2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) David Disseldorp 2012
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "../libcli/security/security.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "include/ntioctl.h"
29 #include "../librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_ioctl.h"
31 #include "smb2_ioctl_private.h"
33 #define COPYCHUNK_MAX_CHUNKS 256 /* 2k8r2 & win8 = 256 */
34 #define COPYCHUNK_MAX_CHUNK_LEN 1048576 /* 2k8r2 & win8 = 1048576 */
35 #define COPYCHUNK_MAX_TOTAL_LEN 16777216 /* 2k8r2 & win8 = 16777216 */
36 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
38 cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
39 cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
40 cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
43 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
46 uint32_t total_len = 0;
49 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
50 * Send and invalid parameter response if:
51 * - The ChunkCount value is greater than
52 * ServerSideCopyMaxNumberofChunks
54 if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
55 return NT_STATUS_INVALID_PARAMETER;
58 for (i = 0; i < cc_copy->chunk_count; i++) {
60 * - The Length value in a single chunk is greater than
61 * ServerSideCopyMaxChunkSize or equal to zero.
63 if ((cc_copy->chunks[i].length == 0)
64 || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
65 return NT_STATUS_INVALID_PARAMETER;
67 total_len += cc_copy->chunks[i].length;
70 * - Sum of Lengths in all chunks is greater than
71 * ServerSideCopyMaxDataSize
73 if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
74 return NT_STATUS_INVALID_PARAMETER;
80 struct fsctl_srv_copychunk_state {
81 struct connection_struct *conn;
82 uint32_t dispatch_count;
84 uint32_t bad_recv_count;
87 struct files_struct *src_fsp;
88 struct files_struct *dst_fsp;
90 COPYCHUNK_OUT_EMPTY = 0,
95 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
97 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
98 struct files_struct *src_fsp,
99 struct files_struct *dst_fsp,
100 struct smb_request *smb1req)
103 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
104 * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
105 * the following are true:
106 * - The Open.GrantedAccess of the destination file does not include
107 * FILE_WRITE_DATA or FILE_APPEND_DATA.
109 if (!CHECK_WRITE(dst_fsp)) {
110 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
111 smb_fname_str_dbg(dst_fsp->fsp_name) ));
112 return NT_STATUS_ACCESS_DENIED;
115 * - The Open.GrantedAccess of the destination file does not include
116 * FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
118 if ((ctl_code == FSCTL_SRV_COPYCHUNK)
119 && !CHECK_READ(dst_fsp, smb1req)) {
120 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
121 smb_fname_str_dbg(dst_fsp->fsp_name) ));
122 return NT_STATUS_ACCESS_DENIED;
125 * - The Open.GrantedAccess of the source file does not include
126 * FILE_READ_DATA access.
128 if (!CHECK_READ(src_fsp, smb1req)) {
129 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
130 smb_fname_str_dbg(src_fsp->fsp_name) ));
131 return NT_STATUS_ACCESS_DENIED;
134 if (src_fsp->is_directory) {
135 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
136 smb_fname_str_dbg(src_fsp->fsp_name) ));
137 return NT_STATUS_ACCESS_DENIED;
140 if (dst_fsp->is_directory) {
141 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
142 smb_fname_str_dbg(dst_fsp->fsp_name) ));
143 return NT_STATUS_ACCESS_DENIED;
146 if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
147 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
148 return NT_STATUS_ACCESS_DENIED;
151 if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
152 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
153 return NT_STATUS_ACCESS_DENIED;
159 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
160 struct tevent_context *ev,
162 struct files_struct *dst_fsp,
164 size_t in_max_output,
165 struct smbd_smb2_request *smb2req)
167 struct tevent_req *req;
168 struct srv_copychunk_copy cc_copy;
169 enum ndr_err_code ndr_ret;
170 uint64_t src_persistent_h;
171 uint64_t src_volatile_h;
173 struct srv_copychunk *chunk;
174 struct fsctl_srv_copychunk_state *state;
176 /* handler for both copy-chunk variants */
177 SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
178 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
180 req = tevent_req_create(mem_ctx, &state,
181 struct fsctl_srv_copychunk_state);
185 state->conn = dst_fsp->conn;
187 if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
188 DEBUG(3, ("max output %d not large enough to hold copy chunk "
189 "response %lu\n", (int)in_max_output,
190 (unsigned long)sizeof(struct srv_copychunk_rsp)));
191 state->status = NT_STATUS_INVALID_PARAMETER;
192 tevent_req_nterror(req, state->status);
193 return tevent_req_post(req, ev);
196 ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
197 (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
198 if (ndr_ret != NDR_ERR_SUCCESS) {
199 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
200 state->status = NT_STATUS_INVALID_PARAMETER;
201 tevent_req_nterror(req, state->status);
202 return tevent_req_post(req, ev);
205 /* persistent/volatile keys sent as the resume key */
206 src_persistent_h = BVAL(cc_copy.source_key, 0);
207 src_volatile_h = BVAL(cc_copy.source_key, 8);
208 state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
209 if (state->src_fsp == NULL) {
210 DEBUG(3, ("invalid resume key in copy chunk req\n"));
211 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
212 tevent_req_nterror(req, state->status);
213 return tevent_req_post(req, ev);
216 state->dst_fsp = dst_fsp;
218 state->status = copychunk_check_handles(ctl_code,
222 if (!NT_STATUS_IS_OK(state->status)) {
223 tevent_req_nterror(req, state->status);
224 return tevent_req_post(req, ev);
227 state->status = copychunk_check_limits(&cc_copy);
228 if (tevent_req_nterror(req, state->status)) {
229 DEBUG(3, ("copy chunk req exceeds limits\n"));
230 state->out_data = COPYCHUNK_OUT_LIMITS;
231 return tevent_req_post(req, ev);
234 /* any errors from here onwards should carry copychunk response data */
235 state->out_data = COPYCHUNK_OUT_RSP;
237 for (i = 0; i < cc_copy.chunk_count; i++) {
238 struct tevent_req *vfs_subreq;
239 chunk = &cc_copy.chunks[i];
240 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
247 if (vfs_subreq == NULL) {
248 DEBUG(0, ("VFS copy chunk send failed\n"));
249 state->status = NT_STATUS_NO_MEMORY;
250 if (state->dispatch_count == 0) {
251 /* nothing dispatched, return immediately */
252 tevent_req_nterror(req, state->status);
253 return tevent_req_post(req, ev);
256 * wait for dispatched to complete before
262 tevent_req_set_callback(vfs_subreq,
263 fsctl_srv_copychunk_vfs_done, req);
264 state->dispatch_count++;
270 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
272 struct tevent_req *req = tevent_req_callback_data(
273 subreq, struct tevent_req);
274 struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
275 struct fsctl_srv_copychunk_state);
276 off_t chunk_nwritten;
280 status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
283 if (NT_STATUS_IS_OK(status)) {
284 DEBUG(10, ("good copy chunk recv %u of %u\n",
285 (unsigned int)state->recv_count,
286 (unsigned int)state->dispatch_count));
287 state->total_written += chunk_nwritten;
289 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
290 (unsigned int)state->recv_count,
291 (unsigned int)state->dispatch_count,
293 state->bad_recv_count++;
294 /* may overwrite previous failed status */
295 state->status = status;
298 if (state->recv_count != state->dispatch_count) {
300 * Wait for all VFS copy_chunk requests to complete, even
301 * if an error is received for a specific chunk.
306 if (!tevent_req_nterror(req, state->status)) {
307 tevent_req_done(req);
311 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
312 struct srv_copychunk_rsp *cc_rsp,
315 struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
316 struct fsctl_srv_copychunk_state);
319 switch (state->out_data) {
320 case COPYCHUNK_OUT_EMPTY:
323 case COPYCHUNK_OUT_LIMITS:
324 /* 2.2.32.1 - send back our maximum transfer size limits */
325 copychunk_pack_limits(cc_rsp);
328 case COPYCHUNK_OUT_RSP:
329 cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
330 cc_rsp->chunk_bytes_written = 0;
331 cc_rsp->total_bytes_written = state->total_written;
334 default: /* not reached */
338 status = state->status;
339 tevent_req_received(req);
344 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
345 struct tevent_context *ev,
346 struct smbXsrv_connection *conn,
348 uint32_t in_max_output,
349 DATA_BLOB *out_output,
352 uint32_t in_capabilities;
353 DATA_BLOB in_guid_blob;
355 uint16_t in_security_mode;
356 uint16_t in_num_dialects;
358 DATA_BLOB out_guid_blob;
360 enum protocol_types protocol = PROTOCOL_NONE;
362 if (in_input->length < 0x18) {
363 return NT_STATUS_INVALID_PARAMETER;
366 in_capabilities = IVAL(in_input->data, 0x00);
367 in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
368 in_security_mode = SVAL(in_input->data, 0x14);
369 in_num_dialects = SVAL(in_input->data, 0x16);
371 if (in_input->length < (0x18 + in_num_dialects*2)) {
372 return NT_STATUS_INVALID_PARAMETER;
375 if (in_max_output < 0x18) {
376 return NT_STATUS_BUFFER_TOO_SMALL;
379 status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
380 if (!NT_STATUS_IS_OK(status)) {
386 * 3.3.5.15.12 Handling a Validate Negotiate Info Request
388 * The server MUST determine the greatest common dialect
389 * between the dialects it implements and the Dialects array
390 * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
391 * matched, or if the value is not equal to Connection.Dialect,
392 * the server MUST terminate the transport connection
393 * and free the Connection object.
395 protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
398 if (conn->protocol != protocol) {
400 return NT_STATUS_ACCESS_DENIED;
403 if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
405 return NT_STATUS_ACCESS_DENIED;
408 if (in_security_mode != conn->smb2.client.security_mode) {
410 return NT_STATUS_ACCESS_DENIED;
413 if (in_capabilities != conn->smb2.client.capabilities) {
415 return NT_STATUS_ACCESS_DENIED;
418 status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
420 if (!NT_STATUS_IS_OK(status)) {
424 *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
425 if (out_output->data == NULL) {
426 return NT_STATUS_NO_MEMORY;
429 SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
430 memcpy(out_output->data+0x04, out_guid_blob.data, 16);
431 SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
432 SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
437 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
438 struct tevent_context *ev,
439 struct files_struct *fsp,
440 uint32_t in_max_output,
441 DATA_BLOB *out_output)
443 struct req_resume_key_rsp rkey_rsp;
444 enum ndr_err_code ndr_ret;
448 return NT_STATUS_FILE_CLOSED;
451 ZERO_STRUCT(rkey_rsp);
452 /* combine persistent and volatile handles for the resume key */
453 SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
454 SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
456 ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
457 (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
458 if (ndr_ret != NDR_ERR_SUCCESS) {
459 return NT_STATUS_INTERNAL_ERROR;
462 if (in_max_output < output.length) {
463 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
464 (unsigned int)in_max_output, (long int)output.length));
465 return NT_STATUS_INVALID_PARAMETER;
467 *out_output = output;
472 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
474 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
475 struct tevent_context *ev,
476 struct tevent_req *req,
477 struct smbd_smb2_ioctl_state *state)
479 struct tevent_req *subreq;
485 * FSCTL_SRV_COPYCHUNK is issued when a handle has
486 * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
487 * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
488 * FILE_WRITE_DATA access.
490 case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
491 case FSCTL_SRV_COPYCHUNK:
492 subreq = fsctl_srv_copychunk_send(state, ev,
496 state->in_max_output,
498 if (tevent_req_nomem(subreq, req)) {
499 return tevent_req_post(req, ev);
501 tevent_req_set_callback(subreq,
502 smb2_ioctl_network_fs_copychunk_done,
506 case FSCTL_VALIDATE_NEGOTIATE_INFO:
507 status = fsctl_validate_neg_info(state, ev,
508 state->smbreq->xconn,
510 state->in_max_output,
513 if (!tevent_req_nterror(req, status)) {
514 tevent_req_done(req);
516 return tevent_req_post(req, ev);
518 case FSCTL_SRV_REQUEST_RESUME_KEY:
519 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
520 state->in_max_output,
522 if (!tevent_req_nterror(req, status)) {
523 tevent_req_done(req);
525 return tevent_req_post(req, ev);
528 uint8_t *out_data = NULL;
529 uint32_t out_data_len = 0;
531 if (state->fsp == NULL) {
532 status = NT_STATUS_NOT_SUPPORTED;
534 status = SMB_VFS_FSCTL(state->fsp,
537 state->smbreq->flags2,
538 state->in_input.data,
539 state->in_input.length,
541 state->in_max_output,
543 state->out_output = data_blob_const(out_data, out_data_len);
544 if (NT_STATUS_IS_OK(status)) {
545 tevent_req_done(req);
546 return tevent_req_post(req, ev);
550 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
551 if (IS_IPC(state->smbreq->conn)) {
552 status = NT_STATUS_FS_DRIVER_REQUIRED;
554 status = NT_STATUS_INVALID_DEVICE_REQUEST;
558 tevent_req_nterror(req, status);
559 return tevent_req_post(req, ev);
564 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
565 return tevent_req_post(req, ev);
568 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
570 struct tevent_req *req = tevent_req_callback_data(subreq,
572 struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
573 struct smbd_smb2_ioctl_state);
574 struct srv_copychunk_rsp cc_rsp;
576 bool pack_rsp = false;
579 status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
581 if (pack_rsp == true) {
582 enum ndr_err_code ndr_ret;
583 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
586 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
587 if (ndr_ret != NDR_ERR_SUCCESS) {
588 status = NT_STATUS_INTERNAL_ERROR;
592 if (!tevent_req_nterror(req, status)) {
593 tevent_req_done(req);