source4/smb_server/smb2/tcon.c

   1 /*
   2    Unix SMB2 implementation.
   3
   4    Copyright (C) Stefan Metzmacher      2005
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libcli/smb2/smb2.h"
  22 #include "libcli/smb2/smb2_calls.h"
  23 #include "smb_server/smb_server.h"
  24 #include "smb_server/service_smb_proto.h"
  25 #include "smb_server/smb2/smb2_server.h"
  26 #include "librpc/gen_ndr/security.h"
  27 #include "smbd/service_stream.h"
  28 #include "ntvfs/ntvfs.h"
  29 #include "param/param.h"
  30
  31 /*
  32   send an oplock break request to a client
  33 */
  34 static NTSTATUS smb2srv_send_oplock_break(void *p, struct ntvfs_handle *h, uint8_t level)
  35 {
  36         struct smbsrv_handle *handle = talloc_get_type(h->frontend_data.private_data,
  37                                                        struct smbsrv_handle);
  38         struct smb2srv_request *req;
  39         NTSTATUS status;
  40
  41         /* setup a dummy request structure */
  42         req = smb2srv_init_request(handle->tcon->smb_conn);
  43         NT_STATUS_HAVE_NO_MEMORY(req);
  44
  45         req->in.buffer          = talloc_array(req, uint8_t,
  46                                                NBT_HDR_SIZE + SMB2_MIN_SIZE);
  47         NT_STATUS_HAVE_NO_MEMORY(req->in.buffer);
  48         req->in.size            = NBT_HDR_SIZE + SMB2_MIN_SIZE;
  49         req->in.allocated       = req->in.size;
  50
  51         req->in.hdr             = req->in.buffer+ NBT_HDR_SIZE;
  52         req->in.body            = req->in.hdr   + SMB2_HDR_BODY;
  53         req->in.body_size       = req->in.size  - (SMB2_HDR_BODY+NBT_HDR_SIZE);
  54         req->in.dynamic         = NULL;
  55
  56         req->seqnum             = UINT64_MAX;
  57
  58         SIVAL(req->in.hdr, 0,                           SMB2_MAGIC);
  59         SSVAL(req->in.hdr, SMB2_HDR_LENGTH,             SMB2_HDR_BODY);
  60         SSVAL(req->in.hdr, SMB2_HDR_PAD1,               0);
  61         SIVAL(req->in.hdr, SMB2_HDR_STATUS,             0);
  62         SSVAL(req->in.hdr, SMB2_HDR_OPCODE,             SMB2_OP_BREAK);
  63         SSVAL(req->in.hdr, SMB2_HDR_UNKNOWN1,           0);
  64         SIVAL(req->in.hdr, SMB2_HDR_FLAGS,              0);
  65         SIVAL(req->in.hdr, SMB2_HDR_CHAIN_OFFSET,       0);
  66         SBVAL(req->in.hdr, SMB2_HDR_SEQNUM,             0);
  67         SIVAL(req->in.hdr, SMB2_HDR_PID,                0);
  68         SIVAL(req->in.hdr, SMB2_HDR_TID,                0);
  69         SBVAL(req->in.hdr, SMB2_HDR_UID,                0);
  70         memset(req->in.hdr+SMB2_HDR_SIG, 0, 16);
  71
  72         SSVAL(req->in.body, 0, 2);
  73
  74         status = smb2srv_setup_reply(req, 0x18, false, 0);
  75         NT_STATUS_NOT_OK_RETURN(status);
  76
  77         SSVAL(req->out.hdr, SMB2_HDR_UNKNOWN1,  0x0000);
  78
  79         SSVAL(req->out.body, 0x02, 0x0001);
  80         SIVAL(req->out.body, 0x04, 0x00000000);
  81         smb2srv_push_handle(req->out.body, 0x08, h);
  82
  83         smb2srv_send_reply(req);
  84
  85         return NT_STATUS_OK;
  86 }
  87
  88 struct ntvfs_handle *smb2srv_pull_handle(struct smb2srv_request *req, const uint8_t *base, uint_t offset)
  89 {
  90         struct smbsrv_tcon *tcon;
  91         struct smbsrv_handle *handle;
  92         uint32_t hid;
  93         uint32_t tid;
  94         uint64_t uid;
  95
  96         /*
  97          * if there're chained requests used the cached handle
  98          *
  99          * TODO: check if this also correct when the given handle
 100          *       isn't all 0xFF.
 101          */
 102         if (req->chained_file_handle) {
 103                 base = req->chained_file_handle;
 104                 offset = 0;
 105         }
 106
 107         hid = IVAL(base, offset);
 108         tid = IVAL(base, offset + 4);
 109         uid = BVAL(base, offset + 8);
 110
 111         /* if it's the wildcard handle, don't waste time to search it... */
 112         if (hid == UINT32_MAX && tid == UINT32_MAX && uid == UINT64_MAX) {
 113                 return NULL;
 114         }
 115
 116         /*
 117          * if the (v)uid part doesn't match the given session the handle isn't
 118          * valid
 119          */
 120         if (uid != req->session->vuid) {
 121                 return NULL;
 122         }
 123
 124         /*
 125          * the handle can belong to a different tcon
 126          * as that TID in the SMB2 header says, but
 127          * the request should succeed nevertheless!
 128          *
 129          * because of this we put the 32 bit TID into the
 130          * 128 bit handle, so that we can extract the tcon from the
 131          * handle
 132          */
 133         tcon = req->tcon;
 134         if (tid != req->tcon->tid) {
 135                 tcon = smbsrv_smb2_tcon_find(req->session, tid, req->request_time);
 136                 if (!tcon) {
 137                         return NULL;
 138                 }
 139         }
 140
 141         handle = smbsrv_smb2_handle_find(tcon, hid, req->request_time);
 142         if (!handle) {
 143                 return NULL;
 144         }
 145
 146         /*
 147          * as the smb2srv_tcon is a child object of the smb2srv_session
 148          * the handle belongs to the correct session!
 149          *
 150          * Note: no check is needed here for SMB2
 151          */
 152
 153         /*
 154          * as the handle may have overwritten the tcon
 155          * we need to set it on the request so that the
 156          * correct ntvfs context will be used for the ntvfs_*() request
 157          *
 158          * TODO: check if that's correct for chained requests as well!
 159          */
 160         req->tcon = tcon;
 161         return handle->ntvfs;
 162 }
 163
 164 void smb2srv_push_handle(uint8_t *base, uint_t offset, struct ntvfs_handle *ntvfs)
 165 {
 166         struct smbsrv_handle *handle = talloc_get_type(ntvfs->frontend_data.private_data,
 167                                        struct smbsrv_handle);
 168
 169         /*
 170          * the handle is 128 bit on the wire
 171          */
 172         SIVAL(base, offset,     handle->hid);
 173         SIVAL(base, offset + 4, handle->tcon->tid);
 174         SBVAL(base, offset + 8, handle->session->vuid);
 175 }
 176
 177 static NTSTATUS smb2srv_handle_create_new(void *private_data, struct ntvfs_request *ntvfs, struct ntvfs_handle **_h)
 178 {
 179         struct smb2srv_request *req = talloc_get_type(ntvfs->frontend_data.private_data,
 180                                       struct smb2srv_request);
 181         struct smbsrv_handle *handle;
 182         struct ntvfs_handle *h;
 183
 184         handle = smbsrv_handle_new(req->session, req->tcon, req, req->request_time);
 185         if (!handle) return NT_STATUS_INSUFFICIENT_RESOURCES;
 186
 187         h = talloc_zero(handle, struct ntvfs_handle);
 188         if (!h) goto nomem;
 189
 190         /*
 191          * note: we don't set handle->ntvfs yet,
 192          *       this will be done by smbsrv_handle_make_valid()
 193          *       this makes sure the handle is invalid for clients
 194          *       until the ntvfs subsystem has made it valid
 195          */
 196         h->ctx          = ntvfs->ctx;
 197         h->session_info = ntvfs->session_info;
 198         h->smbpid       = ntvfs->smbpid;
 199
 200         h->frontend_data.private_data = handle;
 201
 202         *_h = h;
 203         return NT_STATUS_OK;
 204 nomem:
 205         talloc_free(handle);
 206         return NT_STATUS_NO_MEMORY;
 207 }
 208
 209 static NTSTATUS smb2srv_handle_make_valid(void *private_data, struct ntvfs_handle *h)
 210 {
 211         struct smbsrv_tcon *tcon = talloc_get_type(private_data, struct smbsrv_tcon);
 212         struct smbsrv_handle *handle = talloc_get_type(h->frontend_data.private_data,
 213                                                        struct smbsrv_handle);
 214         /* this tells the frontend that the handle is valid */
 215         handle->ntvfs = h;
 216         /* this moves the smbsrv_request to the smbsrv_tcon memory context */
 217         talloc_steal(tcon, handle);
 218         return NT_STATUS_OK;
 219 }
 220
 221 static void smb2srv_handle_destroy(void *private_data, struct ntvfs_handle *h)
 222 {
 223         struct smbsrv_handle *handle = talloc_get_type(h->frontend_data.private_data,
 224                                                        struct smbsrv_handle);
 225         talloc_free(handle);
 226 }
 227
 228 static struct ntvfs_handle *smb2srv_handle_search_by_wire_key(void *private_data, struct ntvfs_request *ntvfs, const DATA_BLOB *key)
 229 {
 230         return NULL;
 231 }
 232
 233 static DATA_BLOB smb2srv_handle_get_wire_key(void *private_data, struct ntvfs_handle *handle, TALLOC_CTX *mem_ctx)
 234 {
 235         return data_blob(NULL, 0);
 236 }
 237
 238 static NTSTATUS smb2srv_tcon_backend(struct smb2srv_request *req, union smb_tcon *io)
 239 {
 240         struct smbsrv_tcon *tcon;
 241         NTSTATUS status;
 242         enum ntvfs_type type;
 243         uint16_t type_smb2;
 244         uint32_t unknown2;
 245         const char *service = io->smb2.in.path;
 246         struct share_config *scfg;
 247         const char *sharetype;
 248
 249         if (strncmp(service, "\\\\", 2) == 0) {
 250                 const char *p = strchr(service+2, '\\');
 251                 if (p) {
 252                         service = p + 1;
 253                 }
 254         }
 255
 256         status = share_get_config(req, req->smb_conn->share_context, service, &scfg);
 257         if (!NT_STATUS_IS_OK(status)) {
 258                 DEBUG(0,("smb2srv_tcon_backend: couldn't find service %s\n", service));
 259                 return NT_STATUS_BAD_NETWORK_NAME;
 260         }
 261
 262         if (!socket_check_access(req->smb_conn->connection->socket,
 263                                  scfg->name,
 264                                  share_string_list_option(req, scfg, SHARE_HOSTS_ALLOW),
 265                                  share_string_list_option(req, scfg, SHARE_HOSTS_DENY))) {
 266                 return NT_STATUS_ACCESS_DENIED;
 267         }
 268
 269         /* work out what sort of connection this is */
 270         sharetype = share_string_option(scfg, SHARE_TYPE, "DISK");
 271         if (sharetype && strcmp(sharetype, "IPC") == 0) {
 272                 type = NTVFS_IPC;
 273                 type_smb2 = 0x0002;
 274                 unknown2 = 0x00000030;
 275         } else if (sharetype && strcmp(sharetype, "PRINTER") == 0) {
 276                 type = NTVFS_PRINT;
 277                 type_smb2 = 0x0003;
 278                 unknown2 = 0x00000000;
 279         } else {
 280                 type = NTVFS_DISK;
 281                 type_smb2 = 0x0001;
 282                 unknown2 = 0x00000800;
 283         }
 284
 285         tcon = smbsrv_smb2_tcon_new(req->session, scfg->name);
 286         if (!tcon) {
 287                 DEBUG(0,("smb2srv_tcon_backend: Couldn't find free connection.\n"));
 288                 return NT_STATUS_INSUFFICIENT_RESOURCES;
 289         }
 290         req->tcon = tcon;
 291
 292         /* init ntvfs function pointers */
 293         status = ntvfs_init_connection(tcon, scfg, type,
 294                                        req->smb_conn->negotiate.protocol,
 295                                        req->smb_conn->connection->event.ctx,
 296                                        req->smb_conn->connection->msg_ctx,
 297                                        global_loadparm,
 298                                        req->smb_conn->connection->server_id,
 299                                        &tcon->ntvfs);
 300         if (!NT_STATUS_IS_OK(status)) {
 301                 DEBUG(0, ("smb2srv_tcon_backend: ntvfs_init_connection failed for service %s\n",
 302                           scfg->name));
 303                 goto failed;
 304         }
 305
 306         status = ntvfs_set_oplock_handler(tcon->ntvfs, smb2srv_send_oplock_break, tcon);
 307         if (!NT_STATUS_IS_OK(status)) {
 308                 DEBUG(0,("smb2srv_tcon_backend: NTVFS failed to set the oplock handler!\n"));
 309                 goto failed;
 310         }
 311
 312         status = ntvfs_set_addr_callbacks(tcon->ntvfs, smbsrv_get_my_addr, smbsrv_get_peer_addr, req->smb_conn);
 313         if (!NT_STATUS_IS_OK(status)) {
 314                 DEBUG(0,("smb2srv_tcon_backend: NTVFS failed to set the addr callbacks!\n"));
 315                 goto failed;
 316         }
 317
 318         status = ntvfs_set_handle_callbacks(tcon->ntvfs,
 319                                             smb2srv_handle_create_new,
 320                                             smb2srv_handle_make_valid,
 321                                             smb2srv_handle_destroy,
 322                                             smb2srv_handle_search_by_wire_key,
 323                                             smb2srv_handle_get_wire_key,
 324                                             tcon);
 325         if (!NT_STATUS_IS_OK(status)) {
 326                 DEBUG(0,("smb2srv_tcon_backend: NTVFS failed to set the handle callbacks!\n"));
 327                 goto failed;
 328         }
 329
 330         req->ntvfs = ntvfs_request_create(req->tcon->ntvfs, req,
 331                                           req->session->session_info,
 332                                           0, /* TODO: fill in PID */
 333                                           req->request_time,
 334                                           req, NULL, 0);
 335         if (!req->ntvfs) {
 336                 status = NT_STATUS_NO_MEMORY;
 337                 goto failed;
 338         }
 339
 340         /* Invoke NTVFS connection hook */
 341         status = ntvfs_connect(req->ntvfs, scfg->name);
 342         if (!NT_STATUS_IS_OK(status)) {
 343                 DEBUG(0,("smb2srv_tcon_backend: NTVFS ntvfs_connect() failed!\n"));
 344                 goto failed;
 345         }
 346
 347         io->smb2.out.unknown1   = type_smb2; /* 1 - DISK, 2 - Print, 3 - IPC */
 348         io->smb2.out.unknown2   = unknown2;
 349         io->smb2.out.unknown3   = 0x00000000;
 350         io->smb2.out.access_mask= SEC_RIGHTS_FILE_ALL;
 351
 352         io->smb2.out.tid        = tcon->tid;
 353
 354         return NT_STATUS_OK;
 355
 356 failed:
 357         req->tcon = NULL;
 358         talloc_free(tcon);
 359         return status;
 360 }
 361
 362 static void smb2srv_tcon_send(struct smb2srv_request *req, union smb_tcon *io)
 363 {
 364         uint16_t unknown1;
 365
 366         if (!NT_STATUS_IS_OK(req->status)) {
 367                 smb2srv_send_error(req, req->status);
 368                 return;
 369         }
 370         if (io->smb2.out.unknown1 == 0x0002) {
 371                 /* if it's an IPC share vista returns 0x0005 */
 372                 unknown1 = 0x0005;
 373         } else {
 374                 unknown1 = 0x0001;
 375         }
 376
 377         SMB2SRV_CHECK(smb2srv_setup_reply(req, 0x10, false, 0));
 378
 379         SIVAL(req->out.hdr,     SMB2_HDR_TID,   io->smb2.out.tid);
 380         SSVAL(req->out.hdr,     SMB2_HDR_UNKNOWN1,unknown1);
 381
 382         SSVAL(req->out.body,    0x02,           io->smb2.out.unknown1);
 383         SIVAL(req->out.body,    0x04,           io->smb2.out.unknown2);
 384         SIVAL(req->out.body,    0x08,           io->smb2.out.unknown3);
 385         SIVAL(req->out.body,    0x0C,           io->smb2.out.access_mask);
 386
 387         smb2srv_send_reply(req);
 388 }
 389
 390 void smb2srv_tcon_recv(struct smb2srv_request *req)
 391 {
 392         union smb_tcon *io;
 393
 394         SMB2SRV_CHECK_BODY_SIZE(req, 0x08, true);
 395         SMB2SRV_TALLOC_IO_PTR(io, union smb_tcon);
 396
 397         io->smb2.level          = RAW_TCON_SMB2;
 398         io->smb2.in.unknown1    = SVAL(req->in.body, 0x02);
 399         SMB2SRV_CHECK(smb2_pull_o16s16_string(&req->in, io, req->in.body+0x04, &io->smb2.in.path));
 400
 401         req->status = smb2srv_tcon_backend(req, io);
 402
 403         if (req->control_flags & SMB2SRV_REQ_CTRL_FLAG_NOT_REPLY) {
 404                 talloc_free(req);
 405                 return;
 406         }
 407         smb2srv_tcon_send(req, io);
 408 }
 409
 410 static NTSTATUS smb2srv_tdis_backend(struct smb2srv_request *req)
 411 {
 412         /* TODO: call ntvfs backends to close file of this tcon */
 413         talloc_free(req->tcon);
 414         req->tcon = NULL;
 415         return NT_STATUS_OK;
 416 }
 417
 418 static void smb2srv_tdis_send(struct smb2srv_request *req)
 419 {
 420         NTSTATUS status;
 421
 422         if (NT_STATUS_IS_ERR(req->status)) {
 423                 smb2srv_send_error(req, req->status);
 424                 return;
 425         }
 426
 427         status = smb2srv_setup_reply(req, 0x04, false, 0);
 428         if (!NT_STATUS_IS_OK(status)) {
 429                 smbsrv_terminate_connection(req->smb_conn, nt_errstr(status));
 430                 talloc_free(req);
 431                 return;
 432         }
 433
 434         SSVAL(req->out.body, 0x02, 0);
 435
 436         smb2srv_send_reply(req);
 437 }
 438
 439 void smb2srv_tdis_recv(struct smb2srv_request *req)
 440 {
 441         uint16_t _pad;
 442
 443         SMB2SRV_CHECK_BODY_SIZE(req, 0x04, false);
 444
 445         _pad    = SVAL(req->in.body, 0x02);
 446
 447         req->status = smb2srv_tdis_backend(req);
 448
 449         if (req->control_flags & SMB2SRV_REQ_CTRL_FLAG_NOT_REPLY) {
 450                 talloc_free(req);
 451                 return;
 452         }
 453         smb2srv_tdis_send(req);
 454 }