2 Unix SMB/CIFS implementation.
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
27 struct smbd_smb2_notify_state {
28 struct smbd_smb2_request *smb2req;
29 struct smb_request *smbreq;
30 struct tevent_immediate *im;
32 DATA_BLOB out_output_buffer;
35 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
36 struct tevent_context *ev,
37 struct smbd_smb2_request *smb2req,
39 uint32_t in_output_buffer_length,
40 uint64_t in_file_id_volatile,
41 uint64_t in_completion_filter);
42 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
44 DATA_BLOB *out_output_buffer);
46 static void smbd_smb2_request_notify_done(struct tevent_req *subreq);
47 NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
50 const uint8_t *inbody;
51 int i = req->current_idx;
52 size_t expected_body_size = 0x20;
55 uint32_t in_output_buffer_length;
56 uint64_t in_file_id_persistent;
57 uint64_t in_file_id_volatile;
58 uint64_t in_completion_filter;
59 struct tevent_req *subreq;
61 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
62 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
63 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
66 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
68 body_size = SVAL(inbody, 0x00);
69 if (body_size != expected_body_size) {
70 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
73 in_flags = SVAL(inbody, 0x02);
74 in_output_buffer_length = IVAL(inbody, 0x04);
75 in_file_id_persistent = BVAL(inbody, 0x08);
76 in_file_id_volatile = BVAL(inbody, 0x10);
77 in_completion_filter = IVAL(inbody, 0x18);
80 * 0x00010000 is what Windows 7 uses,
81 * Windows 2008 uses 0x00080000
83 if (in_output_buffer_length > lp_smb2_max_trans()) {
84 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
87 if (req->compat_chain_fsp) {
89 } else if (in_file_id_persistent != in_file_id_volatile) {
90 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
93 subreq = smbd_smb2_notify_send(req,
94 req->sconn->smb2.event_ctx,
97 in_output_buffer_length,
99 in_completion_filter);
100 if (subreq == NULL) {
101 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
103 tevent_req_set_callback(subreq, smbd_smb2_request_notify_done, req);
105 return smbd_smb2_request_pending_queue(req, subreq);
108 static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
110 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
111 struct smbd_smb2_request);
112 int i = req->current_idx;
116 uint16_t out_output_buffer_offset;
117 DATA_BLOB out_output_buffer = data_blob_null;
119 NTSTATUS error; /* transport error */
121 if (req->cancelled) {
122 struct smbd_smb2_notify_state *state = tevent_req_data(subreq,
123 struct smbd_smb2_notify_state);
124 const uint8_t *inhdr = (const uint8_t *)req->in.vector[i].iov_base;
125 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
127 DEBUG(10,("smbd_smb2_request_notify_done: cancelled mid %llu\n",
128 (unsigned long long)mid ));
129 error = smbd_smb2_request_error(req, NT_STATUS_CANCELLED);
130 if (!NT_STATUS_IS_OK(error)) {
131 smbd_server_connection_terminate(req->sconn,
135 TALLOC_FREE(state->im);
139 status = smbd_smb2_notify_recv(subreq,
143 if (!NT_STATUS_IS_OK(status)) {
144 error = smbd_smb2_request_error(req, status);
145 if (!NT_STATUS_IS_OK(error)) {
146 smbd_server_connection_terminate(req->sconn,
153 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
155 outhdr = (uint8_t *)req->out.vector[i].iov_base;
157 outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
158 if (outbody.data == NULL) {
159 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
160 if (!NT_STATUS_IS_OK(error)) {
161 smbd_server_connection_terminate(req->sconn,
168 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
169 SSVAL(outbody.data, 0x02,
170 out_output_buffer_offset); /* output buffer offset */
171 SIVAL(outbody.data, 0x04,
172 out_output_buffer.length); /* output buffer length */
174 outdyn = out_output_buffer;
176 error = smbd_smb2_request_done(req, outbody, &outdyn);
177 if (!NT_STATUS_IS_OK(error)) {
178 smbd_server_connection_terminate(req->sconn,
184 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
186 uint8_t *buf, size_t len);
187 static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
188 struct tevent_immediate *im,
190 static bool smbd_smb2_notify_cancel(struct tevent_req *req);
192 static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
193 struct tevent_context *ev,
194 struct smbd_smb2_request *smb2req,
196 uint32_t in_output_buffer_length,
197 uint64_t in_file_id_volatile,
198 uint64_t in_completion_filter)
200 struct tevent_req *req;
201 struct smbd_smb2_notify_state *state;
202 struct smb_request *smbreq;
203 connection_struct *conn = smb2req->tcon->compat_conn;
205 bool recursive = (in_flags & 0x0001) ? true : false;
208 req = tevent_req_create(mem_ctx, &state,
209 struct smbd_smb2_notify_state);
213 state->smb2req = smb2req;
214 state->status = NT_STATUS_INTERNAL_ERROR;
215 state->out_output_buffer = data_blob_null;
218 DEBUG(10,("smbd_smb2_notify_send: file_id[0x%016llX]\n",
219 (unsigned long long)in_file_id_volatile));
221 smbreq = smbd_smb2_fake_smb_request(smb2req);
222 if (tevent_req_nomem(smbreq, req)) {
223 return tevent_req_post(req, ev);
226 state->smbreq = smbreq;
227 smbreq->async_priv = (void *)req;
229 fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
231 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
232 return tevent_req_post(req, ev);
234 if (conn != fsp->conn) {
235 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
236 return tevent_req_post(req, ev);
238 if (smb2req->session->vuid != fsp->vuid) {
239 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
240 return tevent_req_post(req, ev);
246 filter_string = notify_filter_string(NULL, in_completion_filter);
247 if (tevent_req_nomem(filter_string, req)) {
248 return tevent_req_post(req, ev);
251 DEBUG(3,("smbd_smb2_notify_send: notify change "
252 "called on %s, filter = %s, recursive = %d\n",
253 fsp_str_dbg(fsp), filter_string, recursive));
255 TALLOC_FREE(filter_string);
258 if ((!fsp->is_directory) || (conn != fsp->conn)) {
259 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
260 return tevent_req_post(req, ev);
263 if (fsp->notify == NULL) {
265 status = change_notify_create(fsp,
266 in_completion_filter,
268 if (!NT_STATUS_IS_OK(status)) {
269 DEBUG(10, ("change_notify_create returned %s\n",
271 tevent_req_nterror(req, status);
272 return tevent_req_post(req, ev);
276 if (fsp->notify->num_changes != 0) {
279 * We've got changes pending, respond immediately
283 * TODO: write a torture test to check the filtering behaviour
287 change_notify_reply(smbreq,
289 in_output_buffer_length,
291 smbd_smb2_notify_reply);
294 * change_notify_reply() above has independently
295 * called tevent_req_done().
297 return tevent_req_post(req, ev);
300 state->im = tevent_create_immediate(state);
301 if (tevent_req_nomem(state->im, req)) {
302 return tevent_req_post(req, ev);
306 * No changes pending, queue the request
309 status = change_notify_add_request(smbreq,
310 in_output_buffer_length,
311 in_completion_filter,
313 smbd_smb2_notify_reply);
314 if (!NT_STATUS_IS_OK(status)) {
315 tevent_req_nterror(req, status);
316 return tevent_req_post(req, ev);
319 /* allow this request to be canceled */
320 tevent_req_set_cancel_fn(req, smbd_smb2_notify_cancel);
325 static void smbd_smb2_notify_reply(struct smb_request *smbreq,
327 uint8_t *buf, size_t len)
329 struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
331 struct smbd_smb2_notify_state *state = tevent_req_data(req,
332 struct smbd_smb2_notify_state);
334 state->status = error_code;
335 if (!NT_STATUS_IS_OK(error_code)) {
337 } else if (len == 0) {
338 state->status = STATUS_NOTIFY_ENUM_DIR;
340 state->out_output_buffer = data_blob_talloc(state, buf, len);
341 if (state->out_output_buffer.data == NULL) {
342 state->status = NT_STATUS_NO_MEMORY;
346 if (state->im == NULL) {
347 smbd_smb2_notify_reply_trigger(NULL, NULL, req);
352 * if this is called async, we need to go via an immediate event
353 * because the caller replies on the smb_request (a child of req
354 * being arround after calling this function
356 tevent_schedule_immediate(state->im,
357 state->smb2req->sconn->smb2.event_ctx,
358 smbd_smb2_notify_reply_trigger,
362 static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
363 struct tevent_immediate *im,
366 struct tevent_req *req = talloc_get_type_abort(private_data,
368 struct smbd_smb2_notify_state *state = tevent_req_data(req,
369 struct smbd_smb2_notify_state);
371 if (!NT_STATUS_IS_OK(state->status)) {
372 tevent_req_nterror(req, state->status);
376 tevent_req_done(req);
379 static bool smbd_smb2_notify_cancel(struct tevent_req *req)
381 struct smbd_smb2_notify_state *state = tevent_req_data(req,
382 struct smbd_smb2_notify_state);
384 smbd_notify_cancel_by_smbreq(state->smbreq);
386 state->smb2req->cancelled = true;
387 tevent_req_done(req);
391 static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
393 DATA_BLOB *out_output_buffer)
396 struct smbd_smb2_notify_state *state = tevent_req_data(req,
397 struct smbd_smb2_notify_state);
399 if (tevent_req_is_nterror(req, &status)) {
400 tevent_req_received(req);
404 *out_output_buffer = state->out_output_buffer;
405 talloc_steal(mem_ctx, out_output_buffer->data);
407 tevent_req_received(req);