s4-smb2: check for invalid SMB2 lock ranges
[ira/wip.git] / source4 / ntvfs / ntvfs_generic.c
index c34bb7125e6834dd8cc1f00c3fd6b3207fa4cc56..d564db72ff24bf1077bd1d8883e29bcdbd043003 100644 (file)
@@ -56,7 +56,8 @@ struct ntvfs_map_async {
 */
 static void ntvfs_map_async_send(struct ntvfs_request *req)
 {
-       struct ntvfs_map_async *m = req->async_states->private_data;
+       struct ntvfs_map_async *m = talloc_get_type(req->async_states->private_data,
+                                   struct ntvfs_map_async);
 
        ntvfs_async_state_pop(req);
 
@@ -105,7 +106,8 @@ static NTSTATUS ntvfs_map_async_finish(struct ntvfs_request *req, NTSTATUS statu
 
        /* the backend is replying immediately. call the 2nd stage function after popping our local
           async state */
-       m = req->async_states->private_data;
+       m = talloc_get_type(req->async_states->private_data,
+                           struct ntvfs_map_async);
 
        ntvfs_async_state_pop(req);
 
@@ -281,6 +283,8 @@ static NTSTATUS map_openx_open(uint16_t flags, uint16_t open_mode,
                               uint16_t open_func, const char *fname,
                               union smb_open *io2)
 {
+       io2->generic.in.create_options = NTCREATEX_OPTIONS_NON_DIRECTORY_FILE;
+
        if (flags & OPENX_FLAGS_REQUEST_OPLOCK) {
                io2->generic.in.flags |= NTCREATEX_FLAGS_REQUEST_OPLOCK;
        }
@@ -511,7 +515,7 @@ NTSTATUS ntvfs_map_open(struct ntvfs_module_context *ntvfs,
                        io2->generic.in.flags = 0;
                        break;
                }
-               io2->generic.in.root_fid        = 0;
+               io2->generic.in.root_fid.fnum   = 0;
                io2->generic.in.access_mask     = io->smb2.in.desired_access;
                io2->generic.in.alloc_size      = io->smb2.in.alloc_size;
                io2->generic.in.file_attr       = io->smb2.in.file_attributes;
@@ -533,6 +537,8 @@ NTSTATUS ntvfs_map_open(struct ntvfs_module_context *ntvfs,
 
                /* we need to check these bits before we check the private mask */
                if (io2->generic.in.create_options & SMB2_CREATE_OPTIONS_NOT_SUPPORTED_MASK) {
+                       DEBUG(2,(__location__ " create_options 0x%x not supported\n",
+                                io2->generic.in.create_options));
                        status = NT_STATUS_NOT_SUPPORTED;
                        break;
                }
@@ -554,31 +560,14 @@ done:
 
 
 /* 
-   NTVFS fsinfo generic to any mapper
+   NTVFS any to fsinfo mapper
 */
-NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
-                                  struct ntvfs_request *req,
-                                  union smb_fsinfo *fs)
+static NTSTATUS ntvfs_map_fsinfo_finish(struct ntvfs_module_context *ntvfs,
+                                     struct ntvfs_request *req,
+                                     union smb_fsinfo *fs,
+                                     union smb_fsinfo *fs2,
+                                     NTSTATUS status)
 {
-       NTSTATUS status;
-       union smb_fsinfo *fs2;
-
-       fs2 = talloc(req, union smb_fsinfo);
-       if (fs2 == NULL) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       if (fs->generic.level == RAW_QFS_GENERIC) {
-               return NT_STATUS_INVALID_LEVEL;
-       }
-       
-       /* only used by the simple backend, which doesn't do async */
-       req->async_states->state &= ~NTVFS_ASYNC_STATE_MAY_ASYNC;
-
-       /* ask the backend for the generic info */
-       fs2->generic.level = RAW_QFS_GENERIC;
-
-       status = ntvfs->ops->fsinfo(ntvfs, req, fs2);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
@@ -681,6 +670,38 @@ NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
        return NT_STATUS_INVALID_LEVEL;
 }
 
+/*
+   NTVFS fsinfo any to generic mapper
+*/
+NTSTATUS ntvfs_map_fsinfo(struct ntvfs_module_context *ntvfs,
+                         struct ntvfs_request *req,
+                         union smb_fsinfo *fs)
+{
+       NTSTATUS status;
+       union smb_fsinfo *fs2;
+
+       fs2 = talloc(req, union smb_fsinfo);
+       if (fs2 == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (fs->generic.level == RAW_QFS_GENERIC) {
+               return NT_STATUS_INVALID_LEVEL;
+       }
+
+       status = ntvfs_map_async_setup(ntvfs, req, fs, fs2,
+                                      (second_stage_t)ntvfs_map_fsinfo_finish);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       /* ask the backend for the generic info */
+       fs2->generic.level = RAW_QFS_GENERIC;
+
+       status = ntvfs->ops->fsinfo(ntvfs, req, fs2);
+       return ntvfs_map_async_finish(req, status);
+}
+
 
 /* 
    NTVFS fileinfo generic to any mapper
@@ -852,7 +873,7 @@ NTSTATUS ntvfs_map_fileinfo(TALLOC_CTX *mem_ctx,
                                        return NT_STATUS_NO_MEMORY;
                                }
                                info->all_eas.out.eas[i].value.data = 
-                                       talloc_memdup(info->all_eas.out.eas,
+                                       (uint8_t *)talloc_memdup(info->all_eas.out.eas,
                                                info2->generic.out.eas[i].value.data,
                                                info2->generic.out.eas[i].value.length);
                                if (!info->all_eas.out.eas[i].value.data) {
@@ -914,6 +935,22 @@ NTSTATUS ntvfs_map_fileinfo(TALLOC_CTX *mem_ctx,
 }
 
 /* 
+   NTVFS any to fileinfo mapper
+*/
+static NTSTATUS ntvfs_map_qfileinfo_finish(struct ntvfs_module_context *ntvfs,
+                                     struct ntvfs_request *req,
+                                     union smb_fileinfo *info,
+                                     union smb_fileinfo *info2,
+                                     NTSTATUS status)
+{
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       return ntvfs_map_fileinfo(req, info, info2);
+}
+
+/*
    NTVFS fileinfo generic to any mapper
 */
 NTSTATUS ntvfs_map_qfileinfo(struct ntvfs_module_context *ntvfs,
@@ -932,17 +969,33 @@ NTSTATUS ntvfs_map_qfileinfo(struct ntvfs_module_context *ntvfs,
                return NT_STATUS_INVALID_LEVEL;
        }
 
+       status = ntvfs_map_async_setup(ntvfs, req, info, info2,
+                                      (second_stage_t)ntvfs_map_qfileinfo_finish);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
        /* ask the backend for the generic info */
        info2->generic.level = RAW_FILEINFO_GENERIC;
        info2->generic.in.file.ntvfs= info->generic.in.file.ntvfs;
 
-       /* only used by the simple backend, which doesn't do async */
-       req->async_states->state &= ~NTVFS_ASYNC_STATE_MAY_ASYNC;
-
        status = ntvfs->ops->qfileinfo(ntvfs, req, info2);
+       return ntvfs_map_async_finish(req, status);
+}
+
+/*
+   NTVFS any to fileinfo mapper
+*/
+static NTSTATUS ntvfs_map_qpathinfo_finish(struct ntvfs_module_context *ntvfs,
+                                     struct ntvfs_request *req,
+                                     union smb_fileinfo *info,
+                                     union smb_fileinfo *info2,
+                                     NTSTATUS status)
+{
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
+
        return ntvfs_map_fileinfo(req, info, info2);
 }
 
@@ -965,18 +1018,18 @@ NTSTATUS ntvfs_map_qpathinfo(struct ntvfs_module_context *ntvfs,
                return NT_STATUS_INVALID_LEVEL;
        }
 
+       status = ntvfs_map_async_setup(ntvfs, req, info, info2,
+                                      (second_stage_t)ntvfs_map_qpathinfo_finish);
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
        /* ask the backend for the generic info */
        info2->generic.level            = RAW_FILEINFO_GENERIC;
        info2->generic.in.file.path     = info->generic.in.file.path;
 
-       /* only used by the simple backend, which doesn't do async */
-       req->async_states->state &= ~NTVFS_ASYNC_STATE_MAY_ASYNC;
-
        status = ntvfs->ops->qpathinfo(ntvfs, req, info2);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-       return ntvfs_map_fileinfo(req, info, info2);
+       return ntvfs_map_async_finish(req, status);
 }
 
 
@@ -1053,6 +1106,9 @@ NTSTATUS ntvfs_map_lock(struct ntvfs_module_context *ntvfs,
                /* only the first lock gives the UNLOCK bit - see
                   MS-SMB2 3.3.5.14 */
                if (lck->smb2.in.locks[0].flags & SMB2_LOCK_FLAG_UNLOCK) {
+                       if (lck->smb2.in.locks[0].flags & SMB2_LOCK_FLAG_FAIL_IMMEDIATELY) {
+                               return NT_STATUS_INVALID_PARAMETER;
+                       }
                        lck2->generic.in.ulock_cnt = lck->smb2.in.lock_count;
                        isunlock = true;
                } else {
@@ -1060,6 +1116,20 @@ NTSTATUS ntvfs_map_lock(struct ntvfs_module_context *ntvfs,
                        isunlock = false;
                }
                for (i=0;i<lck->smb2.in.lock_count;i++) {
+                       if (lck->smb2.in.locks[i].length > 1 &&
+                           lck->smb2.in.locks[i].offset +
+                           lck->smb2.in.locks[i].length <
+                           lck->smb2.in.locks[i].offset) {
+                               return NT_STATUS_INVALID_LOCK_RANGE;
+                       }
+                       if (lck->smb2.in.locks[i].flags == SMB2_LOCK_FLAG_NONE) {
+                               return NT_STATUS_INVALID_PARAMETER;
+                       }
+
+                       if (lck->smb2.in.locks[i].flags & ~SMB2_LOCK_FLAG_ALL_MASK) {
+                               return NT_STATUS_INVALID_PARAMETER;
+                       }
+
                        if (isunlock && 
                            (lck->smb2.in.locks[i].flags & 
                             (SMB2_LOCK_FLAG_SHARED|SMB2_LOCK_FLAG_EXCLUSIVE))) {