2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) David Disseldorp 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../libcli/security/security.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "include/ntioctl.h"
29 #include "../librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_ioctl.h"
31 #include "smb2_ioctl_private.h"
33 #define COPYCHUNK_MAX_CHUNKS 256 /* 2k8r2 & win8 = 256 */
34 #define COPYCHUNK_MAX_CHUNK_LEN 1048576 /* 2k8r2 & win8 = 1048576 */
35 #define COPYCHUNK_MAX_TOTAL_LEN 16777216 /* 2k8r2 & win8 = 16777216 */
36 static void copychunk_pack_limits(struct srv_copychunk_rsp
*cc_rsp
)
38 cc_rsp
->chunks_written
= COPYCHUNK_MAX_CHUNKS
;
39 cc_rsp
->chunk_bytes_written
= COPYCHUNK_MAX_CHUNK_LEN
;
40 cc_rsp
->total_bytes_written
= COPYCHUNK_MAX_TOTAL_LEN
;
43 static NTSTATUS
copychunk_check_limits(struct srv_copychunk_copy
*cc_copy
)
46 uint32_t total_len
= 0;
49 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
50 * Send and invalid parameter response if:
51 * - The ChunkCount value is greater than
52 * ServerSideCopyMaxNumberofChunks
54 if (cc_copy
->chunk_count
> COPYCHUNK_MAX_CHUNKS
) {
55 return NT_STATUS_INVALID_PARAMETER
;
58 for (i
= 0; i
< cc_copy
->chunk_count
; i
++) {
60 * - The Length value in a single chunk is greater than
61 * ServerSideCopyMaxChunkSize or equal to zero.
63 if ((cc_copy
->chunks
[i
].length
== 0)
64 || (cc_copy
->chunks
[i
].length
> COPYCHUNK_MAX_CHUNK_LEN
)) {
65 return NT_STATUS_INVALID_PARAMETER
;
67 total_len
+= cc_copy
->chunks
[i
].length
;
70 * - Sum of Lengths in all chunks is greater than
71 * ServerSideCopyMaxDataSize
73 if (total_len
> COPYCHUNK_MAX_TOTAL_LEN
) {
74 return NT_STATUS_INVALID_PARAMETER
;
80 struct fsctl_srv_copychunk_state
{
81 struct connection_struct
*conn
;
82 uint32_t dispatch_count
;
84 uint32_t bad_recv_count
;
87 struct files_struct
*src_fsp
;
88 struct files_struct
*dst_fsp
;
90 COPYCHUNK_OUT_EMPTY
= 0,
95 static void fsctl_srv_copychunk_vfs_done(struct tevent_req
*subreq
);
97 static NTSTATUS
copychunk_check_handles(uint32_t ctl_code
,
98 struct files_struct
*src_fsp
,
99 struct files_struct
*dst_fsp
,
100 struct smb_request
*smb1req
)
103 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
104 * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
105 * the following are true:
106 * - The Open.GrantedAccess of the destination file does not include
107 * FILE_WRITE_DATA or FILE_APPEND_DATA.
109 if (!CHECK_WRITE(dst_fsp
)) {
110 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
111 smb_fname_str_dbg(dst_fsp
->fsp_name
) ));
112 return NT_STATUS_ACCESS_DENIED
;
115 * - The Open.GrantedAccess of the destination file does not include
116 * FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
118 if ((ctl_code
== FSCTL_SRV_COPYCHUNK
)
119 && !CHECK_READ(dst_fsp
, smb1req
)) {
120 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
121 smb_fname_str_dbg(dst_fsp
->fsp_name
) ));
122 return NT_STATUS_ACCESS_DENIED
;
125 * - The Open.GrantedAccess of the source file does not include
126 * FILE_READ_DATA access.
128 if (!CHECK_READ(src_fsp
, smb1req
)) {
129 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
130 smb_fname_str_dbg(src_fsp
->fsp_name
) ));
131 return NT_STATUS_ACCESS_DENIED
;
134 if (src_fsp
->is_directory
) {
135 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
136 smb_fname_str_dbg(src_fsp
->fsp_name
) ));
137 return NT_STATUS_ACCESS_DENIED
;
140 if (dst_fsp
->is_directory
) {
141 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
142 smb_fname_str_dbg(dst_fsp
->fsp_name
) ));
143 return NT_STATUS_ACCESS_DENIED
;
146 if (IS_IPC(src_fsp
->conn
) || IS_IPC(dst_fsp
->conn
)) {
147 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
148 return NT_STATUS_ACCESS_DENIED
;
151 if (IS_PRINT(src_fsp
->conn
) || IS_PRINT(dst_fsp
->conn
)) {
152 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
153 return NT_STATUS_ACCESS_DENIED
;
159 static struct tevent_req
*fsctl_srv_copychunk_send(TALLOC_CTX
*mem_ctx
,
160 struct tevent_context
*ev
,
162 struct files_struct
*dst_fsp
,
164 size_t in_max_output
,
165 struct smbd_smb2_request
*smb2req
)
167 struct tevent_req
*req
;
168 struct srv_copychunk_copy cc_copy
;
169 enum ndr_err_code ndr_ret
;
170 uint64_t src_persistent_h
;
171 uint64_t src_volatile_h
;
173 struct srv_copychunk
*chunk
;
174 struct fsctl_srv_copychunk_state
*state
;
176 /* handler for both copy-chunk variants */
177 SMB_ASSERT((ctl_code
== FSCTL_SRV_COPYCHUNK
)
178 || (ctl_code
== FSCTL_SRV_COPYCHUNK_WRITE
));
180 req
= tevent_req_create(mem_ctx
, &state
,
181 struct fsctl_srv_copychunk_state
);
185 state
->conn
= dst_fsp
->conn
;
187 if (in_max_output
< sizeof(struct srv_copychunk_rsp
)) {
188 DEBUG(3, ("max output %d not large enough to hold copy chunk "
189 "response %lu\n", (int)in_max_output
,
190 (unsigned long)sizeof(struct srv_copychunk_rsp
)));
191 state
->status
= NT_STATUS_INVALID_PARAMETER
;
192 tevent_req_nterror(req
, state
->status
);
193 return tevent_req_post(req
, ev
);
196 ndr_ret
= ndr_pull_struct_blob(in_input
, mem_ctx
, &cc_copy
,
197 (ndr_pull_flags_fn_t
)ndr_pull_srv_copychunk_copy
);
198 if (ndr_ret
!= NDR_ERR_SUCCESS
) {
199 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
200 state
->status
= NT_STATUS_INVALID_PARAMETER
;
201 tevent_req_nterror(req
, state
->status
);
202 return tevent_req_post(req
, ev
);
205 /* persistent/volatile keys sent as the resume key */
206 src_persistent_h
= BVAL(cc_copy
.source_key
, 0);
207 src_volatile_h
= BVAL(cc_copy
.source_key
, 8);
208 state
->src_fsp
= file_fsp_get(smb2req
, src_persistent_h
, src_volatile_h
);
209 if (state
->src_fsp
== NULL
) {
210 DEBUG(3, ("invalid resume key in copy chunk req\n"));
211 state
->status
= NT_STATUS_OBJECT_NAME_NOT_FOUND
;
212 tevent_req_nterror(req
, state
->status
);
213 return tevent_req_post(req
, ev
);
216 state
->dst_fsp
= dst_fsp
;
218 state
->status
= copychunk_check_handles(ctl_code
,
222 if (!NT_STATUS_IS_OK(state
->status
)) {
223 tevent_req_nterror(req
, state
->status
);
224 return tevent_req_post(req
, ev
);
227 state
->status
= copychunk_check_limits(&cc_copy
);
228 if (tevent_req_nterror(req
, state
->status
)) {
229 DEBUG(3, ("copy chunk req exceeds limits\n"));
230 state
->out_data
= COPYCHUNK_OUT_LIMITS
;
231 return tevent_req_post(req
, ev
);
234 /* any errors from here onwards should carry copychunk response data */
235 state
->out_data
= COPYCHUNK_OUT_RSP
;
237 for (i
= 0; i
< cc_copy
.chunk_count
; i
++) {
238 struct tevent_req
*vfs_subreq
;
239 chunk
= &cc_copy
.chunks
[i
];
240 vfs_subreq
= SMB_VFS_COPY_CHUNK_SEND(dst_fsp
->conn
,
247 if (vfs_subreq
== NULL
) {
248 DEBUG(0, ("VFS copy chunk send failed\n"));
249 state
->status
= NT_STATUS_NO_MEMORY
;
250 if (state
->dispatch_count
== 0) {
251 /* nothing dispatched, return immediately */
252 tevent_req_nterror(req
, state
->status
);
253 return tevent_req_post(req
, ev
);
256 * wait for dispatched to complete before
262 tevent_req_set_callback(vfs_subreq
,
263 fsctl_srv_copychunk_vfs_done
, req
);
264 state
->dispatch_count
++;
270 static void fsctl_srv_copychunk_vfs_done(struct tevent_req
*subreq
)
272 struct tevent_req
*req
= tevent_req_callback_data(
273 subreq
, struct tevent_req
);
274 struct fsctl_srv_copychunk_state
*state
= tevent_req_data(req
,
275 struct fsctl_srv_copychunk_state
);
276 off_t chunk_nwritten
;
280 status
= SMB_VFS_COPY_CHUNK_RECV(state
->conn
, subreq
,
283 if (NT_STATUS_IS_OK(status
)) {
284 DEBUG(10, ("good copy chunk recv %u of %u\n",
285 (unsigned int)state
->recv_count
,
286 (unsigned int)state
->dispatch_count
));
287 state
->total_written
+= chunk_nwritten
;
289 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
290 (unsigned int)state
->recv_count
,
291 (unsigned int)state
->dispatch_count
,
293 state
->bad_recv_count
++;
294 /* may overwrite previous failed status */
295 state
->status
= status
;
298 if (state
->recv_count
!= state
->dispatch_count
) {
300 * Wait for all VFS copy_chunk requests to complete, even
301 * if an error is received for a specific chunk.
306 if (!tevent_req_nterror(req
, state
->status
)) {
307 tevent_req_done(req
);
311 static NTSTATUS
fsctl_srv_copychunk_recv(struct tevent_req
*req
,
312 struct srv_copychunk_rsp
*cc_rsp
,
315 struct fsctl_srv_copychunk_state
*state
= tevent_req_data(req
,
316 struct fsctl_srv_copychunk_state
);
319 switch (state
->out_data
) {
320 case COPYCHUNK_OUT_EMPTY
:
323 case COPYCHUNK_OUT_LIMITS
:
324 /* 2.2.32.1 - send back our maximum transfer size limits */
325 copychunk_pack_limits(cc_rsp
);
328 case COPYCHUNK_OUT_RSP
:
329 cc_rsp
->chunks_written
= state
->recv_count
- state
->bad_recv_count
;
330 cc_rsp
->chunk_bytes_written
= 0;
331 cc_rsp
->total_bytes_written
= state
->total_written
;
334 default: /* not reached */
338 status
= state
->status
;
339 tevent_req_received(req
);
344 static NTSTATUS
fsctl_validate_neg_info(TALLOC_CTX
*mem_ctx
,
345 struct tevent_context
*ev
,
346 struct smbXsrv_connection
*conn
,
348 uint32_t in_max_output
,
349 DATA_BLOB
*out_output
,
352 uint32_t in_capabilities
;
353 DATA_BLOB in_guid_blob
;
355 uint16_t in_security_mode
;
356 uint16_t in_num_dialects
;
358 DATA_BLOB out_guid_blob
;
360 enum protocol_types protocol
= PROTOCOL_NONE
;
362 if (in_input
->length
< 0x18) {
363 return NT_STATUS_INVALID_PARAMETER
;
366 in_capabilities
= IVAL(in_input
->data
, 0x00);
367 in_guid_blob
= data_blob_const(in_input
->data
+ 0x04, 16);
368 in_security_mode
= SVAL(in_input
->data
, 0x14);
369 in_num_dialects
= SVAL(in_input
->data
, 0x16);
371 if (in_input
->length
< (0x18 + in_num_dialects
*2)) {
372 return NT_STATUS_INVALID_PARAMETER
;
375 if (in_max_output
< 0x18) {
376 return NT_STATUS_BUFFER_TOO_SMALL
;
379 status
= GUID_from_ndr_blob(&in_guid_blob
, &in_guid
);
380 if (!NT_STATUS_IS_OK(status
)) {
386 * 3.3.5.15.12 Handling a Validate Negotiate Info Request
388 * The server MUST determine the greatest common dialect
389 * between the dialects it implements and the Dialects array
390 * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
391 * matched, or if the value is not equal to Connection.Dialect,
392 * the server MUST terminate the transport connection
393 * and free the Connection object.
395 protocol
= smbd_smb2_protocol_dialect_match(in_input
->data
+ 0x18,
398 if (conn
->protocol
!= protocol
) {
400 return NT_STATUS_ACCESS_DENIED
;
403 if (!GUID_equal(&in_guid
, &conn
->smb2
.client
.guid
)) {
405 return NT_STATUS_ACCESS_DENIED
;
408 if (in_security_mode
!= conn
->smb2
.client
.security_mode
) {
410 return NT_STATUS_ACCESS_DENIED
;
413 if (in_capabilities
!= conn
->smb2
.client
.capabilities
) {
415 return NT_STATUS_ACCESS_DENIED
;
418 status
= GUID_to_ndr_blob(&conn
->smb2
.server
.guid
, mem_ctx
,
420 if (!NT_STATUS_IS_OK(status
)) {
424 *out_output
= data_blob_talloc(mem_ctx
, NULL
, 0x18);
425 if (out_output
->data
== NULL
) {
426 return NT_STATUS_NO_MEMORY
;
429 SIVAL(out_output
->data
, 0x00, conn
->smb2
.server
.capabilities
);
430 memcpy(out_output
->data
+0x04, out_guid_blob
.data
, 16);
431 SSVAL(out_output
->data
, 0x14, conn
->smb2
.server
.security_mode
);
432 SSVAL(out_output
->data
, 0x16, conn
->smb2
.server
.dialect
);
437 static NTSTATUS
fsctl_srv_req_resume_key(TALLOC_CTX
*mem_ctx
,
438 struct tevent_context
*ev
,
439 struct files_struct
*fsp
,
440 uint32_t in_max_output
,
441 DATA_BLOB
*out_output
)
443 struct req_resume_key_rsp rkey_rsp
;
444 enum ndr_err_code ndr_ret
;
448 return NT_STATUS_FILE_CLOSED
;
451 ZERO_STRUCT(rkey_rsp
);
452 /* combine persistent and volatile handles for the resume key */
453 SBVAL(rkey_rsp
.resume_key
, 0, fsp
->op
->global
->open_persistent_id
);
454 SBVAL(rkey_rsp
.resume_key
, 8, fsp
->op
->global
->open_volatile_id
);
456 ndr_ret
= ndr_push_struct_blob(&output
, mem_ctx
, &rkey_rsp
,
457 (ndr_push_flags_fn_t
)ndr_push_req_resume_key_rsp
);
458 if (ndr_ret
!= NDR_ERR_SUCCESS
) {
459 return NT_STATUS_INTERNAL_ERROR
;
462 if (in_max_output
< output
.length
) {
463 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
464 (unsigned int)in_max_output
, (long int)output
.length
));
465 return NT_STATUS_INVALID_PARAMETER
;
467 *out_output
= output
;
472 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req
*subreq
);
474 struct tevent_req
*smb2_ioctl_network_fs(uint32_t ctl_code
,
475 struct tevent_context
*ev
,
476 struct tevent_req
*req
,
477 struct smbd_smb2_ioctl_state
*state
)
479 struct tevent_req
*subreq
;
485 * FSCTL_SRV_COPYCHUNK is issued when a handle has
486 * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
487 * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
488 * FILE_WRITE_DATA access.
490 case FSCTL_SRV_COPYCHUNK_WRITE
: /* FALL THROUGH */
491 case FSCTL_SRV_COPYCHUNK
:
492 subreq
= fsctl_srv_copychunk_send(state
, ev
,
496 state
->in_max_output
,
498 if (tevent_req_nomem(subreq
, req
)) {
499 return tevent_req_post(req
, ev
);
501 tevent_req_set_callback(subreq
,
502 smb2_ioctl_network_fs_copychunk_done
,
506 case FSCTL_VALIDATE_NEGOTIATE_INFO
:
507 status
= fsctl_validate_neg_info(state
, ev
,
508 state
->smbreq
->xconn
,
510 state
->in_max_output
,
513 if (!tevent_req_nterror(req
, status
)) {
514 tevent_req_done(req
);
516 return tevent_req_post(req
, ev
);
518 case FSCTL_SRV_REQUEST_RESUME_KEY
:
519 status
= fsctl_srv_req_resume_key(state
, ev
, state
->fsp
,
520 state
->in_max_output
,
522 if (!tevent_req_nterror(req
, status
)) {
523 tevent_req_done(req
);
525 return tevent_req_post(req
, ev
);
528 uint8_t *out_data
= NULL
;
529 uint32_t out_data_len
= 0;
531 if (state
->fsp
== NULL
) {
532 status
= NT_STATUS_NOT_SUPPORTED
;
534 status
= SMB_VFS_FSCTL(state
->fsp
,
537 state
->smbreq
->flags2
,
538 state
->in_input
.data
,
539 state
->in_input
.length
,
541 state
->in_max_output
,
543 state
->out_output
= data_blob_const(out_data
, out_data_len
);
544 if (NT_STATUS_IS_OK(status
)) {
545 tevent_req_done(req
);
546 return tevent_req_post(req
, ev
);
550 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_SUPPORTED
)) {
551 if (IS_IPC(state
->smbreq
->conn
)) {
552 status
= NT_STATUS_FS_DRIVER_REQUIRED
;
554 status
= NT_STATUS_INVALID_DEVICE_REQUEST
;
558 tevent_req_nterror(req
, status
);
559 return tevent_req_post(req
, ev
);
564 tevent_req_nterror(req
, NT_STATUS_INTERNAL_ERROR
);
565 return tevent_req_post(req
, ev
);
568 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req
*subreq
)
570 struct tevent_req
*req
= tevent_req_callback_data(subreq
,
572 struct smbd_smb2_ioctl_state
*ioctl_state
= tevent_req_data(req
,
573 struct smbd_smb2_ioctl_state
);
574 struct srv_copychunk_rsp cc_rsp
;
576 bool pack_rsp
= false;
579 status
= fsctl_srv_copychunk_recv(subreq
, &cc_rsp
, &pack_rsp
);
581 if (pack_rsp
== true) {
582 enum ndr_err_code ndr_ret
;
583 ndr_ret
= ndr_push_struct_blob(&ioctl_state
->out_output
,
586 (ndr_push_flags_fn_t
)ndr_push_srv_copychunk_rsp
);
587 if (ndr_ret
!= NDR_ERR_SUCCESS
) {
588 status
= NT_STATUS_INTERNAL_ERROR
;
592 if (!tevent_req_nterror(req
, status
)) {
593 tevent_req_done(req
);