LCOV - code coverage report
Current view: top level - source3/smbd - notify.c (source / functions) Hit Total Coverage
Test: coverage report for master 6248eab5 Lines: 286 375 76.3 %
Date: 2021-08-25 13:27:56 Functions: 20 26 76.9 %

          Line data    Source code
       1             : /*
       2             :    Unix SMB/CIFS implementation.
       3             :    change notify handling
       4             :    Copyright (C) Andrew Tridgell 2000
       5             :    Copyright (C) Jeremy Allison 1994-1998
       6             :    Copyright (C) Volker Lendecke 2007
       7             : 
       8             :    This program is free software; you can redistribute it and/or modify
       9             :    it under the terms of the GNU General Public License as published by
      10             :    the Free Software Foundation; either version 3 of the License, or
      11             :    (at your option) any later version.
      12             : 
      13             :    This program is distributed in the hope that it will be useful,
      14             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      15             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      16             :    GNU General Public License for more details.
      17             : 
      18             :    You should have received a copy of the GNU General Public License
      19             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      20             : */
      21             : 
      22             : #include "includes.h"
      23             : #include "smbd/smbd.h"
      24             : #include "smbd/globals.h"
      25             : #include "../librpc/gen_ndr/ndr_notify.h"
      26             : #include "librpc/gen_ndr/ndr_file_id.h"
      27             : #include "libcli/security/privileges.h"
      28             : #include "libcli/security/security.h"
      29             : 
      30             : struct notify_change_event {
      31             :         struct timespec when;
      32             :         uint32_t action;
      33             :         const char *name;
      34             : };
      35             : 
      36             : struct notify_change_buf {
      37             :         /*
      38             :          * Filters for reinitializing after notifyd has been restarted
      39             :          */
      40             :         uint32_t filter;
      41             :         uint32_t subdir_filter;
      42             : 
      43             :         /*
      44             :          * If no requests are pending, changes are queued here. Simple array,
      45             :          * we only append.
      46             :          */
      47             : 
      48             :         uint32_t max_buffer_size;
      49             : 
      50             :         /*
      51             :          * num_changes == -1 means that we have got a catch-all change, when
      52             :          * asked we just return NT_STATUS_OK without specific changes.
      53             :          */
      54             :         int num_changes;
      55             :         struct notify_change_event *changes;
      56             : 
      57             :         /*
      58             :          * If no changes are around requests are queued here. Using a linked
      59             :          * list, because we have to append at the end and delete from the top.
      60             :          */
      61             :         struct notify_change_request *requests;
      62             : };
      63             : 
      64             : struct notify_change_request {
      65             :         struct notify_change_request *prev, *next;
      66             :         struct files_struct *fsp;       /* backpointer for cancel by mid */
      67             :         struct smb_request *req;
      68             :         uint32_t filter;
      69             :         uint32_t max_param;
      70             :         void (*reply_fn)(struct smb_request *req,
      71             :                          NTSTATUS error_code,
      72             :                          uint8_t *buf, size_t len);
      73             :         struct notify_mid_map *mid_map;
      74             :         void *backend_data;
      75             : };
      76             : 
      77             : static void notify_fsp(files_struct *fsp, struct timespec when,
      78             :                        uint32_t action, const char *name);
      79             : 
      80        2784 : bool change_notify_fsp_has_changes(struct files_struct *fsp)
      81             : {
      82        2784 :         if (fsp == NULL) {
      83           0 :                 return false;
      84             :         }
      85             : 
      86        2784 :         if (fsp->notify == NULL) {
      87           0 :                 return false;
      88             :         }
      89             : 
      90        2784 :         if (fsp->notify->num_changes == 0) {
      91        2675 :                 return false;
      92             :         }
      93             : 
      94         109 :         return true;
      95             : }
      96             : 
      97             : /*
      98             :  * For NTCancel, we need to find the notify_change_request indexed by
      99             :  * mid. Separate list here.
     100             :  */
     101             : 
     102             : struct notify_mid_map {
     103             :         struct notify_mid_map *prev, *next;
     104             :         struct notify_change_request *req;
     105             :         uint64_t mid;
     106             : };
     107             : 
     108        1079 : static bool notify_change_record_identical(struct notify_change_event *c1,
     109             :                                            struct notify_change_event *c2)
     110             : {
     111             :         /* Note this is deliberately case sensitive. */
     112        1379 :         if (c1->action == c2->action &&
     113         300 :                         strcmp(c1->name, c2->name) == 0) {
     114           0 :                 return True;
     115             :         }
     116        1079 :         return False;
     117             : }
     118             : 
     119        3286 : static int compare_notify_change_events(const void *p1, const void *p2)
     120             : {
     121        3286 :         const struct notify_change_event *e1 = p1;
     122        3286 :         const struct notify_change_event *e2 = p2;
     123             : 
     124        3286 :         return timespec_compare(&e1->when, &e2->when);
     125             : }
     126             : 
     127         243 : static bool notify_marshall_changes(int num_changes,
     128             :                                 uint32_t max_offset,
     129             :                                 struct notify_change_event *changes,
     130             :                                 DATA_BLOB *final_blob)
     131             : {
     132             :         int i;
     133             : 
     134         243 :         if (num_changes == -1) {
     135           0 :                 return false;
     136             :         }
     137             : 
     138             :         /*
     139             :          * Sort the notifies by timestamp when the event happened to avoid
     140             :          * coalescing and thus dropping events.
     141             :          */
     142             : 
     143         243 :         qsort(changes, num_changes,
     144             :               sizeof(*changes), compare_notify_change_events);
     145             : 
     146        3110 :         for (i=0; i<num_changes; i++) {
     147             :                 enum ndr_err_code ndr_err;
     148             :                 struct notify_change_event *c;
     149             :                 struct FILE_NOTIFY_INFORMATION m;
     150             :                 DATA_BLOB blob;
     151        1318 :                 uint16_t pad = 0;
     152             : 
     153             :                 /* Coalesce any identical records. */
     154        3715 :                 while (i+1 < num_changes &&
     155        1079 :                         notify_change_record_identical(&changes[i],
     156        1079 :                                                 &changes[i+1])) {
     157           0 :                         i++;
     158             :                 }
     159             : 
     160        1318 :                 c = &changes[i];
     161             : 
     162        1318 :                 m.FileName1 = c->name;
     163        1318 :                 m.FileNameLength = strlen_m(c->name)*2;
     164        1318 :                 m.Action = c->action;
     165             : 
     166        1318 :                 m._pad = data_blob_null;
     167             : 
     168             :                 /*
     169             :                  * Offset to next entry, only if there is one
     170             :                  */
     171             : 
     172        1318 :                 if (i == (num_changes-1)) {
     173         239 :                         m.NextEntryOffset = 0;
     174             :                 } else {
     175        1079 :                         if ((m.FileNameLength % 4) == 2) {
     176         456 :                                 m._pad = data_blob_const(&pad, 2);
     177             :                         }
     178        1079 :                         m.NextEntryOffset =
     179        1079 :                                 ndr_size_FILE_NOTIFY_INFORMATION(&m, 0);
     180             :                 }
     181             : 
     182        1318 :                 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &m,
     183             :                         (ndr_push_flags_fn_t)ndr_push_FILE_NOTIFY_INFORMATION);
     184        1318 :                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
     185           6 :                         return false;
     186             :                 }
     187             : 
     188        1318 :                 if (DEBUGLEVEL >= 10) {
     189           0 :                         NDR_PRINT_DEBUG(FILE_NOTIFY_INFORMATION, &m);
     190             :                 }
     191             : 
     192        2636 :                 if (!data_blob_append(talloc_tos(), final_blob,
     193        1318 :                                       blob.data, blob.length)) {
     194           0 :                         data_blob_free(&blob);
     195           0 :                         return false;
     196             :                 }
     197             : 
     198        1318 :                 data_blob_free(&blob);
     199             : 
     200        1318 :                 if (final_blob->length > max_offset) {
     201             :                         /* Too much data for client. */
     202           6 :                         DEBUG(10, ("Client only wanted %d bytes, trying to "
     203             :                                    "marshall %d bytes\n", (int)max_offset,
     204             :                                    (int)final_blob->length));
     205           6 :                         return False;
     206             :                 }
     207             :         }
     208             : 
     209         237 :         return True;
     210             : }
     211             : 
     212             : /****************************************************************************
     213             :  Setup the common parts of the return packet and send it.
     214             : *****************************************************************************/
     215             : 
     216        2784 : void change_notify_reply(struct smb_request *req,
     217             :                          NTSTATUS error_code,
     218             :                          uint32_t max_param,
     219             :                          struct notify_change_buf *notify_buf,
     220             :                          void (*reply_fn)(struct smb_request *req,
     221             :                                           NTSTATUS error_code,
     222             :                                           uint8_t *buf, size_t len))
     223             : {
     224        2784 :         DATA_BLOB blob = data_blob_null;
     225             : 
     226        2784 :         if (!NT_STATUS_IS_OK(error_code)) {
     227        2531 :                 reply_fn(req, error_code, NULL, 0);
     228        2531 :                 return;
     229             :         }
     230             : 
     231         253 :         if (notify_buf == NULL) {
     232          10 :                 reply_fn(req, NT_STATUS_OK, NULL, 0);
     233          10 :                 return;
     234             :         }
     235             : 
     236         243 :         max_param = MIN(max_param, notify_buf->max_buffer_size);
     237             : 
     238         243 :         if (!notify_marshall_changes(notify_buf->num_changes, max_param,
     239             :                                         notify_buf->changes, &blob)) {
     240             :                 /*
     241             :                  * We exceed what the client is willing to accept. Send
     242             :                  * nothing.
     243             :                  */
     244           6 :                 data_blob_free(&blob);
     245             :         }
     246             : 
     247         243 :         reply_fn(req, NT_STATUS_OK, blob.data, blob.length);
     248             : 
     249         243 :         data_blob_free(&blob);
     250             : 
     251         243 :         TALLOC_FREE(notify_buf->changes);
     252         243 :         notify_buf->num_changes = 0;
     253             : }
     254             : 
     255             : struct notify_fsp_state {
     256             :         struct files_struct *notified_fsp;
     257             :         struct timespec when;
     258             :         const struct notify_event *e;
     259             : };
     260             : 
     261        9404 : static struct files_struct *notify_fsp_cb(struct files_struct *fsp,
     262             :                                           void *private_data)
     263             : {
     264        9404 :         struct notify_fsp_state *state = private_data;
     265             : 
     266        9404 :         if (fsp == state->notified_fsp) {
     267        1951 :                 DBG_DEBUG("notify_callback called for %s\n", fsp_str_dbg(fsp));
     268        1951 :                 notify_fsp(fsp, state->when, state->e->action, state->e->path);
     269        1951 :                 return fsp;
     270             :         }
     271             : 
     272        7453 :         return NULL;
     273             : }
     274             : 
     275        1953 : void notify_callback(struct smbd_server_connection *sconn,
     276             :                      void *private_data, struct timespec when,
     277             :                      const struct notify_event *e)
     278             : {
     279        1953 :         struct notify_fsp_state state = {
     280             :                 .notified_fsp = private_data, .when = when, .e = e
     281             :         };
     282        1953 :         files_forall(sconn, notify_fsp_cb, &state);
     283        1953 : }
     284             : 
     285        1852 : NTSTATUS change_notify_create(struct files_struct *fsp,
     286             :                               uint32_t max_buffer_size,
     287             :                               uint32_t filter,
     288             :                               bool recursive)
     289        1852 : {
     290        1852 :         size_t len = fsp_fullbasepath(fsp, NULL, 0);
     291        1852 :         char fullpath[len+1];
     292        1852 :         NTSTATUS status = NT_STATUS_NOT_IMPLEMENTED;
     293             : 
     294             :         /*
     295             :          * Setting a changenotify needs READ/LIST access
     296             :          * on the directory handle.
     297             :          */
     298        1852 :         if (!(fsp->access_mask & SEC_DIR_LIST)) {
     299           2 :                 return NT_STATUS_ACCESS_DENIED;
     300             :         }
     301             : 
     302        1850 :         if (fsp->notify != NULL) {
     303           0 :                 DEBUG(1, ("change_notify_create: fsp->notify != NULL, "
     304             :                           "fname = %s\n", fsp->fsp_name->base_name));
     305           0 :                 return NT_STATUS_INVALID_PARAMETER;
     306             :         }
     307             : 
     308        1850 :         if (!(fsp->notify = talloc_zero(NULL, struct notify_change_buf))) {
     309           0 :                 DEBUG(0, ("talloc failed\n"));
     310           0 :                 return NT_STATUS_NO_MEMORY;
     311             :         }
     312        1850 :         fsp->notify->filter = filter;
     313        1850 :         fsp->notify->subdir_filter = recursive ? filter : 0;
     314        1850 :         fsp->notify->max_buffer_size = max_buffer_size;
     315             : 
     316        1850 :         fsp_fullbasepath(fsp, fullpath, sizeof(fullpath));
     317             : 
     318             :         /*
     319             :          * Avoid /. at the end of the path name. notify can't deal with it.
     320             :          */
     321        1850 :         if (len > 1 && fullpath[len-1] == '.' && fullpath[len-2] == '/') {
     322          80 :                 fullpath[len-2] = '\0';
     323             :         }
     324             : 
     325        1850 :         if ((fsp->notify->filter != 0) ||
     326           0 :             (fsp->notify->subdir_filter != 0)) {
     327        3700 :                 status = notify_add(fsp->conn->sconn->notify_ctx,
     328        1850 :                                     fullpath, fsp->notify->filter,
     329        1850 :                                     fsp->notify->subdir_filter, fsp);
     330             :         }
     331             : 
     332        1850 :         return status;
     333             : }
     334             : 
     335        2675 : NTSTATUS change_notify_add_request(struct smb_request *req,
     336             :                                 uint32_t max_param,
     337             :                                 uint32_t filter, bool recursive,
     338             :                                 struct files_struct *fsp,
     339             :                                 void (*reply_fn)(struct smb_request *req,
     340             :                                         NTSTATUS error_code,
     341             :                                         uint8_t *buf, size_t len))
     342             : {
     343        2675 :         struct notify_change_request *request = NULL;
     344        2675 :         struct notify_mid_map *map = NULL;
     345        2675 :         struct smbd_server_connection *sconn = req->sconn;
     346             : 
     347        2675 :         DEBUG(10, ("change_notify_add_request: Adding request for %s: "
     348             :                    "max_param = %d\n", fsp_str_dbg(fsp), (int)max_param));
     349             : 
     350        2675 :         if (!(request = talloc(NULL, struct notify_change_request))
     351        2675 :             || !(map = talloc(request, struct notify_mid_map))) {
     352           0 :                 TALLOC_FREE(request);
     353           0 :                 return NT_STATUS_NO_MEMORY;
     354             :         }
     355             : 
     356        2675 :         request->mid_map = map;
     357        2675 :         map->req = request;
     358             : 
     359        2675 :         request->req = talloc_move(request, &req);
     360        2675 :         request->max_param = max_param;
     361        2675 :         request->filter = filter;
     362        2675 :         request->fsp = fsp;
     363        2675 :         request->reply_fn = reply_fn;
     364        2675 :         request->backend_data = NULL;
     365             : 
     366        2675 :         DLIST_ADD_END(fsp->notify->requests, request);
     367             : 
     368        2675 :         map->mid = request->req->mid;
     369        2675 :         DLIST_ADD(sconn->smb1.notify_mid_maps, map);
     370             : 
     371        2675 :         return NT_STATUS_OK;
     372             : }
     373             : 
     374        2675 : static void change_notify_remove_request(struct smbd_server_connection *sconn,
     375             :                                          struct notify_change_request *remove_req)
     376             : {
     377             :         files_struct *fsp;
     378             :         struct notify_change_request *req;
     379             : 
     380             :         /*
     381             :          * Paranoia checks, the fsp referenced must must have the request in
     382             :          * its list of pending requests
     383             :          */
     384             : 
     385        2675 :         fsp = remove_req->fsp;
     386        2675 :         SMB_ASSERT(fsp->notify != NULL);
     387             : 
     388        2675 :         for (req = fsp->notify->requests; req; req = req->next) {
     389        2675 :                 if (req == remove_req) {
     390        2675 :                         break;
     391             :                 }
     392             :         }
     393             : 
     394        2675 :         if (req == NULL) {
     395           0 :                 smb_panic("notify_req not found in fsp's requests");
     396             :         }
     397             : 
     398        2675 :         DLIST_REMOVE(fsp->notify->requests, req);
     399        2675 :         DLIST_REMOVE(sconn->smb1.notify_mid_maps, req->mid_map);
     400        2675 :         TALLOC_FREE(req);
     401        2675 : }
     402             : 
     403        2503 : static void smbd_notify_cancel_by_map(struct notify_mid_map *map)
     404             : {
     405        2503 :         struct smb_request *smbreq = map->req->req;
     406        2503 :         struct smbd_server_connection *sconn = smbreq->sconn;
     407        2503 :         struct smbd_smb2_request *smb2req = smbreq->smb2req;
     408        2503 :         NTSTATUS notify_status = NT_STATUS_CANCELLED;
     409             : 
     410        2503 :         if (smb2req != NULL) {
     411             :                 NTSTATUS sstatus;
     412             : 
     413        1562 :                 if (smb2req->session == NULL) {
     414           0 :                         sstatus = NT_STATUS_USER_SESSION_DELETED;
     415             :                 } else {
     416        1562 :                         sstatus = smb2req->session->status;
     417             :                 }
     418             : 
     419        1562 :                 if (NT_STATUS_EQUAL(sstatus, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
     420           8 :                         sstatus = NT_STATUS_OK;
     421             :                 }
     422             : 
     423        1562 :                 if (!NT_STATUS_IS_OK(sstatus)) {
     424           6 :                         notify_status = NT_STATUS_NOTIFY_CLEANUP;
     425        1556 :                 } else if (smb2req->tcon == NULL) {
     426           0 :                         notify_status = NT_STATUS_NOTIFY_CLEANUP;
     427        1556 :                 } else if (!NT_STATUS_IS_OK(smb2req->tcon->status)) {
     428           2 :                         notify_status = NT_STATUS_NOTIFY_CLEANUP;
     429             :                 }
     430             :         }
     431             : 
     432        2503 :         change_notify_reply(smbreq, notify_status,
     433        2503 :                             0, NULL, map->req->reply_fn);
     434        2503 :         change_notify_remove_request(sconn, map->req);
     435        2503 : }
     436             : 
     437             : /****************************************************************************
     438             :  Delete entries by mid from the change notify pending queue. Always send reply.
     439             : *****************************************************************************/
     440             : 
     441        1004 : bool remove_pending_change_notify_requests_by_mid(
     442             :         struct smbd_server_connection *sconn, uint64_t mid)
     443             : {
     444             :         struct notify_mid_map *map;
     445             : 
     446        1008 :         for (map = sconn->smb1.notify_mid_maps; map; map = map->next) {
     447         945 :                 if (map->mid == mid) {
     448         941 :                         break;
     449             :                 }
     450             :         }
     451             : 
     452        1004 :         if (map == NULL) {
     453          63 :                 return false;
     454             :         }
     455             : 
     456         941 :         smbd_notify_cancel_by_map(map);
     457         941 :         return true;
     458             : }
     459             : 
     460        1562 : void smbd_notify_cancel_by_smbreq(const struct smb_request *smbreq)
     461             : {
     462        1562 :         struct smbd_server_connection *sconn = smbreq->sconn;
     463             :         struct notify_mid_map *map;
     464             : 
     465        1562 :         for (map = sconn->smb1.notify_mid_maps; map; map = map->next) {
     466        1562 :                 if (map->req->req == smbreq) {
     467        1562 :                         break;
     468             :                 }
     469             :         }
     470             : 
     471        1562 :         if (map == NULL) {
     472           0 :                 return;
     473             :         }
     474             : 
     475        1562 :         smbd_notify_cancel_by_map(map);
     476             : }
     477             : 
     478      182239 : static struct files_struct *smbd_notify_cancel_deleted_fn(
     479             :         struct files_struct *fsp, void *private_data)
     480             : {
     481      182239 :         struct file_id *fid = talloc_get_type_abort(
     482             :                 private_data, struct file_id);
     483             : 
     484      182239 :         if (file_id_equal(&fsp->file_id, fid)) {
     485        2773 :                 remove_pending_change_notify_requests_by_fid(
     486        2773 :                         fsp, NT_STATUS_DELETE_PENDING);
     487             :         }
     488      182239 :         return NULL;
     489             : }
     490             : 
     491      144001 : void smbd_notify_cancel_deleted(struct messaging_context *msg,
     492             :                                 void *private_data, uint32_t msg_type,
     493             :                                 struct server_id server_id, DATA_BLOB *data)
     494             : {
     495      144001 :         struct smbd_server_connection *sconn = talloc_get_type_abort(
     496             :                 private_data, struct smbd_server_connection);
     497             :         struct file_id *fid;
     498             :         enum ndr_err_code ndr_err;
     499             : 
     500      144001 :         fid = talloc(talloc_tos(), struct file_id);
     501      144001 :         if (fid == NULL) {
     502           0 :                 DEBUG(1, ("talloc failed\n"));
     503           0 :                 return;
     504             :         }
     505             : 
     506      144001 :         ndr_err = ndr_pull_struct_blob_all(
     507             :                 data, fid, fid, (ndr_pull_flags_fn_t)ndr_pull_file_id);
     508      144001 :         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
     509           0 :                 DEBUG(10, ("%s: ndr_pull_file_id failed: %s\n", __func__,
     510             :                            ndr_errstr(ndr_err)));
     511           0 :                 goto done;
     512             :         }
     513             : 
     514      144001 :         files_forall(sconn, smbd_notify_cancel_deleted_fn, fid);
     515             : 
     516      144001 : done:
     517      144001 :         TALLOC_FREE(fid);
     518             : }
     519             : 
     520           0 : static struct files_struct *smbd_notifyd_reregister(struct files_struct *fsp,
     521             :                                                     void *private_data)
     522             : {
     523           0 :         DBG_DEBUG("reregister %s\n", fsp->fsp_name->base_name);
     524             : 
     525           0 :         if ((fsp->conn->sconn->notify_ctx != NULL) &&
     526           0 :             (fsp->notify != NULL) &&
     527           0 :             ((fsp->notify->filter != 0) ||
     528           0 :              (fsp->notify->subdir_filter != 0))) {
     529           0 :                 size_t len = fsp_fullbasepath(fsp, NULL, 0);
     530           0 :                 char fullpath[len+1];
     531             : 
     532             :                 NTSTATUS status;
     533             : 
     534           0 :                 fsp_fullbasepath(fsp, fullpath, sizeof(fullpath));
     535           0 :                 if (len > 1 && fullpath[len-1] == '.' &&
     536           0 :                     fullpath[len-2] == '/') {
     537           0 :                         fullpath[len-2] = '\0';
     538             :                 }
     539             : 
     540           0 :                 status = notify_add(fsp->conn->sconn->notify_ctx,
     541           0 :                                     fullpath, fsp->notify->filter,
     542           0 :                                     fsp->notify->subdir_filter, fsp);
     543           0 :                 if (!NT_STATUS_IS_OK(status)) {
     544           0 :                         DBG_DEBUG("notify_add failed: %s\n",
     545             :                                   nt_errstr(status));
     546             :                 }
     547             :         }
     548           0 :         return NULL;
     549             : }
     550             : 
     551           0 : void smbd_notifyd_restarted(struct messaging_context *msg,
     552             :                             void *private_data, uint32_t msg_type,
     553             :                             struct server_id server_id, DATA_BLOB *data)
     554             : {
     555           0 :         struct smbd_server_connection *sconn = talloc_get_type_abort(
     556             :                 private_data, struct smbd_server_connection);
     557             : 
     558           0 :         TALLOC_FREE(sconn->notify_ctx);
     559             : 
     560           0 :         sconn->notify_ctx = notify_init(sconn, sconn->msg_ctx,
     561             :                                         sconn, notify_callback);
     562           0 :         if (sconn->notify_ctx == NULL) {
     563           0 :                 DBG_DEBUG("notify_init failed\n");
     564           0 :                 return;
     565             :         }
     566             : 
     567           0 :         files_forall(sconn, smbd_notifyd_reregister, sconn->notify_ctx);
     568             : }
     569             : 
     570             : /****************************************************************************
     571             :  Delete entries by fnum from the change notify pending queue.
     572             : *****************************************************************************/
     573             : 
     574       52695 : void remove_pending_change_notify_requests_by_fid(files_struct *fsp,
     575             :                                                   NTSTATUS status)
     576             : {
     577       52695 :         if (fsp->notify == NULL) {
     578       50510 :                 return;
     579             :         }
     580             : 
     581        3762 :         while (fsp->notify->requests != NULL) {
     582          38 :                 change_notify_reply(fsp->notify->requests->req,
     583             :                                     status, 0, NULL,
     584          38 :                                     fsp->notify->requests->reply_fn);
     585          38 :                 change_notify_remove_request(fsp->conn->sconn,
     586          38 :                                              fsp->notify->requests);
     587             :         }
     588             : }
     589             : 
     590      384916 : void notify_fname(connection_struct *conn, uint32_t action, uint32_t filter,
     591             :                   const char *path)
     592             : {
     593      384916 :         struct notify_context *notify_ctx = conn->sconn->notify_ctx;
     594             : 
     595      384916 :         if (path[0] == '.' && path[1] == '/') {
     596           0 :                 path += 2;
     597             :         }
     598             : 
     599      384916 :         notify_trigger(notify_ctx, action, filter, conn->connectpath, path);
     600      384916 : }
     601             : 
     602          12 : static bool user_can_stat_name_under_fsp(files_struct *fsp, const char *name)
     603             : {
     604             :         uint32_t rights;
     605          12 :         struct smb_filename *fname = NULL;
     606          12 :         char *filepath = NULL;
     607             :         NTSTATUS status;
     608          12 :         char *p = NULL;
     609             : 
     610             :         /*
     611             :          * Assume we get filepath (relative to the share)
     612             :          * like this:
     613             :          *
     614             :          *  'dir1/dir2/dir3/file'
     615             :          *
     616             :          * We start with LIST and TRAVERSE on the
     617             :          * direct parent ('dir1/dir2/dir3')
     618             :          *
     619             :          * Then we switch to just TRAVERSE for
     620             :          * the rest: 'dir1/dir2', 'dir1', '.'
     621             :          *
     622             :          * For a file in the share root, we'll have
     623             :          *  'file'
     624             :          * and would just check '.' with LIST and TRAVERSE.
     625             :          *
     626             :          * It's important to always check '.' as the last step,
     627             :          * which means we check the permissions of the share root
     628             :          * directory.
     629             :          */
     630             : 
     631          12 :         if (ISDOT(fsp->fsp_name->base_name)) {
     632           6 :                 filepath = talloc_strdup(talloc_tos(), name);
     633             :         } else {
     634           6 :                 filepath = talloc_asprintf(talloc_tos(),
     635             :                         "%s/%s",
     636           6 :                         fsp->fsp_name->base_name,
     637             :                         name);
     638             :         }
     639          12 :         if (filepath == NULL) {
     640           0 :                 DBG_ERR("Memory allocation failed\n");
     641           0 :                 return false;
     642             :         }
     643             : 
     644          12 :         rights = SEC_DIR_LIST|SEC_DIR_TRAVERSE;
     645          12 :         p = strrchr_m(filepath, '/');
     646             :         /*
     647             :          * Check each path component, exluding the share root.
     648             :          *
     649             :          * We could check all components including root using
     650             :          * a do { .. } while() loop, but IMHO the logic is clearer
     651             :          * having the share root check separately afterwards.
     652             :          */
     653          28 :         while (p != NULL) {
     654          12 :                 *p = '\0';
     655          12 :                 status = synthetic_pathref(talloc_tos(),
     656          12 :                                            fsp->conn->cwd_fsp,
     657             :                                            filepath,
     658             :                                            NULL,
     659             :                                            NULL,
     660             :                                            0,
     661             :                                            0,
     662             :                                            &fname);
     663          12 :                 if (!NT_STATUS_IS_OK(status)) {
     664           0 :                         DBG_ERR("synthetic_pathref failed for %s, error %s\n",
     665             :                                 filepath,
     666             :                                 nt_errstr(status));
     667           0 :                         TALLOC_FREE(fname);
     668           0 :                         TALLOC_FREE(filepath);
     669           0 :                         return false;
     670             :                 }
     671             : 
     672          12 :                 status = smbd_check_access_rights_fsp(fsp->conn->cwd_fsp,
     673          12 :                                                   fname->fsp,
     674             :                                                   false,
     675             :                                                   rights);
     676          12 :                 if (!NT_STATUS_IS_OK(status)) {
     677           8 :                         DBG_DEBUG("Access rights for %s/%s: %s\n",
     678             :                                   fsp->conn->connectpath,
     679             :                                   filepath,
     680             :                                   nt_errstr(status));
     681           8 :                         TALLOC_FREE(fname);
     682           8 :                         TALLOC_FREE(filepath);
     683           8 :                         return false;
     684             :                 }
     685             : 
     686           4 :                 TALLOC_FREE(fname);
     687           4 :                 rights = SEC_DIR_TRAVERSE;
     688           4 :                 p = strrchr_m(filepath, '/');
     689             :         }
     690             : 
     691           4 :         TALLOC_FREE(filepath);
     692             : 
     693             :         /* Finally check share root. */
     694           4 :         filepath = talloc_strdup(talloc_tos(), ".");
     695           4 :         if (filepath == NULL) {
     696           0 :                 DBG_ERR("Memory allocation failed\n");
     697           0 :                 return false;
     698             :         }
     699           4 :         status = synthetic_pathref(talloc_tos(),
     700           4 :                                    fsp->conn->cwd_fsp,
     701             :                                    filepath,
     702             :                                    NULL,
     703             :                                    NULL,
     704             :                                    0,
     705             :                                    0,
     706             :                                    &fname);
     707           4 :         if (!NT_STATUS_IS_OK(status)) {
     708           0 :                 DBG_ERR("synthetic_pathref failed for %s, error %s\n",
     709             :                         filepath,
     710             :                         nt_errstr(status));
     711           0 :                 TALLOC_FREE(fname);
     712           0 :                 TALLOC_FREE(filepath);
     713           0 :                 return false;
     714             :         }
     715           4 :         status = smbd_check_access_rights_fsp(fsp->conn->cwd_fsp,
     716           4 :                                           fname->fsp,
     717             :                                           false,
     718             :                                           rights);
     719           4 :         if (!NT_STATUS_IS_OK(status)) {
     720           0 :                 DBG_DEBUG("TRAVERSE access rights for %s failed with %s\n",
     721             :                           fsp->conn->connectpath,
     722             :                           nt_errstr(status));
     723           0 :                 TALLOC_FREE(fname);
     724           0 :                 TALLOC_FREE(filepath);
     725           0 :                 return false;
     726             :         }
     727           4 :         TALLOC_FREE(fname);
     728           4 :         TALLOC_FREE(filepath);
     729           4 :         return true;
     730             : }
     731             : 
     732        1951 : static void notify_fsp(files_struct *fsp, struct timespec when,
     733             :                        uint32_t action, const char *name)
     734             : {
     735             :         struct notify_change_event *change, *changes;
     736             :         char *tmp;
     737             : 
     738        1951 :         if (fsp->notify == NULL) {
     739             :                 /*
     740             :                  * Nobody is waiting, don't queue
     741             :                  */
     742           0 :                 return;
     743             :         }
     744             : 
     745        1951 :         if (lp_honor_change_notify_privilege(SNUM(fsp->conn))) {
     746             :                 bool has_sec_change_notify_privilege;
     747          38 :                 bool expose = false;
     748             : 
     749          38 :                 has_sec_change_notify_privilege = security_token_has_privilege(
     750          38 :                         fsp->conn->session_info->security_token,
     751             :                         SEC_PRIV_CHANGE_NOTIFY);
     752             : 
     753          38 :                 if (has_sec_change_notify_privilege) {
     754          26 :                         expose = true;
     755             :                 } else {
     756             :                         bool ok;
     757             : 
     758          12 :                         ok = become_user_without_service_by_fsp(fsp);
     759          12 :                         if (ok) {
     760          12 :                                 expose = user_can_stat_name_under_fsp(fsp, name);
     761          12 :                                 unbecome_user_without_service();
     762             :                         }
     763             :                 }
     764          38 :                 DBG_DEBUG("has_sec_change_notify_privilege=%s "
     765             :                           "expose=%s for %s notify %s\n",
     766             :                           has_sec_change_notify_privilege ? "true" : "false",
     767             :                           expose ? "true" : "false",
     768             :                           fsp->fsp_name->base_name, name);
     769          38 :                 if (!expose) {
     770           8 :                         return;
     771             :                 }
     772             :         }
     773             : 
     774             :         /*
     775             :          * Someone has triggered a notify previously, queue the change for
     776             :          * later.
     777             :          */
     778             : 
     779        1943 :         if ((fsp->notify->num_changes > 1000) || (name == NULL)) {
     780             :                 /*
     781             :                  * The real number depends on the client buf, just provide a
     782             :                  * guard against a DoS here.  If name == NULL the CN backend is
     783             :                  * alerting us to a problem.  Possibly dropped events.  Clear
     784             :                  * queued changes and send the catch-all response to the client
     785             :                  * if a request is pending.
     786             :                  */
     787           0 :                 TALLOC_FREE(fsp->notify->changes);
     788           0 :                 fsp->notify->num_changes = -1;
     789           0 :                 if (fsp->notify->requests != NULL) {
     790           0 :                         change_notify_reply(fsp->notify->requests->req,
     791           0 :                                             NT_STATUS_OK,
     792           0 :                                             fsp->notify->requests->max_param,
     793             :                                             fsp->notify,
     794           0 :                                             fsp->notify->requests->reply_fn);
     795           0 :                         change_notify_remove_request(fsp->conn->sconn,
     796           0 :                                                      fsp->notify->requests);
     797             :                 }
     798           0 :                 return;
     799             :         }
     800             : 
     801             :         /* If we've exceeded the server side queue or received a NULL name
     802             :          * from the underlying CN implementation, don't queue up any more
     803             :          * requests until we can send a catch-all response to the client */
     804        1943 :         if (fsp->notify->num_changes == -1) {
     805           0 :                 return;
     806             :         }
     807             : 
     808        1943 :         if (!(changes = talloc_realloc(
     809             :                       fsp->notify, fsp->notify->changes,
     810             :                       struct notify_change_event,
     811             :                       fsp->notify->num_changes+1))) {
     812           0 :                 DEBUG(0, ("talloc_realloc failed\n"));
     813           0 :                 return;
     814             :         }
     815             : 
     816        1943 :         fsp->notify->changes = changes;
     817             : 
     818        1943 :         change = &(fsp->notify->changes[fsp->notify->num_changes]);
     819             : 
     820        1943 :         if (!(tmp = talloc_strdup(changes, name))) {
     821           0 :                 DEBUG(0, ("talloc_strdup failed\n"));
     822           0 :                 return;
     823             :         }
     824             : 
     825        1943 :         string_replace(tmp, '/', '\\');
     826        1943 :         change->name = tmp;  
     827             : 
     828        1943 :         change->when = when;
     829        1943 :         change->action = action;
     830        1943 :         fsp->notify->num_changes += 1;
     831             : 
     832        1943 :         if (fsp->notify->requests == NULL) {
     833             :                 /*
     834             :                  * Nobody is waiting, so don't send anything. The ot
     835             :                  */
     836        1803 :                 return;
     837             :         }
     838             : 
     839         140 :         if (action == NOTIFY_ACTION_OLD_NAME) {
     840             :                 /*
     841             :                  * We have to send the two rename events in one reply. So hold
     842             :                  * the first part back.
     843             :                  */
     844           6 :                 return;
     845             :         }
     846             : 
     847             :         /*
     848             :          * Someone is waiting for the change, trigger the reply immediately.
     849             :          *
     850             :          * TODO: do we have to walk the lists of requests pending?
     851             :          */
     852             : 
     853         402 :         change_notify_reply(fsp->notify->requests->req,
     854         134 :                             NT_STATUS_OK,
     855         134 :                             fsp->notify->requests->max_param,
     856             :                             fsp->notify,
     857         134 :                             fsp->notify->requests->reply_fn);
     858             : 
     859         134 :         change_notify_remove_request(fsp->conn->sconn, fsp->notify->requests);
     860             : }
     861             : 
     862        1070 : char *notify_filter_string(TALLOC_CTX *mem_ctx, uint32_t filter)
     863             : {
     864        1070 :         char *result = NULL;
     865             : 
     866        1070 :         result = talloc_strdup(mem_ctx, "");
     867             : 
     868        1070 :         if (filter & FILE_NOTIFY_CHANGE_FILE_NAME)
     869         188 :                 result = talloc_asprintf_append(result, "FILE_NAME|");
     870        1070 :         if (filter & FILE_NOTIFY_CHANGE_DIR_NAME)
     871         180 :                 result = talloc_asprintf_append(result, "DIR_NAME|");
     872        1070 :         if (filter & FILE_NOTIFY_CHANGE_ATTRIBUTES)
     873          44 :                 result = talloc_asprintf_append(result, "ATTRIBUTES|");
     874        1070 :         if (filter & FILE_NOTIFY_CHANGE_SIZE)
     875          28 :                 result = talloc_asprintf_append(result, "SIZE|");
     876        1070 :         if (filter & FILE_NOTIFY_CHANGE_LAST_WRITE)
     877          28 :                 result = talloc_asprintf_append(result, "LAST_WRITE|");
     878        1070 :         if (filter & FILE_NOTIFY_CHANGE_LAST_ACCESS)
     879          28 :                 result = talloc_asprintf_append(result, "LAST_ACCESS|");
     880        1070 :         if (filter & FILE_NOTIFY_CHANGE_CREATION)
     881          36 :                 result = talloc_asprintf_append(result, "CREATION|");
     882        1070 :         if (filter & FILE_NOTIFY_CHANGE_EA)
     883          28 :                 result = talloc_asprintf_append(result, "EA|");
     884        1070 :         if (filter & FILE_NOTIFY_CHANGE_SECURITY)
     885          28 :                 result = talloc_asprintf_append(result, "SECURITY|");
     886        1070 :         if (filter & FILE_NOTIFY_CHANGE_STREAM_NAME)
     887          30 :                 result = talloc_asprintf_append(result, "STREAM_NAME|");
     888        1070 :         if (filter & FILE_NOTIFY_CHANGE_STREAM_SIZE)
     889          28 :                 result = talloc_asprintf_append(result, "STREAM_SIZE|");
     890        1070 :         if (filter & FILE_NOTIFY_CHANGE_STREAM_WRITE)
     891          28 :                 result = talloc_asprintf_append(result, "STREAM_WRITE|");
     892             : 
     893        1070 :         if (result == NULL) return NULL;
     894        1070 :         if (*result == '\0') return result;
     895             : 
     896         506 :         result[strlen(result)-1] = '\0';
     897         506 :         return result;
     898             : }
     899             : 
     900           0 : struct sys_notify_context *sys_notify_context_create(TALLOC_CTX *mem_ctx,
     901             :                                                      struct tevent_context *ev)
     902             : {
     903             :         struct sys_notify_context *ctx;
     904             : 
     905           0 :         if (!(ctx = talloc(mem_ctx, struct sys_notify_context))) {
     906           0 :                 DEBUG(0, ("talloc failed\n"));
     907           0 :                 return NULL;
     908             :         }
     909             : 
     910           0 :         ctx->ev = ev;
     911           0 :         ctx->private_data = NULL;
     912           0 :         return ctx;
     913             : }

Generated by: LCOV version 1.13