source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "../lib/ccan/build_assert/build_assert.h"
  29 #include "include/ntioctl.h"
  30 #include "../librpc/ndr/libndr.h"
  31 #include "librpc/gen_ndr/ndr_ioctl.h"
  32 #include "smb2_ioctl_private.h"
  33
  34 #define COPYCHUNK_MAX_CHUNKS    256             /* 2k8r2 & win8 = 256 */
  35 #define COPYCHUNK_MAX_CHUNK_LEN 1048576         /* 2k8r2 & win8 = 1048576 */
  36 #define COPYCHUNK_MAX_TOTAL_LEN 16777216        /* 2k8r2 & win8 = 16777216 */
  37 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  38 {
  39         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  40         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  41         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  42 }
  43
  44 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  45 {
  46         uint32_t i;
  47         uint32_t total_len = 0;
  48
  49         /*
  50          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  51          * Send and invalid parameter response if:
  52          * - The ChunkCount value is greater than
  53          *   ServerSideCopyMaxNumberofChunks
  54          */
  55         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  56                 return NT_STATUS_INVALID_PARAMETER;
  57         }
  58
  59         for (i = 0; i < cc_copy->chunk_count; i++) {
  60                 /*
  61                  * - The Length value in a single chunk is greater than
  62                  *   ServerSideCopyMaxChunkSize or equal to zero.
  63                  */
  64                 if ((cc_copy->chunks[i].length == 0)
  65                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  66                         return NT_STATUS_INVALID_PARAMETER;
  67                 }
  68                 total_len += cc_copy->chunks[i].length;
  69         }
  70         /*
  71          * - Sum of Lengths in all chunks is greater than
  72          *   ServerSideCopyMaxDataSize
  73          */
  74         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  75                 return NT_STATUS_INVALID_PARAMETER;
  76         }
  77
  78         return NT_STATUS_OK;
  79 }
  80
  81 struct fsctl_srv_copychunk_state {
  82         struct connection_struct *conn;
  83         uint32_t dispatch_count;
  84         uint32_t recv_count;
  85         uint32_t bad_recv_count;
  86         NTSTATUS status;
  87         off_t total_written;
  88         struct files_struct *src_fsp;
  89         struct files_struct *dst_fsp;
  90         enum {
  91                 COPYCHUNK_OUT_EMPTY = 0,
  92                 COPYCHUNK_OUT_LIMITS,
  93                 COPYCHUNK_OUT_RSP,
  94         } out_data;
  95 };
  96 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  97
  98 static NTSTATUS copychunk_check_handles(struct files_struct *src_fsp,
  99                                         struct files_struct *dst_fsp,
 100                                         struct smb_request *smb1req)
 101 {
 102         /*
 103          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 104          * If Open.GrantedAccess of the destination file does not
 105          * include FILE_WRITE_DATA, then the request MUST be failed with
 106          * STATUS_ACCESS_DENIED. If Open.GrantedAccess of the
 107          * destination file does not include FILE_READ_DATA access and
 108          * the CtlCode is FSCTL_SRV_COPYCHUNK, then the request MUST be
 109          * failed with STATUS_ACCESS_DENIED.
 110          */
 111         if (!CHECK_WRITE(dst_fsp)) {
 112                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 113                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 114                 return NT_STATUS_ACCESS_DENIED;
 115         }
 116         if (!CHECK_READ(dst_fsp, smb1req)) {
 117                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 118                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 119                 return NT_STATUS_ACCESS_DENIED;
 120         }
 121         if (!CHECK_READ(src_fsp, smb1req)) {
 122                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 123                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 124                 return NT_STATUS_ACCESS_DENIED;
 125         }
 126
 127         if (src_fsp->is_directory) {
 128                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 129                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 130                 return NT_STATUS_ACCESS_DENIED;
 131         }
 132
 133         if (dst_fsp->is_directory) {
 134                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 135                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 136                 return NT_STATUS_ACCESS_DENIED;
 137         }
 138
 139         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 140                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 141                 return NT_STATUS_ACCESS_DENIED;
 142         }
 143
 144         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 145                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 146                 return NT_STATUS_ACCESS_DENIED;
 147         }
 148
 149         return NT_STATUS_OK;
 150 }
 151
 152 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 153                                                    struct tevent_context *ev,
 154                                                    struct files_struct *dst_fsp,
 155                                                    DATA_BLOB *in_input,
 156                                                    size_t in_max_output,
 157                                                    struct smbd_smb2_request *smb2req)
 158 {
 159         struct tevent_req *req;
 160         struct srv_copychunk_copy cc_copy;
 161         enum ndr_err_code ndr_ret;
 162         uint64_t src_persistent_h;
 163         uint64_t src_volatile_h;
 164         int i;
 165         struct srv_copychunk *chunk;
 166         struct fsctl_srv_copychunk_state *state;
 167
 168         req = tevent_req_create(mem_ctx, &state,
 169                                 struct fsctl_srv_copychunk_state);
 170         if (req == NULL) {
 171                 return NULL;
 172         }
 173         state->conn = dst_fsp->conn;
 174
 175         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 176                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 177                           "response %lu\n", (int)in_max_output,
 178                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 179                 state->status = NT_STATUS_INVALID_PARAMETER;
 180                 tevent_req_nterror(req, state->status);
 181                 return tevent_req_post(req, ev);
 182         }
 183
 184         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
 185                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 186         if (ndr_ret != NDR_ERR_SUCCESS) {
 187                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 188                 state->status = NT_STATUS_INVALID_PARAMETER;
 189                 tevent_req_nterror(req, state->status);
 190                 return tevent_req_post(req, ev);
 191         }
 192
 193         /* persistent/volatile keys sent as the resume key */
 194         src_persistent_h = BVAL(cc_copy.source_key, 0);
 195         src_volatile_h = BVAL(cc_copy.source_key, 8);
 196         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 197         if (state->src_fsp == NULL) {
 198                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 199                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 200                 tevent_req_nterror(req, state->status);
 201                 return tevent_req_post(req, ev);
 202         }
 203
 204         state->dst_fsp = dst_fsp;
 205
 206         state->status = copychunk_check_handles(state->src_fsp,
 207                                                 state->dst_fsp,
 208                                                 smb2req->smb1req);
 209         if (!NT_STATUS_IS_OK(state->status)) {
 210                 tevent_req_nterror(req, state->status);
 211                 return tevent_req_post(req, ev);
 212         }
 213
 214         state->status = copychunk_check_limits(&cc_copy);
 215         if (tevent_req_nterror(req, state->status)) {
 216                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 217                 state->out_data = COPYCHUNK_OUT_LIMITS;
 218                 return tevent_req_post(req, ev);
 219         }
 220
 221         /* any errors from here onwards should carry copychunk response data */
 222         state->out_data = COPYCHUNK_OUT_RSP;
 223
 224         for (i = 0; i < cc_copy.chunk_count; i++) {
 225                 struct tevent_req *vfs_subreq;
 226                 chunk = &cc_copy.chunks[i];
 227                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 228                                                      state, ev,
 229                                                      state->src_fsp,
 230                                                      chunk->source_off,
 231                                                      state->dst_fsp,
 232                                                      chunk->target_off,
 233                                                      chunk->length);
 234                 if (vfs_subreq == NULL) {
 235                         DEBUG(0, ("VFS copy chunk send failed\n"));
 236                         state->status = NT_STATUS_NO_MEMORY;
 237                         if (state->dispatch_count == 0) {
 238                                 /* nothing dispatched, return immediately */
 239                                 tevent_req_nterror(req, state->status);
 240                                 return tevent_req_post(req, ev);
 241                         } else {
 242                                 /*
 243                                  * wait for dispatched to complete before
 244                                  * returning error.
 245                                  */
 246                                 break;
 247                         }
 248                 }
 249                 tevent_req_set_callback(vfs_subreq,
 250                                         fsctl_srv_copychunk_vfs_done, req);
 251                 state->dispatch_count++;
 252         }
 253
 254         return req;
 255 }
 256
 257 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 258 {
 259         struct tevent_req *req = tevent_req_callback_data(
 260                 subreq, struct tevent_req);
 261         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 262                                         struct fsctl_srv_copychunk_state);
 263         off_t chunk_nwritten;
 264         NTSTATUS status;
 265
 266         state->recv_count++;
 267         status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
 268                                          &chunk_nwritten);
 269         TALLOC_FREE(subreq);
 270         if (NT_STATUS_IS_OK(status)) {
 271                 DEBUG(10, ("good copy chunk recv %u of %u\n",
 272                            (unsigned int)state->recv_count,
 273                            (unsigned int)state->dispatch_count));
 274                 state->total_written += chunk_nwritten;
 275         } else {
 276                 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
 277                           (unsigned int)state->recv_count,
 278                           (unsigned int)state->dispatch_count,
 279                           nt_errstr(status)));
 280                 state->bad_recv_count++;
 281                 /* may overwrite previous failed status */
 282                 state->status = status;
 283         }
 284
 285         if (state->recv_count != state->dispatch_count) {
 286                 /*
 287                  * Wait for all VFS copy_chunk requests to complete, even
 288                  * if an error is received for a specific chunk.
 289                  */
 290                 return;
 291         }
 292
 293         if (!tevent_req_nterror(req, state->status)) {
 294                 tevent_req_done(req);
 295         }
 296 }
 297
 298 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 299                                          struct srv_copychunk_rsp *cc_rsp,
 300                                          bool *pack_rsp)
 301 {
 302         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 303                                         struct fsctl_srv_copychunk_state);
 304         NTSTATUS status;
 305
 306         switch (state->out_data) {
 307         case COPYCHUNK_OUT_EMPTY:
 308                 *pack_rsp = false;
 309                 break;
 310         case COPYCHUNK_OUT_LIMITS:
 311                 /* 2.2.32.1 - send back our maximum transfer size limits */
 312                 copychunk_pack_limits(cc_rsp);
 313                 *pack_rsp = true;
 314                 break;
 315         case COPYCHUNK_OUT_RSP:
 316                 cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
 317                 cc_rsp->chunk_bytes_written = 0;
 318                 cc_rsp->total_bytes_written = state->total_written;
 319                 *pack_rsp = true;
 320                 break;
 321         default:        /* not reached */
 322                 assert(1);
 323                 break;
 324         }
 325         status = state->status;
 326         tevent_req_received(req);
 327
 328         return status;
 329 }
 330
 331 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 332                                         struct tevent_context *ev,
 333                                         struct smbXsrv_connection *conn,
 334                                         DATA_BLOB *in_input,
 335                                         uint32_t in_max_output,
 336                                         DATA_BLOB *out_output,
 337                                         bool *disconnect)
 338 {
 339         uint32_t in_capabilities;
 340         DATA_BLOB in_guid_blob;
 341         struct GUID in_guid;
 342         uint16_t in_security_mode;
 343         uint16_t in_num_dialects;
 344         uint16_t i;
 345         DATA_BLOB out_guid_blob;
 346         NTSTATUS status;
 347
 348         if (in_input->length < 0x18) {
 349                 return NT_STATUS_INVALID_PARAMETER;
 350         }
 351
 352         in_capabilities = IVAL(in_input->data, 0x00);
 353         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 354         in_security_mode = SVAL(in_input->data, 0x14);
 355         in_num_dialects = SVAL(in_input->data, 0x16);
 356
 357         if (in_input->length < (0x18 + in_num_dialects*2)) {
 358                 return NT_STATUS_INVALID_PARAMETER;
 359         }
 360
 361         if (in_max_output < 0x18) {
 362                 return NT_STATUS_BUFFER_TOO_SMALL;
 363         }
 364
 365         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 366         if (!NT_STATUS_IS_OK(status)) {
 367                 return status;
 368         }
 369
 370         if (in_num_dialects != conn->smb2.client.num_dialects) {
 371                 *disconnect = true;
 372                 return NT_STATUS_ACCESS_DENIED;
 373         }
 374
 375         for (i=0; i < in_num_dialects; i++) {
 376                 uint16_t v = SVAL(in_input->data, 0x18 + i*2);
 377
 378                 if (conn->smb2.client.dialects[i] != v) {
 379                         *disconnect = true;
 380                         return NT_STATUS_ACCESS_DENIED;
 381                 }
 382         }
 383
 384         if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) {
 385                 *disconnect = true;
 386                 return NT_STATUS_ACCESS_DENIED;
 387         }
 388
 389         if (in_security_mode != conn->smb2.client.security_mode) {
 390                 *disconnect = true;
 391                 return NT_STATUS_ACCESS_DENIED;
 392         }
 393
 394         if (in_capabilities != conn->smb2.client.capabilities) {
 395                 *disconnect = true;
 396                 return NT_STATUS_ACCESS_DENIED;
 397         }
 398
 399         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 400                                   &out_guid_blob);
 401         if (!NT_STATUS_IS_OK(status)) {
 402                 return status;
 403         }
 404
 405         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 406         if (out_output->data == NULL) {
 407                 return NT_STATUS_NO_MEMORY;
 408         }
 409
 410         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 411         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 412         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 413         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 414
 415         return NT_STATUS_OK;
 416 }
 417
 418 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
 419                                          struct tevent_context *ev,
 420                                          struct files_struct *fsp,
 421                                          uint32_t in_max_output,
 422                                          DATA_BLOB *out_output)
 423 {
 424         struct req_resume_key_rsp rkey_rsp;
 425         enum ndr_err_code ndr_ret;
 426         DATA_BLOB output;
 427
 428         if (fsp == NULL) {
 429                 return NT_STATUS_FILE_CLOSED;
 430         }
 431
 432         ZERO_STRUCT(rkey_rsp);
 433         /* combine persistent and volatile handles for the resume key */
 434         SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
 435         SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
 436
 437         ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
 438                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 439         if (ndr_ret != NDR_ERR_SUCCESS) {
 440                 return NT_STATUS_INTERNAL_ERROR;
 441         }
 442
 443         if (in_max_output < output.length) {
 444                 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
 445                           (unsigned int)in_max_output, (long int)output.length));
 446                 return NT_STATUS_INVALID_PARAMETER;
 447         }
 448         *out_output = output;
 449
 450         return NT_STATUS_OK;
 451 }
 452
 453 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 454
 455 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 456                                          struct tevent_context *ev,
 457                                          struct tevent_req *req,
 458                                          struct smbd_smb2_ioctl_state *state)
 459 {
 460         struct tevent_req *subreq;
 461         NTSTATUS status;
 462
 463         switch (ctl_code) {
 464         case FSCTL_SRV_COPYCHUNK:
 465                 subreq = fsctl_srv_copychunk_send(state, ev, state->fsp,
 466                                                   &state->in_input,
 467                                                   state->in_max_output,
 468                                                   state->smb2req);
 469                 if (tevent_req_nomem(subreq, req)) {
 470                         return tevent_req_post(req, ev);
 471                 }
 472                 tevent_req_set_callback(subreq,
 473                                         smb2_ioctl_network_fs_copychunk_done,
 474                                         req);
 475                 return req;
 476                 break;
 477         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 478                 status = fsctl_validate_neg_info(state, ev,
 479                                                  state->smbreq->sconn->conn,
 480                                                  &state->in_input,
 481                                                  state->in_max_output,
 482                                                  &state->out_output,
 483                                                  &state->disconnect);
 484                 if (!tevent_req_nterror(req, status)) {
 485                         tevent_req_done(req);
 486                 }
 487                 return tevent_req_post(req, ev);
 488                 break;
 489         case FSCTL_SRV_REQUEST_RESUME_KEY:
 490                 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
 491                                                   state->in_max_output,
 492                                                   &state->out_output);
 493                 if (!tevent_req_nterror(req, status)) {
 494                         tevent_req_done(req);
 495                 }
 496                 return tevent_req_post(req, ev);
 497                 break;
 498         default: {
 499                 uint8_t *out_data = NULL;
 500                 uint32_t out_data_len = 0;
 501
 502                 if (state->fsp == NULL) {
 503                         status = NT_STATUS_NOT_SUPPORTED;
 504                 } else {
 505                         status = SMB_VFS_FSCTL(state->fsp,
 506                                                state,
 507                                                ctl_code,
 508                                                state->smbreq->flags2,
 509                                                state->in_input.data,
 510                                                state->in_input.length,
 511                                                &out_data,
 512                                                state->in_max_output,
 513                                                &out_data_len);
 514                         state->out_output = data_blob_const(out_data, out_data_len);
 515                         if (NT_STATUS_IS_OK(status)) {
 516                                 tevent_req_done(req);
 517                                 return tevent_req_post(req, ev);
 518                         }
 519                 }
 520
 521                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 522                         if (IS_IPC(state->smbreq->conn)) {
 523                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 524                         } else {
 525                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 526                         }
 527                 }
 528
 529                 tevent_req_nterror(req, status);
 530                 return tevent_req_post(req, ev);
 531                 break;
 532         }
 533         }
 534
 535         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 536         return tevent_req_post(req, ev);
 537 }
 538
 539 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 540 {
 541         struct tevent_req *req = tevent_req_callback_data(subreq,
 542                                                           struct tevent_req);
 543         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 544                                                 struct smbd_smb2_ioctl_state);
 545         struct srv_copychunk_rsp cc_rsp;
 546         NTSTATUS status;
 547         bool pack_rsp = false;
 548
 549         ZERO_STRUCT(cc_rsp);
 550         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 551         TALLOC_FREE(subreq);
 552         if (pack_rsp == true) {
 553                 enum ndr_err_code ndr_ret;
 554                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 555                                                ioctl_state,
 556                                                &cc_rsp,
 557                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 558                 if (ndr_ret != NDR_ERR_SUCCESS) {
 559                         status = NT_STATUS_INTERNAL_ERROR;
 560                 }
 561         }
 562
 563         if (!tevent_req_nterror(req, status)) {
 564                 tevent_req_done(req);
 565         }
 566 }