it is possible to lose
    // 1 bits when we shift a number to the right.  We don't care, we're
    // doing our best to fix a broken protocol.  NT clients will use
    // QueryFSAttribute and will get the correct answer.
    //

    //
    // If this is a DOS client, make the cluster size < 0x10000.
    //

    isDos = IS_DOS_DIALECT( WorkContext->Connection->SmbDialect );

    sectorsPerUnit = fsSizeInfo.SectorsPerAllocationUnit;
    bytesPerSector = fsSizeInfo.BytesPerSector;

    if ( isDos ) {
        while ( (sectorsPerUnit * bytesPerSector) > 0xFFFF ) {
            if ( sectorsPerUnit >= 2 ) {
                sectorsPerUnit /= 2;
            } else {
                bytesPerSector /= 2;
            }
            fsSizeInfo.TotalAllocationUnits.QuadPart *= 2;
            fsSizeInfo.AvailableAllocationUnits.QuadPart *= 2;
        }
    }

    //
    // Calculate how much the total cluster count needs to be shifted in
    // order to fit in a word.
    //

    if ( fsSizeInfo.TotalAllocationUnits.HighPart != 0 ) {
        highpart = TRUE;
        searchword = fsSizeInfo.TotalAllocationUnits.HighPart;
    } else {
        highpart = FALSE;
        searchword = fsSizeInfo.TotalAllocationUnits.LowPart;
    }

    highbit = 0;
    while ( searchword != 0 ) {
        highbit++;
        searchword /= 2;
    }

    if ( highpart ) {
        highbit += 32;
    } else {
        if ( highbit < 16) {
            highbit = 0;
        } else {
            highbit -= 16;
        }
    }

    if ( highbit > 0 ) {

        //
        // Attempt to adjust the other values to absorb the excess bits.
        // If this is a DOS client, don't let the cluster size get
        // bigger than 0xFFFF.
        //

        extrabits = highbit;

        if ( isDos ) {

            while ( (highbit > 0) &&
                    ((sectorsPerUnit*bytesPerSector) < 0x8000) ) {
                sectorsPerUnit *= 2;
                highbit--;
            }

        } else {

            while ( (highbit > 0) && (sectorsPerUnit < 0x8000) ) {
                sectorsPerUnit *= 2;
                highbit--;
            }

            while ( (highbit > 0) && (bytesPerSector < 0x8000) ) {
                bytesPerSector *= 2;
                highbit--;
            }

        }

        //
        // Adjust the total and free unit counts.
        //

        if ( highbit > 0 ) {

            //
            // There is no way to get the information to fit.  Use the
            // maximum possible value.
            //


            totalUnits = 0xFFFF;

        } else {

            result.QuadPart = fsSizeInfo.TotalAllocationUnits.QuadPart >> extrabits;

            ASSERT( result.HighPart == 0 );
            ASSERT( result.LowPart < 0x10000 );

            totalUnits = (USHORT)result.LowPart;

        }

        result.QuadPart =  fsSizeInfo.AvailableAllocationUnits.QuadPart >>
                                            (CCHAR)(extrabits - highbit);

        if ( result.HighPart != 0 || result.LowPart > 0xFFFF ) {
            freeUnits = 0xFFFF;
        } else {
            freeUnits = (USHORT)result.LowPart;
        }

    } else {

        totalUnits = (USHORT)fsSizeInfo.TotalAllocationUnits.LowPart;
        freeUnits = (USHORT)fsSizeInfo.AvailableAllocationUnits.LowPart;

    }

    //
    // Build the response SMB.
    //

    response->WordCount = 5;

    SmbPutUshort( &response->TotalUnits, totalUnits );
    SmbPutUshort( &response->BlocksPerUnit, (USHORT)sectorsPerUnit );
    SmbPutUshort( &response->BlockSize, (USHORT)bytesPerSector );
    SmbPutUshort( &response->FreeUnits, freeUnits );

    SmbPutUshort( &response->Reserved, 0 );
    SmbPutUshort( &response->ByteCount, 0 );

    WorkContext->ResponseParameters = NEXT_LOCATION(
                                        response,
                                        RESP_QUERY_INFORMATION_DISK,
                                        0
                                        );

    IF_DEBUG(TRACE2) SrvPrint0( "SrvSmbQueryInformationDisk complete.\n" );

    return SmbStatusSendResponse;

} // SrvSmbQueryInformationDisk


SMB_PROCESSOR_RETURN_TYPE
SrvSmbNtCancel (
    SMB_PROCESSOR_PARAMETERS
    )

/*++

Routine Description:

    Processes an Nt Cancel SMB.

Arguments:

    SMB_PROCESSOR_PARAMETERS - See smbprocs.h for a description
        of the parameters to SMB processor routines.

Return Value:

    SMB_PROCESSOR_RETURN_TYPE - See smbprocs.h

--*/

{
    NTSTATUS status;
    PSESSION session;
    PTREE_CONNECT treeConnect;
    PCONNECTION connection;
    USHORT targetUid, targetPid, targetTid, targetMid;
    PLIST_ENTRY listHead;
    PLIST_ENTRY listEntry;
    PWORK_CONTEXT workContext;
    PSMB_HEADER header;
    BOOLEAN match;
    KIRQL oldIrql;

    PREQ_NT_CANCEL request;
    PRESP_NT_CANCEL response;

    request = (PREQ_NT_CANCEL)WorkContext->RequestParameters;
    response = (PRESP_NT_CANCEL)WorkContext->ResponseParameters;

    //
    // The word count has already been checked.  Now make sure that
    // the byte count is zero.
    //

    if ( SmbGetUshort( &request->ByteCount) != 0 ) {
        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbStatusSendResponse;
    }

    //
    // If a session block has not already been assigned to the current
    // work context , verify the UID.  If verified, the address of the
    // session block corresponding to this user is stored in the WorkContext
    // block and the session block is referenced.
    //
    // Find tree connect corresponding to given TID if a tree connect
    // pointer has not already been put in the WorkContext block by an
    // AndX command.
    //

    status = SrvVerifyUidAndTid(
                WorkContext,
                &session,
                &treeConnect,
                ShareTypeWild
                );

    if ( !NT_SUCCESS(status) ) {
        IF_DEBUG(SMB_ERRORS) {
            SrvPrint0( "SrvSmbNtCancel: Invalid UID or TID\n" );
        }
        SrvSetSmbError( WorkContext, status );
        return SmbStatusSendResponse;
    }

    //
    // Check the work in-progress list to see if this work item is
    // cancellable.
    //

    targetUid = SmbGetAlignedUshort( &WorkContext->RequestHeader->Uid );
    targetPid = SmbGetAlignedUshort( &WorkContext->RequestHeader->Pid );
    targetTid = SmbGetAlignedUshort( &WorkContext->RequestHeader->Tid );
    targetMid = SmbGetAlignedUshort( &WorkContext->RequestHeader->Mid );

    match = FALSE;

    connection = WorkContext->Connection;

    ACQUIRE_SPIN_LOCK( connection->EndpointSpinLock, &oldIrql );

    listHead = &connection->InProgressWorkItemList;
    listEntry = listHead;
    while ( listEntry->Flink != listHead ) {

        listEntry = listEntry->Flink;

        workContext = CONTAINING_RECORD(
                                     listEntry,
                                     WORK_CONTEXT,
                                     InProgressListEntry
                                     );

        header = workContext->RequestHeader;

        //
        // Some workitems in the inprogressworkitemlist are added
        // during a receive indication and the requestheader field
        // has not been set yet.  We can probably set it at that time
        // but this seems to be the safest fix.
        //
        // We have to check whether the workitem ref count is zero or
        // not since we dereference it before removing it from the
        // InProgressWorkItemList queue.  This prevents the workitem
        // from being cleaned up twice.
        //
        // We also need to check the processing count of the workitem.
        // Work items being used for actual smb requests will have
        // a processing count of at least 1.  This will prevent us
        // from touching oplock breaks and pending tdi receives.
        //

        ACQUIRE_DPC_SPIN_LOCK( &workContext->SpinLock );
        if ( (workContext->BlockHeader.ReferenceCount != 0) &&
             (workContext->ProcessingCount != 0) &&
             header != NULL &&
             header->Command != SMB_COM_NT_CANCEL &&
             SmbGetAlignedUshort( &header->Mid ) == targetMid &&
             SmbGetAlignedUshort( &header->Pid ) == targetPid &&
             SmbGetAlignedUshort( &header->Tid ) == targetTid &&
             SmbGetAlignedUshort( &header->Uid ) == targetUid ) {

            match = TRUE;
            break;
        }
        RELEASE_DPC_SPIN_LOCK( &workContext->SpinLock );

    }

    if ( match ) {

        //
        // Reference the work item, so that it cannot get used to process
        // a new SMB while we are trying to cancel the old one.
        //

        SrvReferenceWorkItem( workContext );
        RELEASE_DPC_SPIN_LOCK( &workContext->SpinLock );
        RELEASE_SPIN_LOCK( connection->EndpointSpinLock, oldIrql );

        (VOID)IoCancelIrp( workContext->Irp );
        SrvDereferenceWorkItem( workContext );

    } else {

        RELEASE_SPIN_LOCK( connection->EndpointSpinLock, oldIrql );

    }

    //
    // Done.  Do not send a response
    //

    return SmbStatusNoResponse;

} // SrvSmbNtCancel


SMB_TRANS_STATUS
SrvSmbSetSecurityDescriptor (
    IN OUT PWORK_CONTEXT WorkContext
    )

/*++

Routine Description:

    Processes the Set Security Descriptor request.  This request arrives
    in a Transaction2 SMB.

Arguments:

    WorkContext - Supplies the address of a Work Context Block
        describing the current request.  See smbtypes.h for a more
        complete description of the valid fields.

Return Value:

    SMB_TRANS_STATUS - Indicates whether an error occurred, and, if so,
        whether data should be returned to the client.  See smbtypes.h
        for a more complete description.

--*/

{
    PREQ_SET_SECURITY_DESCRIPTOR request;

    NTSTATUS status;
    PTRANSACTION transaction;
    PRFCB rfcb;

    PAGED_CODE( );

    transaction = WorkContext->Parameters.Transaction;
    IF_SMB_DEBUG(QUERY_SET1) {
        SrvPrint1( "Set Security Descriptor entered; transaction 0x%lx\n",
                    transaction );
    }

    request = (PREQ_SET_SECURITY_DESCRIPTOR)transaction->InParameters;

    //
    // Verify that enough setup bytes were sent.
    //

    if ( transaction->ParameterCount < sizeof(REQ_SET_SECURITY_DESCRIPTOR ) ) {

        //
        // Not enough parameter bytes were sent.
        //

        IF_DEBUG(SMB_ERRORS) {
            SrvPrint1( "SrvSmbSetSecurityInformation: bad setup byte count: "
                        "%ld\n",
                        transaction->ParameterCount );
        }

        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Verify the FID.  If verified, the RFCB block is referenced
    // and its addresses is stored in the WorkContext block, and the
    // RFCB address is returned.
    //

    rfcb = SrvVerifyFid(
                WorkContext,
                SmbGetUshort( &request->Fid ),
                TRUE,
                NULL,   // don't serialize with raw write
                &status
                );

    if ( rfcb == SRV_INVALID_RFCB_POINTER ) {

        //
        // Invalid file ID or write behind error.  Reject the request.
        //

        IF_DEBUG(ERRORS) {
            SrvPrint2(
                "SrvSmbSetFileInformation: Status %X on FID: 0x%lx\n",
                status,
                SmbGetUshort( &request->Fid )
                );
        }

        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;

    }

    //
    //  Attempt to set the security descriptor.  We need to be in the
    //  the user context to do this, in case the security information
    //  specifies change ownership.
    //

    IMPERSONATE( WorkContext );

    status = NtSetSecurityObject(
                 rfcb->Lfcb->FileHandle,
                 SmbGetUlong( &request->SecurityInformation ),
                 transaction->InData
                 );

    REVERT();

    //
    // If an error occurred, return an appropriate response.
    //

    if ( !NT_SUCCESS(status) ) {

        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;
    }

    transaction->ParameterCount = 0;
    transaction->DataCount = 0;

    return SmbTransStatusSuccess;

} // SrvSmbSetSecurityDescriptor


SMB_TRANS_STATUS
SrvSmbQuerySecurityDescriptor (
    IN OUT PWORK_CONTEXT WorkContext
    )

/*++

Routine Description:

    Processes the Query Security Descriptor request.  This request arrives
    in a Transaction2 SMB.

Arguments:

    WorkContext - Supplies the address of a Work Context Block
        describing the current request.  See smbtypes.h for a more
        complete description of the valid fields.

Return Value:

    SMB_TRANS_STATUS - Indicates whether an error occurred, and, if so,
        whether data should be returned to the client.  See smbtypes.h
        for a more complete description.

--*/

{
    PREQ_QUERY_SECURITY_DESCRIPTOR request;
    PRESP_QUERY_SECURITY_DESCRIPTOR response;

    NTSTATUS status;
    PTRANSACTION transaction;
    PRFCB rfcb;
    ULONG lengthNeeded;

    PAGED_CODE( );

    transaction = WorkContext->Parameters.Transaction;
    IF_SMB_DEBUG(QUERY_SET1) {
        SrvPrint1( "Set Security Descriptor entered; transaction 0x%lx\n",
                    transaction );
    }

    request = (PREQ_QUERY_SECURITY_DESCRIPTOR)transaction->InParameters;
    response = (PRESP_QUERY_SECURITY_DESCRIPTOR)transaction->OutParameters;

    //
    // Verify that enough setup bytes were sent.
    //

    if ( transaction->ParameterCount < sizeof(REQ_QUERY_SECURITY_DESCRIPTOR ) ||
         transaction->MaxParameterCount <
             sizeof( RESP_QUERY_SECURITY_DESCRIPTOR ) ) {

        //
        // Not enough parameter bytes were sent.
        //

        IF_DEBUG(SMB_ERRORS) {
            SrvPrint2( "SrvSmbQuerySecurityInformation: bad parameter byte or "
                        "return parameter count: %ld %ld\n",
                        transaction->ParameterCount,
                        transaction->MaxParameterCount );
        }

        SrvSetSmbError( WorkContext, STATUS_INVALID_SMB );
        return SmbTransStatusErrorWithoutData;
    }

    //
    // Verify the FID.  If verified, the RFCB block is referenced
    // and its addresses is stored in the WorkContext block, and the
    // RFCB address is returned.
    //

    rfcb = SrvVerifyFid(
                WorkContext,
                SmbGetUshort( &request->Fid ),
                TRUE,
                NULL,   // don't serialize with raw write
                &status
                );

    if ( rfcb == SRV_INVALID_RFCB_POINTER ) {

        //
        // Invalid file ID or write behind error.  Reject the request.
        //

        IF_DEBUG(ERRORS) {
            SrvPrint2(
                "SrvSmbSetFileInformation: Status %X on FID: 0x%lx\n",
                status,
                SmbGetUshort( &request->Fid )
                );
        }

        SrvSetSmbError( WorkContext, status );
        return SmbTransStatusErrorWithoutData;

    }

    //
    //  Attempt to query the security descriptor
    //

    status = NtQuerySecurityObject(
                 rfcb->Lfcb->FileHandle,
                 SmbGetUlong( &request->SecurityInformation ),
                 transaction->OutData,
                 transaction->MaxDataCount,
                 &lengthNeeded
                 );

    SmbPutUlong( &response->LengthNeeded, lengthNeeded );
    transaction->ParameterCount = sizeof( RESP_QUERY_SECURITY_DESCRIPTOR );

    //
    // If an error occurred, return an appropriate response.
    //

    if ( !NT_SUCCESS(status) ) {

        transaction->DataCount = 0;
        SrvSetSmbError2( WorkContext, status, TRUE );
        return SmbTransStatusErrorWithData;
    } else {
        transaction->DataCount =
                RtlLengthSecurityDescriptor( transaction->OutData );
    }

    return SmbTransStatusSuccess;

} // SrvSmbQuerySecurityDescriptor