source3/modules/offload_token.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Ralph Boehme 2017
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "smbd/smbd.h"
  22 #include "smbd/globals.h"
  23 #include "../libcli/security/security.h"
  24 #include "dbwrap/dbwrap.h"
  25 #include "dbwrap/dbwrap_rbt.h"
  26 #include "dbwrap/dbwrap_open.h"
  27 #include "../lib/util/util_tdb.h"
  28 #include "librpc/gen_ndr/ndr_ioctl.h"
  29 #include "librpc/gen_ndr/ioctl.h"
  30 #include "offload_token.h"
  31
  32 struct vfs_offload_ctx {
  33         bool initialized;
  34         struct db_context *db_ctx;
  35 };
  36
  37 NTSTATUS vfs_offload_token_ctx_init(TALLOC_CTX *mem_ctx,
  38                                     struct vfs_offload_ctx **_ctx)
  39 {
  40         struct vfs_offload_ctx *ctx = *_ctx;
  41
  42         if (ctx != NULL) {
  43                 if (!ctx->initialized) {
  44                         return NT_STATUS_INTERNAL_ERROR;
  45                 }
  46                 return NT_STATUS_OK;
  47         }
  48
  49         ctx = talloc_zero(mem_ctx, struct vfs_offload_ctx);
  50         if (ctx == NULL) {
  51                 return NT_STATUS_NO_MEMORY;
  52         }
  53
  54         ctx->db_ctx = db_open_rbt(mem_ctx);
  55         if (ctx->db_ctx == NULL) {
  56                 TALLOC_FREE(ctx);
  57                 return NT_STATUS_INTERNAL_ERROR;
  58         }
  59
  60         ctx->initialized = true;
  61         *_ctx = ctx;
  62         return NT_STATUS_OK;
  63 }
  64
  65 struct fsp_token_link {
  66         struct vfs_offload_ctx *ctx;
  67         DATA_BLOB token_blob;
  68 };
  69
  70 static int fsp_token_link_destructor(struct fsp_token_link *link)
  71 {
  72         DATA_BLOB token_blob = link->token_blob;
  73         TDB_DATA key = make_tdb_data(token_blob.data, token_blob.length);
  74         NTSTATUS status;
  75
  76         status = dbwrap_delete(link->ctx->db_ctx, key);
  77         if (!NT_STATUS_IS_OK(status)) {
  78                 DBG_ERR("dbwrap_delete failed: %s. Token:\n", nt_errstr(status));
  79                 dump_data(0, token_blob.data, token_blob.length);
  80                 return -1;
  81         }
  82
  83         return 0;
  84 }
  85
  86 NTSTATUS vfs_offload_token_db_store_fsp(struct vfs_offload_ctx *ctx,
  87                                         const files_struct *fsp,
  88                                         const DATA_BLOB *token_blob)
  89 {
  90         struct db_record *rec = NULL;
  91         struct fsp_token_link *link = NULL;
  92         TDB_DATA key = make_tdb_data(token_blob->data, token_blob->length);
  93         TDB_DATA value;
  94         NTSTATUS status;
  95
  96         rec = dbwrap_fetch_locked(ctx->db_ctx, talloc_tos(), key);
  97         if (rec == NULL) {
  98                 return NT_STATUS_INTERNAL_ERROR;
  99         }
 100
 101         value = dbwrap_record_get_value(rec);
 102         if (value.dsize != 0) {
 103                 void *ptr = NULL;
 104                 files_struct *token_db_fsp = NULL;
 105
 106                 if (value.dsize != sizeof(ptr)) {
 107                         DBG_ERR("Bad db entry for token:\n");
 108                         dump_data(1, token_blob->data, token_blob->length);
 109                         TALLOC_FREE(rec);
 110                         return NT_STATUS_INTERNAL_ERROR;
 111                 }
 112                 memcpy(&ptr, value.dptr, value.dsize);
 113                 TALLOC_FREE(rec);
 114
 115                 token_db_fsp = talloc_get_type_abort(ptr, struct files_struct);
 116                 if (token_db_fsp != fsp) {
 117                         DBG_ERR("token for fsp [%s] matches already known "
 118                                 "but different fsp [%s]:\n",
 119                                 fsp_str_dbg(fsp), fsp_str_dbg(token_db_fsp));
 120                         dump_data(1, token_blob->data, token_blob->length);
 121                         return NT_STATUS_INTERNAL_ERROR;
 122                 }
 123
 124                 return NT_STATUS_OK;
 125         }
 126
 127         link = talloc_zero(fsp, struct fsp_token_link);
 128         if (link == NULL) {
 129                 return NT_STATUS_NO_MEMORY;
 130         }
 131         link->ctx = ctx;
 132         link->token_blob = data_blob_talloc(link, token_blob->data,
 133                                             token_blob->length);
 134         if (link->token_blob.data == NULL) {
 135                 TALLOC_FREE(link);
 136                 return NT_STATUS_NO_MEMORY;
 137         }
 138         talloc_set_destructor(link, fsp_token_link_destructor);
 139
 140         value = make_tdb_data((uint8_t *)&fsp, sizeof(files_struct *));
 141
 142         status = dbwrap_record_store(rec, value, 0);
 143         if (!NT_STATUS_IS_OK(status)) {
 144                 DBG_ERR("dbwrap_record_store for [%s] failed: %s. Token\n",
 145                         fsp_str_dbg(fsp), nt_errstr(status));
 146                 dump_data(0, token_blob->data, token_blob->length);
 147                 TALLOC_FREE(link);
 148                 TALLOC_FREE(rec);
 149                 return status;
 150         }
 151
 152         TALLOC_FREE(rec);
 153         return NT_STATUS_OK;
 154 }
 155
 156 NTSTATUS vfs_offload_token_db_fetch_fsp(struct vfs_offload_ctx *ctx,
 157                                         const DATA_BLOB *token_blob,
 158                                         files_struct **fsp)
 159 {
 160         struct db_record *rec = NULL;
 161         TDB_DATA key = make_tdb_data(token_blob->data, token_blob->length);
 162         TDB_DATA value;
 163         void *ptr = NULL;
 164
 165         rec = dbwrap_fetch_locked(ctx->db_ctx, talloc_tos(), key);
 166         if (rec == NULL) {
 167                 return NT_STATUS_INTERNAL_ERROR;
 168         }
 169
 170         value = dbwrap_record_get_value(rec);
 171         if (value.dsize == 0) {
 172                 DBG_DEBUG("Unknown token:\n");
 173                 dump_data(10, token_blob->data, token_blob->length);
 174                 TALLOC_FREE(rec);
 175                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 176         }
 177
 178         if (value.dsize != sizeof(ptr)) {
 179                 DBG_ERR("Bad db entry for token:\n");
 180                 dump_data(1, token_blob->data, token_blob->length);
 181                 TALLOC_FREE(rec);
 182                 return NT_STATUS_INTERNAL_ERROR;
 183         }
 184
 185         memcpy(&ptr, value.dptr, value.dsize);
 186         TALLOC_FREE(rec);
 187
 188         *fsp = talloc_get_type_abort(ptr, struct files_struct);
 189         return NT_STATUS_OK;
 190 }
 191
 192 NTSTATUS vfs_offload_token_create_blob(TALLOC_CTX *mem_ctx,
 193                                        const files_struct *fsp,
 194                                        uint32_t fsctl,
 195                                        DATA_BLOB *token_blob)
 196 {
 197         size_t len;
 198
 199         switch (fsctl) {
 200         case FSCTL_DUP_EXTENTS_TO_FILE:
 201                 len = 20;
 202                 break;
 203         case FSCTL_SRV_REQUEST_RESUME_KEY:
 204                 len = 24;
 205                 break;
 206         default:
 207                 DBG_ERR("Invalid fsctl [%" PRIu32 "]\n", fsctl);
 208                 return NT_STATUS_NOT_SUPPORTED;
 209         }
 210
 211         *token_blob = data_blob_talloc_zero(mem_ctx, len);
 212         if (token_blob->length == 0) {
 213                 return NT_STATUS_NO_MEMORY;
 214         }
 215
 216         /* combine persistent and volatile handles for the resume key */
 217         SBVAL(token_blob->data,  0, fsp->op->global->open_persistent_id);
 218         SBVAL(token_blob->data,  8, fsp->op->global->open_volatile_id);
 219         SIVAL(token_blob->data, 16, fsctl);
 220
 221         return NT_STATUS_OK;
 222 }
 223
 224
 225 NTSTATUS vfs_offload_token_check_handles(uint32_t fsctl,
 226                                          files_struct *src_fsp,
 227                                          files_struct *dst_fsp)
 228 {
 229         if (src_fsp->vuid != dst_fsp->vuid) {
 230                 DBG_INFO("copy chunk handles not in the same session.\n");
 231                 return NT_STATUS_ACCESS_DENIED;
 232         }
 233
 234         if (!NT_STATUS_IS_OK(src_fsp->op->status)) {
 235                 DBG_INFO("copy chunk source handle invalid: %s\n",
 236                          nt_errstr(src_fsp->op->status));
 237                 return NT_STATUS_ACCESS_DENIED;
 238         }
 239
 240         if (!NT_STATUS_IS_OK(dst_fsp->op->status)) {
 241                 DBG_INFO("copy chunk destination handle invalid: %s\n",
 242                          nt_errstr(dst_fsp->op->status));
 243                 return NT_STATUS_ACCESS_DENIED;
 244         }
 245
 246         if (src_fsp->deferred_close != NULL) {
 247                 DBG_INFO("copy chunk src handle with deferred close.\n");
 248                 return NT_STATUS_ACCESS_DENIED;
 249         }
 250
 251         if (dst_fsp->deferred_close != NULL) {
 252                 DBG_INFO("copy chunk dst handle with deferred close.\n");
 253                 return NT_STATUS_ACCESS_DENIED;
 254         }
 255
 256         if (src_fsp->is_directory) {
 257                 DBG_INFO("copy chunk no read on src directory handle (%s).\n",
 258                          smb_fname_str_dbg(src_fsp->fsp_name));
 259                 return NT_STATUS_ACCESS_DENIED;
 260         }
 261
 262         if (dst_fsp->is_directory) {
 263                 DBG_INFO("copy chunk no read on dst directory handle (%s).\n",
 264                          smb_fname_str_dbg(dst_fsp->fsp_name));
 265                 return NT_STATUS_ACCESS_DENIED;
 266         }
 267
 268         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 269                 DBG_INFO("copy chunk no access on IPC$ handle.\n");
 270                 return NT_STATUS_ACCESS_DENIED;
 271         }
 272
 273         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 274                 DBG_INFO("copy chunk no access on PRINT handle.\n");
 275                 return NT_STATUS_ACCESS_DENIED;
 276         }
 277
 278         /*
 279          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 280          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 281          * the following are true:
 282          * - The Open.GrantedAccess of the destination file does not include
 283          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 284          *
 285          * A non writable dst handle also doesn't make sense for other fsctls.
 286          */
 287         if (!CHECK_WRITE(dst_fsp)) {
 288                 DBG_INFO("dest handle not writable (%s).\n",
 289                         smb_fname_str_dbg(dst_fsp->fsp_name));
 290                 return NT_STATUS_ACCESS_DENIED;
 291         }
 292         /*
 293          * - The Open.GrantedAccess of the destination file does not include
 294          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 295          */
 296         if ((fsctl == FSCTL_SRV_COPYCHUNK) && !CHECK_READ_IOCTL(dst_fsp)) {
 297                 DBG_INFO("copy chunk no read on dest handle (%s).\n",
 298                          smb_fname_str_dbg(dst_fsp->fsp_name));
 299                 return NT_STATUS_ACCESS_DENIED;
 300         }
 301         /*
 302          * - The Open.GrantedAccess of the source file does not include
 303          *   FILE_READ_DATA access.
 304          */
 305         if (!CHECK_READ_SMB2(src_fsp)) {
 306                 DBG_INFO("src handle not readable (%s).\n",
 307                          smb_fname_str_dbg(src_fsp->fsp_name));
 308                 return NT_STATUS_ACCESS_DENIED;
 309         }
 310
 311         return NT_STATUS_OK;
 312 }