2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) David Disseldorp 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../libcli/security/security.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "include/ntioctl.h"
29 #include "../librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_ioctl.h"
31 #include "smb2_ioctl_private.h"
32 #include "../lib/tsocket/tsocket.h"
33 #include "lib/messages_ctdb.h"
34 #include "ctdbd_conn.h"
37 #define DBGC_CLASS DBGC_SMB2
39 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
41 cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
42 cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
43 cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
46 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
49 uint32_t total_len = 0;
52 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
53 * Send and invalid parameter response if:
54 * - The ChunkCount value is greater than
55 * ServerSideCopyMaxNumberofChunks
57 if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
58 return NT_STATUS_INVALID_PARAMETER;
61 for (i = 0; i < cc_copy->chunk_count; i++) {
63 * - The Length value in a single chunk is greater than
64 * ServerSideCopyMaxChunkSize or equal to zero.
66 if ((cc_copy->chunks[i].length == 0)
67 || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
68 return NT_STATUS_INVALID_PARAMETER;
70 total_len += cc_copy->chunks[i].length;
73 * - Sum of Lengths in all chunks is greater than
74 * ServerSideCopyMaxDataSize
76 if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
77 return NT_STATUS_INVALID_PARAMETER;
83 struct fsctl_srv_copychunk_state {
84 struct tevent_context *ev;
85 struct connection_struct *conn;
86 struct srv_copychunk_copy cc_copy;
87 uint32_t current_chunk;
92 struct files_struct *src_fsp;
93 struct files_struct *dst_fsp;
95 COPYCHUNK_OUT_EMPTY = 0,
100 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
102 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
104 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
105 struct tevent_context *ev,
107 struct files_struct *dst_fsp,
109 size_t in_max_output,
110 struct smbd_smb2_request *smb2req)
112 struct tevent_req *req = NULL;
113 struct fsctl_srv_copychunk_state *state = NULL;
114 enum ndr_err_code ndr_ret;
117 /* handler for both copy-chunk variants */
118 SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
119 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
121 req = tevent_req_create(mem_ctx, &state,
122 struct fsctl_srv_copychunk_state);
126 *state = (struct fsctl_srv_copychunk_state) {
127 .conn = dst_fsp->conn,
129 .ctl_code = ctl_code,
133 if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
134 DEBUG(3, ("max output %d not large enough to hold copy chunk "
135 "response %lu\n", (int)in_max_output,
136 (unsigned long)sizeof(struct srv_copychunk_rsp)));
137 state->status = NT_STATUS_INVALID_PARAMETER;
138 tevent_req_nterror(req, state->status);
139 return tevent_req_post(req, ev);
142 ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
143 (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
144 if (ndr_ret != NDR_ERR_SUCCESS) {
145 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
146 state->status = NT_STATUS_INVALID_PARAMETER;
147 tevent_req_nterror(req, state->status);
148 return tevent_req_post(req, ev);
151 state->token = data_blob_const(state->cc_copy.source_key,
152 sizeof(state->cc_copy.source_key));
154 state->status = copychunk_check_limits(&state->cc_copy);
155 if (!NT_STATUS_IS_OK(state->status)) {
156 DEBUG(3, ("copy chunk req exceeds limits\n"));
157 state->out_data = COPYCHUNK_OUT_LIMITS;
158 tevent_req_nterror(req, state->status);
159 return tevent_req_post(req, ev);
162 /* any errors from here onwards should carry copychunk response data */
163 state->out_data = COPYCHUNK_OUT_RSP;
165 status = fsctl_srv_copychunk_loop(req);
166 if (tevent_req_nterror(req, status)) {
167 return tevent_req_post(req, ev);
173 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
175 struct fsctl_srv_copychunk_state *state = tevent_req_data(
176 req, struct fsctl_srv_copychunk_state);
177 struct tevent_req *subreq = NULL;
179 off_t source_off = 0;
180 off_t target_off = 0;
183 * chunk_count can be 0 which must either just do nothing returning
184 * success saying number of copied chunks is 0 (verified against
187 * Or it can be a special macOS copyfile request, so we send this into
188 * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
190 if (state->cc_copy.chunk_count > 0) {
191 struct srv_copychunk *chunk = NULL;
193 chunk = &state->cc_copy.chunks[state->current_chunk];
194 length = chunk->length;
195 source_off = chunk->source_off;
196 target_off = chunk->target_off;
199 subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
208 if (tevent_req_nomem(subreq, req)) {
209 return NT_STATUS_NO_MEMORY;
211 tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
216 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
218 struct tevent_req *req = tevent_req_callback_data(
219 subreq, struct tevent_req);
220 struct fsctl_srv_copychunk_state *state = tevent_req_data(
221 req, struct fsctl_srv_copychunk_state);
222 off_t chunk_nwritten;
225 status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
228 if (!NT_STATUS_IS_OK(status)) {
229 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
231 (unsigned int)state->current_chunk,
232 (unsigned int)state->cc_copy.chunk_count);
233 tevent_req_nterror(req, status);
237 DBG_DEBUG("good copy chunk [%u] of [%u]\n",
238 (unsigned int)state->current_chunk,
239 (unsigned int)state->cc_copy.chunk_count);
240 state->total_written += chunk_nwritten;
242 if (state->cc_copy.chunk_count == 0) {
244 * This must not produce an error but just return a chunk count
245 * of 0 in the response.
247 tevent_req_done(req);
251 state->current_chunk++;
252 if (state->current_chunk == state->cc_copy.chunk_count) {
253 tevent_req_done(req);
257 status = fsctl_srv_copychunk_loop(req);
258 if (tevent_req_nterror(req, status)) {
263 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
264 struct srv_copychunk_rsp *cc_rsp,
267 struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
268 struct fsctl_srv_copychunk_state);
271 switch (state->out_data) {
272 case COPYCHUNK_OUT_EMPTY:
275 case COPYCHUNK_OUT_LIMITS:
276 /* 2.2.32.1 - send back our maximum transfer size limits */
277 copychunk_pack_limits(cc_rsp);
280 case COPYCHUNK_OUT_RSP:
281 cc_rsp->chunks_written = state->current_chunk;
282 cc_rsp->chunk_bytes_written = 0;
283 cc_rsp->total_bytes_written = state->total_written;
286 default: /* not reached */
290 status = tevent_req_simple_recv_ntstatus(req);
294 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
295 struct tevent_context *ev,
296 struct smbXsrv_connection *xconn,
298 uint32_t in_max_output,
299 DATA_BLOB *out_output)
301 struct fsctl_net_iface_info *array = NULL;
302 struct fsctl_net_iface_info *first = NULL;
303 struct fsctl_net_iface_info *last = NULL;
305 size_t num_ifaces = iface_count();
306 enum ndr_err_code ndr_err;
307 struct ctdb_public_ip_list_old *ips = NULL;
309 if (in_input->length != 0) {
310 return NT_STATUS_INVALID_PARAMETER;
313 *out_output = data_blob_null;
315 if (lp_clustering()) {
318 ret = ctdbd_control_get_public_ips(messaging_ctdb_connection(),
323 return NT_STATUS_INTERNAL_ERROR;
327 array = talloc_zero_array(mem_ctx,
328 struct fsctl_net_iface_info,
331 return NT_STATUS_NO_MEMORY;
334 for (i=0; i < num_ifaces; i++) {
335 struct fsctl_net_iface_info *cur = &array[i];
336 const struct interface *iface = get_interface(i);
337 const struct sockaddr_storage *ifss = &iface->ip;
338 const void *ifptr = ifss;
339 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
340 struct tsocket_address *a = NULL;
345 ret = tsocket_address_bsd_from_sockaddr(array,
346 ifsa, sizeof(struct sockaddr_storage),
349 return map_nt_error_from_unix_common(errno);
352 ok = tsocket_address_is_inet(a, "ip");
357 addr = tsocket_address_inet_addr_string(a, array);
360 return NT_STATUS_NO_MEMORY;
366 is_public_ip = ctdbd_find_in_public_ips(ips, ifss);
368 DBG_DEBUG("Interface [%s] - "
370 "skipping address [%s].\n",
376 cur->ifindex = iface->if_index;
377 if (cur->ifindex == 0) {
379 * Did not get interface index from kernel,
380 * nor from the config. ==> Apply a common
381 * default value for these cases.
383 cur->ifindex = UINT32_MAX;
385 cur->capability = iface->capability;
386 cur->linkspeed = iface->linkspeed;
387 if (cur->linkspeed == 0) {
388 DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
389 "address [%s].\n", iface->name, addr);
393 ok = tsocket_address_is_inet(a, "ipv4");
395 cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
396 cur->sockaddr.saddr.saddr_in.ipv4 = addr;
398 ok = tsocket_address_is_inet(a, "ipv6");
400 cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
401 cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
418 if (DEBUGLEVEL >= 10) {
419 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
422 ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
423 (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
425 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
426 return ndr_map_error2ntstatus(ndr_err);
432 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
433 struct tevent_context *ev,
434 struct smbXsrv_connection *conn,
436 uint32_t in_max_output,
437 DATA_BLOB *out_output,
440 uint32_t in_capabilities;
441 DATA_BLOB in_guid_blob;
443 uint16_t in_security_mode;
444 uint16_t in_num_dialects;
446 struct GUID_ndr_buf out_guid_buf = { .buf = {0}, };
448 enum protocol_types protocol = PROTOCOL_NONE;
450 if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
452 * With SMB 2.02 we didn't get the
453 * capabitities, client guid, security mode
454 * and dialects the client would have offered.
456 * So we behave compatible with a true
457 * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
459 * As SMB >= 2.10 offers the two phase SMB2 Negotiate
460 * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
461 * starting with SMB 2.10, while Windows only supports
462 * it starting with SMB > 2.10.
464 return NT_STATUS_FILE_CLOSED;
467 if (in_input->length < 0x18) {
468 return NT_STATUS_INVALID_PARAMETER;
471 in_capabilities = IVAL(in_input->data, 0x00);
472 in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
473 in_security_mode = SVAL(in_input->data, 0x14);
474 in_num_dialects = SVAL(in_input->data, 0x16);
476 if (in_input->length < (0x18 + in_num_dialects*2)) {
477 return NT_STATUS_INVALID_PARAMETER;
480 if (in_max_output < 0x18) {
481 return NT_STATUS_BUFFER_TOO_SMALL;
484 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
485 if (!NT_STATUS_IS_OK(status)) {
491 * 3.3.5.15.12 Handling a Validate Negotiate Info Request
493 * The server MUST determine the greatest common dialect
494 * between the dialects it implements and the Dialects array
495 * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
496 * matched, or if the value is not equal to Connection.Dialect,
497 * the server MUST terminate the transport connection
498 * and free the Connection object.
500 protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
503 if (conn->protocol != protocol) {
505 return NT_STATUS_ACCESS_DENIED;
508 if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
510 return NT_STATUS_ACCESS_DENIED;
513 if (in_security_mode != conn->smb2.client.security_mode) {
515 return NT_STATUS_ACCESS_DENIED;
518 if (in_capabilities != conn->smb2.client.capabilities) {
520 return NT_STATUS_ACCESS_DENIED;
523 status = GUID_to_ndr_buf(&conn->smb2.server.guid, &out_guid_buf);
524 if (!NT_STATUS_IS_OK(status)) {
528 *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
529 if (out_output->data == NULL) {
530 return NT_STATUS_NO_MEMORY;
533 SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
534 memcpy(out_output->data+0x04, out_guid_buf.buf, 16);
535 SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
536 SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
541 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
542 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
544 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
545 struct tevent_context *ev,
546 struct tevent_req *req,
547 struct smbd_smb2_ioctl_state *state)
549 struct tevent_req *subreq;
555 * FSCTL_SRV_COPYCHUNK is issued when a handle has
556 * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
557 * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
558 * FILE_WRITE_DATA access.
560 case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
561 case FSCTL_SRV_COPYCHUNK:
562 subreq = fsctl_srv_copychunk_send(state, ev,
566 state->in_max_output,
568 if (tevent_req_nomem(subreq, req)) {
569 return tevent_req_post(req, ev);
571 tevent_req_set_callback(subreq,
572 smb2_ioctl_network_fs_copychunk_done,
576 case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
577 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
579 if (IS_IPC(state->smbreq->conn)) {
580 status = NT_STATUS_FS_DRIVER_REQUIRED;
582 status = NT_STATUS_INVALID_DEVICE_REQUEST;
585 tevent_req_nterror(req, status);
586 return tevent_req_post(req, ev);
589 status = fsctl_network_iface_info(state, ev,
590 state->smbreq->xconn,
592 state->in_max_output,
594 if (!tevent_req_nterror(req, status)) {
595 tevent_req_done(req);
597 return tevent_req_post(req, ev);
599 case FSCTL_VALIDATE_NEGOTIATE_INFO:
600 status = fsctl_validate_neg_info(state, ev,
601 state->smbreq->xconn,
603 state->in_max_output,
606 if (!tevent_req_nterror(req, status)) {
607 tevent_req_done(req);
609 return tevent_req_post(req, ev);
611 case FSCTL_SRV_REQUEST_RESUME_KEY:
612 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
615 FSCTL_SRV_REQUEST_RESUME_KEY,
617 if (tevent_req_nomem(subreq, req)) {
618 return tevent_req_post(req, ev);
620 tevent_req_set_callback(
621 subreq, smb2_ioctl_network_fs_offload_read_done, req);
625 uint8_t *out_data = NULL;
626 uint32_t out_data_len = 0;
628 if (state->fsp == NULL) {
629 status = NT_STATUS_NOT_SUPPORTED;
631 status = SMB_VFS_FSCTL(state->fsp,
634 state->smbreq->flags2,
635 state->in_input.data,
636 state->in_input.length,
638 state->in_max_output,
640 state->out_output = data_blob_const(out_data, out_data_len);
641 if (NT_STATUS_IS_OK(status)) {
642 tevent_req_done(req);
643 return tevent_req_post(req, ev);
647 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
648 if (IS_IPC(state->smbreq->conn)) {
649 status = NT_STATUS_FS_DRIVER_REQUIRED;
651 status = NT_STATUS_INVALID_DEVICE_REQUEST;
655 tevent_req_nterror(req, status);
656 return tevent_req_post(req, ev);
661 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
662 return tevent_req_post(req, ev);
665 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
667 struct tevent_req *req = tevent_req_callback_data(subreq,
669 struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
670 struct smbd_smb2_ioctl_state);
671 struct srv_copychunk_rsp cc_rsp;
673 bool pack_rsp = false;
676 status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
678 if (pack_rsp == true) {
679 enum ndr_err_code ndr_ret;
680 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
683 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
684 if (ndr_ret != NDR_ERR_SUCCESS) {
685 status = NT_STATUS_INTERNAL_ERROR;
689 if (!tevent_req_nterror(req, status)) {
690 tevent_req_done(req);
694 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
696 struct tevent_req *req = tevent_req_callback_data(
697 subreq, struct tevent_req);
698 struct smbd_smb2_ioctl_state *state = tevent_req_data(
699 req, struct smbd_smb2_ioctl_state);
700 struct req_resume_key_rsp rkey_rsp;
701 enum ndr_err_code ndr_ret;
705 status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
710 if (tevent_req_nterror(req, status)) {
714 if (token.length != sizeof(rkey_rsp.resume_key)) {
715 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
719 ZERO_STRUCT(rkey_rsp);
720 memcpy(rkey_rsp.resume_key, token.data, token.length);
722 ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
723 (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
724 if (ndr_ret != NDR_ERR_SUCCESS) {
725 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
729 tevent_req_done(req);