dosdev.c File Reference

#include "basesrv.h"
#include <debug.h>

Include dependency graph for dosdev.c:

Go to the source code of this file.

Classes
struct	_BSM_REQUEST

Macros
#define	NDEBUG

Typedefs
typedef struct _BSM_REQUEST	BSM_REQUEST
typedef struct _BSM_REQUEST *	PBSM_REQUEST

Functions
	LONG (WINAPI *PBROADCASTSYSTEMMESSAGEEXW)(DWORD
VOID	BaseInitDefineDosDevice (VOID)
VOID	BaseCleanupDefineDosDevice (VOID)
NTSTATUS	GetCallerLuid (PLUID CallerLuid)
NTSTATUS	IsGlobalSymbolicLink (HANDLE LinkHandle, PBOOLEAN IsGlobal)
BOOLEAN	CheckForGlobalDriveLetter (SHORT DriveLetter)
NTSTATUS	SendWinStationBSM (DWORD Flags, LPDWORD Recipients, UINT Message, WPARAM wParam, LPARAM lParam)
NTSTATUS	BroadcastDriveLetterChange (LONG DriveLetter, BOOLEAN RemoveDefinition, PLUID BroadcastLuid)
ULONG NTAPI	BaseSrvBSMThread (PVOID StartupContext)
NTSTATUS	CreateBSMThread (VOID)
NTSTATUS	AddBSMRequest (LONG DriveLetter, BOOLEAN RemoveDefinition, PLUID BroadcastLuid)
	CSR_API (BaseSrvDefineDosDevice)

Variables
static RTL_CRITICAL_SECTION	BaseDefineDosDeviceCritSec
RTL_CRITICAL_SECTION	BaseSrvDDDBSMCritSec
PBSM_REQUEST	BSM_Request_Queue = NULL
PBSM_REQUEST	BSM_Request_Queue_End = NULL
ULONG	BaseSrvpBSMThreadCount = 0
	LPDWORD
	UINT
	WPARAM
	LPARAM
	PBSMINFO = NULL

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file dosdev.c.

Typedef Documentation

BSM_REQUEST

typedef struct _BSM_REQUEST BSM_REQUEST

PBSM_REQUEST

typedef struct _BSM_REQUEST * PBSM_REQUEST

Function Documentation

AddBSMRequest()

NTSTATUS AddBSMRequest	(	LONG	DriveLetter,
		BOOLEAN	RemoveDefinition,
		PLUID	BroadcastLuid
	)

Definition at line 391 of file dosdev.c.

{
    LUID CallerLuid;
    NTSTATUS Status;
    LUID SystemLuid = SYSTEM_LUID;
    PBSM_REQUEST Request;
 
    /* We need a broadcast LUID */
    if (BroadcastLuid == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /*
     * If LUID mappings are not enabled, this call makes no sense
     * It should not happen though
     */
    if (BaseStaticServerData->LUIDDeviceMapsEnabled == 0)
    {
        return STATUS_ACCESS_DENIED;
    }
 
    /* Get our caller LUID (not the broadcaster!) */
    Status = GetCallerLuid(&CallerLuid);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }
 
    /* System cannot create LUID mapped drives - thus broadcast makes no sense */
    if (!RtlEqualLuid(&CallerLuid, &SystemLuid))
    {
        return STATUS_ACCESS_DENIED;
    }
 
    /* Allocate our request */
    Request = RtlAllocateHeap(BaseSrvHeap, 0, sizeof(BSM_REQUEST));
    if (Request == NULL)
    {
        return STATUS_NO_MEMORY;
    }
 
    /* Initialize it */
    Request->DriveLetter = DriveLetter;
    Request->RemoveDefinition = RemoveDefinition;
    RtlCopyLuid(&Request->BroadcastLuid, BroadcastLuid);
    Request->Next = NULL;
 
    /* And queue it */
    RtlEnterCriticalSection(&BaseSrvDDDBSMCritSec);
 
    /* At the end of the queue if not empty */
    if (BSM_Request_Queue_End != NULL)
    {
        BSM_Request_Queue_End->Next = Request;
    }
    /* Otherwise, initialize the queue */
    else
    {
        BSM_Request_Queue = Request;
    }
 
    /* We're in FIFO mode */
    BSM_Request_Queue_End = Request;
 
    /* If we don't have a messaging thread running, then start one */
    if (BaseSrvpBSMThreadCount >= 1)
    {
        RtlLeaveCriticalSection(&BaseSrvDDDBSMCritSec);
    }
    else
    {
        RtlLeaveCriticalSection(&BaseSrvDDDBSMCritSec);
        Status = CreateBSMThread();
    }
 
    return Status;
}

Referenced by CSR_API().

BaseCleanupDefineDosDevice()

VOID BaseCleanupDefineDosDevice

(

VOID

)

Definition at line 39 of file dosdev.c.

{
    RtlDeleteCriticalSection(&BaseDefineDosDeviceCritSec);
}

Referenced by DllMain().

BaseInitDefineDosDevice()

VOID BaseInitDefineDosDevice

(

VOID

)

Definition at line 34 of file dosdev.c.

{
    RtlInitializeCriticalSection(&BaseDefineDosDeviceCritSec);
}

Referenced by CSR_SERVER_DLL_INIT().

BaseSrvBSMThread()

ULONG NTAPI BaseSrvBSMThread

(

PVOID

StartupContext

)

Definition at line 314 of file dosdev.c.

{
    ULONG ExitStatus;
    NTSTATUS Status;
    PBSM_REQUEST CurrentRequest;
 
    /* We have a thread */
    ExitStatus = 0;
    RtlEnterCriticalSection(&BaseSrvDDDBSMCritSec);
    ++BaseSrvpBSMThreadCount;
 
    while (TRUE)
    {
        /* If we flushed the queue, job done */
        if (BSM_Request_Queue == NULL)
        {
            break;
        }
 
        /* Queue current request, and remove it from the queue */
        CurrentRequest = BSM_Request_Queue;
        BSM_Request_Queue = BSM_Request_Queue->Next;
 
        /* If that was the last request, NULLify queue end */
        if (BSM_Request_Queue == NULL)
        {
            BSM_Request_Queue_End = NULL;
        }
 
        RtlLeaveCriticalSection(&BaseSrvDDDBSMCritSec);
 
        /* Broadcast the message */
        Status = BroadcastDriveLetterChange(CurrentRequest->DriveLetter,
                                            CurrentRequest->RemoveDefinition,
                                            &CurrentRequest->BroadcastLuid);
 
        /* Reflect the last entry status on stop */
        CurrentRequest->Next = NULL;
        ExitStatus = Status;
 
        RtlFreeHeap(BaseSrvHeap, 0, CurrentRequest);
        RtlEnterCriticalSection(&BaseSrvDDDBSMCritSec);
    }
 
    /* Here, we've flushed the queue, quit the user thread */
    --BaseSrvpBSMThreadCount;
    RtlLeaveCriticalSection(&BaseSrvDDDBSMCritSec);
 
    NtCurrentTeb()->FreeStackOnTermination = TRUE;
    NtTerminateThread(NtCurrentThread(), ExitStatus);
 
    return ExitStatus;
}

Referenced by CreateBSMThread().

BroadcastDriveLetterChange()

NTSTATUS BroadcastDriveLetterChange	(	LONG	DriveLetter,
		BOOLEAN	RemoveDefinition,
		PLUID	BroadcastLuid
	)

Definition at line 226 of file dosdev.c.

{
    HANDLE hUser32;
    NTSTATUS Status;
    UNICODE_STRING User32U;
    ANSI_STRING ProcedureName;
    DWORD Recipients, Flags, wParam;
    LUID SystemLuid = SYSTEM_LUID;
    BSMINFO Info;
    DEV_BROADCAST_VOLUME Volume;
 
    /* We need a broadcast LUID */
    if (BroadcastLuid == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Get the Csr procedure, and keep it forever */
    if (PBROADCASTSYSTEMMESSAGEEXW == NULL)
    {
        hUser32 = NULL;
        RtlInitUnicodeString(&User32U, L"user32");
        Status = LdrGetDllHandle(NULL, NULL, &User32U, &hUser32);
        if (hUser32 != NULL && NT_SUCCESS(Status))
        {
            RtlInitString(&ProcedureName, "CsrBroadcastSystemMessageExW");
            Status = LdrGetProcedureAddress(hUser32,
                                            &ProcedureName,
                                            0,
                                            (PVOID *)&PBROADCASTSYSTEMMESSAGEEXW);
            if (!NT_SUCCESS(Status))
            {
                PBROADCASTSYSTEMMESSAGEEXW = NULL;
            }
        }
 
        /* If we failed to get broadcast procedure, no more actions left */
        if (PBROADCASTSYSTEMMESSAGEEXW == NULL)
        {
            return Status;
        }
    }
 
    /* Initialize broadcast info */
    Info.cbSize = sizeof(BSMINFO);
    Info.hdesk = 0;
    Info.hwnd = 0;
    RtlCopyLuid(&Info.luid, BroadcastLuid);
 
    /* Initialize volume information */
    Volume.dbcv_size = sizeof(DEV_BROADCAST_VOLUME);
    Volume.dbcv_devicetype = DBT_DEVTYP_VOLUME;
    Volume.dbcv_reserved = 0;
    Volume.dbcv_unitmask = 1 << DriveLetter;
    Volume.dbcv_flags = DBTF_NET;
 
    /* Wide broadcast */
    Recipients = BSM_APPLICATIONS | BSM_ALLDESKTOPS;
    Flags = BSF_NOHANG | BSF_NOTIMEOUTIFNOTHUNG | BSF_FORCEIFHUNG;
 
    /*
     * If we don't broadcast as system, it's not a global drive
     * notification, then mark it as LUID mapped drive
     */
    if (!RtlEqualLuid(&Info.luid, &SystemLuid))
    {
        Flags |= BSF_LUID;
    }
 
    /* Set event type */
    wParam = RemoveDefinition ? DBT_DEVICEREMOVECOMPLETE : DBT_DEVICEARRIVAL;
 
    /* And broadcast! */
    Status = PBROADCASTSYSTEMMESSAGEEXW(Flags, &Recipients, WM_DEVICECHANGE, wParam, (LPARAM)&Volume, &Info);
 
    /* If the drive is global, notify Winsta */
    if (!(Flags & BSF_LUID))
    {
        Status = SendWinStationBSM(Flags, &Recipients, WM_DEVICECHANGE, wParam, (LPARAM)&Volume);
    }
 
    return Status;
}

Referenced by BaseSrvBSMThread().

CheckForGlobalDriveLetter()

BOOLEAN CheckForGlobalDriveLetter

(

SHORT

DriveLetter

)

Definition at line 162 of file dosdev.c.

{
    WCHAR Path[8];
    NTSTATUS Status;
    BOOLEAN IsGlobal;
    UNICODE_STRING PathU;
    HANDLE SymbolicLinkHandle;
    OBJECT_ATTRIBUTES ObjectAttributes;
 
    /* Setup our drive path */
    wcsncpy(Path, L"\\??\\X:", (sizeof(L"\\??\\X:") / sizeof(WCHAR)));
    Path[4] = DriveLetter + L'A';
    Path[6] = UNICODE_NULL;
 
    /* Prepare everything to open the link */
    RtlInitUnicodeString(&PathU, Path);
    InitializeObjectAttributes(&ObjectAttributes,
                               &PathU,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    /* Impersonate the caller */
    if (!CsrImpersonateClient(NULL))
    {
        return FALSE;
    }
 
    /* Open our drive letter */
    Status = NtOpenSymbolicLinkObject(&SymbolicLinkHandle,
                                      SYMBOLIC_LINK_QUERY,
                                      &ObjectAttributes);
 
    CsrRevertToSelf();
 
    if (!NT_SUCCESS(Status))
    {
        return FALSE;
    }
 
    /* Check whether it's global */
    Status = IsGlobalSymbolicLink(SymbolicLinkHandle, &IsGlobal);
    NtClose(SymbolicLinkHandle);
 
    if (!NT_SUCCESS(Status))
    {
        return FALSE;
    }
 
    return IsGlobal;
}

Referenced by CSR_API().

CreateBSMThread()

NTSTATUS CreateBSMThread

(

VOID

)

Definition at line 369 of file dosdev.c.

{
    /* This can only be true for LUID mappings */
    if (BaseStaticServerData->LUIDDeviceMapsEnabled == 0)
    {
        return STATUS_ACCESS_DENIED;
    }
 
    /* Create our user thread */
    return RtlCreateUserThread(NtCurrentProcess(),
                               NULL,
                               FALSE,
                               0,
                               0,
                               0,
                               BaseSrvBSMThread,
                               NULL,
                               NULL,
                               NULL);
}

Referenced by AddBSMRequest().

CSR_API()

CSR_API

(

BaseSrvDefineDosDevice

)

Definition at line 474 of file dosdev.c.

{
    NTSTATUS Status;
    PBASE_DEFINE_DOS_DEVICE DefineDosDeviceRequest = &((PBASE_API_MESSAGE)ApiMessage)->Data.DefineDosDeviceRequest;
    OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE LinkHandle;
    UNICODE_STRING DeviceName = {0};
    UNICODE_STRING LinkTarget = {0};
    ULONG Length;
    SID_IDENTIFIER_AUTHORITY WorldAuthority = {SECURITY_WORLD_SID_AUTHORITY};
    SID_IDENTIFIER_AUTHORITY SystemAuthority = {SECURITY_NT_AUTHORITY};
    PSID SystemSid;
    PSID WorldSid;
    PWSTR lpBuffer;
    WCHAR Letter;
    SHORT AbsLetter;
    BOOLEAN DriveLetter = FALSE;
    BOOLEAN RemoveDefinition;
    BOOLEAN HandleTarget;
    BOOLEAN Broadcast = FALSE;
    BOOLEAN IsGlobal = FALSE;
    ULONG CchLengthLeft;
    ULONG CchLength;
    ULONG TargetLength;
    PWSTR TargetBuffer;
    PWSTR CurrentBuffer;
    /* We store them on the stack, they are known in advance */
    union {
        SECURITY_DESCRIPTOR SecurityDescriptor;
        UCHAR Buffer[20];
    } SecurityDescriptor;
    union {
        ACL Dacl;
        UCHAR Buffer[256];
    } Dacl;
    ACCESS_MASK AccessMask;
    LUID CallerLuid;
    WCHAR * CurrentPtr;
    WCHAR CurrentChar;
    PWSTR OrigPtr;
    PWSTR InterPtr;
    BOOLEAN RemoveFound;
 
    if (!CsrValidateMessageBuffer(ApiMessage,
                                  (PVOID*)&DefineDosDeviceRequest->DeviceName.Buffer,
                                  DefineDosDeviceRequest->DeviceName.Length,
                                  sizeof(BYTE)) ||
        (DefineDosDeviceRequest->DeviceName.Length & 1) != 0 ||
        !CsrValidateMessageBuffer(ApiMessage,
                                  (PVOID*)&DefineDosDeviceRequest->TargetPath.Buffer,
                                  DefineDosDeviceRequest->TargetPath.Length +
                                    (DefineDosDeviceRequest->TargetPath.Length != 0
                                        ? sizeof(UNICODE_NULL) : 0),
                                  sizeof(BYTE)) ||
        (DefineDosDeviceRequest->TargetPath.Length & 1) != 0)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    DPRINT("BaseSrvDefineDosDevice entered, Flags:%d, DeviceName:%wZ (%d), TargetPath:%wZ (%d)\n",
           DefineDosDeviceRequest->Flags,
           &DefineDosDeviceRequest->DeviceName,
           DefineDosDeviceRequest->DeviceName.Length,
           &DefineDosDeviceRequest->TargetPath,
           DefineDosDeviceRequest->TargetPath.Length);
 
    /*
     * Allocate a buffer big enough to contain:
     * - device name
     * - targets
     */
    lpBuffer = RtlAllocateHeap(BaseSrvHeap, 0, 0x2000);
    if (lpBuffer == NULL)
    {
        return STATUS_NO_MEMORY;
    }
 
    /* Enter our critical section */
    Status = RtlEnterCriticalSection(&BaseDefineDosDeviceCritSec);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("RtlEnterCriticalSection() failed (Status %lx)\n",
                Status);
        RtlFreeHeap(BaseSrvHeap, 0, lpBuffer);
        return Status;
    }
 
    LinkHandle = 0;
    /* Does the caller wants to remove definition? */
    RemoveDefinition = !!(DefineDosDeviceRequest->Flags & DDD_REMOVE_DEFINITION);
    _SEH2_TRY
    {
        /* First of all, check if that's a drive letter device amongst LUID mappings */
        if (BaseStaticServerData->LUIDDeviceMapsEnabled && !(DefineDosDeviceRequest->Flags & DDD_NO_BROADCAST_SYSTEM))
        {
            if (DefineDosDeviceRequest->DeviceName.Buffer != NULL &&
                DefineDosDeviceRequest->DeviceName.Length == 2 * sizeof(WCHAR) &&
                DefineDosDeviceRequest->DeviceName.Buffer[1] == L':')
            {
                Letter = DefineDosDeviceRequest->DeviceName.Buffer[0];
 
                /* Handle both lower cases and upper cases */
                AbsLetter = Letter - L'a';
                if (AbsLetter < 26 && AbsLetter >= 0)
                {
                    Letter = RtlUpcaseUnicodeChar(Letter);
                }
 
                AbsLetter = Letter - L'A';
                if (AbsLetter < 26)
                {
                    /* That's a letter! */
                    DriveLetter = TRUE;
                }
            }
        }
 
        /* We can only broadcast drive letters in case of LUID mappings */
        if (DefineDosDeviceRequest->Flags & DDD_LUID_BROADCAST_DRIVE &&
            !DriveLetter)
        {
            Status = STATUS_INVALID_PARAMETER;
            _SEH2_LEAVE;
        }
 
        /* First usage of our buffer: create device name */
        CchLength = _snwprintf(lpBuffer, 0x1000, L"\\??\\%wZ", &DefineDosDeviceRequest->DeviceName);
        CchLengthLeft = 0x1000 - 1 - CchLength; /* UNICODE_NULL */
        CurrentBuffer = lpBuffer + CchLength + 1; /* UNICODE_NULL */
        RtlInitUnicodeString(&DeviceName, lpBuffer);
 
        /* And prepare to open it */
        InitializeObjectAttributes(&ObjectAttributes,
                                   &DeviceName,
                                   OBJ_CASE_INSENSITIVE,
                                   NULL,
                                   NULL);
 
        /* Assume it's OK and has a target to deal with */
        HandleTarget = TRUE;
 
        /* Move to the client context if the mapping was local */
        if (!CsrImpersonateClient(NULL))
        {
            Status = STATUS_BAD_IMPERSONATION_LEVEL;
            _SEH2_LEAVE;
        }
 
        /*
         * While impersonating the caller, also get its LUID.
         * This is mandatory in case we have a driver letter,
         * Because we're in the case we've got LUID mapping
         * enabled and broadcasting enabled. LUID will be required
         * for the latter
         */
        if (DriveLetter)
        {
            Status = GetCallerLuid(&CallerLuid);
            if (NT_SUCCESS(Status))
            {
                Broadcast = TRUE;
            }
        }
 
        /* Now, open the device */
        Status = NtOpenSymbolicLinkObject(&LinkHandle,
                                          DELETE | SYMBOLIC_LINK_QUERY,
                                          &ObjectAttributes);
 
        /* And get back to our context */
        CsrRevertToSelf();
 
        /* In case of LUID broadcast, do nothing but return to trigger broadcast */
        if (DefineDosDeviceRequest->Flags & DDD_LUID_BROADCAST_DRIVE)
        {
            /* Zero handle in case of a failure */
            if (!NT_SUCCESS(Status))
            {
                LinkHandle = 0;
            }
 
            /* If removal was asked, and no object found: the remval was successful */
            if (RemoveDefinition && Status == STATUS_OBJECT_NAME_NOT_FOUND)
            {
                Status = STATUS_SUCCESS;
            }
 
            /* We're done here, nothing more to do */
            _SEH2_LEAVE;
        }
 
        /* If device was not found */
        if (Status == STATUS_OBJECT_NAME_NOT_FOUND)
        {
            /* No handle */
            LinkHandle = 0;
 
            /* If we were asked to remove... */
            if (RemoveDefinition)
            {
                /*
                 * If caller asked to pop first entry, nothing specific,
                 * then, we can consider this as a success
                 */
                if (DefineDosDeviceRequest->TargetPath.Length == 0)
                {
                    Status = STATUS_SUCCESS;
                }
 
                /* We're done, nothing to change */
                _SEH2_LEAVE;
            }
 
            /* There's no target to handle */
            HandleTarget = FALSE;
 
            /*
             * We'll consider, that's a success
             * Failing to open the device doesn't prevent
             * from creating it later on to create
             * the linking.
             */
            Status = STATUS_SUCCESS;
        }
        else
        {
            /* Unexpected failure, forward to caller */
            if (!NT_SUCCESS(Status))
            {
                _SEH2_LEAVE;
            }
 
            /* If LUID mapping enabled */
            if (BaseStaticServerData->LUIDDeviceMapsEnabled)
            {
                /* Check if that's global link */
                Status = IsGlobalSymbolicLink(LinkHandle, &IsGlobal);
                if (!NT_SUCCESS(Status))
                {
                    _SEH2_LEAVE;
                }
 
                /* If so, change our device name namespace to GLOBAL?? for link creation */
                if (IsGlobal)
                {
                    CchLength = _snwprintf(lpBuffer, 0x1000, L"\\GLOBAL??\\%wZ", &DefineDosDeviceRequest->DeviceName);
                    CchLengthLeft = 0x1000 - 1 - CchLength; /* UNICODE_NULL */
                    CurrentBuffer = lpBuffer + CchLength + 1; /* UNICODE_NULL */
 
                    DeviceName.Length = CchLength * sizeof(WCHAR);
                    DeviceName.MaximumLength = CchLength * sizeof(WCHAR) + sizeof(UNICODE_NULL);
                }
            }
        }
 
        /* If caller provided a target */
        if (DefineDosDeviceRequest->TargetPath.Length != 0)
        {
            /* Make sure it's null terminated */
            DefineDosDeviceRequest->TargetPath.Buffer[DefineDosDeviceRequest->TargetPath.Length / sizeof(WCHAR)] = UNICODE_NULL;
 
            /* Compute its size */
            TargetLength = wcslen(DefineDosDeviceRequest->TargetPath.Buffer);
 
            /* And make sure it fits our buffer */
            if (TargetLength + 1 >= CchLengthLeft)
            {
                Status = STATUS_INVALID_PARAMETER;
                _SEH2_LEAVE;
            }
 
            /* Copy it to our internal buffer */
            RtlMoveMemory(CurrentBuffer, DefineDosDeviceRequest->TargetPath.Buffer, TargetLength * sizeof(WCHAR) + sizeof(UNICODE_NULL));
            TargetBuffer = CurrentBuffer;
 
            /* Update our buffer status */
            CchLengthLeft -= (TargetLength + 1);
            CurrentBuffer += (TargetLength + 1);
        }
        /* Otherwise, zero everything */
        else
        {
            TargetBuffer = NULL;
            TargetLength = 0;
        }
 
        /* If we opened the device, then, handle its current target */
        if (HandleTarget)
        {
            /* Query it with our internal buffer */
            LinkTarget.Length = 0;
            LinkTarget.MaximumLength = CchLengthLeft * sizeof(WCHAR);
            LinkTarget.Buffer = CurrentBuffer;
 
            Status = NtQuerySymbolicLinkObject(LinkHandle,
                                               &LinkTarget,
                                               &Length);
            /* If we overflow, give up */
            if (Length == LinkTarget.MaximumLength)
            {
                Status = STATUS_BUFFER_OVERFLOW;
            }
            /* In case of a failure, bye bye */
            if (!NT_SUCCESS(Status))
            {
                _SEH2_LEAVE;
            }
 
            /*
             * Properly null it for MULTI_SZ if needed
             * Always update max length with
             * the need size
             * This is needed to hand relatively "small"
             * strings to Ob and avoid killing ourselves
             * on the next query
             */
            CchLength = Length / sizeof(WCHAR);
            if (CchLength < 2 ||
                CurrentBuffer[CchLength - 2] != UNICODE_NULL ||
                CurrentBuffer[CchLength - 1] != UNICODE_NULL)
            {
                CurrentBuffer[CchLength] = UNICODE_NULL;
                LinkTarget.MaximumLength = Length + sizeof(UNICODE_NULL);
            }
            else
            {
                LinkTarget.MaximumLength = Length;
            }
        }
        /* There's no target, and we're asked to remove, so null target */
        else if (RemoveDefinition)
        {
            RtlInitUnicodeString(&LinkTarget, NULL);
        }
        /* There's a target provided - new device, update buffer */
        else
        {
            RtlInitUnicodeString(&LinkTarget, CurrentBuffer - TargetLength - 1);
        }
 
        /*
         * We no longer need old symlink, just drop it, we'll recreate it now
         * with updated target.
         * The benefit of it is that if caller asked us to drop last target, then
         * the device is removed and not dangling
         */
        if (LinkHandle != 0)
        {
            Status = NtMakeTemporaryObject(LinkHandle);
            NtClose(LinkHandle);
            LinkHandle = 0;
        }
 
        /* At this point, we must have no failure */
        if (!NT_SUCCESS(Status))
        {
            _SEH2_LEAVE;
        }
 
        /*
         * If we have to remove definition, let's start to browse our
         * target to actually drop it.
         */
        if (RemoveDefinition)
        {
            /* We'll browse our multi sz string */
            RemoveFound = FALSE;
            CurrentPtr = LinkTarget.Buffer;
            InterPtr = LinkTarget.Buffer;
            while (*CurrentPtr != UNICODE_NULL)
            {
                CchLength = 0;
                OrigPtr = CurrentPtr;
                /* First, find next string */
                while (TRUE)
                {
                    CurrentChar = *CurrentPtr;
                    ++CurrentPtr;
 
                    if (CurrentChar == UNICODE_NULL)
                    {
                        break;
                    }
 
                    ++CchLength;
                }
 
                /* This check is a bit tricky, but dead useful:
                 * If on the previous loop, we found the caller provided target
                 * in our list, then, we'll move current entry over the found one
                 * So that, it gets deleted.
                 * Also, if we don't find caller entry in our entries, then move
                 * current entry in the string if a previous one got deleted
                 */
                if (RemoveFound ||
                    ((!(DefineDosDeviceRequest->Flags & DDD_EXACT_MATCH_ON_REMOVE) ||
                      TargetLength != CchLength || _wcsicmp(OrigPtr, TargetBuffer) != 0) &&
                     ((DefineDosDeviceRequest->Flags & DDD_EXACT_MATCH_ON_REMOVE) ||
                      (TargetLength != 0 && _wcsnicmp(OrigPtr, TargetBuffer, TargetLength) != 0))))
                {
                    if (InterPtr != OrigPtr)
                    {
                        RtlMoveMemory(InterPtr, OrigPtr, sizeof(WCHAR) * CchLength + sizeof(UNICODE_NULL));
                    }
 
                    InterPtr += (CchLength + 1);
                }
                else
                {
                    /* Match case! Remember for next loop turn and to delete it */
                    RemoveFound = TRUE;
                }
            }
 
            /*
             * Drop last entry, as required (pop)
             * If there was a match previously, everything
             * is already moved, so we're just nulling
             * the end of the string
             * If there was no match, this is the pop
             */
            *InterPtr = UNICODE_NULL;
            ++InterPtr;
 
            /* Compute new target length */
            TargetLength = wcslen(LinkTarget.Buffer) * sizeof(WCHAR);
            /*
             * If it's empty, quit
             * Beware, here, we quit with STATUS_SUCCESS, and that's expected!
             * In case we dropped last target entry, then, it's empty
             * and there's no need to recreate the device we deleted previously
             */
            if (TargetLength == 0)
            {
                _SEH2_LEAVE;
            }
 
            /* Update our target string */
            LinkTarget.Length = TargetLength;
            LinkTarget.MaximumLength = (ULONG_PTR)InterPtr - (ULONG_PTR)LinkTarget.Buffer;
        }
        /* If that's not a removal, just update the target to include new target */
        else if (HandleTarget)
        {
            LinkTarget.Buffer = LinkTarget.Buffer - TargetLength - 1;
            LinkTarget.Length = TargetLength * sizeof(WCHAR);
            LinkTarget.MaximumLength += (TargetLength * sizeof(WCHAR) + sizeof(UNICODE_NULL));
            TargetLength *= sizeof(WCHAR);
        }
        /* No changes */
        else
        {
            TargetLength = LinkTarget.Length;
        }
 
        /* Make sure we don't create empty symlink */
        if (TargetLength == 0)
        {
            _SEH2_LEAVE;
        }
 
        /* Initialize our SIDs for symlink ACLs */
        Status = RtlAllocateAndInitializeSid(&WorldAuthority,
                                             1,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             &WorldSid);
        if (!NT_SUCCESS(Status))
        {
            _SEH2_LEAVE;
        }
 
        Status = RtlAllocateAndInitializeSid(&SystemAuthority,
                                             1,
                                             SECURITY_RESTRICTED_CODE_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             SECURITY_NULL_RID,
                                             &SystemSid);
        if (!NT_SUCCESS(Status))
        {
            RtlFreeSid(WorldSid);
            _SEH2_LEAVE;
        }
 
        /* Initialize our SD (on stack) */
        RtlCreateSecurityDescriptor(&SecurityDescriptor,
                                    SECURITY_DESCRIPTOR_REVISION);
 
        /* And our ACL (still on stack) */
        RtlCreateAcl(&Dacl.Dacl, sizeof(Dacl), ACL_REVISION);
 
        /*
         * For access mask, if we have no session ID, or if
         * protection mode is disabled, make them wide open
         */
        if (SessionId == 0 ||
            (ProtectionMode & 3) == 0)
        {
            AccessMask = DELETE | SYMBOLIC_LINK_QUERY;
        }
        else
        {
            AccessMask = SYMBOLIC_LINK_QUERY;
        }
 
        /* Setup the ACL */
        RtlAddAccessAllowedAce(&Dacl.Dacl, ACL_REVISION2, AccessMask, WorldSid);
        RtlAddAccessAllowedAce(&Dacl.Dacl, ACL_REVISION2, AccessMask, SystemSid);
 
        /* Drop SIDs */
        RtlFreeSid(WorldSid);
        RtlFreeSid(SystemSid);
 
        /* Link DACL to the SD */
        RtlSetDaclSecurityDescriptor(&SecurityDescriptor, TRUE, &Dacl.Dacl, TRUE);
 
        /* And set it in the OA used for creation */
        ObjectAttributes.SecurityDescriptor = &SecurityDescriptor;
 
        /*
         * If LUID and not global, we need to impersonate the caller
         * to make it local.
         */
        if (BaseStaticServerData->LUIDDeviceMapsEnabled)
        {
            if (!IsGlobal)
            {
                if (!CsrImpersonateClient(NULL))
                {
                    Status = STATUS_BAD_IMPERSONATION_LEVEL;
                    _SEH2_LEAVE;
                }
            }
        }
        /* The object will be permanent */
        else
        {
            ObjectAttributes.Attributes |= OBJ_PERMANENT;
        }
 
        /* (Re)Create the symbolic link/device */
        Status = NtCreateSymbolicLinkObject(&LinkHandle,
                                            SYMBOLIC_LINK_ALL_ACCESS,
                                            &ObjectAttributes,
                                            &LinkTarget);
 
        /* Revert to self if required */
        if (BaseStaticServerData->LUIDDeviceMapsEnabled && !IsGlobal)
        {
            CsrRevertToSelf();
        }
 
        /* In case of a success, make object permanent for LUID links */
        if (NT_SUCCESS(Status))
        {
            if (BaseStaticServerData->LUIDDeviceMapsEnabled)
            {
                Status = NtMakePermanentObject(LinkHandle);
            }
 
            /* Close the link */
            NtClose(LinkHandle);
 
            /*
             * Specific failure case here:
             * We were asked to remove something
             * but we didn't find the something
             * (we recreated the symlink hence the fail here!)
             * so fail with appropriate status
             */
            if (RemoveDefinition && !RemoveFound)
            {
                Status = STATUS_OBJECT_NAME_NOT_FOUND;
            }
        }
 
        /* We closed link, don't double close */
        LinkHandle = 0;
    }
    _SEH2_FINALLY
    {
        /* If we need to close the link, do it now */
        if (LinkHandle != 0)
        {
             NtClose(LinkHandle);
        }
 
        /* Free our internal buffer */
        RtlFreeHeap(BaseSrvHeap, 0, lpBuffer);
 
        /* Broadcast drive letter creation */
        if (DriveLetter && Status == STATUS_SUCCESS && Broadcast)
        {
            LUID SystemLuid = SYSTEM_LUID;
 
            /* If that's a global drive, broadcast as system */
            if (IsGlobal)
            {
                RtlCopyLuid(&CallerLuid, &SystemLuid);
            }
 
            /* Broadcast the event */
            AddBSMRequest(AbsLetter, RemoveDefinition, &CallerLuid);
 
            /*
             * If we removed drive, and the drive was shadowing a global one
             * broadcast the arrival of the global drive (as system - global)
             */
            if (RemoveDefinition && !RtlEqualLuid(&CallerLuid, &SystemLuid))
            {
                if (CheckForGlobalDriveLetter(AbsLetter))
                {
                    AddBSMRequest(AbsLetter, FALSE, &CallerLuid);
                }
            }
        }
 
        /* Done! */
        RtlLeaveCriticalSection(&BaseDefineDosDeviceCritSec);
    }
    _SEH2_END;
 
    return Status;
}

GetCallerLuid()

NTSTATUS GetCallerLuid

(

PLUID

CallerLuid

)

Definition at line 45 of file dosdev.c.

{
    NTSTATUS Status;
    HANDLE TokenHandle;
    ULONG ReturnLength;
    TOKEN_STATISTICS TokenInformation;
 
    /* We need an output buffer */
    if (CallerLuid == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Open thread token */
    TokenHandle = 0;
    ReturnLength = 0;
    Status = NtOpenThreadToken(NtCurrentThread(),
                               READ_CONTROL | TOKEN_QUERY,
                               FALSE, &TokenHandle);
    /* If we fail, open process token */
    if (Status == STATUS_NO_TOKEN)
    {
        Status = NtOpenProcessToken(NtCurrentProcess(),
                                    READ_CONTROL | TOKEN_QUERY,
                                    &TokenHandle);
    }
 
    /* In case of a success get caller LUID and copy it back */
    if (NT_SUCCESS(Status))
    {
        Status = NtQueryInformationToken(TokenHandle,
                                         TokenStatistics,
                                         &TokenInformation,
                                         sizeof(TokenInformation),
                                         &ReturnLength);
        if (NT_SUCCESS(Status))
        {
            RtlCopyLuid(CallerLuid, &TokenInformation.AuthenticationId);
        }
    }
 
    /* Close token handle */
    if (TokenHandle != 0)
    {
        NtClose(TokenHandle);
    }
 
    return Status;
}

Referenced by AddBSMRequest(), and CSR_API().

IsGlobalSymbolicLink()

NTSTATUS IsGlobalSymbolicLink	(	HANDLE	LinkHandle,
		PBOOLEAN	IsGlobal
	)

Definition at line 96 of file dosdev.c.

{
    NTSTATUS Status;
    DWORD ReturnLength;
    UNICODE_STRING GlobalString;
    OBJECT_NAME_INFORMATION NameInfo, *PNameInfo;
 
    /* We need both parameters */
    if (LinkHandle == 0 || IsGlobal == NULL)
    {
        return STATUS_INVALID_PARAMETER;
    }
 
    PNameInfo = NULL;
    _SEH2_TRY
    {
        /* Query handle information */
        Status = NtQueryObject(LinkHandle,
                               ObjectNameInformation,
                               &NameInfo,
                               0,
                               &ReturnLength);
        /* Only failure we tolerate is length mismatch */
        if (NT_SUCCESS(Status) || Status == STATUS_INFO_LENGTH_MISMATCH)
        {
            /* Allocate big enough buffer */
            PNameInfo = RtlAllocateHeap(BaseSrvHeap, 0, ReturnLength);
            if (PNameInfo == NULL)
            {
                Status = STATUS_NO_MEMORY;
                _SEH2_LEAVE;
            }
 
            /* Query again handle information */
            Status = NtQueryObject(LinkHandle,
                                   ObjectNameInformation,
                                   PNameInfo,
                                   ReturnLength,
                                   &ReturnLength);
 
            /*
             * If it succeed, check we have Global??
             * If so, return success
             */
            if (NT_SUCCESS(Status))
            {
                RtlInitUnicodeString(&GlobalString, L"\\GLOBAL??");
                *IsGlobal = RtlPrefixUnicodeString(&GlobalString, &PNameInfo->Name, FALSE);
                Status = STATUS_SUCCESS;
            }
        }
    }
    _SEH2_FINALLY
    {
        if (PNameInfo != NULL)
        {
            RtlFreeHeap(BaseSrvHeap, 0, PNameInfo);
        }
    }
    _SEH2_END;
 
    return Status;
}

Referenced by CheckForGlobalDriveLetter(), and CSR_API().

LONG()

LONG

(

WINAPI *

PBROADCASTSYSTEMMESSAGEEXW

)

SendWinStationBSM()

NTSTATUS SendWinStationBSM	(	DWORD	Flags,
		LPDWORD	Recipients,
		UINT	Message,
		WPARAM	wParam,
		LPARAM	lParam
	)

Definition at line 215 of file dosdev.c.

{
    UNIMPLEMENTED;
    return STATUS_NOT_IMPLEMENTED;
}

Referenced by BroadcastDriveLetterChange().

Variable Documentation

BaseDefineDosDeviceCritSec

RTL_CRITICAL_SECTION BaseDefineDosDeviceCritSec

static

Definition at line 26 of file dosdev.c.

Referenced by BaseCleanupDefineDosDevice(), BaseInitDefineDosDevice(), and CSR_API().

BaseSrvDDDBSMCritSec

RTL_CRITICAL_SECTION BaseSrvDDDBSMCritSec

Definition at line 27 of file dosdev.c.

Referenced by AddBSMRequest(), BaseInitializeStaticServerData(), and BaseSrvBSMThread().

BaseSrvpBSMThreadCount

ULONG BaseSrvpBSMThreadCount = 0

Definition at line 29 of file dosdev.c.

Referenced by AddBSMRequest(), and BaseSrvBSMThread().

BSM_Request_Queue

PBSM_REQUEST BSM_Request_Queue = NULL

Definition at line 28 of file dosdev.c.

Referenced by AddBSMRequest(), and BaseSrvBSMThread().

BSM_Request_Queue_End

PBSM_REQUEST BSM_Request_Queue_End = NULL

Definition at line 28 of file dosdev.c.

Referenced by AddBSMRequest(), and BaseSrvBSMThread().

LPARAM

LPARAM

Definition at line 30 of file dosdev.c.

LPDWORD

LPDWORD

Definition at line 30 of file dosdev.c.

PBSMINFO

PBSMINFO = NULL

Definition at line 30 of file dosdev.c.

UINT

UINT

Definition at line 30 of file dosdev.c.

WPARAM

WPARAM

Definition at line 30 of file dosdev.c.