2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "smbd/globals.h"
23 #include "../libcli/smb/smb_common.h"
25 struct smbd_smb2_notify_state {
26 struct smbd_smb2_request *smb2req;
27 struct smb_request *smbreq;
28 struct tevent_immediate *im;
30 DATA_BLOB out_output_buffer;
33 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
34 struct tevent_context *ev,
35 struct smbd_smb2_request *smb2req,
37 uint32_t in_output_buffer_length,
38 uint64_t in_file_id_volatile,
39 uint64_t in_completion_filter);
40 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
42 DATA_BLOB *out_output_buffer);
44 static void smbd_smb2_request_notify_done(struct tevent_req *subreq);
45 NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
48 const uint8_t *inbody;
49 int i = req->current_idx;
50 size_t expected_body_size = 0x20;
53 uint32_t in_output_buffer_length;
54 uint64_t in_file_id_persistent;
55 uint64_t in_file_id_volatile;
56 uint64_t in_completion_filter;
57 struct tevent_req *subreq;
59 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
60 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
61 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
64 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
66 body_size = SVAL(inbody, 0x00);
67 if (body_size != expected_body_size) {
68 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
71 in_flags = SVAL(inbody, 0x02);
72 in_output_buffer_length = IVAL(inbody, 0x04);
73 in_file_id_persistent = BVAL(inbody, 0x08);
74 in_file_id_volatile = BVAL(inbody, 0x10);
75 in_completion_filter = IVAL(inbody, 0x18);
78 * 0x00010000 is what Windows 7 uses,
79 * Windows 2008 uses 0x00080000
81 if (in_output_buffer_length > lp_smb2_max_trans()) {
82 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
85 if (req->compat_chain_fsp) {
87 } else if (in_file_id_persistent != 0) {
88 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
91 subreq = smbd_smb2_notify_send(req,
92 req->sconn->smb2.event_ctx,
95 in_output_buffer_length,
97 in_completion_filter);
99 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
101 tevent_req_set_callback(subreq, smbd_smb2_request_notify_done, req);
103 return smbd_smb2_request_pending_queue(req, subreq);
106 static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
108 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
109 struct smbd_smb2_request);
110 int i = req->current_idx;
114 uint16_t out_output_buffer_offset;
115 DATA_BLOB out_output_buffer = data_blob_null;
117 NTSTATUS error; /* transport error */
119 if (req->cancelled) {
120 struct smbd_smb2_notify_state *state = tevent_req_data(subreq,
121 struct smbd_smb2_notify_state);
122 const uint8_t *inhdr = (const uint8_t *)req->in.vector[i].iov_base;
123 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
125 DEBUG(10,("smbd_smb2_request_notify_done: cancelled mid %llu\n",
126 (unsigned long long)mid ));
127 error = smbd_smb2_request_error(req, NT_STATUS_CANCELLED);
128 if (!NT_STATUS_IS_OK(error)) {
129 smbd_server_connection_terminate(req->sconn,
133 TALLOC_FREE(state->im);
137 status = smbd_smb2_notify_recv(subreq,
141 if (!NT_STATUS_IS_OK(status)) {
142 error = smbd_smb2_request_error(req, status);
143 if (!NT_STATUS_IS_OK(error)) {
144 smbd_server_connection_terminate(req->sconn,
151 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
153 outhdr = (uint8_t *)req->out.vector[i].iov_base;
155 outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
156 if (outbody.data == NULL) {
157 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
158 if (!NT_STATUS_IS_OK(error)) {
159 smbd_server_connection_terminate(req->sconn,
166 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
167 SSVAL(outbody.data, 0x02,
168 out_output_buffer_offset); /* output buffer offset */
169 SIVAL(outbody.data, 0x04,
170 out_output_buffer.length); /* output buffer length */
172 outdyn = out_output_buffer;
174 error = smbd_smb2_request_done(req, outbody, &outdyn);
175 if (!NT_STATUS_IS_OK(error)) {
176 smbd_server_connection_terminate(req->sconn,
182 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
184 uint8_t *buf, size_t len);
185 static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
186 struct tevent_immediate *im,
188 static bool smbd_smb2_notify_cancel(struct tevent_req *req);
190 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
191 struct tevent_context *ev,
192 struct smbd_smb2_request *smb2req,
194 uint32_t in_output_buffer_length,
195 uint64_t in_file_id_volatile,
196 uint64_t in_completion_filter)
198 struct tevent_req *req;
199 struct smbd_smb2_notify_state *state;
200 struct smb_request *smbreq;
201 connection_struct *conn = smb2req->tcon->compat_conn;
203 bool recursive = (in_flags & 0x0001) ? true : false;
206 req = tevent_req_create(mem_ctx, &state,
207 struct smbd_smb2_notify_state);
211 state->smb2req = smb2req;
212 state->status = NT_STATUS_INTERNAL_ERROR;
213 state->out_output_buffer = data_blob_null;
216 DEBUG(10,("smbd_smb2_notify_send: file_id[0x%016llX]\n",
217 (unsigned long long)in_file_id_volatile));
219 smbreq = smbd_smb2_fake_smb_request(smb2req);
220 if (tevent_req_nomem(smbreq, req)) {
221 return tevent_req_post(req, ev);
224 state->smbreq = smbreq;
225 smbreq->async_priv = (void *)req;
227 fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
229 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
230 return tevent_req_post(req, ev);
232 if (conn != fsp->conn) {
233 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
234 return tevent_req_post(req, ev);
236 if (smb2req->session->vuid != fsp->vuid) {
237 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
238 return tevent_req_post(req, ev);
244 filter_string = notify_filter_string(NULL, in_completion_filter);
245 if (tevent_req_nomem(filter_string, req)) {
246 return tevent_req_post(req, ev);
249 DEBUG(3,("smbd_smb2_notify_send: notify change "
250 "called on %s, filter = %s, recursive = %d\n",
251 fsp_str_dbg(fsp), filter_string, recursive));
253 TALLOC_FREE(filter_string);
256 if ((!fsp->is_directory) || (conn != fsp->conn)) {
257 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
258 return tevent_req_post(req, ev);
261 if (fsp->notify == NULL) {
263 status = change_notify_create(fsp,
264 in_completion_filter,
266 if (!NT_STATUS_IS_OK(status)) {
267 DEBUG(10, ("change_notify_create returned %s\n",
269 tevent_req_nterror(req, status);
270 return tevent_req_post(req, ev);
274 if (fsp->notify->num_changes != 0) {
277 * We've got changes pending, respond immediately
281 * TODO: write a torture test to check the filtering behaviour
285 change_notify_reply(fsp->conn, smbreq,
287 in_output_buffer_length,
289 smbd_smb2_notify_reply);
292 * change_notify_reply() above has independently
293 * called tevent_req_done().
295 return tevent_req_post(req, ev);
298 state->im = tevent_create_immediate(state);
299 if (tevent_req_nomem(state->im, req)) {
300 return tevent_req_post(req, ev);
304 * No changes pending, queue the request
307 status = change_notify_add_request(smbreq,
308 in_output_buffer_length,
309 in_completion_filter,
311 smbd_smb2_notify_reply);
312 if (!NT_STATUS_IS_OK(status)) {
313 tevent_req_nterror(req, status);
314 return tevent_req_post(req, ev);
317 /* allow this request to be canceled */
318 tevent_req_set_cancel_fn(req, smbd_smb2_notify_cancel);
323 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
325 uint8_t *buf, size_t len)
327 struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
329 struct smbd_smb2_notify_state *state = tevent_req_data(req,
330 struct smbd_smb2_notify_state);
332 state->status = error_code;
333 if (!NT_STATUS_IS_OK(error_code)) {
335 } else if (len == 0) {
336 state->status = STATUS_NOTIFY_ENUM_DIR;
338 state->out_output_buffer = data_blob_talloc(state, buf, len);
339 if (state->out_output_buffer.data == NULL) {
340 state->status = NT_STATUS_NO_MEMORY;
344 if (state->im == NULL) {
345 smbd_smb2_notify_reply_trigger(NULL, NULL, req);
350 * if this is called async, we need to go via an immediate event
351 * because the caller replies on the smb_request (a child of req
352 * being arround after calling this function
354 tevent_schedule_immediate(state->im,
355 state->smb2req->sconn->smb2.event_ctx,
356 smbd_smb2_notify_reply_trigger,
360 static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
361 struct tevent_immediate *im,
364 struct tevent_req *req = talloc_get_type_abort(private_data,
366 struct smbd_smb2_notify_state *state = tevent_req_data(req,
367 struct smbd_smb2_notify_state);
369 if (!NT_STATUS_IS_OK(state->status)) {
370 tevent_req_nterror(req, state->status);
374 tevent_req_done(req);
377 static bool smbd_smb2_notify_cancel(struct tevent_req *req)
379 struct smbd_smb2_notify_state *state = tevent_req_data(req,
380 struct smbd_smb2_notify_state);
382 smbd_notify_cancel_by_smbreq(state->smb2req->sconn,
385 state->smb2req->cancelled = true;
386 tevent_req_done(req);
390 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
392 DATA_BLOB *out_output_buffer)
395 struct smbd_smb2_notify_state *state = tevent_req_data(req,
396 struct smbd_smb2_notify_state);
398 if (tevent_req_is_nterror(req, &status)) {
399 tevent_req_received(req);
403 *out_output_buffer = state->out_output_buffer;
404 talloc_steal(mem_ctx, out_output_buffer->data);
406 tevent_req_received(req);