1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
// Copyright 2021 Colin Finck <colin@reactos.org>
// SPDX-License-Identifier: GPL-2.0-or-later
use crate::error::Result;
use crate::structured_values::NtfsStructuredValueFromData;
use crate::types::Vcn;
use bitflags::bitflags;
use byteorder::{ByteOrder, LittleEndian};
use core::iter::FusedIterator;
use core::mem;
use core::ops::Range;
use memoffset::offset_of;
/// Size of all [`IndexEntryHeader`] fields plus some reserved bytes.
const INDEX_ENTRY_HEADER_SIZE: i64 = 16;
#[repr(C, packed)]
struct IndexEntryHeader {
file_ref: u64,
index_entry_length: u16,
key_length: u16,
flags: u8,
}
bitflags! {
pub struct NtfsIndexEntryFlags: u8 {
/// This index entry points to a sub-node.
const HAS_SUBNODE = 0x01;
/// This is the last index entry in the list.
const LAST_ENTRY = 0x02;
}
}
pub(crate) struct IndexEntryRange {
range: Range<usize>,
position: u64,
}
impl IndexEntryRange {
pub(crate) const fn new(range: Range<usize>, position: u64) -> Self {
Self { range, position }
}
pub(crate) fn to_entry<'d>(&self, data: &'d [u8]) -> NtfsIndexEntry<'d> {
NtfsIndexEntry::new(&data[self.range.clone()], self.position)
}
}
#[derive(Clone, Debug)]
pub struct NtfsIndexEntry<'d> {
data: &'d [u8],
position: u64,
}
impl<'d> NtfsIndexEntry<'d> {
pub(crate) const fn new(data: &'d [u8], position: u64) -> Self {
Self { data, position }
}
pub fn flags(&self) -> NtfsIndexEntryFlags {
let flags = self.data[offset_of!(IndexEntryHeader, flags)];
NtfsIndexEntryFlags::from_bits_truncate(flags)
}
pub fn index_entry_length(&self) -> u16 {
let start = offset_of!(IndexEntryHeader, index_entry_length);
LittleEndian::read_u16(&self.data[start..])
}
pub fn key_length(&self) -> u16 {
let start = offset_of!(IndexEntryHeader, key_length);
LittleEndian::read_u16(&self.data[start..])
}
/// Returns the structured value of the key of this Index Entry,
/// or `None` if this Index Entry has no key.
/// The last Index Entry never has a key.
pub fn key_structured_value<K>(&self) -> Option<Result<K>>
where
K: NtfsStructuredValueFromData<'d>,
{
// The key/stream is only set when the last entry flag is not set.
// https://flatcap.org/linux-ntfs/ntfs/concepts/index_entry.html
if self.key_length() == 0 || self.flags().contains(NtfsIndexEntryFlags::LAST_ENTRY) {
return None;
}
let start = INDEX_ENTRY_HEADER_SIZE as usize;
let end = start + self.key_length() as usize;
let position = self.position + start as u64;
let structured_value = iter_try!(K::from_data(&self.data[start..end], position));
Some(Ok(structured_value))
}
/// Returns the Virtual Cluster Number (VCN) of the subnode of this Index Entry,
/// or `None` if this Index Entry has no subnode.
pub fn subnode_vcn(&self) -> Option<Vcn> {
if !self.flags().contains(NtfsIndexEntryFlags::HAS_SUBNODE) {
return None;
}
// Get the subnode VCN from the very end of the Index Entry.
let start = self.index_entry_length() as usize - mem::size_of::<Vcn>();
let vcn = Vcn::from(LittleEndian::read_i64(&self.data[start..]));
Some(vcn)
}
}
pub(crate) struct IndexNodeEntryRanges {
data: Vec<u8>,
range: Range<usize>,
position: u64,
}
impl IndexNodeEntryRanges {
pub(crate) fn new(data: Vec<u8>, range: Range<usize>, position: u64) -> Self {
debug_assert!(range.end <= data.len());
Self {
data,
range,
position,
}
}
pub(crate) fn data<'d>(&'d self) -> &'d [u8] {
&self.data
}
}
impl Iterator for IndexNodeEntryRanges {
type Item = IndexEntryRange;
fn next(&mut self) -> Option<Self::Item> {
if self.range.is_empty() {
return None;
}
// Get the current entry.
let start = self.range.start;
let position = self.position + self.range.start as u64;
let entry = NtfsIndexEntry::new(&self.data[start..], position);
let end = start + entry.index_entry_length() as usize;
if entry.flags().contains(NtfsIndexEntryFlags::LAST_ENTRY) {
// This is the last entry.
// Ensure that we don't read any other entries by advancing `self.range.start` to the end.
self.range.start = self.data.len();
} else {
// This is not the last entry.
// Advance our iterator to the next entry.
self.range.start = end;
}
Some(IndexEntryRange::new(start..end, position))
}
}
impl FusedIterator for IndexNodeEntryRanges {}
#[derive(Clone, Debug)]
pub struct NtfsIndexNodeEntries<'d> {
data: &'d [u8],
position: u64,
}
impl<'d> NtfsIndexNodeEntries<'d> {
pub(crate) const fn new(data: &'d [u8], position: u64) -> Self {
Self { data, position }
}
}
impl<'d> Iterator for NtfsIndexNodeEntries<'d> {
type Item = NtfsIndexEntry<'d>;
fn next(&mut self) -> Option<Self::Item> {
if self.data.is_empty() {
return None;
}
// Get the current entry.
let entry = NtfsIndexEntry::new(self.data, self.position);
if entry.flags().contains(NtfsIndexEntryFlags::LAST_ENTRY) {
// This is the last entry.
// Ensure that we don't read any other entries by emptying the slice.
self.data = &[];
} else {
// This is not the last entry.
// Advance our iterator to the next entry.
let bytes_to_advance = entry.index_entry_length() as usize;
self.data = &self.data[bytes_to_advance..];
self.position += bytes_to_advance as u64;
}
Some(entry)
}
}
impl<'d> FusedIterator for NtfsIndexNodeEntries<'d> {}
|
