*/
#include "includes.h"
+#include "smbd/smbd.h"
#include "smbd/globals.h"
#include "../libcli/smb/smb_common.h"
+#include "trans2.h"
+#include "../lib/util/tevent_ntstatus.h"
static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct smbd_smb2_request *smb2req,
+ struct files_struct *in_fsp,
uint8_t in_info_type,
uint8_t in_file_info_class,
uint32_t in_output_buffer_length,
DATA_BLOB in_input_buffer,
uint32_t in_additional_information,
- uint32_t in_flags,
- uint64_t in_file_id_volatile);
+ uint32_t in_flags);
static NTSTATUS smbd_smb2_getinfo_recv(struct tevent_req *req,
TALLOC_CTX *mem_ctx,
DATA_BLOB *out_output_buffer,
static void smbd_smb2_request_getinfo_done(struct tevent_req *subreq);
NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req)
{
- const uint8_t *inhdr;
+ NTSTATUS status;
const uint8_t *inbody;
int i = req->current_idx;
- size_t expected_body_size = 0x29;
- size_t body_size;
uint8_t in_info_type;
uint8_t in_file_info_class;
uint32_t in_output_buffer_length;
uint32_t in_flags;
uint64_t in_file_id_persistent;
uint64_t in_file_id_volatile;
+ struct files_struct *in_fsp;
struct tevent_req *subreq;
- inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
- if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ status = smbd_smb2_request_verify_sizes(req, 0x29);
+ if (!NT_STATUS_IS_OK(status)) {
+ return smbd_smb2_request_error(req, status);
}
-
inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
- body_size = SVAL(inbody, 0x00);
- if (body_size != expected_body_size) {
- return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
- }
-
in_info_type = CVAL(inbody, 0x02);
in_file_info_class = CVAL(inbody, 0x03);
in_output_buffer_length = IVAL(inbody, 0x04);
if (in_input_buffer_offset == 0 && in_input_buffer_length == 0) {
/* This is ok */
} else if (in_input_buffer_offset !=
- (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
+ (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
}
in_input_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
in_input_buffer.length = in_input_buffer_length;
- if (req->compat_chain_fsp) {
- /* skip check */
- } else if (in_file_id_persistent != 0) {
+ if (in_input_buffer.length > req->sconn->smb2.max_trans) {
+ return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ }
+ if (in_output_buffer_length > req->sconn->smb2.max_trans) {
+ return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
+ }
+
+ in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
+ if (in_fsp == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
}
- subreq = smbd_smb2_getinfo_send(req,
- req->sconn->smb2.event_ctx,
- req,
+ subreq = smbd_smb2_getinfo_send(req, req->sconn->smb2.event_ctx,
+ req, in_fsp,
in_info_type,
in_file_info_class,
in_output_buffer_length,
in_input_buffer,
in_additional_information,
- in_flags,
- in_file_id_volatile);
+ in_flags);
if (subreq == NULL) {
return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
}
uint16_t out_output_buffer_offset;
DATA_BLOB out_output_buffer = data_blob_null;
NTSTATUS status;
- NTSTATUS call_status;
+ NTSTATUS call_status = NT_STATUS_OK;
NTSTATUS error; /* transport error */
status = smbd_smb2_getinfo_recv(subreq,
return;
}
- if (!NT_STATUS_IS_OK(call_status)) {
+ /* some GetInfo responses set STATUS_BUFFER_OVERFLOW and return partial,
+ but valid data */
+ if (!(NT_STATUS_IS_OK(call_status) ||
+ NT_STATUS_EQUAL(call_status, STATUS_BUFFER_OVERFLOW))) {
/* Return a specific error with data. */
error = smbd_smb2_request_error_ex(req,
call_status,
outdyn = out_output_buffer;
- error = smbd_smb2_request_done(req, outbody, &outdyn);
+ error = smbd_smb2_request_done_ex(req, call_status, outbody, &outdyn, __location__);
if (!NT_STATUS_IS_OK(error)) {
smbd_server_connection_terminate(req->sconn,
nt_errstr(error));
DATA_BLOB out_output_buffer;
};
+static void smb2_ipc_getinfo(struct tevent_req *req,
+ struct smbd_smb2_getinfo_state *state,
+ struct tevent_context *ev,
+ uint8_t in_info_type,
+ uint8_t in_file_info_class)
+{
+ /* We want to reply to SMB2_GETINFO_FILE
+ with a class of SMB2_FILE_STANDARD_INFO as
+ otherwise a Win7 client issues this request
+ twice (2xroundtrips) if we return NOT_SUPPORTED.
+ NB. We do the same for SMB1 in call_trans2qpipeinfo() */
+
+ if (in_info_type == 0x01 && /* SMB2_GETINFO_FILE */
+ in_file_info_class == 0x05) { /* SMB2_FILE_STANDARD_INFO */
+ state->out_output_buffer = data_blob_talloc(state,
+ NULL, 24);
+ if (tevent_req_nomem(state->out_output_buffer.data, req)) {
+ return;
+ }
+
+ memset(state->out_output_buffer.data,0,24);
+ SOFF_T(state->out_output_buffer.data,0,4096LL);
+ SIVAL(state->out_output_buffer.data,16,1);
+ SIVAL(state->out_output_buffer.data,20,1);
+ tevent_req_done(req);
+ } else {
+ tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
+ }
+}
+
static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct smbd_smb2_request *smb2req,
+ struct files_struct *fsp,
uint8_t in_info_type,
uint8_t in_file_info_class,
uint32_t in_output_buffer_length,
DATA_BLOB in_input_buffer,
uint32_t in_additional_information,
- uint32_t in_flags,
- uint64_t in_file_id_volatile)
+ uint32_t in_flags)
{
struct tevent_req *req;
struct smbd_smb2_getinfo_state *state;
struct smb_request *smbreq;
connection_struct *conn = smb2req->tcon->compat_conn;
- files_struct *fsp;
NTSTATUS status;
req = tevent_req_create(mem_ctx, &state,
state->status = NT_STATUS_OK;
state->out_output_buffer = data_blob_null;
- DEBUG(10,("smbd_smb2_getinfo_send: file_id[0x%016llX]\n",
- (unsigned long long)in_file_id_volatile));
+ DEBUG(10,("smbd_smb2_getinfo_send: %s - fnum[%d]\n",
+ fsp_str_dbg(fsp), fsp->fnum));
smbreq = smbd_smb2_fake_smb_request(smb2req);
if (tevent_req_nomem(smbreq, req)) {
return tevent_req_post(req, ev);
}
- fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
- if (fsp == NULL) {
- tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
- return tevent_req_post(req, ev);
- }
- if (conn != fsp->conn) {
- tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
- return tevent_req_post(req, ev);
- }
- if (smb2req->session->vuid != fsp->vuid) {
- tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
- return tevent_req_post(req, ev);
- }
-
if (IS_IPC(conn)) {
- tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
+ smb2_ipc_getinfo(req, state, ev,
+ in_info_type, in_file_info_class);
return tevent_req_post(req, ev);
}
switch (in_info_type) {
- case 0x01:/* SMB2_GETINFO_FILE */
+ case SMB2_GETINFO_FILE:
{
uint16_t file_info_level;
char *data = NULL;
struct ea_list *ea_list = NULL;
int lock_data_count = 0;
char *lock_data = NULL;
+ size_t fixed_portion;
ZERO_STRUCT(write_time_ts);
/* We know this name is ok, it's already passed the checks. */
- } else if (fsp && (fsp->is_directory || fsp->fh->fd == -1)) {
+ } else if (fsp && fsp->fh->fd == -1) {
/*
* This is actually a QFILEINFO on a directory
* handle (returned from an NT SMB). NT5.0 seems
fileid = vfs_file_id_from_sbuf(conn,
&fsp->fsp_name->st);
- get_file_infos(fileid, &delete_pending, &write_time_ts);
+ get_file_infos(fileid, fsp->name_hash,
+ &delete_pending, &write_time_ts);
} else {
/*
* Original code - this is an open file.
}
fileid = vfs_file_id_from_sbuf(conn,
&fsp->fsp_name->st);
- get_file_infos(fileid, &delete_pending, &write_time_ts);
+ get_file_infos(fileid, fsp->name_hash,
+ &delete_pending, &write_time_ts);
}
status = smbd_do_qfilepathinfo(conn, state,
lock_data,
STR_UNICODE,
in_output_buffer_length,
+ &fixed_portion,
&data,
&data_size);
if (!NT_STATUS_IS_OK(status)) {
tevent_req_nterror(req, status);
return tevent_req_post(req, ev);
}
+ if (in_output_buffer_length < fixed_portion) {
+ SAFE_FREE(data);
+ tevent_req_nterror(
+ req, NT_STATUS_INFO_LENGTH_MISMATCH);
+ return tevent_req_post(req, ev);
+ }
if (data_size > 0) {
state->out_output_buffer = data_blob_talloc(state,
data,
if (tevent_req_nomem(state->out_output_buffer.data, req)) {
return tevent_req_post(req, ev);
}
+ if (data_size > in_output_buffer_length) {
+ state->out_output_buffer.length =
+ in_output_buffer_length;
+ status = STATUS_BUFFER_OVERFLOW;
+ }
}
SAFE_FREE(data);
break;
}
- case 0x02:/* SMB2_GETINFO_FS */
+ case SMB2_GETINFO_FS:
{
uint16_t file_info_level;
char *data = NULL;
int data_size = 0;
+ size_t fixed_portion;
/* the levels directly map to the passthru levels */
file_info_level = in_file_info_class + 1000;
file_info_level,
STR_UNICODE,
in_output_buffer_length,
+ &fixed_portion,
+ fsp->fsp_name,
&data,
&data_size);
- if (!NT_STATUS_IS_OK(status)) {
+ /* some responses set STATUS_BUFFER_OVERFLOW and return
+ partial, but valid data */
+ if (!(NT_STATUS_IS_OK(status) ||
+ NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW))) {
SAFE_FREE(data);
if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) {
status = NT_STATUS_INVALID_INFO_CLASS;
tevent_req_nterror(req, status);
return tevent_req_post(req, ev);
}
+ if (in_output_buffer_length < fixed_portion) {
+ SAFE_FREE(data);
+ tevent_req_nterror(
+ req, NT_STATUS_INFO_LENGTH_MISMATCH);
+ return tevent_req_post(req, ev);
+ }
if (data_size > 0) {
state->out_output_buffer = data_blob_talloc(state,
data,
if (tevent_req_nomem(state->out_output_buffer.data, req)) {
return tevent_req_post(req, ev);
}
+ if (data_size > in_output_buffer_length) {
+ state->out_output_buffer.length =
+ in_output_buffer_length;
+ status = STATUS_BUFFER_OVERFLOW;
+ }
}
SAFE_FREE(data);
break;
}
- case 0x03:/* SMB2_GETINFO_SEC */
+ case SMB2_GETINFO_SECURITY:
{
uint8_t *p_marshalled_sd = NULL;
size_t sd_size = 0;
return tevent_req_post(req, ev);
}
+ state->status = status;
tevent_req_done(req);
return tevent_req_post(req, ev);
}
git.samba.org / samba.git / blobdiff