source: vendor/3.6.0/source3/smbd/smb2_write.c

Last change on this file was 740, checked in by Silvan Scherrer, 13 years ago

Samba Server: update vendor to 3.6.0
File size: 11.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "smbd/smbd.h"
23#include "smbd/globals.h"
24#include "../libcli/smb/smb_common.h"
25#include "../lib/util/tevent_ntstatus.h"
26#include "rpc_server/srv_pipe_hnd.h"
27
28static struct tevent_req *smbd_smb2_write_send(TALLOC_CTX *mem_ctx,
29 struct tevent_context *ev,
30 struct smbd_smb2_request *smb2req,
31 uint32_t in_smbpid,
32 uint64_t in_file_id_volatile,
33 DATA_BLOB in_data,
34 uint64_t in_offset,
35 uint32_t in_flags);
36static NTSTATUS smbd_smb2_write_recv(struct tevent_req *req,
37 uint32_t *out_count);
38
39static void smbd_smb2_request_write_done(struct tevent_req *subreq);
40NTSTATUS smbd_smb2_request_process_write(struct smbd_smb2_request *req)
41{
42 const uint8_t *inhdr;
43 const uint8_t *inbody;
44 int i = req->current_idx;
45 size_t expected_body_size = 0x31;
46 size_t body_size;
47 uint32_t in_smbpid;
48 uint16_t in_data_offset;
49 uint32_t in_data_length;
50 DATA_BLOB in_data_buffer;
51 uint64_t in_offset;
52 uint64_t in_file_id_persistent;
53 uint64_t in_file_id_volatile;
54 uint32_t in_flags;
55 struct tevent_req *subreq;
56
57 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
58 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
59 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
60 }
61
62 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
63
64 body_size = SVAL(inbody, 0x00);
65 if (body_size != expected_body_size) {
66 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
67 }
68
69 in_smbpid = IVAL(inhdr, SMB2_HDR_PID);
70
71 in_data_offset = SVAL(inbody, 0x02);
72 in_data_length = IVAL(inbody, 0x04);
73 in_offset = BVAL(inbody, 0x08);
74 in_file_id_persistent = BVAL(inbody, 0x10);
75 in_file_id_volatile = BVAL(inbody, 0x18);
76 in_flags = IVAL(inbody, 0x2C);
77
78 if (in_data_offset != (SMB2_HDR_BODY + (body_size & 0xFFFFFFFE))) {
79 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
80 }
81
82 if (in_data_length > req->in.vector[i+2].iov_len) {
83 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
84 }
85
86 /* check the max write size */
87 if (in_data_length > lp_smb2_max_write()) {
88 /* This is a warning. */
89 DEBUG(2,("smbd_smb2_request_process_write : "
90 "client ignored max write :%s: 0x%08X: 0x%08X\n",
91 __location__, in_data_length, lp_smb2_max_write()));
92#if 0
93 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
94#endif
95 }
96
97 in_data_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
98 in_data_buffer.length = in_data_length;
99
100 if (req->compat_chain_fsp) {
101 /* skip check */
102 } else if (in_file_id_persistent != in_file_id_volatile) {
103 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
104 }
105
106 subreq = smbd_smb2_write_send(req,
107 req->sconn->smb2.event_ctx,
108 req,
109 in_smbpid,
110 in_file_id_volatile,
111 in_data_buffer,
112 in_offset,
113 in_flags);
114 if (subreq == NULL) {
115 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
116 }
117 tevent_req_set_callback(subreq, smbd_smb2_request_write_done, req);
118
119 return smbd_smb2_request_pending_queue(req, subreq);
120}
121
122static void smbd_smb2_request_write_done(struct tevent_req *subreq)
123{
124 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
125 struct smbd_smb2_request);
126 int i = req->current_idx;
127 uint8_t *outhdr;
128 DATA_BLOB outbody;
129 DATA_BLOB outdyn;
130 uint32_t out_count = 0;
131 NTSTATUS status;
132 NTSTATUS error; /* transport error */
133
134 status = smbd_smb2_write_recv(subreq, &out_count);
135 TALLOC_FREE(subreq);
136 if (!NT_STATUS_IS_OK(status)) {
137 error = smbd_smb2_request_error(req, status);
138 if (!NT_STATUS_IS_OK(error)) {
139 smbd_server_connection_terminate(req->sconn,
140 nt_errstr(error));
141 return;
142 }
143 return;
144 }
145
146 outhdr = (uint8_t *)req->out.vector[i].iov_base;
147
148 outbody = data_blob_talloc(req->out.vector, NULL, 0x10);
149 if (outbody.data == NULL) {
150 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
151 if (!NT_STATUS_IS_OK(error)) {
152 smbd_server_connection_terminate(req->sconn,
153 nt_errstr(error));
154 return;
155 }
156 return;
157 }
158
159 SSVAL(outbody.data, 0x00, 0x10 + 1); /* struct size */
160 SSVAL(outbody.data, 0x02, 0); /* reserved */
161 SIVAL(outbody.data, 0x04, out_count); /* count */
162 SIVAL(outbody.data, 0x08, 0); /* remaining */
163 SSVAL(outbody.data, 0x0C, 0); /* write channel info offset */
164 SSVAL(outbody.data, 0x0E, 0); /* write channel info length */
165
166 outdyn = data_blob_const(NULL, 0);
167
168 error = smbd_smb2_request_done(req, outbody, &outdyn);
169 if (!NT_STATUS_IS_OK(error)) {
170 smbd_server_connection_terminate(req->sconn, nt_errstr(error));
171 return;
172 }
173}
174
175struct smbd_smb2_write_state {
176 struct smbd_smb2_request *smb2req;
177 files_struct *fsp;
178 bool write_through;
179 uint32_t in_length;
180 uint64_t in_offset;
181 uint32_t out_count;
182};
183
184static void smbd_smb2_write_pipe_done(struct tevent_req *subreq);
185
186NTSTATUS smb2_write_complete(struct tevent_req *req, ssize_t nwritten, int err)
187{
188 NTSTATUS status;
189 struct smbd_smb2_write_state *state = tevent_req_data(req,
190 struct smbd_smb2_write_state);
191 files_struct *fsp = state->fsp;
192
193 DEBUG(3,("smb2: fnum=[%d/%s] "
194 "length=%lu offset=%lu wrote=%lu\n",
195 fsp->fnum,
196 fsp_str_dbg(fsp),
197 (unsigned long)state->in_length,
198 (unsigned long)state->in_offset,
199 (unsigned long)nwritten));
200
201 if (nwritten == -1) {
202 return map_nt_error_from_unix(err);
203 }
204
205 if ((nwritten == 0) && (state->in_length != 0)) {
206 DEBUG(5,("smb2: write [%s] disk full\n",
207 fsp_str_dbg(fsp)));
208 return NT_STATUS_DISK_FULL;
209 }
210
211 status = sync_file(fsp->conn, fsp, state->write_through);
212 if (!NT_STATUS_IS_OK(status)) {
213 DEBUG(5,("smb2: sync_file for %s returned %s\n",
214 fsp_str_dbg(fsp),
215 nt_errstr(status)));
216 return status;
217 }
218
219 state->out_count = nwritten;
220
221 return NT_STATUS_OK;
222}
223
224static struct tevent_req *smbd_smb2_write_send(TALLOC_CTX *mem_ctx,
225 struct tevent_context *ev,
226 struct smbd_smb2_request *smb2req,
227 uint32_t in_smbpid,
228 uint64_t in_file_id_volatile,
229 DATA_BLOB in_data,
230 uint64_t in_offset,
231 uint32_t in_flags)
232{
233 NTSTATUS status;
234 struct tevent_req *req = NULL;
235 struct smbd_smb2_write_state *state = NULL;
236 struct smb_request *smbreq = NULL;
237 connection_struct *conn = smb2req->tcon->compat_conn;
238 files_struct *fsp = NULL;
239 ssize_t nwritten;
240 struct lock_struct lock;
241
242 req = tevent_req_create(mem_ctx, &state,
243 struct smbd_smb2_write_state);
244 if (req == NULL) {
245 return NULL;
246 }
247 state->smb2req = smb2req;
248 if (in_flags & 0x00000001) {
249 state->write_through = true;
250 }
251 state->in_length = in_data.length;
252 state->out_count = 0;
253
254 DEBUG(10,("smbd_smb2_write: file_id[0x%016llX]\n",
255 (unsigned long long)in_file_id_volatile));
256
257 smbreq = smbd_smb2_fake_smb_request(smb2req);
258 if (tevent_req_nomem(smbreq, req)) {
259 return tevent_req_post(req, ev);
260 }
261
262 fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
263 if (fsp == NULL) {
264 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
265 return tevent_req_post(req, ev);
266 }
267 if (conn != fsp->conn) {
268 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
269 return tevent_req_post(req, ev);
270 }
271 if (smb2req->session->vuid != fsp->vuid) {
272 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
273 return tevent_req_post(req, ev);
274 }
275
276 state->fsp = fsp;
277
278 if (IS_IPC(smbreq->conn)) {
279 struct tevent_req *subreq = NULL;
280
281 if (!fsp_is_np(fsp)) {
282 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
283 return tevent_req_post(req, ev);
284 }
285
286 subreq = np_write_send(state, smbd_event_context(),
287 fsp->fake_file_handle,
288 in_data.data,
289 in_data.length);
290 if (tevent_req_nomem(subreq, req)) {
291 return tevent_req_post(req, ev);
292 }
293 tevent_req_set_callback(subreq,
294 smbd_smb2_write_pipe_done,
295 req);
296 return req;
297 }
298
299 if (!CHECK_WRITE(fsp)) {
300 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
301 return tevent_req_post(req, ev);
302 }
303
304 /* Try and do an asynchronous write. */
305 status = schedule_aio_smb2_write(conn,
306 smbreq,
307 fsp,
308 in_offset,
309 in_data,
310 state->write_through);
311
312 if (NT_STATUS_IS_OK(status)) {
313 /*
314 * Doing an async write. Don't
315 * send a "gone async" message
316 * as we expect this to be less
317 * than the client timeout period.
318 * JRA. FIXME for offline files..
319 * FIXME - add cancel code..
320 */
321 smb2req->async = true;
322 return req;
323 }
324
325 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
326 /* Real error in setting up aio. Fail. */
327 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
328 return tevent_req_post(req, ev);
329 }
330
331 /* Fallback to synchronous. */
332 init_strict_lock_struct(fsp,
333 in_file_id_volatile,
334 in_offset,
335 in_data.length,
336 WRITE_LOCK,
337 &lock);
338
339 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
340 tevent_req_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
341 return tevent_req_post(req, ev);
342 }
343
344 nwritten = write_file(smbreq, fsp,
345 (const char *)in_data.data,
346 in_offset,
347 in_data.length);
348
349 status = smb2_write_complete(req, nwritten, errno);
350
351 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
352
353 DEBUG(10,("smb2: write on "
354 "file %s, offset %.0f, requested %u, written = %u\n",
355 fsp_str_dbg(fsp),
356 (double)in_offset,
357 (unsigned int)in_data.length,
358 (unsigned int)nwritten ));
359
360 if (!NT_STATUS_IS_OK(status)) {
361 tevent_req_nterror(req, status);
362 } else {
363 /* Success. */
364 tevent_req_done(req);
365 }
366
367 return tevent_req_post(req, ev);
368}
369
370static void smbd_smb2_write_pipe_done(struct tevent_req *subreq)
371{
372 struct tevent_req *req = tevent_req_callback_data(subreq,
373 struct tevent_req);
374 struct smbd_smb2_write_state *state = tevent_req_data(req,
375 struct smbd_smb2_write_state);
376 NTSTATUS status;
377 ssize_t nwritten = -1;
378
379 status = np_write_recv(subreq, &nwritten);
380 TALLOC_FREE(subreq);
381 if (!NT_STATUS_IS_OK(status)) {
382 tevent_req_nterror(req, status);
383 return;
384 }
385
386 if ((nwritten == 0 && state->in_length != 0) || (nwritten < 0)) {
387 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
388 return;
389 }
390
391 state->out_count = nwritten;
392
393 tevent_req_done(req);
394}
395
396static NTSTATUS smbd_smb2_write_recv(struct tevent_req *req,
397 uint32_t *out_count)
398{
399 NTSTATUS status;
400 struct smbd_smb2_write_state *state = tevent_req_data(req,
401 struct smbd_smb2_write_state);
402
403 if (tevent_req_is_nterror(req, &status)) {
404 tevent_req_received(req);
405 return status;
406 }
407
408 *out_count = state->out_count;
409
410 tevent_req_received(req);
411 return NT_STATUS_OK;
412}
Note: See TracBrowser for help on using the repository browser.