s3:smbd: s/struct timed_event/struct tevent_timer
[Samba/gebeck_regimport.git] / source3 / smbd / smb2_ioctl_network_fs.c
blob1e1e3e5e9429985375a711211f49cbdf8da2f061
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) David Disseldorp 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../libcli/security/security.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "../lib/ccan/build_assert/build_assert.h"
29 #include "include/ntioctl.h"
30 #include "../librpc/ndr/libndr.h"
31 #include "librpc/gen_ndr/ndr_ioctl.h"
32 #include "smb2_ioctl_private.h"
34 #define COPYCHUNK_MAX_CHUNKS 256 /* 2k8r2 & win8 = 256 */
35 #define COPYCHUNK_MAX_CHUNK_LEN 1048576 /* 2k8r2 & win8 = 1048576 */
36 #define COPYCHUNK_MAX_TOTAL_LEN 16777216 /* 2k8r2 & win8 = 16777216 */
37 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
39 cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
40 cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
41 cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
44 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
46 uint32_t i;
47 uint32_t total_len = 0;
49 if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
50 return NT_STATUS_INVALID_PARAMETER;
53 for (i = 0; i < cc_copy->chunk_count; i++) {
54 if (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN) {
55 return NT_STATUS_INVALID_PARAMETER;
57 total_len += cc_copy->chunks[i].length;
59 if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
60 return NT_STATUS_INVALID_PARAMETER;
63 return NT_STATUS_OK;
66 struct fsctl_srv_copychunk_state {
67 struct connection_struct *conn;
68 uint32_t dispatch_count;
69 uint32_t recv_count;
70 uint32_t bad_recv_count;
71 NTSTATUS status;
72 off_t total_written;
73 struct files_struct *src_fsp;
74 struct files_struct *dst_fsp;
75 enum {
76 COPYCHUNK_OUT_EMPTY = 0,
77 COPYCHUNK_OUT_LIMITS,
78 COPYCHUNK_OUT_RSP,
79 } out_data;
81 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
83 static NTSTATUS copychunk_check_handles(struct files_struct *src_fsp,
84 struct files_struct *dst_fsp,
85 struct smb_request *smb1req)
88 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
89 * If Open.GrantedAccess of the destination file does not
90 * include FILE_WRITE_DATA, then the request MUST be failed with
91 * STATUS_ACCESS_DENIED. If Open.GrantedAccess of the
92 * destination file does not include FILE_READ_DATA access and
93 * the CtlCode is FSCTL_SRV_COPYCHUNK, then the request MUST be
94 * failed with STATUS_ACCESS_DENIED.
96 if (!CHECK_WRITE(dst_fsp)) {
97 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
98 smb_fname_str_dbg(dst_fsp->fsp_name) ));
99 return NT_STATUS_ACCESS_DENIED;
101 if (!CHECK_READ(dst_fsp, smb1req)) {
102 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
103 smb_fname_str_dbg(dst_fsp->fsp_name) ));
104 return NT_STATUS_ACCESS_DENIED;
106 if (!CHECK_READ(src_fsp, smb1req)) {
107 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
108 smb_fname_str_dbg(src_fsp->fsp_name) ));
109 return NT_STATUS_ACCESS_DENIED;
112 if (src_fsp->is_directory) {
113 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
114 smb_fname_str_dbg(src_fsp->fsp_name) ));
115 return NT_STATUS_ACCESS_DENIED;
118 if (dst_fsp->is_directory) {
119 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
120 smb_fname_str_dbg(dst_fsp->fsp_name) ));
121 return NT_STATUS_ACCESS_DENIED;
124 if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
125 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
126 return NT_STATUS_ACCESS_DENIED;
129 if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
130 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
131 return NT_STATUS_ACCESS_DENIED;
134 return NT_STATUS_OK;
137 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
138 struct tevent_context *ev,
139 struct files_struct *dst_fsp,
140 DATA_BLOB *in_input,
141 size_t in_max_output,
142 struct smbd_smb2_request *smb2req)
144 struct tevent_req *req;
145 struct srv_copychunk_copy cc_copy;
146 enum ndr_err_code ndr_ret;
147 uint64_t src_persistent_h;
148 uint64_t src_volatile_h;
149 int i;
150 struct srv_copychunk *chunk;
151 struct fsctl_srv_copychunk_state *state;
153 req = tevent_req_create(mem_ctx, &state,
154 struct fsctl_srv_copychunk_state);
155 if (req == NULL) {
156 return NULL;
158 state->conn = dst_fsp->conn;
160 if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
161 DEBUG(3, ("max output %d not large enough to hold copy chunk "
162 "response %lu\n", (int)in_max_output,
163 (unsigned long)sizeof(struct srv_copychunk_rsp)));
164 state->status = NT_STATUS_INVALID_PARAMETER;
165 tevent_req_nterror(req, state->status);
166 return tevent_req_post(req, ev);
169 ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
170 (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
171 if (ndr_ret != NDR_ERR_SUCCESS) {
172 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
173 state->status = NT_STATUS_INVALID_PARAMETER;
174 tevent_req_nterror(req, state->status);
175 return tevent_req_post(req, ev);
178 /* persistent/volatile keys sent as the resume key */
179 src_persistent_h = BVAL(cc_copy.source_key, 0);
180 src_volatile_h = BVAL(cc_copy.source_key, 8);
181 state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
182 if (state->src_fsp == NULL) {
183 DEBUG(3, ("invalid resume key in copy chunk req\n"));
184 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
185 tevent_req_nterror(req, state->status);
186 return tevent_req_post(req, ev);
189 state->dst_fsp = dst_fsp;
191 state->status = copychunk_check_handles(state->src_fsp,
192 state->dst_fsp,
193 smb2req->smb1req);
194 if (!NT_STATUS_IS_OK(state->status)) {
195 tevent_req_nterror(req, state->status);
196 return tevent_req_post(req, ev);
199 state->status = copychunk_check_limits(&cc_copy);
200 if (tevent_req_nterror(req, state->status)) {
201 DEBUG(3, ("copy chunk req exceeds limits\n"));
202 state->out_data = COPYCHUNK_OUT_LIMITS;
203 return tevent_req_post(req, ev);
206 /* any errors from here onwards should carry copychunk response data */
207 state->out_data = COPYCHUNK_OUT_RSP;
209 for (i = 0; i < cc_copy.chunk_count; i++) {
210 struct tevent_req *vfs_subreq;
211 chunk = &cc_copy.chunks[i];
212 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
213 state, ev,
214 state->src_fsp,
215 chunk->source_off,
216 state->dst_fsp,
217 chunk->target_off,
218 chunk->length);
219 if (vfs_subreq == NULL) {
220 DEBUG(0, ("VFS copy chunk send failed\n"));
221 state->status = NT_STATUS_NO_MEMORY;
222 if (state->dispatch_count == 0) {
223 /* nothing dispatched, return immediately */
224 tevent_req_nterror(req, state->status);
225 return tevent_req_post(req, ev);
226 } else {
228 * wait for dispatched to complete before
229 * returning error.
231 break;
234 tevent_req_set_callback(vfs_subreq,
235 fsctl_srv_copychunk_vfs_done, req);
236 state->dispatch_count++;
239 return req;
242 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
244 struct tevent_req *req = tevent_req_callback_data(
245 subreq, struct tevent_req);
246 struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
247 struct fsctl_srv_copychunk_state);
248 off_t chunk_nwritten;
249 NTSTATUS status;
251 state->recv_count++;
252 status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
253 &chunk_nwritten);
254 TALLOC_FREE(subreq);
255 if (NT_STATUS_IS_OK(status)) {
256 DEBUG(10, ("good copy chunk recv %u of %u\n",
257 (unsigned int)state->recv_count,
258 (unsigned int)state->dispatch_count));
259 state->total_written += chunk_nwritten;
260 } else {
261 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
262 (unsigned int)state->recv_count,
263 (unsigned int)state->dispatch_count,
264 nt_errstr(status)));
265 state->bad_recv_count++;
266 /* may overwrite previous failed status */
267 state->status = status;
270 if (state->recv_count != state->dispatch_count) {
272 * Wait for all VFS copy_chunk requests to complete, even
273 * if an error is received for a specific chunk.
275 return;
278 if (!tevent_req_nterror(req, state->status)) {
279 tevent_req_done(req);
283 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
284 struct srv_copychunk_rsp *cc_rsp,
285 bool *pack_rsp)
287 struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
288 struct fsctl_srv_copychunk_state);
289 NTSTATUS status;
291 switch (state->out_data) {
292 case COPYCHUNK_OUT_EMPTY:
293 *pack_rsp = false;
294 break;
295 case COPYCHUNK_OUT_LIMITS:
296 /* 2.2.32.1 - send back our maximum transfer size limits */
297 copychunk_pack_limits(cc_rsp);
298 *pack_rsp = true;
299 break;
300 case COPYCHUNK_OUT_RSP:
301 cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
302 cc_rsp->chunk_bytes_written = 0;
303 cc_rsp->total_bytes_written = state->total_written;
304 *pack_rsp = true;
305 break;
306 default: /* not reached */
307 assert(1);
308 break;
310 status = state->status;
311 tevent_req_received(req);
313 return status;
316 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
317 struct tevent_context *ev,
318 struct smbXsrv_connection *conn,
319 DATA_BLOB *in_input,
320 uint32_t in_max_output,
321 DATA_BLOB *out_output,
322 bool *disconnect)
324 uint32_t in_capabilities;
325 DATA_BLOB in_guid_blob;
326 struct GUID in_guid;
327 uint16_t in_security_mode;
328 uint16_t in_num_dialects;
329 uint16_t i;
330 DATA_BLOB out_guid_blob;
331 NTSTATUS status;
333 if (in_input->length < 0x18) {
334 return NT_STATUS_INVALID_PARAMETER;
337 in_capabilities = IVAL(in_input->data, 0x00);
338 in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
339 in_security_mode = SVAL(in_input->data, 0x14);
340 in_num_dialects = SVAL(in_input->data, 0x16);
342 if (in_input->length < (0x18 + in_num_dialects*2)) {
343 return NT_STATUS_INVALID_PARAMETER;
346 if (in_max_output < 0x18) {
347 return NT_STATUS_BUFFER_TOO_SMALL;
350 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
351 if (!NT_STATUS_IS_OK(status)) {
352 return status;
355 if (in_num_dialects != conn->smb2.client.num_dialects) {
356 *disconnect = true;
357 return NT_STATUS_ACCESS_DENIED;
360 for (i=0; i < in_num_dialects; i++) {
361 uint16_t v = SVAL(in_input->data, 0x18 + i*2);
363 if (conn->smb2.client.dialects[i] != v) {
364 *disconnect = true;
365 return NT_STATUS_ACCESS_DENIED;
369 if (GUID_compare(&in_guid, &conn->smb2.client.guid) != 0) {
370 *disconnect = true;
371 return NT_STATUS_ACCESS_DENIED;
374 if (in_security_mode != conn->smb2.client.security_mode) {
375 *disconnect = true;
376 return NT_STATUS_ACCESS_DENIED;
379 if (in_capabilities != conn->smb2.client.capabilities) {
380 *disconnect = true;
381 return NT_STATUS_ACCESS_DENIED;
384 status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
385 &out_guid_blob);
386 if (!NT_STATUS_IS_OK(status)) {
387 return status;
390 *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
391 if (out_output->data == NULL) {
392 return NT_STATUS_NO_MEMORY;
395 SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
396 memcpy(out_output->data+0x04, out_guid_blob.data, 16);
397 SIVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
398 SIVAL(out_output->data, 0x16, conn->smb2.server.dialect);
400 return NT_STATUS_OK;
403 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
404 struct tevent_context *ev,
405 struct files_struct *fsp,
406 uint32_t in_max_output,
407 DATA_BLOB *out_output)
409 struct req_resume_key_rsp rkey_rsp;
410 enum ndr_err_code ndr_ret;
411 DATA_BLOB output;
413 if (fsp == NULL) {
414 return NT_STATUS_FILE_CLOSED;
417 ZERO_STRUCT(rkey_rsp);
418 /* combine persistent and volatile handles for the resume key */
419 SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
420 SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
422 ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
423 (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
424 if (ndr_ret != NDR_ERR_SUCCESS) {
425 return NT_STATUS_INTERNAL_ERROR;
428 if (in_max_output < output.length) {
429 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
430 (unsigned int)in_max_output, (long int)output.length));
431 return NT_STATUS_INVALID_PARAMETER;
433 *out_output = output;
435 return NT_STATUS_OK;
438 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
440 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
441 struct tevent_context *ev,
442 struct tevent_req *req,
443 struct smbd_smb2_ioctl_state *state)
445 struct tevent_req *subreq;
446 NTSTATUS status;
448 switch (ctl_code) {
449 case FSCTL_SRV_COPYCHUNK:
450 subreq = fsctl_srv_copychunk_send(state, ev, state->fsp,
451 &state->in_input,
452 state->in_max_output,
453 state->smb2req);
454 if (tevent_req_nomem(subreq, req)) {
455 return tevent_req_post(req, ev);
457 tevent_req_set_callback(subreq,
458 smb2_ioctl_network_fs_copychunk_done,
459 req);
460 return req;
461 break;
462 case FSCTL_VALIDATE_NEGOTIATE_INFO:
463 status = fsctl_validate_neg_info(state, ev,
464 state->smbreq->sconn->conn,
465 &state->in_input,
466 state->in_max_output,
467 &state->out_output,
468 &state->disconnect);
469 if (!tevent_req_nterror(req, status)) {
470 tevent_req_done(req);
472 return tevent_req_post(req, ev);
473 break;
474 case FSCTL_SRV_REQUEST_RESUME_KEY:
475 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
476 state->in_max_output,
477 &state->out_output);
478 if (!tevent_req_nterror(req, status)) {
479 tevent_req_done(req);
481 return tevent_req_post(req, ev);
482 break;
483 default: {
484 uint8_t *out_data = NULL;
485 uint32_t out_data_len = 0;
487 if (state->fsp == NULL) {
488 status = NT_STATUS_NOT_SUPPORTED;
489 } else {
490 status = SMB_VFS_FSCTL(state->fsp,
491 state,
492 ctl_code,
493 state->smbreq->flags2,
494 state->in_input.data,
495 state->in_input.length,
496 &out_data,
497 state->in_max_output,
498 &out_data_len);
499 state->out_output = data_blob_const(out_data, out_data_len);
500 if (NT_STATUS_IS_OK(status)) {
501 tevent_req_done(req);
502 return tevent_req_post(req, ev);
506 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
507 if (IS_IPC(state->smbreq->conn)) {
508 status = NT_STATUS_FS_DRIVER_REQUIRED;
509 } else {
510 status = NT_STATUS_INVALID_DEVICE_REQUEST;
514 tevent_req_nterror(req, status);
515 return tevent_req_post(req, ev);
516 break;
520 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
521 return tevent_req_post(req, ev);
524 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
526 struct tevent_req *req = tevent_req_callback_data(subreq,
527 struct tevent_req);
528 struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
529 struct smbd_smb2_ioctl_state);
530 struct srv_copychunk_rsp cc_rsp;
531 NTSTATUS status;
532 bool pack_rsp = false;
534 ZERO_STRUCT(cc_rsp);
535 status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
536 TALLOC_FREE(subreq);
537 if (pack_rsp == true) {
538 enum ndr_err_code ndr_ret;
539 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
540 ioctl_state,
541 &cc_rsp,
542 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
543 if (ndr_ret != NDR_ERR_SUCCESS) {
544 status = NT_STATUS_INTERNAL_ERROR;
548 if (!tevent_req_nterror(req, status)) {
549 tevent_req_done(req);