Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : Core SMB2 server
4 :
5 : Copyright (C) Stefan Metzmacher 2009
6 : Copyright (C) David Disseldorp 2012
7 :
8 : This program is free software; you can redistribute it and/or modify
9 : it under the terms of the GNU General Public License as published by
10 : the Free Software Foundation; either version 3 of the License, or
11 : (at your option) any later version.
12 :
13 : This program is distributed in the hope that it will be useful,
14 : but WITHOUT ANY WARRANTY; without even the implied warranty of
15 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 : GNU General Public License for more details.
17 :
18 : You should have received a copy of the GNU General Public License
19 : along with this program. If not, see <http://www.gnu.org/licenses/>.
20 : */
21 :
22 : #include "includes.h"
23 : #include "smbd/smbd.h"
24 : #include "smbd/globals.h"
25 : #include "../libcli/smb/smb_common.h"
26 : #include "../libcli/security/security.h"
27 : #include "../lib/util/tevent_ntstatus.h"
28 : #include "include/ntioctl.h"
29 : #include "../librpc/ndr/libndr.h"
30 : #include "librpc/gen_ndr/ndr_ioctl.h"
31 : #include "smb2_ioctl_private.h"
32 : #include "../lib/tsocket/tsocket.h"
33 : #include "lib/messages_ctdb.h"
34 : #include "ctdbd_conn.h"
35 :
36 : #undef DBGC_CLASS
37 : #define DBGC_CLASS DBGC_SMB2
38 :
39 16 : static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
40 : {
41 16 : cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
42 16 : cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
43 16 : cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
44 16 : }
45 :
46 280 : static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
47 : {
48 0 : uint32_t i;
49 280 : uint32_t total_len = 0;
50 :
51 : /*
52 : * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
53 : * Send and invalid parameter response if:
54 : * - The ChunkCount value is greater than
55 : * ServerSideCopyMaxNumberofChunks
56 : */
57 280 : if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
58 0 : return NT_STATUS_INVALID_PARAMETER;
59 : }
60 :
61 576 : for (i = 0; i < cc_copy->chunk_count; i++) {
62 : /*
63 : * - The Length value in a single chunk is greater than
64 : * ServerSideCopyMaxChunkSize or equal to zero.
65 : */
66 312 : if ((cc_copy->chunks[i].length == 0)
67 304 : || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
68 16 : return NT_STATUS_INVALID_PARAMETER;
69 : }
70 296 : total_len += cc_copy->chunks[i].length;
71 : }
72 : /*
73 : * - Sum of Lengths in all chunks is greater than
74 : * ServerSideCopyMaxDataSize
75 : */
76 264 : if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
77 0 : return NT_STATUS_INVALID_PARAMETER;
78 : }
79 :
80 264 : return NT_STATUS_OK;
81 : }
82 :
83 : struct fsctl_srv_copychunk_state {
84 : struct tevent_context *ev;
85 : struct connection_struct *conn;
86 : struct srv_copychunk_copy cc_copy;
87 : uint32_t current_chunk;
88 : NTSTATUS status;
89 : off_t total_written;
90 : uint32_t ctl_code;
91 : DATA_BLOB token;
92 : struct files_struct *src_fsp;
93 : struct files_struct *dst_fsp;
94 : enum {
95 : COPYCHUNK_OUT_EMPTY = 0,
96 : COPYCHUNK_OUT_LIMITS,
97 : COPYCHUNK_OUT_RSP,
98 : } out_data;
99 : };
100 : static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
101 :
102 : static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
103 :
104 288 : static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
105 : struct tevent_context *ev,
106 : uint32_t ctl_code,
107 : struct files_struct *dst_fsp,
108 : DATA_BLOB *in_input,
109 : size_t in_max_output,
110 : struct smbd_smb2_request *smb2req)
111 : {
112 288 : struct tevent_req *req = NULL;
113 288 : struct fsctl_srv_copychunk_state *state = NULL;
114 0 : enum ndr_err_code ndr_ret;
115 0 : NTSTATUS status;
116 :
117 : /* handler for both copy-chunk variants */
118 288 : SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
119 : || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
120 :
121 288 : req = tevent_req_create(mem_ctx, &state,
122 : struct fsctl_srv_copychunk_state);
123 288 : if (req == NULL) {
124 0 : return NULL;
125 : }
126 288 : *state = (struct fsctl_srv_copychunk_state) {
127 288 : .conn = dst_fsp->conn,
128 : .ev = ev,
129 : .ctl_code = ctl_code,
130 : .dst_fsp = dst_fsp,
131 : };
132 :
133 288 : if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
134 8 : DEBUG(3, ("max output %d not large enough to hold copy chunk "
135 : "response %lu\n", (int)in_max_output,
136 : (unsigned long)sizeof(struct srv_copychunk_rsp)));
137 8 : state->status = NT_STATUS_INVALID_PARAMETER;
138 8 : tevent_req_nterror(req, state->status);
139 8 : return tevent_req_post(req, ev);
140 : }
141 :
142 280 : ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
143 : (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
144 280 : if (ndr_ret != NDR_ERR_SUCCESS) {
145 0 : DEBUG(0, ("failed to unmarshall copy chunk req\n"));
146 0 : state->status = NT_STATUS_INVALID_PARAMETER;
147 0 : tevent_req_nterror(req, state->status);
148 0 : return tevent_req_post(req, ev);
149 : }
150 :
151 280 : state->token = data_blob_const(state->cc_copy.source_key,
152 : sizeof(state->cc_copy.source_key));
153 :
154 280 : state->status = copychunk_check_limits(&state->cc_copy);
155 280 : if (!NT_STATUS_IS_OK(state->status)) {
156 16 : DEBUG(3, ("copy chunk req exceeds limits\n"));
157 16 : state->out_data = COPYCHUNK_OUT_LIMITS;
158 16 : tevent_req_nterror(req, state->status);
159 16 : return tevent_req_post(req, ev);
160 : }
161 :
162 : /* any errors from here onwards should carry copychunk response data */
163 264 : state->out_data = COPYCHUNK_OUT_RSP;
164 :
165 264 : status = fsctl_srv_copychunk_loop(req);
166 264 : if (tevent_req_nterror(req, status)) {
167 0 : return tevent_req_post(req, ev);
168 : }
169 :
170 264 : return req;
171 : }
172 :
173 312 : static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
174 : {
175 312 : struct fsctl_srv_copychunk_state *state = tevent_req_data(
176 : req, struct fsctl_srv_copychunk_state);
177 312 : struct tevent_req *subreq = NULL;
178 312 : uint32_t length = 0;
179 312 : off_t source_off = 0;
180 312 : off_t target_off = 0;
181 :
182 : /*
183 : * chunk_count can be 0 which must either just do nothing returning
184 : * success saying number of copied chunks is 0 (verified against
185 : * Windows).
186 : *
187 : * Or it can be a special macOS copyfile request, so we send this into
188 : * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
189 : */
190 312 : if (state->cc_copy.chunk_count > 0) {
191 296 : struct srv_copychunk *chunk = NULL;
192 :
193 296 : chunk = &state->cc_copy.chunks[state->current_chunk];
194 296 : length = chunk->length;
195 296 : source_off = chunk->source_off;
196 296 : target_off = chunk->target_off;
197 : }
198 :
199 312 : subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
200 : state,
201 : state->ev,
202 : state->ctl_code,
203 : &state->token,
204 : source_off,
205 : state->dst_fsp,
206 : target_off,
207 : length);
208 312 : if (tevent_req_nomem(subreq, req)) {
209 0 : return NT_STATUS_NO_MEMORY;
210 : }
211 312 : tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
212 :
213 312 : return NT_STATUS_OK;
214 : }
215 :
216 312 : static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
217 : {
218 312 : struct tevent_req *req = tevent_req_callback_data(
219 : subreq, struct tevent_req);
220 312 : struct fsctl_srv_copychunk_state *state = tevent_req_data(
221 : req, struct fsctl_srv_copychunk_state);
222 0 : off_t chunk_nwritten;
223 0 : NTSTATUS status;
224 :
225 312 : status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
226 : &chunk_nwritten);
227 312 : TALLOC_FREE(subreq);
228 312 : if (!NT_STATUS_IS_OK(status)) {
229 72 : DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
230 : nt_errstr(status),
231 : (unsigned int)state->current_chunk,
232 : (unsigned int)state->cc_copy.chunk_count);
233 72 : tevent_req_nterror(req, status);
234 264 : return;
235 : }
236 :
237 240 : DBG_DEBUG("good copy chunk [%u] of [%u]\n",
238 : (unsigned int)state->current_chunk,
239 : (unsigned int)state->cc_copy.chunk_count);
240 240 : state->total_written += chunk_nwritten;
241 :
242 240 : if (state->cc_copy.chunk_count == 0) {
243 : /*
244 : * This must not produce an error but just return a chunk count
245 : * of 0 in the response.
246 : */
247 16 : tevent_req_done(req);
248 16 : return;
249 : }
250 :
251 224 : state->current_chunk++;
252 224 : if (state->current_chunk == state->cc_copy.chunk_count) {
253 176 : tevent_req_done(req);
254 176 : return;
255 : }
256 :
257 48 : status = fsctl_srv_copychunk_loop(req);
258 48 : if (tevent_req_nterror(req, status)) {
259 0 : return;
260 : }
261 : }
262 :
263 288 : static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
264 : struct srv_copychunk_rsp *cc_rsp,
265 : bool *pack_rsp)
266 : {
267 288 : struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
268 : struct fsctl_srv_copychunk_state);
269 0 : NTSTATUS status;
270 :
271 288 : switch (state->out_data) {
272 8 : case COPYCHUNK_OUT_EMPTY:
273 8 : *pack_rsp = false;
274 8 : break;
275 16 : case COPYCHUNK_OUT_LIMITS:
276 : /* 2.2.32.1 - send back our maximum transfer size limits */
277 16 : copychunk_pack_limits(cc_rsp);
278 16 : *pack_rsp = true;
279 16 : break;
280 264 : case COPYCHUNK_OUT_RSP:
281 264 : cc_rsp->chunks_written = state->current_chunk;
282 264 : cc_rsp->chunk_bytes_written = 0;
283 264 : cc_rsp->total_bytes_written = state->total_written;
284 264 : *pack_rsp = true;
285 264 : break;
286 0 : default: /* not reached */
287 : assert(1);
288 0 : break;
289 : }
290 288 : status = tevent_req_simple_recv_ntstatus(req);
291 288 : return status;
292 : }
293 :
294 : struct cluster_movable_ips {
295 : uint32_t array_len;
296 : uint32_t array_index;
297 : struct sockaddr_storage *ips;
298 : };
299 :
300 0 : static int stash_cluster_movable_ips(uint32_t total_ip_count,
301 : const struct sockaddr_storage *ip,
302 : bool is_movable_ip,
303 : void *private_data)
304 : {
305 0 : struct cluster_movable_ips *cluster_movable_ips
306 0 : = talloc_get_type_abort(private_data,
307 : struct cluster_movable_ips);
308 :
309 0 : if (!is_movable_ip) {
310 0 : return 0;
311 : }
312 :
313 0 : if (cluster_movable_ips->array_len == 0) {
314 0 : SMB_ASSERT(total_ip_count < INT_MAX);
315 0 : cluster_movable_ips->ips
316 0 : = talloc_zero_array(cluster_movable_ips,
317 : struct sockaddr_storage,
318 : total_ip_count);
319 0 : if (cluster_movable_ips->ips == NULL) {
320 0 : return ENOMEM;
321 : }
322 0 : cluster_movable_ips->array_len = total_ip_count;
323 : }
324 :
325 0 : SMB_ASSERT(cluster_movable_ips->array_index
326 : < cluster_movable_ips->array_len);
327 :
328 0 : cluster_movable_ips->ips[cluster_movable_ips->array_index] = *ip;
329 0 : cluster_movable_ips->array_index++;
330 :
331 0 : return 0;
332 : }
333 :
334 0 : static bool find_in_cluster_movable_ips(
335 : struct cluster_movable_ips *cluster_movable_ips,
336 : const struct sockaddr_storage *ifss)
337 : {
338 0 : struct samba_sockaddr srv_ip = {
339 : .u = {
340 : .ss = *ifss,
341 : },
342 : };
343 0 : uint32_t i;
344 :
345 0 : for (i = 0; i < cluster_movable_ips->array_index; i++) {
346 0 : struct samba_sockaddr pub_ip = {
347 : .u = {
348 0 : .ss = cluster_movable_ips->ips[i],
349 : },
350 : };
351 0 : if (sockaddr_equal(&pub_ip.u.sa, &srv_ip.u.sa)) {
352 0 : return true;
353 : }
354 : }
355 0 : return false;
356 : }
357 :
358 72 : static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
359 : struct tevent_context *ev,
360 : struct smbXsrv_connection *xconn,
361 : DATA_BLOB *in_input,
362 : uint32_t in_max_output,
363 : DATA_BLOB *out_output)
364 : {
365 72 : struct samba_sockaddr xconn_srv_addr = { .sa_socklen = 0, };
366 72 : struct fsctl_net_iface_info *array = NULL;
367 72 : struct fsctl_net_iface_info *first = NULL;
368 72 : struct fsctl_net_iface_info *last = NULL;
369 0 : size_t i;
370 0 : size_t num_ifaces;
371 0 : enum ndr_err_code ndr_err;
372 72 : struct cluster_movable_ips *cluster_movable_ips = NULL;
373 0 : ssize_t sret;
374 0 : int ret;
375 :
376 72 : if (in_input->length != 0) {
377 0 : return NT_STATUS_INVALID_PARAMETER;
378 : }
379 :
380 : /*
381 : * The list of probed interfaces might have changed, we might need to
382 : * refresh local_interfaces to get up-to-date network information, and
383 : * respond to clients which sent FSCTL_QUERY_NETWORK_INTERFACE_INFO.
384 : * For example, network speed is changed, interfaces count is changed
385 : * (some link down or link up), and etc.
386 : */
387 72 : load_interfaces();
388 72 : num_ifaces = iface_count();
389 :
390 72 : *out_output = data_blob_null;
391 :
392 72 : array = talloc_zero_array(mem_ctx,
393 : struct fsctl_net_iface_info,
394 : num_ifaces);
395 72 : if (array == NULL) {
396 0 : return NT_STATUS_NO_MEMORY;
397 : }
398 :
399 72 : if (lp_clustering()) {
400 0 : cluster_movable_ips = talloc_zero(array,
401 : struct cluster_movable_ips);
402 0 : if (cluster_movable_ips == NULL) {
403 0 : TALLOC_FREE(array);
404 0 : return NT_STATUS_NO_MEMORY;
405 : }
406 0 : ret = ctdbd_public_ip_foreach(messaging_ctdb_connection(),
407 : stash_cluster_movable_ips,
408 : cluster_movable_ips);
409 0 : if (ret != 0) {
410 0 : TALLOC_FREE(array);
411 0 : return NT_STATUS_INTERNAL_ERROR;
412 : }
413 : }
414 :
415 72 : sret = tsocket_address_bsd_sockaddr(xconn->local_address,
416 : &xconn_srv_addr.u.sa,
417 : sizeof(xconn_srv_addr.u.ss));
418 72 : if (sret < 0) {
419 0 : return NT_STATUS_INTERNAL_ERROR;
420 : }
421 72 : xconn_srv_addr.sa_socklen = sret;
422 :
423 216 : for (i=0; i < num_ifaces; i++) {
424 144 : struct fsctl_net_iface_info *cur = &array[i];
425 144 : const struct interface *iface = get_interface(i);
426 144 : const struct sockaddr_storage *ifss = &iface->ip;
427 144 : const void *ifptr = ifss;
428 144 : const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
429 144 : struct tsocket_address *a = NULL;
430 0 : char *addr;
431 0 : bool ok;
432 :
433 144 : ret = tsocket_address_bsd_from_sockaddr(array,
434 : ifsa, sizeof(struct sockaddr_storage),
435 : &a);
436 144 : if (ret != 0) {
437 0 : NTSTATUS status = map_nt_error_from_unix_common(errno);
438 0 : TALLOC_FREE(array);
439 0 : return status;
440 : }
441 :
442 144 : ok = tsocket_address_is_inet(a, "ip");
443 144 : if (!ok) {
444 0 : continue;
445 : }
446 :
447 144 : addr = tsocket_address_inet_addr_string(a, array);
448 144 : if (addr == NULL) {
449 0 : TALLOC_FREE(array);
450 0 : return NT_STATUS_NO_MEMORY;
451 : }
452 :
453 144 : if (sockaddr_equal(ifsa, &xconn_srv_addr.u.sa)) {
454 : /*
455 : * We can announce the ip of the current connection even
456 : * if it is a moveable cluster address... as the client
457 : * is already connected to it.
458 : *
459 : * It means in a typical ctdb cluster, where we
460 : * only have public addresses, the client can at least
461 : * have more than one multichannel'ed connection to the
462 : * public ip.
463 : */
464 72 : } else if (cluster_movable_ips != NULL) {
465 0 : bool is_movable_ip = find_in_cluster_movable_ips(
466 : cluster_movable_ips,
467 : ifss);
468 0 : if (is_movable_ip) {
469 0 : DBG_DEBUG("Interface [%s] - "
470 : "has movable public ip - "
471 : "skipping address [%s].\n",
472 : iface->name, addr);
473 0 : continue;
474 : }
475 : }
476 :
477 144 : cur->ifindex = iface->if_index;
478 144 : if (cur->ifindex == 0) {
479 : /*
480 : * Did not get interface index from kernel,
481 : * nor from the config. ==> Apply a common
482 : * default value for these cases.
483 : */
484 144 : cur->ifindex = UINT32_MAX;
485 : }
486 144 : cur->capability = iface->capability;
487 144 : cur->linkspeed = iface->linkspeed;
488 144 : if (cur->linkspeed == 0) {
489 0 : DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
490 : "address [%s].\n", iface->name, addr);
491 0 : continue;
492 : }
493 :
494 144 : ok = tsocket_address_is_inet(a, "ipv4");
495 144 : if (ok) {
496 72 : cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
497 72 : cur->sockaddr.saddr.saddr_in.ipv4 = addr;
498 : }
499 144 : ok = tsocket_address_is_inet(a, "ipv6");
500 144 : if (ok) {
501 72 : cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
502 72 : cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
503 : }
504 :
505 144 : if (first == NULL) {
506 72 : first = cur;
507 : }
508 144 : if (last != NULL) {
509 72 : last->next = cur;
510 : }
511 144 : last = cur;
512 : }
513 :
514 72 : if (first == NULL) {
515 0 : TALLOC_FREE(array);
516 0 : return NT_STATUS_OK;
517 : }
518 :
519 72 : if (DEBUGLEVEL >= 10) {
520 0 : NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
521 : }
522 :
523 72 : ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
524 : (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
525 72 : TALLOC_FREE(array);
526 72 : if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
527 0 : return ndr_map_error2ntstatus(ndr_err);
528 : }
529 :
530 72 : return NT_STATUS_OK;
531 : }
532 :
533 2738 : static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
534 : struct tevent_context *ev,
535 : struct smbXsrv_connection *conn,
536 : DATA_BLOB *in_input,
537 : uint32_t in_max_output,
538 : DATA_BLOB *out_output,
539 : bool *disconnect)
540 : {
541 22 : uint32_t in_capabilities;
542 22 : DATA_BLOB in_guid_blob;
543 22 : struct GUID in_guid;
544 22 : uint16_t in_security_mode;
545 22 : uint16_t in_num_dialects;
546 22 : uint16_t dialect;
547 2738 : struct GUID_ndr_buf out_guid_buf = { .buf = {0}, };
548 22 : NTSTATUS status;
549 2738 : enum protocol_types protocol = PROTOCOL_NONE;
550 :
551 2738 : if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
552 : /*
553 : * With SMB 2.02 we didn't get the
554 : * capabitities, client guid, security mode
555 : * and dialects the client would have offered.
556 : *
557 : * So we behave compatible with a true
558 : * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
559 : *
560 : * As SMB >= 2.10 offers the two phase SMB2 Negotiate
561 : * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
562 : * starting with SMB 2.10, while Windows only supports
563 : * it starting with SMB > 2.10.
564 : */
565 64 : return NT_STATUS_FILE_CLOSED;
566 : }
567 :
568 2674 : if (in_input->length < 0x18) {
569 0 : return NT_STATUS_INVALID_PARAMETER;
570 : }
571 :
572 2674 : in_capabilities = IVAL(in_input->data, 0x00);
573 2674 : in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
574 2674 : in_security_mode = SVAL(in_input->data, 0x14);
575 2674 : in_num_dialects = SVAL(in_input->data, 0x16);
576 :
577 2674 : if (in_input->length < (0x18 + in_num_dialects*2)) {
578 0 : return NT_STATUS_INVALID_PARAMETER;
579 : }
580 :
581 2674 : if (in_max_output < 0x18) {
582 0 : return NT_STATUS_BUFFER_TOO_SMALL;
583 : }
584 :
585 2674 : status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
586 2674 : if (!NT_STATUS_IS_OK(status)) {
587 0 : return status;
588 : }
589 :
590 : /*
591 : * From: [MS-SMB2]
592 : * 3.3.5.15.12 Handling a Validate Negotiate Info Request
593 : *
594 : * The server MUST determine the greatest common dialect
595 : * between the dialects it implements and the Dialects array
596 : * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
597 : * matched, or if the value is not equal to Connection.Dialect,
598 : * the server MUST terminate the transport connection
599 : * and free the Connection object.
600 : */
601 2674 : protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
602 : in_num_dialects,
603 : &dialect);
604 2674 : if (conn->protocol != protocol) {
605 0 : *disconnect = true;
606 0 : return NT_STATUS_ACCESS_DENIED;
607 : }
608 :
609 2674 : if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
610 0 : *disconnect = true;
611 0 : return NT_STATUS_ACCESS_DENIED;
612 : }
613 :
614 2674 : if (in_security_mode != conn->smb2.client.security_mode) {
615 0 : *disconnect = true;
616 0 : return NT_STATUS_ACCESS_DENIED;
617 : }
618 :
619 2674 : if (in_capabilities != conn->smb2.client.capabilities) {
620 0 : *disconnect = true;
621 0 : return NT_STATUS_ACCESS_DENIED;
622 : }
623 :
624 2674 : status = GUID_to_ndr_buf(&conn->smb2.server.guid, &out_guid_buf);
625 2674 : if (!NT_STATUS_IS_OK(status)) {
626 0 : return status;
627 : }
628 :
629 2674 : *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
630 2674 : if (out_output->data == NULL) {
631 0 : return NT_STATUS_NO_MEMORY;
632 : }
633 :
634 2674 : SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
635 2674 : memcpy(out_output->data+0x04, out_guid_buf.buf, 16);
636 2674 : SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
637 2674 : SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
638 :
639 2674 : return NT_STATUS_OK;
640 : }
641 :
642 : static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
643 : static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
644 :
645 4832 : struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
646 : struct tevent_context *ev,
647 : struct tevent_req *req,
648 : struct smbd_smb2_ioctl_state *state)
649 : {
650 22 : struct tevent_req *subreq;
651 22 : NTSTATUS status;
652 :
653 4832 : switch (ctl_code) {
654 : /*
655 : * [MS-SMB2] 2.2.31
656 : * FSCTL_SRV_COPYCHUNK is issued when a handle has
657 : * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
658 : * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
659 : * FILE_WRITE_DATA access.
660 : */
661 288 : case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
662 : case FSCTL_SRV_COPYCHUNK:
663 288 : subreq = fsctl_srv_copychunk_send(state, ev,
664 : ctl_code,
665 288 : state->fsp,
666 : &state->in_input,
667 288 : state->in_max_output,
668 : state->smb2req);
669 288 : if (tevent_req_nomem(subreq, req)) {
670 0 : return tevent_req_post(req, ev);
671 : }
672 288 : tevent_req_set_callback(subreq,
673 : smb2_ioctl_network_fs_copychunk_done,
674 : req);
675 288 : return req;
676 0 : break;
677 72 : case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
678 72 : if (!state->smbreq->xconn->client->server_multi_channel_enabled)
679 : {
680 0 : if (IS_IPC(state->smbreq->conn)) {
681 0 : status = NT_STATUS_FS_DRIVER_REQUIRED;
682 : } else {
683 0 : status = NT_STATUS_INVALID_DEVICE_REQUEST;
684 : }
685 :
686 0 : tevent_req_nterror(req, status);
687 0 : return tevent_req_post(req, ev);
688 : }
689 :
690 72 : status = fsctl_network_iface_info(state, ev,
691 72 : state->smbreq->xconn,
692 : &state->in_input,
693 : state->in_max_output,
694 : &state->out_output);
695 72 : if (!tevent_req_nterror(req, status)) {
696 72 : tevent_req_done(req);
697 : }
698 72 : return tevent_req_post(req, ev);
699 22 : break;
700 2738 : case FSCTL_VALIDATE_NEGOTIATE_INFO:
701 2760 : status = fsctl_validate_neg_info(state, ev,
702 2738 : state->smbreq->xconn,
703 : &state->in_input,
704 : state->in_max_output,
705 : &state->out_output,
706 : &state->disconnect);
707 2738 : if (!tevent_req_nterror(req, status)) {
708 2674 : tevent_req_done(req);
709 : }
710 2738 : return tevent_req_post(req, ev);
711 0 : break;
712 280 : case FSCTL_SRV_REQUEST_RESUME_KEY:
713 280 : subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
714 : ev,
715 : state->fsp,
716 : FSCTL_SRV_REQUEST_RESUME_KEY,
717 : 0, 0, 0);
718 280 : if (tevent_req_nomem(subreq, req)) {
719 0 : return tevent_req_post(req, ev);
720 : }
721 280 : tevent_req_set_callback(
722 : subreq, smb2_ioctl_network_fs_offload_read_done, req);
723 280 : return req;
724 :
725 1454 : default: {
726 1454 : uint8_t *out_data = NULL;
727 1454 : uint32_t out_data_len = 0;
728 :
729 1454 : if (state->fsp == NULL) {
730 0 : status = NT_STATUS_NOT_SUPPORTED;
731 : } else {
732 1454 : status = SMB_VFS_FSCTL(state->fsp,
733 : state,
734 : ctl_code,
735 : state->smbreq->flags2,
736 : state->in_input.data,
737 : state->in_input.length,
738 : &out_data,
739 : state->in_max_output,
740 : &out_data_len);
741 1454 : state->out_output = data_blob_const(out_data, out_data_len);
742 1454 : if (NT_STATUS_IS_OK(status)) {
743 1246 : tevent_req_done(req);
744 1246 : return tevent_req_post(req, ev);
745 : }
746 : }
747 :
748 208 : if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
749 208 : if (IS_IPC(state->smbreq->conn)) {
750 0 : status = NT_STATUS_FS_DRIVER_REQUIRED;
751 : } else {
752 208 : status = NT_STATUS_INVALID_DEVICE_REQUEST;
753 : }
754 : }
755 :
756 208 : tevent_req_nterror(req, status);
757 208 : return tevent_req_post(req, ev);
758 0 : break;
759 : }
760 : }
761 :
762 : tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
763 : return tevent_req_post(req, ev);
764 : }
765 :
766 288 : static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
767 : {
768 288 : struct tevent_req *req = tevent_req_callback_data(subreq,
769 : struct tevent_req);
770 288 : struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
771 : struct smbd_smb2_ioctl_state);
772 0 : struct srv_copychunk_rsp cc_rsp;
773 0 : NTSTATUS status;
774 288 : bool pack_rsp = false;
775 :
776 288 : ZERO_STRUCT(cc_rsp);
777 288 : status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
778 288 : TALLOC_FREE(subreq);
779 288 : if (pack_rsp == true) {
780 0 : enum ndr_err_code ndr_ret;
781 280 : ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
782 : ioctl_state,
783 : &cc_rsp,
784 : (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
785 280 : if (ndr_ret != NDR_ERR_SUCCESS) {
786 0 : status = NT_STATUS_INTERNAL_ERROR;
787 : }
788 : }
789 :
790 288 : if (!tevent_req_nterror(req, status)) {
791 192 : tevent_req_done(req);
792 : }
793 288 : }
794 :
795 280 : static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
796 : {
797 280 : struct tevent_req *req = tevent_req_callback_data(
798 : subreq, struct tevent_req);
799 280 : struct smbd_smb2_ioctl_state *state = tevent_req_data(
800 : req, struct smbd_smb2_ioctl_state);
801 0 : struct req_resume_key_rsp rkey_rsp;
802 0 : enum ndr_err_code ndr_ret;
803 0 : uint32_t flags;
804 0 : uint64_t xferlen;
805 0 : DATA_BLOB token;
806 0 : NTSTATUS status;
807 :
808 : /*
809 : * Note that both flags and xferlen are not used with copy-chunk.
810 : */
811 280 : status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
812 : state->fsp->conn,
813 : state,
814 : &flags,
815 : &xferlen,
816 : &token);
817 280 : TALLOC_FREE(subreq);
818 280 : if (tevent_req_nterror(req, status)) {
819 0 : return;
820 : }
821 :
822 280 : if (token.length != sizeof(rkey_rsp.resume_key)) {
823 0 : tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
824 0 : return;
825 : }
826 :
827 280 : ZERO_STRUCT(rkey_rsp);
828 280 : memcpy(rkey_rsp.resume_key, token.data, token.length);
829 :
830 280 : ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
831 : (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
832 280 : if (ndr_ret != NDR_ERR_SUCCESS) {
833 0 : tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
834 0 : return;
835 : }
836 :
837 280 : tevent_req_done(req);
838 280 : return;
839 : }
|
