source3/smbd/smb2_notify.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) Jeremy Allison 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_SMB2
  30
  31 struct smbd_smb2_notify_state {
  32         struct smbd_smb2_request *smb2req;
  33         struct smb_request *smbreq;
  34         bool has_request;
  35         bool skip_reply;
  36         NTSTATUS status;
  37         DATA_BLOB out_output_buffer;
  38 };
  39
  40 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
  41                                                 struct tevent_context *ev,
  42                                                 struct smbd_smb2_request *smb2req,
  43                                                 struct files_struct *in_fsp,
  44                                                 uint16_t in_flags,
  45                                                 uint32_t in_output_buffer_length,
  46                                                 uint64_t in_completion_filter);
  47 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
  48                                       TALLOC_CTX *mem_ctx,
  49                                       DATA_BLOB *out_output_buffer);
  50
  51 static void smbd_smb2_request_notify_done(struct tevent_req *subreq);
  52 NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
  53 {
  54         struct smbXsrv_connection *xconn = req->xconn;
  55         NTSTATUS status;
  56         const uint8_t *inbody;
  57         uint16_t in_flags;
  58         uint32_t in_output_buffer_length;
  59         uint64_t in_file_id_persistent;
  60         uint64_t in_file_id_volatile;
  61         struct files_struct *in_fsp;
  62         uint64_t in_completion_filter;
  63         struct tevent_req *subreq;
  64
  65         status = smbd_smb2_request_verify_sizes(req, 0x20);
  66         if (!NT_STATUS_IS_OK(status)) {
  67                 return smbd_smb2_request_error(req, status);
  68         }
  69         inbody = SMBD_SMB2_IN_BODY_PTR(req);
  70
  71         in_flags                = SVAL(inbody, 0x02);
  72         in_output_buffer_length = IVAL(inbody, 0x04);
  73         in_file_id_persistent   = BVAL(inbody, 0x08);
  74         in_file_id_volatile     = BVAL(inbody, 0x10);
  75         in_completion_filter    = IVAL(inbody, 0x18);
  76
  77         /*
  78          * 0x00010000 is what Windows 7 uses,
  79          * Windows 2008 uses 0x00080000
  80          */
  81         if (in_output_buffer_length > xconn->smb2.server.max_trans) {
  82                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
  83         }
  84
  85         status = smbd_smb2_request_verify_creditcharge(req,
  86                                                 in_output_buffer_length);
  87
  88         if (!NT_STATUS_IS_OK(status)) {
  89                 return smbd_smb2_request_error(req, status);
  90         }
  91
  92         in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
  93         if (in_fsp == NULL) {
  94                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
  95         }
  96
  97         subreq = smbd_smb2_notify_send(req, req->sconn->ev_ctx,
  98                                        req, in_fsp,
  99                                        in_flags,
 100                                        in_output_buffer_length,
 101                                        in_completion_filter);
 102         if (subreq == NULL) {
 103                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 104         }
 105         tevent_req_set_callback(subreq, smbd_smb2_request_notify_done, req);
 106
 107         return smbd_smb2_request_pending_queue(req, subreq, 500);
 108 }
 109
 110 static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
 111 {
 112         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
 113                                         struct smbd_smb2_request);
 114         DATA_BLOB outbody;
 115         DATA_BLOB outdyn;
 116         uint16_t out_output_buffer_offset;
 117         DATA_BLOB out_output_buffer = data_blob_null;
 118         NTSTATUS status;
 119         NTSTATUS error; /* transport error */
 120
 121         status = smbd_smb2_notify_recv(subreq,
 122                                        req,
 123                                        &out_output_buffer);
 124         TALLOC_FREE(subreq);
 125         if (!NT_STATUS_IS_OK(status)) {
 126                 error = smbd_smb2_request_error(req, status);
 127                 if (!NT_STATUS_IS_OK(error)) {
 128                         smbd_server_connection_terminate(req->xconn,
 129                                                          nt_errstr(error));
 130                         return;
 131                 }
 132                 return;
 133         }
 134
 135         out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
 136
 137         outbody = smbd_smb2_generate_outbody(req, 0x08);
 138         if (outbody.data == NULL) {
 139                 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 140                 if (!NT_STATUS_IS_OK(error)) {
 141                         smbd_server_connection_terminate(req->xconn,
 142                                                          nt_errstr(error));
 143                         return;
 144                 }
 145                 return;
 146         }
 147
 148         SSVAL(outbody.data, 0x00, 0x08 + 1);    /* struct size */
 149         SSVAL(outbody.data, 0x02,
 150               out_output_buffer_offset);        /* output buffer offset */
 151         SIVAL(outbody.data, 0x04,
 152               out_output_buffer.length);        /* output buffer length */
 153
 154         outdyn = out_output_buffer;
 155
 156         error = smbd_smb2_request_done(req, outbody, &outdyn);
 157         if (!NT_STATUS_IS_OK(error)) {
 158                 smbd_server_connection_terminate(req->xconn,
 159                                                  nt_errstr(error));
 160                 return;
 161         }
 162 }
 163
 164 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
 165                                    NTSTATUS error_code,
 166                                    uint8_t *buf, size_t len);
 167 static bool smbd_smb2_notify_cancel(struct tevent_req *req);
 168
 169 static int smbd_smb2_notify_state_destructor(struct smbd_smb2_notify_state *state)
 170 {
 171         if (!state->has_request) {
 172                 return 0;
 173         }
 174
 175         state->skip_reply = true;
 176         smbd_notify_cancel_by_smbreq(state->smbreq);
 177         return 0;
 178 }
 179
 180 static int smbd_smb2_notify_smbreq_destructor(struct smb_request *smbreq)
 181 {
 182         struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
 183                                                        struct tevent_req);
 184         struct smbd_smb2_notify_state *state = tevent_req_data(req,
 185                                                struct smbd_smb2_notify_state);
 186
 187         /*
 188          * Our temporary parent from change_notify_add_request()
 189          * goes away.
 190          */
 191         state->has_request = false;
 192
 193         /*
 194          * move it back to its original parent,
 195          * which means we no longer need the destructor
 196          * to protect it.
 197          */
 198         talloc_steal(smbreq->smb2req, smbreq);
 199         talloc_set_destructor(smbreq, NULL);
 200
 201         /*
 202          * We want to keep smbreq!
 203          */
 204         return -1;
 205 }
 206
 207 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
 208                                                 struct tevent_context *ev,
 209                                                 struct smbd_smb2_request *smb2req,
 210                                                 struct files_struct *fsp,
 211                                                 uint16_t in_flags,
 212                                                 uint32_t in_output_buffer_length,
 213                                                 uint64_t in_completion_filter)
 214 {
 215         struct tevent_req *req;
 216         struct smbd_smb2_notify_state *state;
 217         struct smb_request *smbreq;
 218         connection_struct *conn = smb2req->tcon->compat;
 219         bool recursive = (in_flags & SMB2_WATCH_TREE) ? true : false;
 220         NTSTATUS status;
 221
 222         req = tevent_req_create(mem_ctx, &state,
 223                                 struct smbd_smb2_notify_state);
 224         if (req == NULL) {
 225                 return NULL;
 226         }
 227         state->smb2req = smb2req;
 228         state->status = NT_STATUS_INTERNAL_ERROR;
 229         state->out_output_buffer = data_blob_null;
 230         talloc_set_destructor(state, smbd_smb2_notify_state_destructor);
 231
 232         DEBUG(10,("smbd_smb2_notify_send: %s - %s\n",
 233                   fsp_str_dbg(fsp), fsp_fnum_dbg(fsp)));
 234
 235         smbreq = smbd_smb2_fake_smb_request(smb2req, fsp);
 236         if (tevent_req_nomem(smbreq, req)) {
 237                 return tevent_req_post(req, ev);
 238         }
 239
 240         state->smbreq = smbreq;
 241         smbreq->async_priv = (void *)req;
 242
 243         DBG_NOTICE("notify change called on %s, filter = %s, recursive = %d\n",
 244                    fsp_str_dbg(fsp),
 245                    notify_filter_string(talloc_tos(), in_completion_filter),
 246                    recursive);
 247
 248         if ((!fsp->fsp_flags.is_directory) || (conn != fsp->conn)) {
 249                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 250                 return tevent_req_post(req, ev);
 251         }
 252
 253         if (fsp->notify == NULL) {
 254
 255                 status = change_notify_create(fsp,
 256                                               in_output_buffer_length,
 257                                               in_completion_filter,
 258                                               recursive);
 259                 if (tevent_req_nterror(req, status)) {
 260                         DEBUG(10, ("change_notify_create returned %s\n",
 261                                    nt_errstr(status)));
 262                         return tevent_req_post(req, ev);
 263                 }
 264         }
 265
 266         if (change_notify_fsp_has_changes(fsp)) {
 267
 268                 /*
 269                  * We've got changes pending, respond immediately
 270                  */
 271
 272                 /*
 273                  * TODO: write a torture test to check the filtering behaviour
 274                  * here.
 275                  */
 276
 277                 change_notify_reply(smbreq,
 278                                     NT_STATUS_OK,
 279                                     in_output_buffer_length,
 280                                     fsp->notify,
 281                                     smbd_smb2_notify_reply);
 282
 283                 /*
 284                  * change_notify_reply() above has independently
 285                  * called tevent_req_done().
 286                  */
 287                 return tevent_req_post(req, ev);
 288         }
 289
 290         /*
 291          * No changes pending, queue the request
 292          */
 293
 294         status = change_notify_add_request(smbreq,
 295                         in_output_buffer_length,
 296                         in_completion_filter,
 297                         recursive, fsp,
 298                         smbd_smb2_notify_reply);
 299         if (tevent_req_nterror(req, status)) {
 300                 return tevent_req_post(req, ev);
 301         }
 302
 303         /*
 304          * This is a HACK!
 305          *
 306          * change_notify_add_request() talloc_moves()
 307          * smbreq away from us, so we need a destructor
 308          * which moves it back at the end.
 309          */
 310         state->has_request = true;
 311         talloc_set_destructor(smbreq, smbd_smb2_notify_smbreq_destructor);
 312
 313         /* allow this request to be canceled */
 314         tevent_req_set_cancel_fn(req, smbd_smb2_notify_cancel);
 315
 316         SMBPROFILE_IOBYTES_ASYNC_SET_IDLE(state->smb2req->profile);
 317         return req;
 318 }
 319
 320 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
 321                                    NTSTATUS error_code,
 322                                    uint8_t *buf, size_t len)
 323 {
 324         struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
 325                                                        struct tevent_req);
 326         struct smbd_smb2_notify_state *state = tevent_req_data(req,
 327                                                struct smbd_smb2_notify_state);
 328
 329         if (state->skip_reply) {
 330                 return;
 331         }
 332
 333         SMBPROFILE_IOBYTES_ASYNC_SET_BUSY(state->smb2req->profile);
 334
 335         state->status = error_code;
 336         if (!NT_STATUS_IS_OK(error_code)) {
 337                 /* nothing */
 338         } else if (len == 0) {
 339                 state->status = NT_STATUS_NOTIFY_ENUM_DIR;
 340         } else {
 341                 state->out_output_buffer = data_blob_talloc(state, buf, len);
 342                 if (state->out_output_buffer.data == NULL) {
 343                         state->status = NT_STATUS_NO_MEMORY;
 344                 }
 345         }
 346
 347         tevent_req_defer_callback(req, state->smb2req->sconn->ev_ctx);
 348
 349         if (tevent_req_nterror(req, state->status)) {
 350                 return;
 351         }
 352
 353         tevent_req_done(req);
 354 }
 355
 356 static bool smbd_smb2_notify_cancel(struct tevent_req *req)
 357 {
 358         struct smbd_smb2_notify_state *state = tevent_req_data(req,
 359                                                struct smbd_smb2_notify_state);
 360
 361         smbd_notify_cancel_by_smbreq(state->smbreq);
 362
 363         return true;
 364 }
 365
 366 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
 367                                       TALLOC_CTX *mem_ctx,
 368                                       DATA_BLOB *out_output_buffer)
 369 {
 370         NTSTATUS status;
 371         struct smbd_smb2_notify_state *state = tevent_req_data(req,
 372                                                struct smbd_smb2_notify_state);
 373
 374         if (tevent_req_is_nterror(req, &status)) {
 375                 tevent_req_received(req);
 376                 return status;
 377         }
 378
 379         *out_output_buffer = state->out_output_buffer;
 380         talloc_steal(mem_ctx, out_output_buffer->data);
 381
 382         tevent_req_received(req);
 383         return NT_STATUS_OK;
 384 }