source3/smbd/smb2_ioctl_filesys.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2013-2015
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "rpc_server/srv_pipe_hnd.h"
  29 #include "include/ntioctl.h"
  30 #include "../librpc/ndr/libndr.h"
  31 #include "librpc/gen_ndr/ndr_ioctl.h"
  32 #include "smb2_ioctl_private.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_SMB2
  36
  37 /*
  38  * XXX this may reduce dup_extents->byte_count so that it's less than the
  39  * target file size.
  40  */
  41 static NTSTATUS fsctl_dup_extents_check_lengths(struct files_struct *src_fsp,
  42                                                 struct files_struct *dst_fsp,
  43                                 struct fsctl_dup_extents_to_file *dup_extents)
  44 {
  45         NTSTATUS status;
  46
  47         if ((dup_extents->source_off + dup_extents->byte_count
  48                                                 < dup_extents->source_off)
  49          || (dup_extents->target_off + dup_extents->byte_count
  50                                                 < dup_extents->target_off)) {
  51                 return NT_STATUS_INVALID_PARAMETER;     /* wrap */
  52         }
  53
  54         status = vfs_stat_fsp(src_fsp);
  55         if (!NT_STATUS_IS_OK(status)) {
  56                 return status;
  57         }
  58
  59         /*
  60          * XXX vfs_btrfs and vfs_default have size checks in the copychunk
  61          * handler, as this needs to be rechecked after the src has potentially
  62          * been extended by a previous chunk in the compound copychunk req.
  63          */
  64         if (src_fsp->fsp_name->st.st_ex_size
  65                         < dup_extents->source_off + dup_extents->byte_count) {
  66                 DEBUG(2, ("dup_extents req exceeds src size\n"));
  67                 return NT_STATUS_NOT_SUPPORTED;
  68         }
  69
  70         status = vfs_stat_fsp(dst_fsp);
  71         if (!NT_STATUS_IS_OK(status)) {
  72                 return status;
  73         }
  74
  75         if (dst_fsp->fsp_name->st.st_ex_size
  76                         < dup_extents->target_off + dup_extents->byte_count) {
  77
  78                 if (dst_fsp->fsp_name->st.st_ex_size - dup_extents->target_off
  79                                         > dst_fsp->fsp_name->st.st_ex_size) {
  80                         return NT_STATUS_INVALID_PARAMETER;     /* wrap */
  81                 }
  82
  83                 /*
  84                  * this server behaviour is pretty hairy, but we need to match
  85                  * Windows, so...
  86                  */
  87                 DEBUG(2, ("dup_extents req exceeds target size, capping\n"));
  88                 dup_extents->byte_count = dst_fsp->fsp_name->st.st_ex_size
  89                                                 - dup_extents->target_off;
  90         }
  91
  92         return NT_STATUS_OK;
  93 }
  94
  95 static NTSTATUS fsctl_dup_extents_check_overlap(struct files_struct *src_fsp,
  96                                                 struct files_struct *dst_fsp,
  97                                 struct fsctl_dup_extents_to_file *dup_extents)
  98 {
  99         uint64_t src_off_last;
 100         uint64_t tgt_off_last;
 101
 102         if (!file_id_equal(&src_fsp->file_id, &dst_fsp->file_id)) {
 103                 /* src and dest refer to different files */
 104                 return NT_STATUS_OK;
 105         }
 106
 107         if (dup_extents->byte_count == 0) {
 108                 /* no range to overlap */
 109                 return NT_STATUS_OK;
 110         }
 111
 112         /*
 113          * [MS-FSCC] 2.3.8 FSCTL_DUPLICATE_EXTENTS_TO_FILE Reply
 114          * STATUS_NOT_SUPPORTED:
 115          * The source and target destination ranges overlap on the same file.
 116          */
 117
 118         src_off_last = dup_extents->source_off + dup_extents->byte_count - 1;
 119         if ((dup_extents->target_off >= dup_extents->source_off)
 120                                 && (dup_extents->target_off <= src_off_last)) {
 121                 /*
 122                  * src: |-----------|
 123                  * tgt:       |-----------|
 124                  */
 125                 return NT_STATUS_NOT_SUPPORTED;
 126         }
 127
 128
 129         tgt_off_last = dup_extents->target_off + dup_extents->byte_count - 1;
 130         if ((tgt_off_last >= dup_extents->source_off)
 131                                         && (tgt_off_last <= src_off_last)) {
 132                 /*
 133                  * src:       |-----------|
 134                  * tgt: |-----------|
 135                  */
 136                 return NT_STATUS_NOT_SUPPORTED;
 137         }
 138
 139         return NT_STATUS_OK;
 140 }
 141
 142 static NTSTATUS fsctl_dup_extents_check_sparse(struct files_struct *src_fsp,
 143                                                struct files_struct *dst_fsp)
 144 {
 145         /*
 146          * 2.3.8 FSCTL_DUPLICATE_EXTENTS_TO_FILE Reply...
 147          * STATUS_NOT_SUPPORTED: Target file is sparse, while source
 148          *                       is a non-sparse file.
 149          *
 150          * WS2016 has the following behaviour (MS are in the process of fixing
 151          * the spec):
 152          * STATUS_NOT_SUPPORTED is returned if the source is sparse, while the
 153          * target is non-sparse. However, if target is sparse while the source
 154          * is non-sparse, then FSCTL_DUPLICATE_EXTENTS_TO_FILE completes
 155          * successfully.
 156          */
 157         if ((src_fsp->is_sparse) && (!dst_fsp->is_sparse)) {
 158                 return NT_STATUS_NOT_SUPPORTED;
 159         }
 160
 161         return NT_STATUS_OK;
 162 }
 163
 164 struct fsctl_dup_extents_state {
 165         struct tevent_context *ev;
 166         struct connection_struct *conn;
 167         struct files_struct *dst_fsp;
 168         struct fsctl_dup_extents_to_file dup_extents;
 169 };
 170
 171 static void fsctl_dup_extents_offload_read_done(struct tevent_req *subreq);
 172 static void fsctl_dup_extents_vfs_done(struct tevent_req *subreq);
 173
 174 static struct tevent_req *fsctl_dup_extents_send(TALLOC_CTX *mem_ctx,
 175                                                  struct tevent_context *ev,
 176                                                  struct files_struct *dst_fsp,
 177                                                  DATA_BLOB *in_input,
 178                                                  struct smbd_smb2_request *smb2req)
 179 {
 180         struct tevent_req *req = NULL;
 181         struct tevent_req *subreq = NULL;
 182         struct fsctl_dup_extents_state *state = NULL;
 183         uint64_t src_fid_persistent = 0;
 184         uint64_t src_fid_volatile = 0;
 185         struct files_struct *src_fsp = NULL;
 186         int ndr_ret;
 187         NTSTATUS status;
 188
 189         req = tevent_req_create(mem_ctx, &state,
 190                                 struct fsctl_dup_extents_state);
 191         if (req == NULL) {
 192                 return NULL;
 193         }
 194
 195         if (dst_fsp == NULL) {
 196                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 197                 return tevent_req_post(req, ev);
 198         }
 199
 200         *state = (struct fsctl_dup_extents_state) {
 201                 .conn = dst_fsp->conn,
 202                 .ev = ev,
 203                 .dst_fsp = dst_fsp,
 204         };
 205
 206         if ((dst_fsp->conn->fs_capabilities
 207                                 & FILE_SUPPORTS_BLOCK_REFCOUNTING) == 0) {
 208                 DBG_INFO("FS does not advertise block refcounting support\n");
 209                 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 210                 return tevent_req_post(req, ev);
 211         }
 212
 213         ndr_ret = ndr_pull_struct_blob(in_input, state, &state->dup_extents,
 214                        (ndr_pull_flags_fn_t)ndr_pull_fsctl_dup_extents_to_file);
 215         if (ndr_ret != NDR_ERR_SUCCESS) {
 216                 DBG_ERR("failed to unmarshall dup extents to file req\n");
 217                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 218                 return tevent_req_post(req, ev);
 219         }
 220
 221         src_fid_persistent = BVAL(state->dup_extents.source_fid, 0);
 222         src_fid_volatile = BVAL(state->dup_extents.source_fid, 8);
 223         src_fsp = file_fsp_get(smb2req, src_fid_persistent, src_fid_volatile);
 224         if ((src_fsp == NULL)
 225                       || (src_fsp->file_id.devid != dst_fsp->file_id.devid)) {
 226                 /*
 227                  * [MS-FSCC] 2.3.8 FSCTL_DUPLICATE_EXTENTS_TO_FILE Reply
 228                  * STATUS_INVALID_PARAMETER:
 229                  * The FileHandle parameter is either invalid or does not
 230                  * represent a handle to an opened file on the same volume.
 231                  *
 232                  * Windows Server responds with NT_STATUS_INVALID_HANDLE instead
 233                  * of STATUS_INVALID_PARAMETER here, despite the above spec.
 234                  */
 235                 DBG_ERR("invalid src_fsp for dup_extents\n");
 236                 tevent_req_nterror(req, NT_STATUS_INVALID_HANDLE);
 237                 return tevent_req_post(req, ev);
 238         }
 239
 240         status = fsctl_dup_extents_check_lengths(src_fsp, dst_fsp,
 241                                                  &state->dup_extents);
 242         if (!NT_STATUS_IS_OK(status)) {
 243                 tevent_req_nterror(req, status);
 244                 return tevent_req_post(req, ev);
 245         }
 246
 247         if (state->dup_extents.byte_count == 0) {
 248                 DBG_ERR("skipping zero length dup extents\n");
 249                 tevent_req_done(req);
 250                 return tevent_req_post(req, ev);
 251         }
 252
 253         status = fsctl_dup_extents_check_overlap(src_fsp, dst_fsp,
 254                                                  &state->dup_extents);
 255         if (!NT_STATUS_IS_OK(status)) {
 256                 tevent_req_nterror(req, status);
 257                 return tevent_req_post(req, ev);
 258         }
 259
 260         status = fsctl_dup_extents_check_sparse(src_fsp, dst_fsp);
 261         if (!NT_STATUS_IS_OK(status)) {
 262                 tevent_req_nterror(req, status);
 263                 return tevent_req_post(req, ev);
 264         }
 265
 266         subreq = SMB_VFS_OFFLOAD_READ_SEND(state, ev, src_fsp,
 267                                            FSCTL_DUP_EXTENTS_TO_FILE,
 268                                            0, 0, 0);
 269         if (tevent_req_nomem(subreq, req)) {
 270                 return tevent_req_post(req, ev);
 271         }
 272         tevent_req_set_callback(subreq, fsctl_dup_extents_offload_read_done,
 273                                 req);
 274         return req;
 275 }
 276
 277 static void fsctl_dup_extents_offload_read_done(struct tevent_req *subreq)
 278 {
 279         struct tevent_req *req = tevent_req_callback_data(
 280                 subreq, struct tevent_req);
 281         struct fsctl_dup_extents_state *state = tevent_req_data(
 282                 req, struct fsctl_dup_extents_state);
 283         DATA_BLOB token;
 284         NTSTATUS status;
 285
 286         status = SMB_VFS_OFFLOAD_READ_RECV(subreq, state->dst_fsp->conn,
 287                                            state, &token);
 288         if (tevent_req_nterror(req, status)) {
 289                 return;
 290         }
 291
 292         /* tell the VFS to ignore locks across the clone, matching ReFS */
 293         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 294                                             state,
 295                                             state->ev,
 296                                             FSCTL_DUP_EXTENTS_TO_FILE,
 297                                             &token,
 298                                             state->dup_extents.source_off,
 299                                             state->dst_fsp,
 300                                             state->dup_extents.target_off,
 301                                             state->dup_extents.byte_count);
 302         if (tevent_req_nomem(subreq, req)) {
 303                 return;
 304         }
 305         tevent_req_set_callback(subreq, fsctl_dup_extents_vfs_done, req);
 306         return;
 307 }
 308
 309 static void fsctl_dup_extents_vfs_done(struct tevent_req *subreq)
 310 {
 311         struct tevent_req *req = tevent_req_callback_data(
 312                 subreq, struct tevent_req);
 313         struct fsctl_dup_extents_state *state = tevent_req_data(
 314                 req, struct fsctl_dup_extents_state);
 315         off_t nb_chunk;
 316         NTSTATUS status;
 317
 318         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq, &nb_chunk);
 319         TALLOC_FREE(subreq);
 320         if (tevent_req_nterror(req, status)) {
 321                 return;
 322         }
 323
 324         if (nb_chunk != state->dup_extents.byte_count) {
 325                 tevent_req_nterror(req, NT_STATUS_IO_DEVICE_ERROR);
 326                 return;
 327         }
 328
 329         tevent_req_done(req);
 330 }
 331
 332 static NTSTATUS fsctl_dup_extents_recv(struct tevent_req *req)
 333 {
 334         return tevent_req_simple_recv_ntstatus(req);
 335 }
 336
 337 static NTSTATUS fsctl_get_cmprn(TALLOC_CTX *mem_ctx,
 338                                 struct tevent_context *ev,
 339                                 struct files_struct *fsp,
 340                                 size_t in_max_output,
 341                                 DATA_BLOB *out_output)
 342 {
 343         struct compression_state cmpr_state;
 344         enum ndr_err_code ndr_ret;
 345         DATA_BLOB output;
 346         NTSTATUS status;
 347
 348         if (fsp == NULL) {
 349                 return NT_STATUS_FILE_CLOSED;
 350         }
 351
 352         /* Windows doesn't check for SEC_FILE_READ_ATTRIBUTE permission here */
 353
 354         ZERO_STRUCT(cmpr_state);
 355         if (fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) {
 356                 status = SMB_VFS_GET_COMPRESSION(fsp->conn,
 357                                                  mem_ctx,
 358                                                  fsp,
 359                                                  NULL,
 360                                                  &cmpr_state.format);
 361                 if (!NT_STATUS_IS_OK(status)) {
 362                         return status;
 363                 }
 364         } else {
 365                 /*
 366                  * bso#12144: The underlying filesystem doesn't support
 367                  * compression, so we should respond with "not-compressed"
 368                  * (like WS2016 ReFS) instead of STATUS_NOT_SUPPORTED or
 369                  * NT_STATUS_INVALID_DEVICE_REQUEST.
 370                  */
 371                 cmpr_state.format = COMPRESSION_FORMAT_NONE;
 372         }
 373
 374         ndr_ret = ndr_push_struct_blob(&output, mem_ctx,
 375                                        &cmpr_state,
 376                         (ndr_push_flags_fn_t)ndr_push_compression_state);
 377         if (ndr_ret != NDR_ERR_SUCCESS) {
 378                 return NT_STATUS_INTERNAL_ERROR;
 379         }
 380
 381         if (in_max_output < output.length) {
 382                 DEBUG(1, ("max output %u too small for compression state %ld\n",
 383                       (unsigned int)in_max_output, (long int)output.length));
 384                 return NT_STATUS_INVALID_USER_BUFFER;
 385         }
 386         *out_output = output;
 387
 388         return NT_STATUS_OK;
 389 }
 390
 391 static NTSTATUS fsctl_set_cmprn(TALLOC_CTX *mem_ctx,
 392                                 struct tevent_context *ev,
 393                                 struct files_struct *fsp,
 394                                 DATA_BLOB *in_input)
 395 {
 396         struct compression_state cmpr_state;
 397         enum ndr_err_code ndr_ret;
 398         NTSTATUS status;
 399
 400         if (fsp == NULL) {
 401                 return NT_STATUS_FILE_CLOSED;
 402         }
 403
 404         /* WRITE_DATA permission is required, WRITE_ATTRIBUTES is not */
 405         status = check_access_fsp(fsp, FILE_WRITE_DATA);
 406         if (!NT_STATUS_IS_OK(status)) {
 407                 return status;
 408         }
 409
 410         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cmpr_state,
 411                         (ndr_pull_flags_fn_t)ndr_pull_compression_state);
 412         if (ndr_ret != NDR_ERR_SUCCESS) {
 413                 DEBUG(0, ("failed to unmarshall set compression req\n"));
 414                 return NT_STATUS_INVALID_PARAMETER;
 415         }
 416
 417         status = NT_STATUS_NOT_SUPPORTED;
 418         if (fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) {
 419                 status = SMB_VFS_SET_COMPRESSION(fsp->conn,
 420                                                  mem_ctx,
 421                                                  fsp,
 422                                                  cmpr_state.format);
 423         } else if (cmpr_state.format == COMPRESSION_FORMAT_NONE) {
 424                 /*
 425                  * bso#12144: The underlying filesystem doesn't support
 426                  * compression. We should still accept set(FORMAT_NONE) requests
 427                  * (like WS2016 ReFS).
 428                  */
 429                 status = NT_STATUS_OK;
 430         }
 431
 432         return status;
 433 }
 434
 435 static NTSTATUS fsctl_zero_data(TALLOC_CTX *mem_ctx,
 436                                 struct tevent_context *ev,
 437                                 struct files_struct *fsp,
 438                                 DATA_BLOB *in_input)
 439 {
 440         struct file_zero_data_info zdata_info;
 441         enum ndr_err_code ndr_ret;
 442         struct lock_struct lck;
 443         int mode;
 444         uint64_t len;
 445         int ret;
 446         NTSTATUS status;
 447
 448         if (fsp == NULL) {
 449                 return NT_STATUS_FILE_CLOSED;
 450         }
 451
 452         /* WRITE_DATA permission is required */
 453         status = check_access_fsp(fsp, FILE_WRITE_DATA);
 454         if (!NT_STATUS_IS_OK(status)) {
 455                 return status;
 456         }
 457
 458         /* allow regardless of whether FS supports sparse or not */
 459
 460         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &zdata_info,
 461                         (ndr_pull_flags_fn_t)ndr_pull_file_zero_data_info);
 462         if (ndr_ret != NDR_ERR_SUCCESS) {
 463                 DEBUG(0, ("failed to unmarshall zero data request\n"));
 464                 return NT_STATUS_INVALID_PARAMETER;
 465         }
 466
 467         if (zdata_info.beyond_final_zero < zdata_info.file_off) {
 468                 DEBUG(0, ("invalid zero data params: off %lu, bfz, %lu\n",
 469                           (unsigned long)zdata_info.file_off,
 470                           (unsigned long)zdata_info.beyond_final_zero));
 471                 return NT_STATUS_INVALID_PARAMETER;
 472         }
 473
 474         /* convert strange "beyond final zero" param into length */
 475         len = zdata_info.beyond_final_zero - zdata_info.file_off;
 476
 477         if (len == 0) {
 478                 DEBUG(2, ("zero data called with zero length range\n"));
 479                 return NT_STATUS_OK;
 480         }
 481
 482         init_strict_lock_struct(fsp,
 483                                 fsp->op->global->open_persistent_id,
 484                                 zdata_info.file_off,
 485                                 len,
 486                                 WRITE_LOCK,
 487                                 &lck);
 488
 489         if (!SMB_VFS_STRICT_LOCK_CHECK(fsp->conn, fsp, &lck)) {
 490                 DEBUG(2, ("failed to lock range for zero-data\n"));
 491                 return NT_STATUS_FILE_LOCK_CONFLICT;
 492         }
 493
 494         /*
 495          * MS-FSCC <58> Section 2.3.67
 496          * This FSCTL sets the range of bytes to zero (0) without extending the
 497          * file size.
 498          *
 499          * The VFS_FALLOCATE_FL_KEEP_SIZE flag is used to satisfy this
 500          * constraint.
 501          */
 502
 503         mode = VFS_FALLOCATE_FL_PUNCH_HOLE | VFS_FALLOCATE_FL_KEEP_SIZE;
 504         ret = SMB_VFS_FALLOCATE(fsp, mode, zdata_info.file_off, len);
 505         if (ret == -1)  {
 506                 status = map_nt_error_from_unix_common(errno);
 507                 DEBUG(2, ("zero-data fallocate(0x%x) failed: %s\n", mode,
 508                       strerror(errno)));
 509                 return status;
 510         }
 511
 512         if (!fsp->is_sparse && lp_strict_allocate(SNUM(fsp->conn))) {
 513                 /*
 514                  * File marked non-sparse and "strict allocate" is enabled -
 515                  * allocate the range that we just punched out.
 516                  * In future FALLOC_FL_ZERO_RANGE could be used exclusively for
 517                  * this, but it's currently only supported on XFS and ext4.
 518                  *
 519                  * The newly allocated range still won't be found by SEEK_DATA
 520                  * for QAR, but stat.st_blocks will reflect it.
 521                  */
 522                 ret = SMB_VFS_FALLOCATE(fsp, VFS_FALLOCATE_FL_KEEP_SIZE,
 523                                         zdata_info.file_off, len);
 524                 if (ret == -1)  {
 525                         status = map_nt_error_from_unix_common(errno);
 526                         DEBUG(0, ("fallocate failed: %s\n", strerror(errno)));
 527                         return status;
 528                 }
 529         }
 530
 531         return NT_STATUS_OK;
 532 }
 533
 534 static NTSTATUS fsctl_qar_buf_push(TALLOC_CTX *mem_ctx,
 535                                    struct file_alloced_range_buf *qar_buf,
 536                                    DATA_BLOB *qar_array_blob)
 537 {
 538         DATA_BLOB new_slot;
 539         enum ndr_err_code ndr_ret;
 540         bool ok;
 541
 542         ndr_ret = ndr_push_struct_blob(&new_slot, mem_ctx, qar_buf,
 543                         (ndr_push_flags_fn_t)ndr_push_file_alloced_range_buf);
 544         if (ndr_ret != NDR_ERR_SUCCESS) {
 545                 DEBUG(0, ("failed to marshall QAR buf\n"));
 546                 return NT_STATUS_INVALID_PARAMETER;
 547         }
 548
 549         /* TODO should be able to avoid copy by pushing into prealloced buf */
 550         ok = data_blob_append(mem_ctx, qar_array_blob, new_slot.data,
 551                               new_slot.length);
 552         data_blob_free(&new_slot);
 553         if (!ok) {
 554                 return NT_STATUS_NO_MEMORY;
 555         }
 556
 557         return NT_STATUS_OK;
 558 }
 559
 560 static NTSTATUS fsctl_qar_seek_fill(TALLOC_CTX *mem_ctx,
 561                                     struct files_struct *fsp,
 562                                     off_t curr_off,
 563                                     off_t max_off,
 564                                     DATA_BLOB *qar_array_blob)
 565 {
 566         NTSTATUS status = NT_STATUS_NOT_SUPPORTED;
 567
 568 #ifdef HAVE_LSEEK_HOLE_DATA
 569         while (curr_off <= max_off) {
 570                 off_t data_off;
 571                 off_t hole_off;
 572                 struct file_alloced_range_buf qar_buf;
 573
 574                 /* seek next data */
 575                 data_off = SMB_VFS_LSEEK(fsp, curr_off, SEEK_DATA);
 576                 if ((data_off == -1) && (errno == ENXIO)) {
 577                         /* no data from curr_off to EOF */
 578                         break;
 579                 } else if (data_off == -1) {
 580                         status = map_nt_error_from_unix_common(errno);
 581                         DEBUG(1, ("lseek data failed: %s\n", strerror(errno)));
 582                         return status;
 583                 }
 584
 585                 if (data_off > max_off) {
 586                         /* found something, but passed range of interest */
 587                         break;
 588                 }
 589
 590                 hole_off = SMB_VFS_LSEEK(fsp, data_off, SEEK_HOLE);
 591                 if (hole_off == -1) {
 592                         status = map_nt_error_from_unix_common(errno);
 593                         DEBUG(1, ("lseek hole failed: %s\n", strerror(errno)));
 594                         return status;
 595                 }
 596
 597                 if (hole_off <= data_off) {
 598                         DEBUG(1, ("lseek inconsistent: hole %lu at or before "
 599                                   "data %lu\n", (unsigned long)hole_off,
 600                                   (unsigned long)data_off));
 601                         return NT_STATUS_INTERNAL_ERROR;
 602                 }
 603
 604                 qar_buf.file_off = data_off;
 605                 /* + 1 to convert maximum offset to length */
 606                 qar_buf.len = MIN(hole_off, max_off + 1) - data_off;
 607
 608                 status = fsctl_qar_buf_push(mem_ctx, &qar_buf, qar_array_blob);
 609                 if (!NT_STATUS_IS_OK(status)) {
 610                         return NT_STATUS_NO_MEMORY;
 611                 }
 612
 613                 curr_off = hole_off;
 614         }
 615         status = NT_STATUS_OK;
 616 #endif
 617
 618         return status;
 619 }
 620
 621 static NTSTATUS fsctl_qar(TALLOC_CTX *mem_ctx,
 622                           struct tevent_context *ev,
 623                           struct files_struct *fsp,
 624                           DATA_BLOB *in_input,
 625                           size_t in_max_output,
 626                           DATA_BLOB *out_output)
 627 {
 628         struct fsctl_query_alloced_ranges_req qar_req;
 629         struct fsctl_query_alloced_ranges_rsp qar_rsp;
 630         DATA_BLOB qar_array_blob = data_blob_null;
 631         uint64_t max_off;
 632         enum ndr_err_code ndr_ret;
 633         int ret;
 634         NTSTATUS status;
 635         SMB_STRUCT_STAT sbuf;
 636
 637         if (fsp == NULL) {
 638                 return NT_STATUS_FILE_CLOSED;
 639         }
 640
 641         /* READ_DATA permission is required */
 642         status = check_access_fsp(fsp, FILE_READ_DATA);
 643         if (!NT_STATUS_IS_OK(status)) {
 644                 return status;
 645         }
 646
 647         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &qar_req,
 648                 (ndr_pull_flags_fn_t)ndr_pull_fsctl_query_alloced_ranges_req);
 649         if (ndr_ret != NDR_ERR_SUCCESS) {
 650                 DEBUG(0, ("failed to unmarshall QAR req\n"));
 651                 return NT_STATUS_INVALID_PARAMETER;
 652         }
 653
 654         /*
 655          * XXX Windows Server 2008 & 2012 servers don't return lock-conflict
 656          * for QAR requests over an exclusively locked range!
 657          */
 658
 659         ret = SMB_VFS_FSTAT(fsp, &sbuf);
 660         if (ret == -1) {
 661                 status = map_nt_error_from_unix_common(errno);
 662                 DEBUG(2, ("fstat failed: %s\n", strerror(errno)));
 663                 return status;
 664         }
 665
 666         if ((qar_req.buf.len == 0)
 667          || (sbuf.st_ex_size == 0)
 668          || (qar_req.buf.file_off >= sbuf.st_ex_size)) {
 669                 /* zero length range or after EOF, no ranges to return */
 670                 return NT_STATUS_OK;
 671         }
 672
 673         /* check for integer overflow */
 674         if (qar_req.buf.file_off + qar_req.buf.len < qar_req.buf.file_off) {
 675                 return NT_STATUS_INVALID_PARAMETER;
 676         }
 677
 678         /*
 679          * Maximum offset is either the last valid offset _before_ EOF, or the
 680          * last byte offset within the requested range. -1 converts length to
 681          * offset, which is easier to work with for SEEK_DATA/SEEK_HOLE, E.g.:
 682          *
 683          * /off=0             /off=512K          /st_ex_size=1M
 684          * |-------------------------------------|
 685          * | File data                           |
 686          * |-------------------------------------|
 687          *                                                   QAR end\
 688          *                    |=====================================|
 689          *                    |    QAR off=512K, len=1M             |
 690          *                    |=================^===================|
 691          *                                   max_off=1M - 1
 692          *             QAR end\
 693          * |==================|
 694          * |QAR off=0 len=512K|
 695          * |==================|
 696          *                   ^
 697          *                max_off=512K - 1
 698          */
 699         max_off = MIN(sbuf.st_ex_size,
 700                       qar_req.buf.file_off + qar_req.buf.len) - 1;
 701
 702         if (!fsp->is_sparse) {
 703                 struct file_alloced_range_buf qar_buf;
 704
 705                 /* file is non-sparse, claim file_off->max_off is allocated */
 706                 qar_buf.file_off = qar_req.buf.file_off;
 707                 /* + 1 to convert maximum offset back to length */
 708                 qar_buf.len = max_off - qar_req.buf.file_off + 1;
 709
 710                 status = fsctl_qar_buf_push(mem_ctx, &qar_buf, &qar_array_blob);
 711         } else {
 712                 status = fsctl_qar_seek_fill(mem_ctx, fsp, qar_req.buf.file_off,
 713                                              max_off, &qar_array_blob);
 714         }
 715         if (!NT_STATUS_IS_OK(status)) {
 716                 return status;
 717         }
 718
 719         /* marshall response buffer. */
 720         qar_rsp.far_buf_array = qar_array_blob;
 721
 722         ndr_ret = ndr_push_struct_blob(out_output, mem_ctx, &qar_rsp,
 723                 (ndr_push_flags_fn_t)ndr_push_fsctl_query_alloced_ranges_rsp);
 724         if (ndr_ret != NDR_ERR_SUCCESS) {
 725                 DEBUG(0, ("failed to marshall QAR rsp\n"));
 726                 return NT_STATUS_INVALID_PARAMETER;
 727         }
 728
 729         if (out_output->length > in_max_output) {
 730                 DEBUG(2, ("QAR output len %lu exceeds max %lu\n",
 731                           (unsigned long)out_output->length,
 732                           (unsigned long)in_max_output));
 733                 data_blob_free(out_output);
 734                 return NT_STATUS_BUFFER_TOO_SMALL;
 735         }
 736
 737         return NT_STATUS_OK;
 738 }
 739
 740 static void smb2_ioctl_filesys_dup_extents_done(struct tevent_req *subreq);
 741
 742 struct tevent_req *smb2_ioctl_filesys(uint32_t ctl_code,
 743                                       struct tevent_context *ev,
 744                                       struct tevent_req *req,
 745                                       struct smbd_smb2_ioctl_state *state)
 746 {
 747         NTSTATUS status;
 748
 749         switch (ctl_code) {
 750         case FSCTL_GET_COMPRESSION:
 751                 status = fsctl_get_cmprn(state, ev, state->fsp,
 752                                          state->in_max_output,
 753                                          &state->out_output);
 754                 if (!tevent_req_nterror(req, status)) {
 755                         tevent_req_done(req);
 756                 }
 757                 return tevent_req_post(req, ev);
 758                 break;
 759         case FSCTL_SET_COMPRESSION:
 760                 status = fsctl_set_cmprn(state, ev, state->fsp,
 761                                          &state->in_input);
 762                 if (!tevent_req_nterror(req, status)) {
 763                         tevent_req_done(req);
 764                 }
 765                 return tevent_req_post(req, ev);
 766                 break;
 767         case FSCTL_SET_ZERO_DATA:
 768                 status = fsctl_zero_data(state, ev, state->fsp,
 769                                          &state->in_input);
 770                 if (!tevent_req_nterror(req, status)) {
 771                         tevent_req_done(req);
 772                 }
 773                 return tevent_req_post(req, ev);
 774                 break;
 775         case FSCTL_QUERY_ALLOCATED_RANGES:
 776                 status = fsctl_qar(state, ev, state->fsp,
 777                                    &state->in_input,
 778                                    state->in_max_output,
 779                                    &state->out_output);
 780                 if (!tevent_req_nterror(req, status)) {
 781                         tevent_req_done(req);
 782                 }
 783                 return tevent_req_post(req, ev);
 784                 break;
 785         case FSCTL_DUP_EXTENTS_TO_FILE: {
 786                 struct tevent_req *subreq = NULL;
 787
 788                 subreq = fsctl_dup_extents_send(state, ev,
 789                                                 state->fsp,
 790                                                 &state->in_input,
 791                                                 state->smb2req);
 792                 if (tevent_req_nomem(subreq, req)) {
 793                         return tevent_req_post(req, ev);
 794                 }
 795                 tevent_req_set_callback(subreq,
 796                                         smb2_ioctl_filesys_dup_extents_done,
 797                                         req);
 798                 return req;
 799                 break;
 800         }
 801         default: {
 802                 uint8_t *out_data = NULL;
 803                 uint32_t out_data_len = 0;
 804
 805                 if (state->fsp == NULL) {
 806                         status = NT_STATUS_NOT_SUPPORTED;
 807                 } else {
 808                         status = SMB_VFS_FSCTL(state->fsp,
 809                                                state,
 810                                                ctl_code,
 811                                                state->smbreq->flags2,
 812                                                state->in_input.data,
 813                                                state->in_input.length,
 814                                                &out_data,
 815                                                state->in_max_output,
 816                                                &out_data_len);
 817                         state->out_output = data_blob_const(out_data, out_data_len);
 818                         if (NT_STATUS_IS_OK(status)) {
 819                                 tevent_req_done(req);
 820                                 return tevent_req_post(req, ev);
 821                         }
 822                 }
 823
 824                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 825                         if (IS_IPC(state->smbreq->conn)) {
 826                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 827                         } else {
 828                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 829                         }
 830                 }
 831
 832                 tevent_req_nterror(req, status);
 833                 return tevent_req_post(req, ev);
 834                 break;
 835         }
 836         }
 837
 838         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 839         return tevent_req_post(req, ev);
 840 }
 841
 842 static void smb2_ioctl_filesys_dup_extents_done(struct tevent_req *subreq)
 843 {
 844         struct tevent_req *req = tevent_req_callback_data(subreq,
 845                                                           struct tevent_req);
 846         NTSTATUS status;
 847
 848         status = fsctl_dup_extents_recv(subreq);
 849         TALLOC_FREE(subreq);
 850         if (!tevent_req_nterror(req, status)) {
 851                 tevent_req_done(req);
 852         }
 853 }