LCOV - code coverage report
Current view: top level - source3/smbd - smb2_ioctl_network_fs.c (source / functions) Hit Total Coverage
Test: coverage report for master 6248eab5 Lines: 240 329 72.9 %
Date: 2021-08-25 13:27:56 Functions: 11 17 64.7 %

          Line data    Source code
       1             : /*
       2             :    Unix SMB/CIFS implementation.
       3             :    Core SMB2 server
       4             : 
       5             :    Copyright (C) Stefan Metzmacher 2009
       6             :    Copyright (C) David Disseldorp 2012
       7             : 
       8             :    This program is free software; you can redistribute it and/or modify
       9             :    it under the terms of the GNU General Public License as published by
      10             :    the Free Software Foundation; either version 3 of the License, or
      11             :    (at your option) any later version.
      12             : 
      13             :    This program is distributed in the hope that it will be useful,
      14             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      15             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      16             :    GNU General Public License for more details.
      17             : 
      18             :    You should have received a copy of the GNU General Public License
      19             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      20             : */
      21             : 
      22             : #include "includes.h"
      23             : #include "smbd/smbd.h"
      24             : #include "smbd/globals.h"
      25             : #include "../libcli/smb/smb_common.h"
      26             : #include "../libcli/security/security.h"
      27             : #include "../lib/util/tevent_ntstatus.h"
      28             : #include "include/ntioctl.h"
      29             : #include "../librpc/ndr/libndr.h"
      30             : #include "librpc/gen_ndr/ndr_ioctl.h"
      31             : #include "smb2_ioctl_private.h"
      32             : #include "../lib/tsocket/tsocket.h"
      33             : #include "lib/messages_ctdb.h"
      34             : #include "ctdbd_conn.h"
      35             : 
      36             : #undef DBGC_CLASS
      37             : #define DBGC_CLASS DBGC_SMB2
      38             : 
      39          12 : static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
      40             : {
      41          12 :         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
      42          12 :         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
      43          12 :         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
      44          12 : }
      45             : 
      46         220 : static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
      47             : {
      48             :         uint32_t i;
      49         220 :         uint32_t total_len = 0;
      50             : 
      51             :         /*
      52             :          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
      53             :          * Send and invalid parameter response if:
      54             :          * - The ChunkCount value is greater than
      55             :          *   ServerSideCopyMaxNumberofChunks
      56             :          */
      57         220 :         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
      58           0 :                 return NT_STATUS_INVALID_PARAMETER;
      59             :         }
      60             : 
      61         448 :         for (i = 0; i < cc_copy->chunk_count; i++) {
      62             :                 /*
      63             :                  * - The Length value in a single chunk is greater than
      64             :                  *   ServerSideCopyMaxChunkSize or equal to zero.
      65             :                  */
      66         240 :                 if ((cc_copy->chunks[i].length == 0)
      67         234 :                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
      68          12 :                         return NT_STATUS_INVALID_PARAMETER;
      69             :                 }
      70         228 :                 total_len += cc_copy->chunks[i].length;
      71             :         }
      72             :         /*
      73             :          * - Sum of Lengths in all chunks is greater than
      74             :          *   ServerSideCopyMaxDataSize
      75             :          */
      76         208 :         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
      77           0 :                 return NT_STATUS_INVALID_PARAMETER;
      78             :         }
      79             : 
      80         208 :         return NT_STATUS_OK;
      81             : }
      82             : 
      83             : struct fsctl_srv_copychunk_state {
      84             :         struct tevent_context *ev;
      85             :         struct connection_struct *conn;
      86             :         struct srv_copychunk_copy cc_copy;
      87             :         uint32_t current_chunk;
      88             :         NTSTATUS status;
      89             :         off_t total_written;
      90             :         uint32_t ctl_code;
      91             :         DATA_BLOB token;
      92             :         struct files_struct *src_fsp;
      93             :         struct files_struct *dst_fsp;
      94             :         enum {
      95             :                 COPYCHUNK_OUT_EMPTY = 0,
      96             :                 COPYCHUNK_OUT_LIMITS,
      97             :                 COPYCHUNK_OUT_RSP,
      98             :         } out_data;
      99             : };
     100             : static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
     101             : 
     102             : static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
     103             : 
     104         226 : static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
     105             :                                                    struct tevent_context *ev,
     106             :                                                    uint32_t ctl_code,
     107             :                                                    struct files_struct *dst_fsp,
     108             :                                                    DATA_BLOB *in_input,
     109             :                                                    size_t in_max_output,
     110             :                                                    struct smbd_smb2_request *smb2req)
     111             : {
     112         226 :         struct tevent_req *req = NULL;
     113         226 :         struct fsctl_srv_copychunk_state *state = NULL;
     114             :         enum ndr_err_code ndr_ret;
     115             :         NTSTATUS status;
     116             : 
     117             :         /* handler for both copy-chunk variants */
     118         226 :         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
     119             :                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
     120             : 
     121         226 :         req = tevent_req_create(mem_ctx, &state,
     122             :                                 struct fsctl_srv_copychunk_state);
     123         226 :         if (req == NULL) {
     124           0 :                 return NULL;
     125             :         }
     126         452 :         *state = (struct fsctl_srv_copychunk_state) {
     127         226 :                 .conn = dst_fsp->conn,
     128             :                 .ev = ev,
     129             :                 .ctl_code = ctl_code,
     130             :                 .dst_fsp = dst_fsp,
     131             :         };
     132             : 
     133         226 :         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
     134           6 :                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
     135             :                           "response %lu\n", (int)in_max_output,
     136             :                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
     137           6 :                 state->status = NT_STATUS_INVALID_PARAMETER;
     138           6 :                 tevent_req_nterror(req, state->status);
     139           6 :                 return tevent_req_post(req, ev);
     140             :         }
     141             : 
     142         220 :         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
     143             :                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
     144         220 :         if (ndr_ret != NDR_ERR_SUCCESS) {
     145           0 :                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
     146           0 :                 state->status = NT_STATUS_INVALID_PARAMETER;
     147           0 :                 tevent_req_nterror(req, state->status);
     148           0 :                 return tevent_req_post(req, ev);
     149             :         }
     150             : 
     151         220 :         state->token = data_blob_const(state->cc_copy.source_key,
     152             :                                        sizeof(state->cc_copy.source_key));
     153             : 
     154         220 :         state->status = copychunk_check_limits(&state->cc_copy);
     155         220 :         if (!NT_STATUS_IS_OK(state->status)) {
     156          12 :                 DEBUG(3, ("copy chunk req exceeds limits\n"));
     157          12 :                 state->out_data = COPYCHUNK_OUT_LIMITS;
     158          12 :                 tevent_req_nterror(req, state->status);
     159          12 :                 return tevent_req_post(req, ev);
     160             :         }
     161             : 
     162             :         /* any errors from here onwards should carry copychunk response data */
     163         208 :         state->out_data = COPYCHUNK_OUT_RSP;
     164             : 
     165         208 :         status = fsctl_srv_copychunk_loop(req);
     166         208 :         if (tevent_req_nterror(req, status)) {
     167           0 :                 return tevent_req_post(req, ev);
     168             :         }
     169             : 
     170         208 :         return req;
     171             : }
     172             : 
     173         244 : static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
     174             : {
     175         244 :         struct fsctl_srv_copychunk_state *state = tevent_req_data(
     176             :                 req, struct fsctl_srv_copychunk_state);
     177         244 :         struct tevent_req *subreq = NULL;
     178         244 :         uint32_t length = 0;
     179         244 :         off_t source_off = 0;
     180         244 :         off_t target_off = 0;
     181             : 
     182             :         /*
     183             :          * chunk_count can be 0 which must either just do nothing returning
     184             :          * success saying number of copied chunks is 0 (verified against
     185             :          * Windows).
     186             :          *
     187             :          * Or it can be a special macOS copyfile request, so we send this into
     188             :          * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
     189             :          */
     190         244 :         if (state->cc_copy.chunk_count > 0) {
     191         228 :                 struct srv_copychunk *chunk = NULL;
     192             : 
     193         228 :                 chunk = &state->cc_copy.chunks[state->current_chunk];
     194         228 :                 length = chunk->length;
     195         228 :                 source_off = chunk->source_off;
     196         228 :                 target_off = chunk->target_off;
     197             :         }
     198             : 
     199         244 :         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
     200             :                                          state,
     201             :                                          state->ev,
     202             :                                          state->ctl_code,
     203             :                                          &state->token,
     204             :                                          source_off,
     205             :                                          state->dst_fsp,
     206             :                                          target_off,
     207             :                                          length);
     208         244 :         if (tevent_req_nomem(subreq, req)) {
     209           0 :                 return NT_STATUS_NO_MEMORY;
     210             :         }
     211         244 :         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
     212             : 
     213         244 :         return NT_STATUS_OK;
     214             : }
     215             : 
     216         244 : static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
     217             : {
     218         244 :         struct tevent_req *req = tevent_req_callback_data(
     219             :                 subreq, struct tevent_req);
     220         244 :         struct fsctl_srv_copychunk_state *state = tevent_req_data(
     221             :                 req, struct fsctl_srv_copychunk_state);
     222             :         off_t chunk_nwritten;
     223             :         NTSTATUS status;
     224             : 
     225         244 :         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
     226             :                                          &chunk_nwritten);
     227         244 :         TALLOC_FREE(subreq);
     228         244 :         if (!NT_STATUS_IS_OK(status)) {
     229          54 :                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
     230             :                         nt_errstr(status),
     231             :                         (unsigned int)state->current_chunk,
     232             :                         (unsigned int)state->cc_copy.chunk_count);
     233          54 :                 tevent_req_nterror(req, status);
     234          54 :                 return;
     235             :         }
     236             : 
     237         190 :         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
     238             :                   (unsigned int)state->current_chunk,
     239             :                   (unsigned int)state->cc_copy.chunk_count);
     240         190 :         state->total_written += chunk_nwritten;
     241             : 
     242         190 :         if (state->cc_copy.chunk_count == 0) {
     243             :                 /*
     244             :                  * This must not produce an error but just return a chunk count
     245             :                  * of 0 in the response.
     246             :                  */
     247          16 :                 tevent_req_done(req);
     248          16 :                 return;
     249             :         }
     250             : 
     251         174 :         state->current_chunk++;
     252         174 :         if (state->current_chunk == state->cc_copy.chunk_count) {
     253         138 :                 tevent_req_done(req);
     254         138 :                 return;
     255             :         }
     256             : 
     257          36 :         status = fsctl_srv_copychunk_loop(req);
     258          36 :         if (tevent_req_nterror(req, status)) {
     259           0 :                 return;
     260             :         }
     261             : }
     262             : 
     263         226 : static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
     264             :                                          struct srv_copychunk_rsp *cc_rsp,
     265             :                                          bool *pack_rsp)
     266             : {
     267         226 :         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
     268             :                                         struct fsctl_srv_copychunk_state);
     269             :         NTSTATUS status;
     270             : 
     271         226 :         switch (state->out_data) {
     272           6 :         case COPYCHUNK_OUT_EMPTY:
     273           6 :                 *pack_rsp = false;
     274           6 :                 break;
     275          12 :         case COPYCHUNK_OUT_LIMITS:
     276             :                 /* 2.2.32.1 - send back our maximum transfer size limits */
     277          12 :                 copychunk_pack_limits(cc_rsp);
     278          12 :                 *pack_rsp = true;
     279          12 :                 break;
     280         208 :         case COPYCHUNK_OUT_RSP:
     281         208 :                 cc_rsp->chunks_written = state->current_chunk;
     282         208 :                 cc_rsp->chunk_bytes_written = 0;
     283         208 :                 cc_rsp->total_bytes_written = state->total_written;
     284         208 :                 *pack_rsp = true;
     285         208 :                 break;
     286           0 :         default:        /* not reached */
     287             :                 assert(1);
     288           0 :                 break;
     289             :         }
     290         226 :         status = tevent_req_simple_recv_ntstatus(req);
     291         226 :         return status;
     292             : }
     293             : 
     294             : struct cluster_movable_ips {
     295             :         uint32_t array_len;
     296             :         uint32_t array_index;
     297             :         struct sockaddr_storage *ips;
     298             : };
     299             : 
     300           0 : static int stash_cluster_movable_ips(uint32_t total_ip_count,
     301             :                                      const struct sockaddr_storage *ip,
     302             :                                      bool is_movable_ip,
     303             :                                      void *private_data)
     304             : {
     305           0 :         struct cluster_movable_ips *cluster_movable_ips
     306             :                 = talloc_get_type_abort(private_data,
     307             :                                         struct cluster_movable_ips);
     308             : 
     309           0 :         if (!is_movable_ip) {
     310           0 :                 return 0;
     311             :         }
     312             : 
     313           0 :         if (cluster_movable_ips->array_len == 0) {
     314           0 :                 SMB_ASSERT(total_ip_count < INT_MAX);
     315             :                 cluster_movable_ips->ips
     316           0 :                         = talloc_zero_array(cluster_movable_ips,
     317             :                                             struct sockaddr_storage,
     318             :                                             total_ip_count);
     319           0 :                 if (cluster_movable_ips->ips == NULL) {
     320           0 :                         return ENOMEM;
     321             :                 }
     322           0 :                 cluster_movable_ips->array_len = total_ip_count;
     323             :         }
     324             : 
     325           0 :         SMB_ASSERT(cluster_movable_ips->array_index
     326             :                                         < cluster_movable_ips->array_len);
     327             : 
     328           0 :         cluster_movable_ips->ips[cluster_movable_ips->array_index] = *ip;
     329           0 :         cluster_movable_ips->array_index++;
     330             : 
     331           0 :         return 0;
     332             : }
     333             : 
     334           0 : static bool find_in_cluster_movable_ips(
     335             :                 struct cluster_movable_ips *cluster_movable_ips,
     336             :                 const struct sockaddr_storage *ifss)
     337             : {
     338           0 :         struct samba_sockaddr srv_ip = {
     339             :                 .u = {
     340             :                         .ss = *ifss,
     341             :                 },
     342             :         };
     343             :         uint32_t i;
     344             : 
     345           0 :         for (i = 0; i < cluster_movable_ips->array_index; i++) {
     346           0 :                 struct samba_sockaddr pub_ip = {
     347             :                         .u = {
     348           0 :                                 .ss = cluster_movable_ips->ips[i],
     349             :                         },
     350             :                 };
     351           0 :                 if (sockaddr_equal(&pub_ip.u.sa, &srv_ip.u.sa)) {
     352           0 :                         return true;
     353             :                 }
     354             :         }
     355           0 :         return false;
     356             : }
     357             : 
     358          42 : static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
     359             :                                          struct tevent_context *ev,
     360             :                                          struct smbXsrv_connection *xconn,
     361             :                                          DATA_BLOB *in_input,
     362             :                                          uint32_t in_max_output,
     363             :                                          DATA_BLOB *out_output)
     364             : {
     365          42 :         struct fsctl_net_iface_info *array = NULL;
     366          42 :         struct fsctl_net_iface_info *first = NULL;
     367          42 :         struct fsctl_net_iface_info *last = NULL;
     368             :         size_t i;
     369          42 :         size_t num_ifaces = iface_count();
     370             :         enum ndr_err_code ndr_err;
     371          42 :         struct cluster_movable_ips *cluster_movable_ips = NULL;
     372             :         int ret;
     373             : 
     374          42 :         if (in_input->length != 0) {
     375           0 :                 return NT_STATUS_INVALID_PARAMETER;
     376             :         }
     377             : 
     378          42 :         *out_output = data_blob_null;
     379             : 
     380          42 :         array = talloc_zero_array(mem_ctx,
     381             :                                   struct fsctl_net_iface_info,
     382             :                                   num_ifaces);
     383          42 :         if (array == NULL) {
     384           0 :                 return NT_STATUS_NO_MEMORY;
     385             :         }
     386             : 
     387          42 :         if (lp_clustering()) {
     388           0 :                 cluster_movable_ips = talloc_zero(array,
     389             :                                                   struct cluster_movable_ips);
     390           0 :                 if (cluster_movable_ips == NULL) {
     391           0 :                         TALLOC_FREE(array);
     392           0 :                         return NT_STATUS_NO_MEMORY;
     393             :                 }
     394           0 :                 ret = ctdbd_public_ip_foreach(messaging_ctdb_connection(),
     395             :                                               stash_cluster_movable_ips,
     396             :                                               cluster_movable_ips);
     397           0 :                 if (ret != 0) {
     398           0 :                         TALLOC_FREE(array);
     399           0 :                         return NT_STATUS_INTERNAL_ERROR;
     400             :                 }
     401             :         }
     402             : 
     403         126 :         for (i=0; i < num_ifaces; i++) {
     404          84 :                 struct fsctl_net_iface_info *cur = &array[i];
     405          84 :                 const struct interface *iface = get_interface(i);
     406          84 :                 const struct sockaddr_storage *ifss = &iface->ip;
     407          84 :                 const void *ifptr = ifss;
     408          84 :                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
     409          84 :                 struct tsocket_address *a = NULL;
     410             :                 char *addr;
     411             :                 bool ok;
     412             : 
     413          84 :                 ret = tsocket_address_bsd_from_sockaddr(array,
     414             :                                         ifsa, sizeof(struct sockaddr_storage),
     415             :                                         &a);
     416          84 :                 if (ret != 0) {
     417           0 :                         NTSTATUS status = map_nt_error_from_unix_common(errno);
     418           0 :                         TALLOC_FREE(array);
     419           0 :                         return status;
     420             :                 }
     421             : 
     422          84 :                 ok = tsocket_address_is_inet(a, "ip");
     423          84 :                 if (!ok) {
     424           0 :                         continue;
     425             :                 }
     426             : 
     427          84 :                 addr = tsocket_address_inet_addr_string(a, array);
     428          84 :                 if (addr == NULL) {
     429           0 :                         TALLOC_FREE(array);
     430           0 :                         return NT_STATUS_NO_MEMORY;
     431             :                 }
     432             : 
     433          84 :                 if (cluster_movable_ips != NULL) {
     434           0 :                         bool is_movable_ip = find_in_cluster_movable_ips(
     435             :                                                 cluster_movable_ips,
     436             :                                                 ifss);
     437           0 :                         if (is_movable_ip) {
     438           0 :                                 DBG_DEBUG("Interface [%s] - "
     439             :                                           "has movable public ip - "
     440             :                                           "skipping address [%s].\n",
     441             :                                           iface->name, addr);
     442           0 :                                 continue;
     443             :                         }
     444             :                 }
     445             : 
     446          84 :                 cur->ifindex = iface->if_index;
     447          84 :                 if (cur->ifindex == 0) {
     448             :                         /*
     449             :                          * Did not get interface index from kernel,
     450             :                          * nor from the config. ==> Apply a common
     451             :                          * default value for these cases.
     452             :                          */
     453          84 :                         cur->ifindex = UINT32_MAX;
     454             :                 }
     455          84 :                 cur->capability = iface->capability;
     456          84 :                 cur->linkspeed = iface->linkspeed;
     457          84 :                 if (cur->linkspeed == 0) {
     458           0 :                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
     459             :                                   "address [%s].\n", iface->name, addr);
     460           0 :                         continue;
     461             :                 }
     462             : 
     463          84 :                 ok = tsocket_address_is_inet(a, "ipv4");
     464          84 :                 if (ok) {
     465          42 :                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
     466          42 :                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
     467             :                 }
     468          84 :                 ok = tsocket_address_is_inet(a, "ipv6");
     469          84 :                 if (ok) {
     470          42 :                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
     471          42 :                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
     472             :                 }
     473             : 
     474          84 :                 if (first == NULL) {
     475          42 :                         first = cur;
     476             :                 }
     477          84 :                 if (last != NULL) {
     478          42 :                         last->next = cur;
     479             :                 }
     480          84 :                 last = cur;
     481             :         }
     482             : 
     483          42 :         if (first == NULL) {
     484           0 :                 TALLOC_FREE(array);
     485           0 :                 return NT_STATUS_OK;
     486             :         }
     487             : 
     488          42 :         if (DEBUGLEVEL >= 10) {
     489           0 :                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
     490             :         }
     491             : 
     492          42 :         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
     493             :                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
     494          42 :         TALLOC_FREE(array);
     495          42 :         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
     496           0 :                 return ndr_map_error2ntstatus(ndr_err);
     497             :         }
     498             : 
     499          42 :         return NT_STATUS_OK;
     500             : }
     501             : 
     502        2783 : static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
     503             :                                         struct tevent_context *ev,
     504             :                                         struct smbXsrv_connection *conn,
     505             :                                         DATA_BLOB *in_input,
     506             :                                         uint32_t in_max_output,
     507             :                                         DATA_BLOB *out_output,
     508             :                                         bool *disconnect)
     509             : {
     510             :         uint32_t in_capabilities;
     511             :         DATA_BLOB in_guid_blob;
     512             :         struct GUID in_guid;
     513             :         uint16_t in_security_mode;
     514             :         uint16_t in_num_dialects;
     515             :         uint16_t dialect;
     516        2783 :         struct GUID_ndr_buf out_guid_buf = { .buf = {0}, };
     517             :         NTSTATUS status;
     518        2783 :         enum protocol_types protocol = PROTOCOL_NONE;
     519             : 
     520        2783 :         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
     521             :                 /*
     522             :                  * With SMB 2.02 we didn't get the
     523             :                  * capabitities, client guid, security mode
     524             :                  * and dialects the client would have offered.
     525             :                  *
     526             :                  * So we behave compatible with a true
     527             :                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
     528             :                  *
     529             :                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
     530             :                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
     531             :                  * starting with SMB 2.10, while Windows only supports
     532             :                  * it starting with SMB > 2.10.
     533             :                  */
     534          64 :                 return NT_STATUS_FILE_CLOSED;
     535             :         }
     536             : 
     537        2719 :         if (in_input->length < 0x18) {
     538           0 :                 return NT_STATUS_INVALID_PARAMETER;
     539             :         }
     540             : 
     541        2719 :         in_capabilities = IVAL(in_input->data, 0x00);
     542        2719 :         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
     543        2719 :         in_security_mode = SVAL(in_input->data, 0x14);
     544        2719 :         in_num_dialects = SVAL(in_input->data, 0x16);
     545             : 
     546        2719 :         if (in_input->length < (0x18 + in_num_dialects*2)) {
     547           0 :                 return NT_STATUS_INVALID_PARAMETER;
     548             :         }
     549             : 
     550        2719 :         if (in_max_output < 0x18) {
     551           0 :                 return NT_STATUS_BUFFER_TOO_SMALL;
     552             :         }
     553             : 
     554        2719 :         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
     555        2719 :         if (!NT_STATUS_IS_OK(status)) {
     556           0 :                 return status;
     557             :         }
     558             : 
     559             :         /*
     560             :          * From: [MS-SMB2]
     561             :          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
     562             :          *
     563             :          * The server MUST determine the greatest common dialect
     564             :          * between the dialects it implements and the Dialects array
     565             :          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
     566             :          * matched, or if the value is not equal to Connection.Dialect,
     567             :          * the server MUST terminate the transport connection
     568             :          * and free the Connection object.
     569             :          */
     570        2719 :         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
     571             :                                                     in_num_dialects,
     572             :                                                     &dialect);
     573        2719 :         if (conn->protocol != protocol) {
     574           0 :                 *disconnect = true;
     575           0 :                 return NT_STATUS_ACCESS_DENIED;
     576             :         }
     577             : 
     578        2719 :         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
     579           0 :                 *disconnect = true;
     580           0 :                 return NT_STATUS_ACCESS_DENIED;
     581             :         }
     582             : 
     583        2719 :         if (in_security_mode != conn->smb2.client.security_mode) {
     584           0 :                 *disconnect = true;
     585           0 :                 return NT_STATUS_ACCESS_DENIED;
     586             :         }
     587             : 
     588        2719 :         if (in_capabilities != conn->smb2.client.capabilities) {
     589           0 :                 *disconnect = true;
     590           0 :                 return NT_STATUS_ACCESS_DENIED;
     591             :         }
     592             : 
     593        2719 :         status = GUID_to_ndr_buf(&conn->smb2.server.guid, &out_guid_buf);
     594        2719 :         if (!NT_STATUS_IS_OK(status)) {
     595           0 :                 return status;
     596             :         }
     597             : 
     598        2719 :         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
     599        2719 :         if (out_output->data == NULL) {
     600           0 :                 return NT_STATUS_NO_MEMORY;
     601             :         }
     602             : 
     603        2719 :         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
     604        2719 :         memcpy(out_output->data+0x04, out_guid_buf.buf, 16);
     605        2719 :         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
     606        2719 :         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
     607             : 
     608        2719 :         return NT_STATUS_OK;
     609             : }
     610             : 
     611             : static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
     612             : static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
     613             : 
     614        4691 : struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
     615             :                                          struct tevent_context *ev,
     616             :                                          struct tevent_req *req,
     617             :                                          struct smbd_smb2_ioctl_state *state)
     618             : {
     619             :         struct tevent_req *subreq;
     620             :         NTSTATUS status;
     621             : 
     622        4691 :         switch (ctl_code) {
     623             :         /*
     624             :          * [MS-SMB2] 2.2.31
     625             :          * FSCTL_SRV_COPYCHUNK is issued when a handle has
     626             :          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
     627             :          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
     628             :          * FILE_WRITE_DATA access.
     629             :          */
     630         226 :         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
     631             :         case FSCTL_SRV_COPYCHUNK:
     632         678 :                 subreq = fsctl_srv_copychunk_send(state, ev,
     633             :                                                   ctl_code,
     634         226 :                                                   state->fsp,
     635             :                                                   &state->in_input,
     636         226 :                                                   state->in_max_output,
     637             :                                                   state->smb2req);
     638         226 :                 if (tevent_req_nomem(subreq, req)) {
     639           0 :                         return tevent_req_post(req, ev);
     640             :                 }
     641         226 :                 tevent_req_set_callback(subreq,
     642             :                                         smb2_ioctl_network_fs_copychunk_done,
     643             :                                         req);
     644         226 :                 return req;
     645             :                 break;
     646          42 :         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
     647          42 :                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
     648             :                 {
     649           0 :                         if (IS_IPC(state->smbreq->conn)) {
     650           0 :                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
     651             :                         } else {
     652           0 :                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
     653             :                         }
     654             : 
     655           0 :                         tevent_req_nterror(req, status);
     656           0 :                         return tevent_req_post(req, ev);
     657             :                 }
     658             : 
     659          84 :                 status = fsctl_network_iface_info(state, ev,
     660          42 :                                                   state->smbreq->xconn,
     661             :                                                   &state->in_input,
     662             :                                                   state->in_max_output,
     663             :                                                   &state->out_output);
     664          42 :                 if (!tevent_req_nterror(req, status)) {
     665          42 :                         tevent_req_done(req);
     666             :                 }
     667          42 :                 return tevent_req_post(req, ev);
     668             :                 break;
     669        2783 :         case FSCTL_VALIDATE_NEGOTIATE_INFO:
     670        5566 :                 status = fsctl_validate_neg_info(state, ev,
     671        2783 :                                                  state->smbreq->xconn,
     672             :                                                  &state->in_input,
     673             :                                                  state->in_max_output,
     674             :                                                  &state->out_output,
     675             :                                                  &state->disconnect);
     676        2783 :                 if (!tevent_req_nterror(req, status)) {
     677        2719 :                         tevent_req_done(req);
     678             :                 }
     679        2783 :                 return tevent_req_post(req, ev);
     680             :                 break;
     681         220 :         case FSCTL_SRV_REQUEST_RESUME_KEY:
     682         220 :                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
     683             :                                                    ev,
     684             :                                                    state->fsp,
     685             :                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
     686             :                                                    0, 0, 0);
     687         220 :                 if (tevent_req_nomem(subreq, req)) {
     688           0 :                         return tevent_req_post(req, ev);
     689             :                 }
     690         220 :                 tevent_req_set_callback(
     691             :                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
     692         220 :                 return req;
     693             : 
     694        1420 :         default: {
     695        1420 :                 uint8_t *out_data = NULL;
     696        1420 :                 uint32_t out_data_len = 0;
     697             : 
     698        1420 :                 if (state->fsp == NULL) {
     699           0 :                         status = NT_STATUS_NOT_SUPPORTED;
     700             :                 } else {
     701        1420 :                         status = SMB_VFS_FSCTL(state->fsp,
     702             :                                                state,
     703             :                                                ctl_code,
     704             :                                                state->smbreq->flags2,
     705             :                                                state->in_input.data,
     706             :                                                state->in_input.length,
     707             :                                                &out_data,
     708             :                                                state->in_max_output,
     709             :                                                &out_data_len);
     710        1420 :                         state->out_output = data_blob_const(out_data, out_data_len);
     711        1420 :                         if (NT_STATUS_IS_OK(status)) {
     712        1242 :                                 tevent_req_done(req);
     713        1242 :                                 return tevent_req_post(req, ev);
     714             :                         }
     715             :                 }
     716             : 
     717         178 :                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
     718         178 :                         if (IS_IPC(state->smbreq->conn)) {
     719           0 :                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
     720             :                         } else {
     721         178 :                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
     722             :                         }
     723             :                 }
     724             : 
     725         178 :                 tevent_req_nterror(req, status);
     726         178 :                 return tevent_req_post(req, ev);
     727             :                 break;
     728             :         }
     729             :         }
     730             : 
     731             :         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
     732             :         return tevent_req_post(req, ev);
     733             : }
     734             : 
     735         226 : static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
     736             : {
     737         226 :         struct tevent_req *req = tevent_req_callback_data(subreq,
     738             :                                                           struct tevent_req);
     739         226 :         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
     740             :                                                 struct smbd_smb2_ioctl_state);
     741             :         struct srv_copychunk_rsp cc_rsp;
     742             :         NTSTATUS status;
     743         226 :         bool pack_rsp = false;
     744             : 
     745         226 :         ZERO_STRUCT(cc_rsp);
     746         226 :         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
     747         226 :         TALLOC_FREE(subreq);
     748         226 :         if (pack_rsp == true) {
     749             :                 enum ndr_err_code ndr_ret;
     750         220 :                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
     751             :                                                ioctl_state,
     752             :                                                &cc_rsp,
     753             :                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
     754         220 :                 if (ndr_ret != NDR_ERR_SUCCESS) {
     755           0 :                         status = NT_STATUS_INTERNAL_ERROR;
     756             :                 }
     757             :         }
     758             : 
     759         226 :         if (!tevent_req_nterror(req, status)) {
     760         154 :                 tevent_req_done(req);
     761             :         }
     762         226 : }
     763             : 
     764         220 : static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
     765             : {
     766         220 :         struct tevent_req *req = tevent_req_callback_data(
     767             :                 subreq, struct tevent_req);
     768         220 :         struct smbd_smb2_ioctl_state *state = tevent_req_data(
     769             :                 req, struct smbd_smb2_ioctl_state);
     770             :         struct req_resume_key_rsp rkey_rsp;
     771             :         enum ndr_err_code ndr_ret;
     772             :         DATA_BLOB token;
     773             :         NTSTATUS status;
     774             : 
     775         220 :         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
     776             :                                            state->fsp->conn,
     777             :                                            state,
     778             :                                            &token);
     779         220 :         TALLOC_FREE(subreq);
     780         220 :         if (tevent_req_nterror(req, status)) {
     781           0 :                 return;
     782             :         }
     783             : 
     784         220 :         if (token.length != sizeof(rkey_rsp.resume_key)) {
     785           0 :                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
     786           0 :                 return;
     787             :         }
     788             : 
     789         220 :         ZERO_STRUCT(rkey_rsp);
     790         220 :         memcpy(rkey_rsp.resume_key, token.data, token.length);
     791             : 
     792         220 :         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
     793             :                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
     794         220 :         if (ndr_ret != NDR_ERR_SUCCESS) {
     795           0 :                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
     796           0 :                 return;
     797             :         }
     798             : 
     799         220 :         tevent_req_done(req);
     800         220 :         return;
     801             : }

Generated by: LCOV version 1.13