2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/globals.h"
23 #include "../libcli/smb/smb_common.h"
25 static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
26 struct tevent_context *ev,
27 struct smbd_smb2_request *smb2req,
28 uint8_t in_file_info_class,
30 uint32_t in_file_index,
31 uint64_t in_file_id_volatile,
32 uint32_t in_output_buffer_length,
33 const char *in_file_name);
34 static NTSTATUS smbd_smb2_find_recv(struct tevent_req *req,
36 DATA_BLOB *out_output_buffer);
38 static void smbd_smb2_request_find_done(struct tevent_req *subreq);
39 NTSTATUS smbd_smb2_request_process_find(struct smbd_smb2_request *req)
42 const uint8_t *inbody;
43 int i = req->current_idx;
44 size_t expected_body_size = 0x21;
46 uint8_t in_file_info_class;
48 uint32_t in_file_index;
49 uint64_t in_file_id_persistent;
50 uint64_t in_file_id_volatile;
51 uint16_t in_file_name_offset;
52 uint16_t in_file_name_length;
53 DATA_BLOB in_file_name_buffer;
54 char *in_file_name_string;
55 size_t in_file_name_string_size;
56 uint32_t in_output_buffer_length;
57 struct tevent_req *subreq;
60 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
61 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
62 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
65 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
67 body_size = SVAL(inbody, 0x00);
68 if (body_size != expected_body_size) {
69 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
72 in_file_info_class = CVAL(inbody, 0x02);
73 in_flags = CVAL(inbody, 0x03);
74 in_file_index = IVAL(inbody, 0x04);
75 in_file_id_persistent = BVAL(inbody, 0x08);
76 in_file_id_volatile = BVAL(inbody, 0x10);
77 in_file_name_offset = SVAL(inbody, 0x18);
78 in_file_name_length = SVAL(inbody, 0x1A);
79 in_output_buffer_length = IVAL(inbody, 0x1C);
81 if (in_file_name_offset == 0 && in_file_name_length == 0) {
83 } else if (in_file_name_offset !=
84 (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
85 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
88 if (in_file_name_length > req->in.vector[i+2].iov_len) {
89 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
92 /* The output header is 8 bytes. */
93 if (in_output_buffer_length <= 8) {
94 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
97 DEBUG(10,("smbd_smb2_request_find_done: in_output_buffer_length = %u\n",
98 (unsigned int)in_output_buffer_length ));
100 /* Take into account the output header. */
101 in_output_buffer_length -= 8;
103 in_file_name_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
104 in_file_name_buffer.length = in_file_name_length;
106 ok = convert_string_talloc(req, CH_UTF16, CH_UNIX,
107 in_file_name_buffer.data,
108 in_file_name_buffer.length,
109 &in_file_name_string,
110 &in_file_name_string_size, false);
112 return smbd_smb2_request_error(req, NT_STATUS_ILLEGAL_CHARACTER);
115 if (req->compat_chain_fsp) {
117 } else if (in_file_id_persistent != 0) {
118 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
121 subreq = smbd_smb2_find_send(req,
122 req->sconn->smb2.event_ctx,
128 in_output_buffer_length,
129 in_file_name_string);
130 if (subreq == NULL) {
131 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
133 tevent_req_set_callback(subreq, smbd_smb2_request_find_done, req);
135 return smbd_smb2_request_pending_queue(req, subreq);
138 static void smbd_smb2_request_find_done(struct tevent_req *subreq)
140 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
141 struct smbd_smb2_request);
142 int i = req->current_idx;
146 uint16_t out_output_buffer_offset;
147 DATA_BLOB out_output_buffer = data_blob_null;
149 NTSTATUS error; /* transport error */
151 status = smbd_smb2_find_recv(subreq,
155 if (!NT_STATUS_IS_OK(status)) {
156 error = smbd_smb2_request_error(req, status);
157 if (!NT_STATUS_IS_OK(error)) {
158 smbd_server_connection_terminate(req->sconn,
165 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
167 outhdr = (uint8_t *)req->out.vector[i].iov_base;
169 outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
170 if (outbody.data == NULL) {
171 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
172 if (!NT_STATUS_IS_OK(error)) {
173 smbd_server_connection_terminate(req->sconn,
180 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
181 SSVAL(outbody.data, 0x02,
182 out_output_buffer_offset); /* output buffer offset */
183 SIVAL(outbody.data, 0x04,
184 out_output_buffer.length); /* output buffer length */
186 DEBUG(10,("smbd_smb2_request_find_done: out_output_buffer.length = %u\n",
187 (unsigned int)out_output_buffer.length ));
189 outdyn = out_output_buffer;
191 error = smbd_smb2_request_done(req, outbody, &outdyn);
192 if (!NT_STATUS_IS_OK(error)) {
193 smbd_server_connection_terminate(req->sconn,
199 struct smbd_smb2_find_state {
200 struct smbd_smb2_request *smb2req;
201 DATA_BLOB out_output_buffer;
204 static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
205 struct tevent_context *ev,
206 struct smbd_smb2_request *smb2req,
207 uint8_t in_file_info_class,
209 uint32_t in_file_index,
210 uint64_t in_file_id_volatile,
211 uint32_t in_output_buffer_length,
212 const char *in_file_name)
214 struct tevent_req *req;
215 struct smbd_smb2_find_state *state;
216 struct smb_request *smbreq;
217 connection_struct *conn = smb2req->tcon->compat_conn;
220 NTSTATUS empty_status;
226 int last_entry_off = 0;
229 uint32_t dirtype = aHIDDEN | aSYSTEM | aDIR;
230 const char *directory;
231 bool dont_descend = false;
232 bool ask_sharemode = true;
234 req = tevent_req_create(mem_ctx, &state,
235 struct smbd_smb2_find_state);
239 state->smb2req = smb2req;
240 state->out_output_buffer = data_blob_null;
242 DEBUG(10,("smbd_smb2_find_send: file_id[0x%016llX]\n",
243 (unsigned long long)in_file_id_volatile));
245 smbreq = smbd_smb2_fake_smb_request(smb2req);
246 if (tevent_req_nomem(smbreq, req)) {
247 return tevent_req_post(req, ev);
250 fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
252 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
253 return tevent_req_post(req, ev);
255 if (conn != fsp->conn) {
256 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
257 return tevent_req_post(req, ev);
259 if (smb2req->session->vuid != fsp->vuid) {
260 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
261 return tevent_req_post(req, ev);
264 if (!fsp->is_directory) {
265 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
266 return tevent_req_post(req, ev);
269 directory = fsp->fsp_name->base_name;
271 if (strcmp(in_file_name, "") == 0) {
272 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
273 return tevent_req_post(req, ev);
275 if (strcmp(in_file_name, "\\") == 0) {
276 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
277 return tevent_req_post(req, ev);
279 if (strcmp(in_file_name, "/") == 0) {
280 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
281 return tevent_req_post(req, ev);
284 if (in_output_buffer_length > 0x10000) {
285 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
286 return tevent_req_post(req, ev);
289 switch (in_file_info_class) {
290 case SMB2_FIND_DIRECTORY_INFO:
291 info_level = SMB_FIND_FILE_DIRECTORY_INFO;
294 case SMB2_FIND_FULL_DIRECTORY_INFO:
295 info_level = SMB_FIND_FILE_FULL_DIRECTORY_INFO;
298 case SMB2_FIND_BOTH_DIRECTORY_INFO:
299 info_level = SMB_FIND_FILE_BOTH_DIRECTORY_INFO;
302 case SMB2_FIND_NAME_INFO:
303 info_level = SMB_FIND_FILE_NAMES_INFO;
306 case SMB2_FIND_ID_BOTH_DIRECTORY_INFO:
307 info_level = SMB_FIND_ID_BOTH_DIRECTORY_INFO;
310 case SMB2_FIND_ID_FULL_DIRECTORY_INFO:
311 info_level = SMB_FIND_ID_FULL_DIRECTORY_INFO;
315 tevent_req_nterror(req, NT_STATUS_INVALID_INFO_CLASS);
316 return tevent_req_post(req, ev);
319 if (in_flags & SMB2_CONTINUE_FLAG_REOPEN) {
321 dptr_CloseDir(fsp->dptr);
326 if (fsp->dptr == NULL) {
329 if (!(fsp->access_mask & SEC_DIR_LIST)) {
330 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
331 return tevent_req_post(req, ev);
334 wcard_has_wild = ms_has_wild(in_file_name);
336 status = dptr_create(conn,
338 false, /* old_handle */
339 false, /* expect_close */
341 in_file_name, /* wcard */
345 if (!NT_STATUS_IS_OK(status)) {
346 tevent_req_nterror(req, status);
347 return tevent_req_post(req, ev);
350 empty_status = NT_STATUS_NO_SUCH_FILE;
352 empty_status = STATUS_NO_MORE_FILES;
355 if (in_flags & SMB2_CONTINUE_FLAG_RESTART) {
356 dptr_SeekDir(fsp->dptr, 0);
359 if (in_flags & SMB2_CONTINUE_FLAG_SINGLE) {
362 max_count = UINT16_MAX;
365 #define DIR_ENTRY_SAFETY_MARGIN 4096
367 state->out_output_buffer = data_blob_talloc(state, NULL,
368 in_output_buffer_length + DIR_ENTRY_SAFETY_MARGIN);
369 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
370 return tevent_req_post(req, ev);
373 state->out_output_buffer.length = 0;
374 pdata = (char *)state->out_output_buffer.data;
377 * end_data must include the safety margin as it's what is
378 * used to determine if pushed strings have been truncated.
380 end_data = pdata + in_output_buffer_length + DIR_ENTRY_SAFETY_MARGIN - 1;
385 DEBUG(8,("smbd_smb2_find_send: dirpath=<%s> dontdescend=<%s>, "
386 "in_output_buffer_length = %u\n",
387 directory, lp_dontdescend(SNUM(conn)),
388 (unsigned int)in_output_buffer_length ));
389 if (in_list(directory,lp_dontdescend(SNUM(conn)),conn->case_sensitive)) {
393 ask_sharemode = lp_parm_bool(SNUM(conn),
394 "smbd", "search ask sharemode",
399 bool got_exact_match = false;
400 bool out_of_space = false;
401 int space_remaining = in_output_buffer_length - off;
403 SMB_ASSERT(space_remaining >= 0);
405 ok = smbd_dirptr_lanman2_entry(state,
412 false, /* requires_resume_key */
415 8, /* align to 8 bytes */
416 false, /* no padding */
426 off = (int)PTR_DIFF(pdata, base_data);
430 SIVAL(state->out_output_buffer.data, last_entry_off, 0);
431 tevent_req_done(req);
432 return tevent_req_post(req, ev);
433 } else if (out_of_space) {
434 tevent_req_nterror(req, NT_STATUS_INFO_LENGTH_MISMATCH);
435 return tevent_req_post(req, ev);
437 tevent_req_nterror(req, empty_status);
438 return tevent_req_post(req, ev);
443 state->out_output_buffer.length = off;
445 if (num < max_count) {
449 SIVAL(state->out_output_buffer.data, last_entry_off, 0);
450 tevent_req_done(req);
451 return tevent_req_post(req, ev);
454 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
455 return tevent_req_post(req, ev);
458 static NTSTATUS smbd_smb2_find_recv(struct tevent_req *req,
460 DATA_BLOB *out_output_buffer)
463 struct smbd_smb2_find_state *state = tevent_req_data(req,
464 struct smbd_smb2_find_state);
466 if (tevent_req_is_nterror(req, &status)) {
467 tevent_req_received(req);
471 *out_output_buffer = state->out_output_buffer;
472 talloc_steal(mem_ctx, out_output_buffer->data);
474 tevent_req_received(req);