source3/smbd/smb2_read.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/filesys.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "libcli/security/security.h"
  27
  28 static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
  29                                               struct tevent_context *ev,
  30                                               struct smbd_smb2_request *smb2req,
  31                                               uint32_t in_smbpid,
  32                                               uint64_t in_file_id_volatile,
  33                                               uint32_t in_length,
  34                                               uint64_t in_offset,
  35                                               uint32_t in_minimum,
  36                                               uint32_t in_remaining);
  37 static NTSTATUS smbd_smb2_read_recv(struct tevent_req *req,
  38                                     TALLOC_CTX *mem_ctx,
  39                                     DATA_BLOB *out_data,
  40                                     uint32_t *out_remaining);
  41
  42 static void smbd_smb2_request_read_done(struct tevent_req *subreq);
  43 NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
  44 {
  45         const uint8_t *inhdr;
  46         const uint8_t *inbody;
  47         int i = req->current_idx;
  48         size_t expected_body_size = 0x31;
  49         size_t body_size;
  50         uint32_t in_smbpid;
  51         uint32_t in_length;
  52         uint64_t in_offset;
  53         uint64_t in_file_id_persistent;
  54         uint64_t in_file_id_volatile;
  55         uint32_t in_minimum_count;
  56         uint32_t in_remaining_bytes;
  57         struct tevent_req *subreq;
  58
  59         inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
  60         if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
  61                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
  62         }
  63
  64         inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
  65
  66         body_size = SVAL(inbody, 0x00);
  67         if (body_size != expected_body_size) {
  68                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
  69         }
  70
  71         in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
  72
  73         in_length               = IVAL(inbody, 0x04);
  74         in_offset               = BVAL(inbody, 0x08);
  75         in_file_id_persistent   = BVAL(inbody, 0x10);
  76         in_file_id_volatile     = BVAL(inbody, 0x18);
  77         in_minimum_count        = IVAL(inbody, 0x20);
  78         in_remaining_bytes      = IVAL(inbody, 0x28);
  79
  80         /* check the max read size */
  81         if (in_length > lp_smb2_max_read()) {
  82                 DEBUG(0,("here:%s: 0x%08X: 0x%08X\n",
  83                         __location__, in_length, lp_smb2_max_read()));
  84                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
  85         }
  86
  87         if (req->compat_chain_fsp) {
  88                 /* skip check */
  89         } else if (in_file_id_persistent != in_file_id_volatile) {
  90                 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
  91         }
  92
  93         subreq = smbd_smb2_read_send(req,
  94                                      req->sconn->smb2.event_ctx,
  95                                      req,
  96                                      in_smbpid,
  97                                      in_file_id_volatile,
  98                                      in_length,
  99                                      in_offset,
 100                                      in_minimum_count,
 101                                      in_remaining_bytes);
 102         if (subreq == NULL) {
 103                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 104         }
 105         tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
 106
 107         return smbd_smb2_request_pending_queue(req, subreq);
 108 }
 109
 110 static void smbd_smb2_request_read_done(struct tevent_req *subreq)
 111 {
 112         struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
 113                                         struct smbd_smb2_request);
 114         int i = req->current_idx;
 115         uint8_t *outhdr;
 116         DATA_BLOB outbody;
 117         DATA_BLOB outdyn;
 118         uint8_t out_data_offset;
 119         DATA_BLOB out_data_buffer = data_blob_null;
 120         uint32_t out_data_remaining = 0;
 121         NTSTATUS status;
 122         NTSTATUS error; /* transport error */
 123
 124         status = smbd_smb2_read_recv(subreq,
 125                                      req,
 126                                      &out_data_buffer,
 127                                      &out_data_remaining);
 128         TALLOC_FREE(subreq);
 129         if (!NT_STATUS_IS_OK(status)) {
 130                 error = smbd_smb2_request_error(req, status);
 131                 if (!NT_STATUS_IS_OK(error)) {
 132                         smbd_server_connection_terminate(req->sconn,
 133                                                          nt_errstr(error));
 134                         return;
 135                 }
 136                 return;
 137         }
 138
 139         out_data_offset = SMB2_HDR_BODY + 0x10;
 140
 141         outhdr = (uint8_t *)req->out.vector[i].iov_base;
 142
 143         outbody = data_blob_talloc(req->out.vector, NULL, 0x10);
 144         if (outbody.data == NULL) {
 145                 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 146                 if (!NT_STATUS_IS_OK(error)) {
 147                         smbd_server_connection_terminate(req->sconn,
 148                                                          nt_errstr(error));
 149                         return;
 150                 }
 151                 return;
 152         }
 153
 154         SSVAL(outbody.data, 0x00, 0x10 + 1);    /* struct size */
 155         SCVAL(outbody.data, 0x02,
 156               out_data_offset);                 /* data offset */
 157         SCVAL(outbody.data, 0x03, 0);           /* reserved */
 158         SIVAL(outbody.data, 0x04,
 159               out_data_buffer.length);          /* data length */
 160         SIVAL(outbody.data, 0x08,
 161               out_data_remaining);              /* data remaining */
 162         SIVAL(outbody.data, 0x0C, 0);           /* reserved */
 163
 164         outdyn = out_data_buffer;
 165
 166         error = smbd_smb2_request_done(req, outbody, &outdyn);
 167         if (!NT_STATUS_IS_OK(error)) {
 168                 smbd_server_connection_terminate(req->sconn,
 169                                                  nt_errstr(error));
 170                 return;
 171         }
 172 }
 173
 174 struct smbd_smb2_read_state {
 175         struct smbd_smb2_request *smb2req;
 176         files_struct *fsp;
 177         uint64_t in_file_id_volatile;
 178         uint32_t in_length;
 179         uint64_t in_offset;
 180         uint32_t in_minimum;
 181         DATA_BLOB out_data;
 182         uint32_t out_remaining;
 183 };
 184
 185 /* struct smbd_smb2_read_state destructor. Send the SMB2_READ data. */
 186 static int smb2_sendfile_send_data(struct smbd_smb2_read_state *state)
 187 {
 188         struct lock_struct lock;
 189         uint32_t in_length = state->in_length;
 190         uint64_t in_offset = state->in_offset;
 191         files_struct *fsp = state->fsp;
 192         ssize_t nread;
 193
 194         nread = SMB_VFS_SENDFILE(fsp->conn->sconn->sock,
 195                                         fsp,
 196                                         NULL,
 197                                         in_offset,
 198                                         in_length);
 199         DEBUG(10,("smb2_sendfile_send_data: SMB_VFS_SENDFILE returned %d on file %s\n",
 200                 (int)nread,
 201                 fsp_str_dbg(fsp) ));
 202
 203         if (nread == -1) {
 204                 if (errno == ENOSYS || errno == EINTR) {
 205                         /*
 206                          * Special hack for broken systems with no working
 207                          * sendfile. Fake this up by doing read/write calls.
 208                         */
 209                         set_use_sendfile(SNUM(fsp->conn), false);
 210                         nread = fake_sendfile(fsp, in_offset, in_length);
 211                         if (nread == -1) {
 212                                 DEBUG(0,("smb2_sendfile_send_data: "
 213                                         "fake_sendfile failed for "
 214                                         "file %s (%s).\n",
 215                                         fsp_str_dbg(fsp),
 216                                         strerror(errno)));
 217                                 exit_server_cleanly("smb2_sendfile_send_data: "
 218                                         "fake_sendfile failed");
 219                         }
 220                         goto out;
 221                 }
 222
 223                 DEBUG(0,("smb2_sendfile_send_data: sendfile failed for file "
 224                         "%s (%s). Terminating\n",
 225                         fsp_str_dbg(fsp),
 226                         strerror(errno)));
 227                 exit_server_cleanly("smb2_sendfile_send_data: sendfile failed");
 228         } else if (nread == 0) {
 229                 /*
 230                  * Some sendfile implementations return 0 to indicate
 231                  * that there was a short read, but nothing was
 232                  * actually written to the socket.  In this case,
 233                  * fallback to the normal read path so the header gets
 234                  * the correct byte count.
 235                  */
 236                 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
 237                         "falling back to the normal read: %s\n",
 238                         fsp_str_dbg(fsp)));
 239
 240                 nread = fake_sendfile(fsp, in_offset, in_length);
 241                 if (nread == -1) {
 242                         DEBUG(0,("smb2_sendfile_send_data: "
 243                                 "fake_sendfile failed for file "
 244                                 "%s (%s). Terminating\n",
 245                                 fsp_str_dbg(fsp),
 246                                 strerror(errno)));
 247                         exit_server_cleanly("smb2_sendfile_send_data: "
 248                                 "fake_sendfile failed");
 249                 }
 250         }
 251
 252   out:
 253
 254         if (nread < in_length) {
 255                 sendfile_short_send(fsp, nread, 0, in_length);
 256         }
 257
 258         init_strict_lock_struct(fsp,
 259                                 state->in_file_id_volatile,
 260                                 in_offset,
 261                                 in_length,
 262                                 READ_LOCK,
 263                                 &lock);
 264
 265         SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &lock);
 266         return 0;
 267 }
 268
 269 static NTSTATUS schedule_smb2_sendfile_read(struct smbd_smb2_request *smb2req,
 270                                         struct smbd_smb2_read_state *state)
 271 {
 272         struct smbd_smb2_read_state *state_copy = NULL;
 273         files_struct *fsp = state->fsp;
 274
 275         /*
 276          * We cannot use sendfile if...
 277          * We were not configured to do so OR
 278          * Signing is active OR
 279          * This is a compound SMB2 operation OR
 280          * fsp is a STREAM file OR
 281          * We're using a write cache OR
 282          * It's not a regular file OR
 283          * Requested offset is greater than file size OR
 284          * there's not enough data in the file.
 285          * Phew :-). Luckily this means most
 286          * reads on most normal files. JRA.
 287         */
 288
 289         if (!_lp_use_sendfile(SNUM(fsp->conn)) ||
 290                         smb2req->do_signing ||
 291                         smb2req->in.vector_count != 4 ||
 292                         (fsp->base_fsp != NULL) ||
 293                         (fsp->wcp != NULL) ||
 294                         (!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
 295                         (state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
 296                         (fsp->fsp_name->st.st_ex_size < state->in_offset +
 297                                 state->in_length)) {
 298                 return NT_STATUS_RETRY;
 299         }
 300
 301         /* We've already checked there's this amount of data
 302            to read. */
 303         state->out_data.length = state->in_length;
 304         state->out_remaining = 0;
 305
 306         /* Make a copy of state attached to the smb2req. Attach
 307            the destructor here as this will trigger the sendfile
 308            call when the request is destroyed. */
 309         state_copy = TALLOC_P(smb2req, struct smbd_smb2_read_state);
 310         if (!state_copy) {
 311                 return NT_STATUS_NO_MEMORY;
 312         }
 313         *state_copy = *state;
 314         talloc_set_destructor(state_copy, smb2_sendfile_send_data);
 315         return NT_STATUS_OK;
 316 }
 317
 318 static void smbd_smb2_read_pipe_done(struct tevent_req *subreq);
 319
 320 /*******************************************************************
 321  Common read complete processing function for both synchronous and
 322  asynchronous reads.
 323 *******************************************************************/
 324
 325 NTSTATUS smb2_read_complete(struct tevent_req *req, ssize_t nread, int err)
 326 {
 327         struct smbd_smb2_read_state *state = tevent_req_data(req,
 328                                         struct smbd_smb2_read_state);
 329         files_struct *fsp = state->fsp;
 330
 331         if (nread < 0) {
 332                 NTSTATUS status = map_nt_error_from_unix(err);
 333
 334                 DEBUG( 3,( "smb2_read_complete: file %s nread = %d. "
 335                         "Error = %s (NTSTATUS %s)\n",
 336                         fsp_str_dbg(fsp),
 337                         (int)nread,
 338                         strerror(err),
 339                         nt_errstr(status)));
 340
 341                 return status;
 342         }
 343         if (nread == 0 && state->in_length != 0) {
 344                 DEBUG(5,("smb2_read_complete: read_file[%s] end of file\n",
 345                         fsp_str_dbg(fsp)));
 346                 return NT_STATUS_END_OF_FILE;
 347         }
 348
 349         if (nread < state->in_minimum) {
 350                 DEBUG(5,("smb2_read_complete: read_file[%s] read less %d than "
 351                         "minimum requested %u. Returning end of file\n",
 352                         fsp_str_dbg(fsp),
 353                         (int)nread,
 354                         (unsigned int)state->in_minimum));
 355                 return NT_STATUS_END_OF_FILE;
 356         }
 357
 358         DEBUG(3,("smbd_smb2_read: fnum=[%d/%s] length=%lu offset=%lu read=%lu\n",
 359                 fsp->fnum,
 360                 fsp_str_dbg(fsp),
 361                 (unsigned long)state->in_length,
 362                 (unsigned long)state->in_offset,
 363                 (unsigned long)nread));
 364
 365         state->out_data.length = nread;
 366         state->out_remaining = 0;
 367
 368         return NT_STATUS_OK;
 369 }
 370
 371 static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
 372                                               struct tevent_context *ev,
 373                                               struct smbd_smb2_request *smb2req,
 374                                               uint32_t in_smbpid,
 375                                               uint64_t in_file_id_volatile,
 376                                               uint32_t in_length,
 377                                               uint64_t in_offset,
 378                                               uint32_t in_minimum,
 379                                               uint32_t in_remaining)
 380 {
 381         NTSTATUS status;
 382         struct tevent_req *req = NULL;
 383         struct smbd_smb2_read_state *state = NULL;
 384         struct smb_request *smbreq = NULL;
 385         connection_struct *conn = smb2req->tcon->compat_conn;
 386         files_struct *fsp = NULL;
 387         ssize_t nread = -1;
 388         struct lock_struct lock;
 389         int saved_errno;
 390
 391         req = tevent_req_create(mem_ctx, &state,
 392                                 struct smbd_smb2_read_state);
 393         if (req == NULL) {
 394                 return NULL;
 395         }
 396         state->smb2req = smb2req;
 397         state->in_length = in_length;
 398         state->in_offset = in_offset;
 399         state->in_minimum = in_minimum;
 400         state->out_data = data_blob_null;
 401         state->out_remaining = 0;
 402
 403         DEBUG(10,("smbd_smb2_read: file_id[0x%016llX]\n",
 404                   (unsigned long long)in_file_id_volatile));
 405
 406         smbreq = smbd_smb2_fake_smb_request(smb2req);
 407         if (tevent_req_nomem(smbreq, req)) {
 408                 return tevent_req_post(req, ev);
 409         }
 410
 411         fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
 412         if (fsp == NULL) {
 413                 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 414                 return tevent_req_post(req, ev);
 415         }
 416         if (conn != fsp->conn) {
 417                 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 418                 return tevent_req_post(req, ev);
 419         }
 420         if (smb2req->session->vuid != fsp->vuid) {
 421                 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 422                 return tevent_req_post(req, ev);
 423         }
 424         if (fsp->is_directory) {
 425                 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 426                 return tevent_req_post(req, ev);
 427         }
 428
 429         state->fsp = fsp;
 430         state->in_file_id_volatile = in_file_id_volatile;
 431
 432         if (IS_IPC(smbreq->conn)) {
 433                 struct tevent_req *subreq = NULL;
 434
 435                 state->out_data = data_blob_talloc(state, NULL, in_length);
 436                 if (in_length > 0 && tevent_req_nomem(state->out_data.data, req)) {
 437                         return tevent_req_post(req, ev);
 438                 }
 439
 440                 if (!fsp_is_np(fsp)) {
 441                         tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 442                         return tevent_req_post(req, ev);
 443                 }
 444
 445                 subreq = np_read_send(state, smbd_event_context(),
 446                                       fsp->fake_file_handle,
 447                                       state->out_data.data,
 448                                       state->out_data.length);
 449                 if (tevent_req_nomem(subreq, req)) {
 450                         return tevent_req_post(req, ev);
 451                 }
 452                 tevent_req_set_callback(subreq,
 453                                         smbd_smb2_read_pipe_done,
 454                                         req);
 455                 return req;
 456         }
 457
 458         if (!CHECK_READ(fsp, smbreq)) {
 459                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
 460                 return tevent_req_post(req, ev);
 461         }
 462
 463         status = schedule_smb2_aio_read(fsp->conn,
 464                                 smbreq,
 465                                 fsp,
 466                                 state,
 467                                 &state->out_data,
 468                                 (SMB_OFF_T)in_offset,
 469                                 (size_t)in_length);
 470
 471         if (NT_STATUS_IS_OK(status)) {
 472                 /*
 473                  * Doing an async read. Don't
 474                  * send a "gone async" message
 475                  * as we expect this to be less
 476                  * than the client timeout period.
 477                  * JRA. FIXME for offline files..
 478                  * FIXME. Add cancel code..
 479                  */
 480                 smb2req->async = true;
 481                 return req;
 482         }
 483
 484         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
 485                 /* Real error in setting up aio. Fail. */
 486                 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
 487                 return tevent_req_post(req, ev);
 488         }
 489
 490         /* Fallback to synchronous. */
 491
 492         init_strict_lock_struct(fsp,
 493                                 in_file_id_volatile,
 494                                 in_offset,
 495                                 in_length,
 496                                 READ_LOCK,
 497                                 &lock);
 498
 499         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
 500                 tevent_req_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
 501                 return tevent_req_post(req, ev);
 502         }
 503
 504         /* Try sendfile in preference. */
 505         status = schedule_smb2_sendfile_read(smb2req, state);
 506         if (NT_STATUS_IS_OK(status)) {
 507                 tevent_req_done(req);
 508                 return tevent_req_post(req, ev);
 509         } else {
 510                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
 511                         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
 512                         tevent_req_nterror(req, status);
 513                         return tevent_req_post(req, ev);
 514                 }
 515         }
 516
 517         /* Ok, read into memory. Allocate the out buffer. */
 518         state->out_data = data_blob_talloc(state, NULL, in_length);
 519         if (in_length > 0 && tevent_req_nomem(state->out_data.data, req)) {
 520                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
 521                 return tevent_req_post(req, ev);
 522         }
 523
 524         nread = read_file(fsp,
 525                           (char *)state->out_data.data,
 526                           in_offset,
 527                           in_length);
 528
 529         saved_errno = errno;
 530
 531         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
 532
 533         DEBUG(10,("smbd_smb2_read: file %s handle [0x%016llX] offset=%llu "
 534                 "len=%llu returned %lld\n",
 535                 fsp_str_dbg(fsp),
 536                 (unsigned long long)in_file_id_volatile,
 537                 (unsigned long long)in_offset,
 538                 (unsigned long long)in_length,
 539                 (long long)nread));
 540
 541         status = smb2_read_complete(req, nread, saved_errno);
 542         if (!NT_STATUS_IS_OK(status)) {
 543                 tevent_req_nterror(req, status);
 544         } else {
 545                 /* Success. */
 546                 tevent_req_done(req);
 547         }
 548         return tevent_req_post(req, ev);
 549 }
 550
 551 static void smbd_smb2_read_pipe_done(struct tevent_req *subreq)
 552 {
 553         struct tevent_req *req = tevent_req_callback_data(subreq,
 554                                  struct tevent_req);
 555         struct smbd_smb2_read_state *state = tevent_req_data(req,
 556                                              struct smbd_smb2_read_state);
 557         NTSTATUS status;
 558         ssize_t nread = -1;
 559         bool is_data_outstanding;
 560
 561         status = np_read_recv(subreq, &nread, &is_data_outstanding);
 562         TALLOC_FREE(subreq);
 563         if (!NT_STATUS_IS_OK(status)) {
 564                 tevent_req_nterror(req, status);
 565                 return;
 566         }
 567
 568         if (nread == 0 && state->out_data.length != 0) {
 569                 tevent_req_nterror(req, NT_STATUS_END_OF_FILE);
 570                 return;
 571         }
 572
 573         state->out_data.length = nread;
 574         state->out_remaining = 0;
 575
 576         tevent_req_done(req);
 577 }
 578
 579 static NTSTATUS smbd_smb2_read_recv(struct tevent_req *req,
 580                                     TALLOC_CTX *mem_ctx,
 581                                     DATA_BLOB *out_data,
 582                                     uint32_t *out_remaining)
 583 {
 584         NTSTATUS status;
 585         struct smbd_smb2_read_state *state = tevent_req_data(req,
 586                                              struct smbd_smb2_read_state);
 587
 588         if (tevent_req_is_nterror(req, &status)) {
 589                 tevent_req_received(req);
 590                 return status;
 591         }
 592
 593         *out_data = state->out_data;
 594         talloc_steal(mem_ctx, out_data->data);
 595         *out_remaining = state->out_remaining;
 596
 597         tevent_req_received(req);
 598         return NT_STATUS_OK;
 599 }