source3/smbd/smb2_ioctl_filesys.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2013-2015
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "rpc_server/srv_pipe_hnd.h"
  29 #include "include/ntioctl.h"
  30 #include "../librpc/ndr/libndr.h"
  31 #include "librpc/gen_ndr/ndr_ioctl.h"
  32 #include "smb2_ioctl_private.h"
  33
  34 static NTSTATUS fsctl_get_cmprn(TALLOC_CTX *mem_ctx,
  35                                 struct tevent_context *ev,
  36                                 struct files_struct *fsp,
  37                                 size_t in_max_output,
  38                                 DATA_BLOB *out_output)
  39 {
  40         struct compression_state cmpr_state;
  41         enum ndr_err_code ndr_ret;
  42         DATA_BLOB output;
  43         NTSTATUS status;
  44
  45         if (fsp == NULL) {
  46                 return NT_STATUS_FILE_CLOSED;
  47         }
  48
  49         /* Windows doesn't check for SEC_FILE_READ_ATTRIBUTE permission here */
  50
  51         if ((fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) == 0) {
  52                 DEBUG(4, ("FS does not advertise compression support\n"));
  53                 return NT_STATUS_NOT_SUPPORTED;
  54         }
  55
  56         ZERO_STRUCT(cmpr_state);
  57         status = SMB_VFS_GET_COMPRESSION(fsp->conn,
  58                                          mem_ctx,
  59                                          fsp,
  60                                          NULL,
  61                                          &cmpr_state.format);
  62         if (!NT_STATUS_IS_OK(status)) {
  63                 return status;
  64         }
  65
  66         ndr_ret = ndr_push_struct_blob(&output, mem_ctx,
  67                                        &cmpr_state,
  68                         (ndr_push_flags_fn_t)ndr_push_compression_state);
  69         if (ndr_ret != NDR_ERR_SUCCESS) {
  70                 return NT_STATUS_INTERNAL_ERROR;
  71         }
  72
  73         if (in_max_output < output.length) {
  74                 DEBUG(1, ("max output %u too small for compression state %ld\n",
  75                       (unsigned int)in_max_output, (long int)output.length));
  76                 return NT_STATUS_INVALID_USER_BUFFER;
  77         }
  78         *out_output = output;
  79
  80         return NT_STATUS_OK;
  81 }
  82
  83 static NTSTATUS fsctl_set_cmprn(TALLOC_CTX *mem_ctx,
  84                                 struct tevent_context *ev,
  85                                 struct files_struct *fsp,
  86                                 DATA_BLOB *in_input)
  87 {
  88         struct compression_state cmpr_state;
  89         enum ndr_err_code ndr_ret;
  90         NTSTATUS status;
  91
  92         if (fsp == NULL) {
  93                 return NT_STATUS_FILE_CLOSED;
  94         }
  95
  96         /* WRITE_DATA permission is required, WRITE_ATTRIBUTES is not */
  97         status = check_access(fsp->conn, fsp, NULL,
  98                               FILE_WRITE_DATA);
  99         if (!NT_STATUS_IS_OK(status)) {
 100                 return status;
 101         }
 102
 103         if ((fsp->conn->fs_capabilities & FILE_FILE_COMPRESSION) == 0) {
 104                 DEBUG(4, ("FS does not advertise compression support\n"));
 105                 return NT_STATUS_NOT_SUPPORTED;
 106         }
 107
 108         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cmpr_state,
 109                         (ndr_pull_flags_fn_t)ndr_pull_compression_state);
 110         if (ndr_ret != NDR_ERR_SUCCESS) {
 111                 DEBUG(0, ("failed to unmarshall set compression req\n"));
 112                 return NT_STATUS_INVALID_PARAMETER;
 113         }
 114
 115         status = SMB_VFS_SET_COMPRESSION(fsp->conn,
 116                                          mem_ctx,
 117                                          fsp,
 118                                          cmpr_state.format);
 119         if (!NT_STATUS_IS_OK(status)) {
 120                 return status;
 121         }
 122
 123         return NT_STATUS_OK;
 124 }
 125
 126 static NTSTATUS fsctl_zero_data(TALLOC_CTX *mem_ctx,
 127                                 struct tevent_context *ev,
 128                                 struct files_struct *fsp,
 129                                 DATA_BLOB *in_input)
 130 {
 131         struct file_zero_data_info zdata_info;
 132         enum ndr_err_code ndr_ret;
 133         struct lock_struct lck;
 134         int mode;
 135         uint64_t len;
 136         int ret;
 137         NTSTATUS status;
 138
 139         if (fsp == NULL) {
 140                 return NT_STATUS_FILE_CLOSED;
 141         }
 142
 143         /* WRITE_DATA permission is required */
 144         status = check_access(fsp->conn, fsp, NULL, FILE_WRITE_DATA);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 return status;
 147         }
 148
 149         /* allow regardless of whether FS supports sparse or not */
 150
 151         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &zdata_info,
 152                         (ndr_pull_flags_fn_t)ndr_pull_file_zero_data_info);
 153         if (ndr_ret != NDR_ERR_SUCCESS) {
 154                 DEBUG(0, ("failed to unmarshall zero data request\n"));
 155                 return NT_STATUS_INVALID_PARAMETER;
 156         }
 157
 158         if (zdata_info.beyond_final_zero < zdata_info.file_off) {
 159                 DEBUG(0, ("invalid zero data params: off %lu, bfz, %lu\n",
 160                           (unsigned long)zdata_info.file_off,
 161                           (unsigned long)zdata_info.beyond_final_zero));
 162                 return NT_STATUS_INVALID_PARAMETER;
 163         }
 164
 165         /* convert strange "beyond final zero" param into length */
 166         len = zdata_info.beyond_final_zero - zdata_info.file_off;
 167
 168         if (len == 0) {
 169                 DEBUG(2, ("zero data called with zero length range\n"));
 170                 return NT_STATUS_OK;
 171         }
 172
 173         init_strict_lock_struct(fsp,
 174                                 fsp->op->global->open_persistent_id,
 175                                 zdata_info.file_off,
 176                                 len,
 177                                 WRITE_LOCK,
 178                                 &lck);
 179
 180         if (!SMB_VFS_STRICT_LOCK(fsp->conn, fsp, &lck)) {
 181                 DEBUG(2, ("failed to lock range for zero-data\n"));
 182                 return NT_STATUS_FILE_LOCK_CONFLICT;
 183         }
 184
 185         /*
 186          * MS-FSCC <58> Section 2.3.65
 187          * This FSCTL sets the range of bytes to zero (0) without extending the
 188          * file size.
 189          *
 190          * The VFS_FALLOCATE_FL_KEEP_SIZE flag is used to satisfy this
 191          * constraint.
 192          */
 193
 194         mode = VFS_FALLOCATE_FL_PUNCH_HOLE | VFS_FALLOCATE_FL_KEEP_SIZE;
 195         ret = SMB_VFS_FALLOCATE(fsp, mode, zdata_info.file_off, len);
 196         if (ret == -1)  {
 197                 status = map_nt_error_from_unix_common(errno);
 198                 DEBUG(2, ("zero-data fallocate(0x%x) failed: %s\n", mode,
 199                       strerror(errno)));
 200                 SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &lck);
 201                 return status;
 202         }
 203
 204         if (!fsp->is_sparse && lp_strict_allocate(SNUM(fsp->conn))) {
 205                 /*
 206                  * File marked non-sparse and "strict allocate" is enabled -
 207                  * allocate the range that we just punched out.
 208                  * In future FALLOC_FL_ZERO_RANGE could be used exclusively for
 209                  * this, but it's currently only supported on XFS and ext4.
 210                  *
 211                  * The newly allocated range still won't be found by SEEK_DATA
 212                  * for QAR, but stat.st_blocks will reflect it.
 213                  */
 214                 ret = SMB_VFS_FALLOCATE(fsp, VFS_FALLOCATE_FL_KEEP_SIZE,
 215                                         zdata_info.file_off, len);
 216                 if (ret == -1)  {
 217                         status = map_nt_error_from_unix_common(errno);
 218                         DEBUG(0, ("fallocate failed: %s\n", strerror(errno)));
 219                         SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &lck);
 220                         return status;
 221                 }
 222         }
 223
 224         SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &lck);
 225         return NT_STATUS_OK;
 226 }
 227
 228 static NTSTATUS fsctl_qar_buf_push(TALLOC_CTX *mem_ctx,
 229                                    struct file_alloced_range_buf *qar_buf,
 230                                    DATA_BLOB *qar_array_blob)
 231 {
 232         DATA_BLOB new_slot;
 233         enum ndr_err_code ndr_ret;
 234         bool ok;
 235
 236         ndr_ret = ndr_push_struct_blob(&new_slot, mem_ctx, qar_buf,
 237                         (ndr_push_flags_fn_t)ndr_push_file_alloced_range_buf);
 238         if (ndr_ret != NDR_ERR_SUCCESS) {
 239                 DEBUG(0, ("failed to marshall QAR buf\n"));
 240                 return NT_STATUS_INVALID_PARAMETER;
 241         }
 242
 243         /* TODO should be able to avoid copy by pushing into prealloced buf */
 244         ok = data_blob_append(mem_ctx, qar_array_blob, new_slot.data,
 245                               new_slot.length);
 246         data_blob_free(&new_slot);
 247         if (!ok) {
 248                 return NT_STATUS_NO_MEMORY;
 249         }
 250
 251         return NT_STATUS_OK;
 252 }
 253
 254 static NTSTATUS fsctl_qar_seek_fill(TALLOC_CTX *mem_ctx,
 255                                     struct files_struct *fsp,
 256                                     off_t curr_off,
 257                                     off_t max_off,
 258                                     DATA_BLOB *qar_array_blob)
 259 {
 260         NTSTATUS status = NT_STATUS_NOT_SUPPORTED;
 261
 262 #ifdef HAVE_LSEEK_HOLE_DATA
 263         while (curr_off <= max_off) {
 264                 off_t data_off;
 265                 off_t hole_off;
 266                 struct file_alloced_range_buf qar_buf;
 267
 268                 /* seek next data */
 269                 data_off = SMB_VFS_LSEEK(fsp, curr_off, SEEK_DATA);
 270                 if ((data_off == -1) && (errno == ENXIO)) {
 271                         /* no data from curr_off to EOF */
 272                         break;
 273                 } else if (data_off == -1) {
 274                         status = map_nt_error_from_unix_common(errno);
 275                         DEBUG(1, ("lseek data failed: %s\n", strerror(errno)));
 276                         return status;
 277                 }
 278
 279                 if (data_off > max_off) {
 280                         /* found something, but passed range of interest */
 281                         break;
 282                 }
 283
 284                 hole_off = SMB_VFS_LSEEK(fsp, data_off, SEEK_HOLE);
 285                 if (hole_off == -1) {
 286                         status = map_nt_error_from_unix_common(errno);
 287                         DEBUG(1, ("lseek hole failed: %s\n", strerror(errno)));
 288                         return status;
 289                 }
 290
 291                 if (hole_off <= data_off) {
 292                         DEBUG(1, ("lseek inconsistent: hole %lu at or before "
 293                                   "data %lu\n", (unsigned long)hole_off,
 294                                   (unsigned long)data_off));
 295                         return NT_STATUS_INTERNAL_ERROR;
 296                 }
 297
 298                 qar_buf.file_off = data_off;
 299                 /* + 1 to convert maximum offset to length */
 300                 qar_buf.len = MIN(hole_off, max_off + 1) - data_off;
 301
 302                 status = fsctl_qar_buf_push(mem_ctx, &qar_buf, qar_array_blob);
 303                 if (!NT_STATUS_IS_OK(status)) {
 304                         return NT_STATUS_NO_MEMORY;
 305                 }
 306
 307                 curr_off = hole_off;
 308         }
 309         status = NT_STATUS_OK;
 310 #endif
 311
 312         return status;
 313 }
 314
 315 static NTSTATUS fsctl_qar(TALLOC_CTX *mem_ctx,
 316                           struct tevent_context *ev,
 317                           struct files_struct *fsp,
 318                           DATA_BLOB *in_input,
 319                           size_t in_max_output,
 320                           DATA_BLOB *out_output)
 321 {
 322         struct fsctl_query_alloced_ranges_req qar_req;
 323         struct fsctl_query_alloced_ranges_rsp qar_rsp;
 324         DATA_BLOB qar_array_blob = data_blob_null;
 325         uint64_t max_off;
 326         enum ndr_err_code ndr_ret;
 327         int ret;
 328         NTSTATUS status;
 329         SMB_STRUCT_STAT sbuf;
 330
 331         if (fsp == NULL) {
 332                 return NT_STATUS_FILE_CLOSED;
 333         }
 334
 335         /* READ_DATA permission is required */
 336         status = check_access(fsp->conn, fsp, NULL, FILE_READ_DATA);
 337         if (!NT_STATUS_IS_OK(status)) {
 338                 return status;
 339         }
 340
 341         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &qar_req,
 342                 (ndr_pull_flags_fn_t)ndr_pull_fsctl_query_alloced_ranges_req);
 343         if (ndr_ret != NDR_ERR_SUCCESS) {
 344                 DEBUG(0, ("failed to unmarshall QAR req\n"));
 345                 return NT_STATUS_INVALID_PARAMETER;
 346         }
 347
 348         /*
 349          * XXX Windows Server 2008 & 2012 servers don't return lock-conflict
 350          * for QAR requests over an exclusively locked range!
 351          */
 352
 353         ret = SMB_VFS_FSTAT(fsp, &sbuf);
 354         if (ret == -1) {
 355                 status = map_nt_error_from_unix_common(errno);
 356                 DEBUG(2, ("fstat failed: %s\n", strerror(errno)));
 357                 return status;
 358         }
 359
 360         if ((qar_req.buf.len == 0)
 361          || (sbuf.st_ex_size == 0)
 362          || (qar_req.buf.file_off >= sbuf.st_ex_size)) {
 363                 /* zero length range or after EOF, no ranges to return */
 364                 return NT_STATUS_OK;
 365         }
 366
 367         /* check for integer overflow */
 368         if (qar_req.buf.file_off + qar_req.buf.len < qar_req.buf.file_off) {
 369                 return NT_STATUS_INVALID_PARAMETER;
 370         }
 371
 372         /*
 373          * Maximum offset is either the last valid offset _before_ EOF, or the
 374          * last byte offset within the requested range. -1 converts length to
 375          * offset, which is easier to work with for SEEK_DATA/SEEK_HOLE, E.g.:
 376          *
 377          * /off=0             /off=512K          /st_ex_size=1M
 378          * |-------------------------------------|
 379          * | File data                           |
 380          * |-------------------------------------|
 381          *                                                   QAR end\
 382          *                    |=====================================|
 383          *                    |    QAR off=512K, len=1M             |
 384          *                    |=================^===================|
 385          *                                   max_off=1M - 1
 386          *             QAR end\
 387          * |==================|
 388          * |QAR off=0 len=512K|
 389          * |==================|
 390          *                   ^
 391          *                max_off=512K - 1
 392          */
 393         max_off = MIN(sbuf.st_ex_size,
 394                       qar_req.buf.file_off + qar_req.buf.len) - 1;
 395
 396         if (!fsp->is_sparse) {
 397                 struct file_alloced_range_buf qar_buf;
 398
 399                 /* file is non-sparse, claim file_off->max_off is allocated */
 400                 qar_buf.file_off = qar_req.buf.file_off;
 401                 /* + 1 to convert maximum offset back to length */
 402                 qar_buf.len = max_off - qar_req.buf.file_off + 1;
 403
 404                 status = fsctl_qar_buf_push(mem_ctx, &qar_buf, &qar_array_blob);
 405         } else {
 406                 status = fsctl_qar_seek_fill(mem_ctx, fsp, qar_req.buf.file_off,
 407                                              max_off, &qar_array_blob);
 408         }
 409         if (!NT_STATUS_IS_OK(status)) {
 410                 return status;
 411         }
 412
 413         /* marshall response buffer. */
 414         qar_rsp.far_buf_array = qar_array_blob;
 415
 416         ndr_ret = ndr_push_struct_blob(out_output, mem_ctx, &qar_rsp,
 417                 (ndr_push_flags_fn_t)ndr_push_fsctl_query_alloced_ranges_rsp);
 418         if (ndr_ret != NDR_ERR_SUCCESS) {
 419                 DEBUG(0, ("failed to marshall QAR rsp\n"));
 420                 return NT_STATUS_INVALID_PARAMETER;
 421         }
 422
 423         if (out_output->length > in_max_output) {
 424                 DEBUG(2, ("QAR output len %lu exceeds max %lu\n",
 425                           (unsigned long)out_output->length,
 426                           (unsigned long)in_max_output));
 427                 data_blob_free(out_output);
 428                 return NT_STATUS_BUFFER_TOO_SMALL;
 429         }
 430
 431         return NT_STATUS_OK;
 432 }
 433
 434 struct tevent_req *smb2_ioctl_filesys(uint32_t ctl_code,
 435                                       struct tevent_context *ev,
 436                                       struct tevent_req *req,
 437                                       struct smbd_smb2_ioctl_state *state)
 438 {
 439         NTSTATUS status;
 440
 441         switch (ctl_code) {
 442         case FSCTL_GET_COMPRESSION:
 443                 status = fsctl_get_cmprn(state, ev, state->fsp,
 444                                          state->in_max_output,
 445                                          &state->out_output);
 446                 if (!tevent_req_nterror(req, status)) {
 447                         tevent_req_done(req);
 448                 }
 449                 return tevent_req_post(req, ev);
 450                 break;
 451         case FSCTL_SET_COMPRESSION:
 452                 status = fsctl_set_cmprn(state, ev, state->fsp,
 453                                          &state->in_input);
 454                 if (!tevent_req_nterror(req, status)) {
 455                         tevent_req_done(req);
 456                 }
 457                 return tevent_req_post(req, ev);
 458                 break;
 459         case FSCTL_SET_ZERO_DATA:
 460                 status = fsctl_zero_data(state, ev, state->fsp,
 461                                          &state->in_input);
 462                 if (!tevent_req_nterror(req, status)) {
 463                         tevent_req_done(req);
 464                 }
 465                 return tevent_req_post(req, ev);
 466                 break;
 467         case FSCTL_QUERY_ALLOCATED_RANGES:
 468                 status = fsctl_qar(state, ev, state->fsp,
 469                                    &state->in_input,
 470                                    state->in_max_output,
 471                                    &state->out_output);
 472                 if (!tevent_req_nterror(req, status)) {
 473                         tevent_req_done(req);
 474                 }
 475                 return tevent_req_post(req, ev);
 476                 break;
 477         default: {
 478                 uint8_t *out_data = NULL;
 479                 uint32_t out_data_len = 0;
 480
 481                 if (state->fsp == NULL) {
 482                         status = NT_STATUS_NOT_SUPPORTED;
 483                 } else {
 484                         status = SMB_VFS_FSCTL(state->fsp,
 485                                                state,
 486                                                ctl_code,
 487                                                state->smbreq->flags2,
 488                                                state->in_input.data,
 489                                                state->in_input.length,
 490                                                &out_data,
 491                                                state->in_max_output,
 492                                                &out_data_len);
 493                         state->out_output = data_blob_const(out_data, out_data_len);
 494                         if (NT_STATUS_IS_OK(status)) {
 495                                 tevent_req_done(req);
 496                                 return tevent_req_post(req, ev);
 497                         }
 498                 }
 499
 500                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 501                         if (IS_IPC(state->smbreq->conn)) {
 502                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 503                         } else {
 504                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 505                         }
 506                 }
 507
 508                 tevent_req_nterror(req, status);
 509                 return tevent_req_post(req, ev);
 510                 break;
 511         }
 512         }
 513
 514         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 515         return tevent_req_post(req, ev);
 516 }