source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../lib/util/tevent_ntstatus.h"
  27 #include "../lib/ccan/build_assert/build_assert.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32
  33 #define COPYCHUNK_MAX_CHUNKS    256             /* 2k8r2 & win8 = 256 */
  34 #define COPYCHUNK_MAX_CHUNK_LEN 1048576         /* 2k8r2 & win8 = 1048576 */
  35 #define COPYCHUNK_MAX_TOTAL_LEN 16777216        /* 2k8r2 & win8 = 16777216 */
  36 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  37 {
  38         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  39         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  40         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  41 }
  42
  43 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  44 {
  45         uint32_t i;
  46         uint32_t total_len = 0;
  47
  48         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  49                 return NT_STATUS_INVALID_PARAMETER;
  50         }
  51
  52         for (i = 0; i < cc_copy->chunk_count; i++) {
  53                 if (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN) {
  54                         return NT_STATUS_INVALID_PARAMETER;
  55                 }
  56                 total_len += cc_copy->chunks[i].length;
  57         }
  58         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  59                 return NT_STATUS_INVALID_PARAMETER;
  60         }
  61
  62         return NT_STATUS_OK;
  63 }
  64
  65 struct fsctl_srv_copychunk_state {
  66         struct connection_struct *conn;
  67         uint32_t dispatch_count;
  68         uint32_t recv_count;
  69         uint32_t bad_recv_count;
  70         NTSTATUS status;
  71         off_t total_written;
  72 };
  73 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  74
  75 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
  76                                                    struct tevent_context *ev,
  77                                                    struct files_struct *dst_fsp,
  78                                                    DATA_BLOB *in_input,
  79                                                    struct smbd_server_connection *sconn)
  80 {
  81         struct tevent_req *req;
  82         struct srv_copychunk_copy cc_copy;
  83         enum ndr_err_code ndr_ret;
  84         struct file_id src_file_id;
  85         struct files_struct *src_fsp;
  86         int i;
  87         struct srv_copychunk *chunk;
  88         struct fsctl_srv_copychunk_state *state;
  89
  90         req = tevent_req_create(mem_ctx, &state,
  91                                 struct fsctl_srv_copychunk_state);
  92         if (req == NULL) {
  93                 return NULL;
  94         }
  95         state->conn = dst_fsp->conn;
  96         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
  97                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
  98         if (ndr_ret != NDR_ERR_SUCCESS) {
  99                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 100                 state->status = NT_STATUS_INVALID_PARAMETER;
 101                 tevent_req_nterror(req, state->status);
 102                 return tevent_req_post(req, ev);
 103         }
 104
 105         /* file id is sent as a copychunk resume key */
 106         ZERO_STRUCT(src_file_id);
 107         BUILD_ASSERT(ARRAY_SIZE(cc_copy.source_key) == sizeof(src_file_id));
 108         memcpy(&src_file_id, cc_copy.source_key, ARRAY_SIZE(cc_copy.source_key));
 109         src_fsp = file_find_di_first(sconn, src_file_id);
 110         if (src_fsp == NULL) {
 111                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 112                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 113                 tevent_req_nterror(req, state->status);
 114                 return tevent_req_post(req, ev);
 115         }
 116
 117         state->status = copychunk_check_limits(&cc_copy);
 118         if (tevent_req_nterror(req, state->status)) {
 119                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 120                 return tevent_req_post(req, ev);
 121         }
 122
 123         for (i = 0; i < cc_copy.chunk_count; i++) {
 124                 struct tevent_req *vfs_subreq;
 125                 chunk = &cc_copy.chunks[i];
 126                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 127                                                      state, ev,
 128                                                      src_fsp, chunk->source_off,
 129                                                      dst_fsp, chunk->target_off,
 130                                                      chunk->length);
 131                 if (vfs_subreq == NULL) {
 132                         DEBUG(0, ("VFS copy chunk send failed\n"));
 133                         state->status = NT_STATUS_NO_MEMORY;
 134                         if (state->dispatch_count == 0) {
 135                                 /* nothing dispatched, return immediately */
 136                                 tevent_req_nterror(req, state->status);
 137                                 return tevent_req_post(req, ev);
 138                         } else {
 139                                 /*
 140                                  * wait for dispatched to complete before
 141                                  * returning error
 142                                  */
 143                                 break;
 144                         }
 145                 }
 146                 tevent_req_set_callback(vfs_subreq,
 147                                         fsctl_srv_copychunk_vfs_done, req);
 148                 state->dispatch_count++;
 149         }
 150
 151         return req;
 152 }
 153
 154 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 155 {
 156         struct tevent_req *req = tevent_req_callback_data(
 157                 subreq, struct tevent_req);
 158         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 159                                         struct fsctl_srv_copychunk_state);
 160         off_t chunk_nwritten;
 161         NTSTATUS status;
 162
 163         state->recv_count++;
 164         status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
 165                                          &chunk_nwritten);
 166         if (NT_STATUS_IS_OK(status)) {
 167                 DEBUG(10, ("good copy chunk recv %d of %d\n",
 168                            state->recv_count,
 169                            state->dispatch_count));
 170                 state->total_written += chunk_nwritten;
 171         } else {
 172                 DEBUG(0, ("bad status in copy chunk recv %d of %d: %s\n",
 173                           state->recv_count,
 174                           state->dispatch_count,
 175                           nt_errstr(status)));
 176                 state->bad_recv_count++;
 177                 /* may overwrite previous failed status */
 178                 state->status = status;
 179         }
 180
 181         if (state->recv_count != state->dispatch_count) {
 182                 /*
 183                  * Wait for all VFS copy_chunk requests to complete, even
 184                  * if an error is received for a specific chunk.
 185                  */
 186                 return;
 187         }
 188
 189         /* all VFS copy_chunk requests done */
 190         if (!tevent_req_nterror(req, state->status)) {
 191                 tevent_req_done(req);
 192         }
 193 }
 194
 195 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 196                                          struct srv_copychunk_rsp *cc_rsp)
 197 {
 198         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 199                                         struct fsctl_srv_copychunk_state);
 200         NTSTATUS status;
 201
 202         if (NT_STATUS_EQUAL(state->status, NT_STATUS_INVALID_PARAMETER)) {
 203                 /* 2.2.32.1 - send back our maximum transfer size limits */
 204                 copychunk_pack_limits(cc_rsp);
 205                 tevent_req_received(req);
 206                 return NT_STATUS_INVALID_PARAMETER;
 207         }
 208
 209         cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
 210         cc_rsp->chunk_bytes_written = 0;
 211         cc_rsp->total_bytes_written = state->total_written;
 212         status = state->status;
 213         tevent_req_received(req);
 214
 215         return status;
 216 }
 217
 218 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 219                                         struct tevent_context *ev,
 220                                         struct smbXsrv_connection *conn,
 221                                         DATA_BLOB *in_input,
 222                                         uint32_t in_max_output,
 223                                         DATA_BLOB *out_output,
 224                                         bool *disconnect)
 225 {
 226         uint32_t in_capabilities;
 227         DATA_BLOB in_guid_blob;
 228         struct GUID in_guid;
 229         uint16_t in_security_mode;
 230         uint16_t in_num_dialects;
 231         uint16_t i;
 232         DATA_BLOB out_guid_blob;
 233         NTSTATUS status;
 234
 235         if (in_input->length < 0x18) {
 236                 return NT_STATUS_INVALID_PARAMETER;
 237         }
 238
 239         in_capabilities = IVAL(in_input->data, 0x00);
 240         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 241         in_security_mode = SVAL(in_input->data, 0x14);
 242         in_num_dialects = SVAL(in_input->data, 0x16);
 243
 244         if (in_input->length < (0x18 + in_num_dialects*2)) {
 245                 return NT_STATUS_INVALID_PARAMETER;
 246         }
 247
 248         if (in_max_output < 0x18) {
 249                 return NT_STATUS_BUFFER_TOO_SMALL;
 250         }
 251
 252         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 253         if (!NT_STATUS_IS_OK(status)) {
 254                 return status;
 255         }
 256
 257         if (in_num_dialects != conn->smb2.client.num_dialects) {
 258                 *disconnect = true;
 259                 return NT_STATUS_ACCESS_DENIED;
 260         }
 261
 262         for (i=0; i < in_num_dialects; i++) {
 263                 uint16_t v = SVAL(in_input->data, 0x18 + i*2);
 264
 265                 if (conn->smb2.client.dialects[i] != v) {
 266                         *disconnect = true;
 267                         return NT_STATUS_ACCESS_DENIED;
 268                 }
 269         }
 270
 271         if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) {
 272                 *disconnect = true;
 273                 return NT_STATUS_ACCESS_DENIED;
 274         }
 275
 276         if (in_security_mode != conn->smb2.client.security_mode) {
 277                 *disconnect = true;
 278                 return NT_STATUS_ACCESS_DENIED;
 279         }
 280
 281         if (in_capabilities != conn->smb2.client.capabilities) {
 282                 *disconnect = true;
 283                 return NT_STATUS_ACCESS_DENIED;
 284         }
 285
 286         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 287                                   &out_guid_blob);
 288         if (!NT_STATUS_IS_OK(status)) {
 289                 return status;
 290         }
 291
 292         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 293         if (out_output->data == NULL) {
 294                 return NT_STATUS_NO_MEMORY;
 295         }
 296
 297         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 298         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 299         SIVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 300         SIVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 301
 302         return NT_STATUS_OK;
 303 }
 304
 305 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
 306                                          struct tevent_context *ev,
 307                                          struct files_struct *fsp,
 308                                          uint32_t in_max_output,
 309                                          DATA_BLOB *out_output)
 310 {
 311         struct req_resume_key_rsp rkey_rsp;
 312         enum ndr_err_code ndr_ret;
 313         DATA_BLOB output;
 314
 315         if (fsp == NULL) {
 316                 return NT_STATUS_FILE_CLOSED;
 317         }
 318
 319         ZERO_STRUCT(rkey_rsp);
 320         /* use the file id as a copychunk resume key */
 321         BUILD_ASSERT(ARRAY_SIZE(rkey_rsp.resume_key) == sizeof(fsp->file_id));
 322         memcpy(rkey_rsp.resume_key, &fsp->file_id, sizeof(fsp->file_id));
 323
 324         ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
 325                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 326         if (ndr_ret != NDR_ERR_SUCCESS) {
 327                 return NT_STATUS_INTERNAL_ERROR;
 328         }
 329
 330         if (in_max_output < output.length) {
 331                 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
 332                           in_max_output, (long int)output.length));
 333                 return NT_STATUS_INVALID_PARAMETER;
 334         }
 335         *out_output = output;
 336
 337         return NT_STATUS_OK;
 338 }
 339
 340 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 341
 342 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 343                                          struct tevent_context *ev,
 344                                          struct tevent_req *req,
 345                                          struct smbd_smb2_ioctl_state *state)
 346 {
 347         struct tevent_req *subreq;
 348         NTSTATUS status;
 349
 350         switch (ctl_code) {
 351         case FSCTL_SRV_COPYCHUNK:
 352                 subreq = fsctl_srv_copychunk_send(state, ev, state->fsp,
 353                                                   &state->in_input,
 354                                                   state->smb2req->sconn);
 355                 if (tevent_req_nomem(subreq, req)) {
 356                         return tevent_req_post(req, ev);
 357                 }
 358                 tevent_req_set_callback(subreq,
 359                                         smb2_ioctl_network_fs_copychunk_done,
 360                                         req);
 361                 return req;
 362                 break;
 363         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 364                 status = fsctl_validate_neg_info(state, ev,
 365                                                  state->smbreq->sconn->conn,
 366                                                  &state->in_input,
 367                                                  state->in_max_output,
 368                                                  &state->out_output,
 369                                                  &state->disconnect);
 370                 if (!tevent_req_nterror(req, status)) {
 371                         tevent_req_done(req);
 372                 }
 373                 return tevent_req_post(req, ev);
 374                 break;
 375         case FSCTL_SRV_REQUEST_RESUME_KEY:
 376                 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
 377                                                   state->in_max_output,
 378                                                   &state->out_output);
 379                 if (!tevent_req_nterror(req, status)) {
 380                         tevent_req_done(req);
 381                 }
 382                 return tevent_req_post(req, ev);
 383                 break;
 384         default: {
 385                 uint8_t *out_data = NULL;
 386                 uint32_t out_data_len = 0;
 387
 388                 status = SMB_VFS_FSCTL(state->fsp,
 389                                        state,
 390                                        ctl_code,
 391                                        state->smbreq->flags2,
 392                                        state->in_input.data,
 393                                        state->in_input.length,
 394                                        &out_data,
 395                                        state->in_max_output,
 396                                        &out_data_len);
 397                 state->out_output = data_blob_const(out_data, out_data_len);
 398                 if (NT_STATUS_IS_OK(status)) {
 399                         tevent_req_done(req);
 400                         return tevent_req_post(req, ev);
 401                 }
 402
 403                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 404                         if (IS_IPC(state->smbreq->conn)) {
 405                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 406                         } else {
 407                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 408                         }
 409                 }
 410
 411                 tevent_req_nterror(req, status);
 412                 return tevent_req_post(req, ev);
 413                 break;
 414         }
 415         }
 416
 417         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 418         return tevent_req_post(req, ev);
 419 }
 420
 421 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 422 {
 423         struct tevent_req *req = tevent_req_callback_data(subreq,
 424                                                           struct tevent_req);
 425         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 426                                                 struct smbd_smb2_ioctl_state);
 427         struct srv_copychunk_rsp cc_rsp;
 428         NTSTATUS status;
 429         enum ndr_err_code ndr_ret;
 430
 431         ZERO_STRUCT(cc_rsp);
 432         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp);
 433
 434         ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 435                                        ioctl_state,
 436                                        &cc_rsp,
 437                         (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 438         if (ndr_ret != NDR_ERR_SUCCESS) {
 439                 status = NT_STATUS_INTERNAL_ERROR;
 440         }
 441
 442         if (!tevent_req_nterror(req, status)) {
 443                 tevent_req_done(req);
 444         }
 445 }