source: vendor/3.6.9/source3/smbd/smb2_find.c

Last change on this file was 746, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated vendor to 3.6.9
File size: 13.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "smbd/smbd.h"
23#include "smbd/globals.h"
24#include "../libcli/smb/smb_common.h"
25#include "trans2.h"
26#include "../lib/util/tevent_ntstatus.h"
27
28static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
29 struct tevent_context *ev,
30 struct smbd_smb2_request *smb2req,
31 struct files_struct *in_fsp,
32 uint8_t in_file_info_class,
33 uint8_t in_flags,
34 uint32_t in_file_index,
35 uint32_t in_output_buffer_length,
36 const char *in_file_name);
37static NTSTATUS smbd_smb2_find_recv(struct tevent_req *req,
38 TALLOC_CTX *mem_ctx,
39 DATA_BLOB *out_output_buffer);
40
41static void smbd_smb2_request_find_done(struct tevent_req *subreq);
42NTSTATUS smbd_smb2_request_process_find(struct smbd_smb2_request *req)
43{
44 NTSTATUS status;
45 const uint8_t *inbody;
46 int i = req->current_idx;
47 uint8_t in_file_info_class;
48 uint8_t in_flags;
49 uint32_t in_file_index;
50 uint64_t in_file_id_persistent;
51 uint64_t in_file_id_volatile;
52 struct files_struct *in_fsp;
53 uint16_t in_file_name_offset;
54 uint16_t in_file_name_length;
55 DATA_BLOB in_file_name_buffer;
56 char *in_file_name_string;
57 size_t in_file_name_string_size;
58 uint32_t in_output_buffer_length;
59 struct tevent_req *subreq;
60 bool ok;
61
62 status = smbd_smb2_request_verify_sizes(req, 0x21);
63 if (!NT_STATUS_IS_OK(status)) {
64 return smbd_smb2_request_error(req, status);
65 }
66 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
67
68 in_file_info_class = CVAL(inbody, 0x02);
69 in_flags = CVAL(inbody, 0x03);
70 in_file_index = IVAL(inbody, 0x04);
71 in_file_id_persistent = BVAL(inbody, 0x08);
72 in_file_id_volatile = BVAL(inbody, 0x10);
73 in_file_name_offset = SVAL(inbody, 0x18);
74 in_file_name_length = SVAL(inbody, 0x1A);
75 in_output_buffer_length = IVAL(inbody, 0x1C);
76
77 if (in_file_name_offset == 0 && in_file_name_length == 0) {
78 /* This is ok */
79 } else if (in_file_name_offset !=
80 (SMB2_HDR_BODY + req->in.vector[i+1].iov_len)) {
81 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
82 }
83
84 if (in_file_name_length > req->in.vector[i+2].iov_len) {
85 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
86 }
87
88 /* The output header is 8 bytes. */
89 if (in_output_buffer_length <= 8) {
90 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
91 }
92
93 DEBUG(10,("smbd_smb2_request_find_done: in_output_buffer_length = %u\n",
94 (unsigned int)in_output_buffer_length ));
95
96 /* Take into account the output header. */
97 in_output_buffer_length -= 8;
98
99 in_file_name_buffer.data = (uint8_t *)req->in.vector[i+2].iov_base;
100 in_file_name_buffer.length = in_file_name_length;
101
102 ok = convert_string_talloc(req, CH_UTF16, CH_UNIX,
103 in_file_name_buffer.data,
104 in_file_name_buffer.length,
105 &in_file_name_string,
106 &in_file_name_string_size, false);
107 if (!ok) {
108 return smbd_smb2_request_error(req, NT_STATUS_ILLEGAL_CHARACTER);
109 }
110
111 if (in_file_name_buffer.length == 0) {
112 in_file_name_string_size = 0;
113 }
114
115 if (strlen(in_file_name_string) != in_file_name_string_size) {
116 return smbd_smb2_request_error(req, NT_STATUS_OBJECT_NAME_INVALID);
117 }
118
119 in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
120 if (in_fsp == NULL) {
121 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
122 }
123
124 subreq = smbd_smb2_find_send(req, req->sconn->smb2.event_ctx,
125 req, in_fsp,
126 in_file_info_class,
127 in_flags,
128 in_file_index,
129 in_output_buffer_length,
130 in_file_name_string);
131 if (subreq == NULL) {
132 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
133 }
134 tevent_req_set_callback(subreq, smbd_smb2_request_find_done, req);
135
136 return smbd_smb2_request_pending_queue(req, subreq);
137}
138
139static void smbd_smb2_request_find_done(struct tevent_req *subreq)
140{
141 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
142 struct smbd_smb2_request);
143 int i = req->current_idx;
144 uint8_t *outhdr;
145 DATA_BLOB outbody;
146 DATA_BLOB outdyn;
147 uint16_t out_output_buffer_offset;
148 DATA_BLOB out_output_buffer = data_blob_null;
149 NTSTATUS status;
150 NTSTATUS error; /* transport error */
151
152 status = smbd_smb2_find_recv(subreq,
153 req,
154 &out_output_buffer);
155 TALLOC_FREE(subreq);
156 if (!NT_STATUS_IS_OK(status)) {
157 error = smbd_smb2_request_error(req, status);
158 if (!NT_STATUS_IS_OK(error)) {
159 smbd_server_connection_terminate(req->sconn,
160 nt_errstr(error));
161 return;
162 }
163 return;
164 }
165
166 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
167
168 outhdr = (uint8_t *)req->out.vector[i].iov_base;
169
170 outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
171 if (outbody.data == NULL) {
172 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
173 if (!NT_STATUS_IS_OK(error)) {
174 smbd_server_connection_terminate(req->sconn,
175 nt_errstr(error));
176 return;
177 }
178 return;
179 }
180
181 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
182 SSVAL(outbody.data, 0x02,
183 out_output_buffer_offset); /* output buffer offset */
184 SIVAL(outbody.data, 0x04,
185 out_output_buffer.length); /* output buffer length */
186
187 DEBUG(10,("smbd_smb2_request_find_done: out_output_buffer.length = %u\n",
188 (unsigned int)out_output_buffer.length ));
189
190 outdyn = out_output_buffer;
191
192 error = smbd_smb2_request_done(req, outbody, &outdyn);
193 if (!NT_STATUS_IS_OK(error)) {
194 smbd_server_connection_terminate(req->sconn,
195 nt_errstr(error));
196 return;
197 }
198}
199
200struct smbd_smb2_find_state {
201 struct smbd_smb2_request *smb2req;
202 DATA_BLOB out_output_buffer;
203};
204
205static struct tevent_req *smbd_smb2_find_send(TALLOC_CTX *mem_ctx,
206 struct tevent_context *ev,
207 struct smbd_smb2_request *smb2req,
208 struct files_struct *fsp,
209 uint8_t in_file_info_class,
210 uint8_t in_flags,
211 uint32_t in_file_index,
212 uint32_t in_output_buffer_length,
213 const char *in_file_name)
214{
215 struct tevent_req *req;
216 struct smbd_smb2_find_state *state;
217 struct smb_request *smbreq;
218 connection_struct *conn = smb2req->tcon->compat_conn;
219 NTSTATUS status;
220 NTSTATUS empty_status;
221 uint32_t info_level;
222 uint32_t max_count;
223 char *pdata;
224 char *base_data;
225 char *end_data;
226 int last_entry_off = 0;
227 int off = 0;
228 uint32_t num = 0;
229 uint32_t dirtype = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_DIRECTORY;
230 bool dont_descend = false;
231 bool ask_sharemode = true;
232
233 req = tevent_req_create(mem_ctx, &state,
234 struct smbd_smb2_find_state);
235 if (req == NULL) {
236 return NULL;
237 }
238 state->smb2req = smb2req;
239 state->out_output_buffer = data_blob_null;
240
241 DEBUG(10,("smbd_smb2_find_send: %s - fnum[%d]\n",
242 fsp_str_dbg(fsp), fsp->fnum));
243
244 smbreq = smbd_smb2_fake_smb_request(smb2req);
245 if (tevent_req_nomem(smbreq, req)) {
246 return tevent_req_post(req, ev);
247 }
248
249 if (!fsp->is_directory) {
250 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
251 return tevent_req_post(req, ev);
252 }
253
254 if (strcmp(in_file_name, "") == 0) {
255 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
256 return tevent_req_post(req, ev);
257 }
258 if (strcmp(in_file_name, "\\") == 0) {
259 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
260 return tevent_req_post(req, ev);
261 }
262 if (strcmp(in_file_name, "/") == 0) {
263 tevent_req_nterror(req, NT_STATUS_OBJECT_NAME_INVALID);
264 return tevent_req_post(req, ev);
265 }
266
267 if (in_output_buffer_length > smb2req->sconn->smb2.max_trans) {
268 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
269 return tevent_req_post(req, ev);
270 }
271
272 switch (in_file_info_class) {
273 case SMB2_FIND_DIRECTORY_INFO:
274 info_level = SMB_FIND_FILE_DIRECTORY_INFO;
275 break;
276
277 case SMB2_FIND_FULL_DIRECTORY_INFO:
278 info_level = SMB_FIND_FILE_FULL_DIRECTORY_INFO;
279 break;
280
281 case SMB2_FIND_BOTH_DIRECTORY_INFO:
282 info_level = SMB_FIND_FILE_BOTH_DIRECTORY_INFO;
283 break;
284
285 case SMB2_FIND_NAME_INFO:
286 info_level = SMB_FIND_FILE_NAMES_INFO;
287 break;
288
289 case SMB2_FIND_ID_BOTH_DIRECTORY_INFO:
290 info_level = SMB_FIND_ID_BOTH_DIRECTORY_INFO;
291 break;
292
293 case SMB2_FIND_ID_FULL_DIRECTORY_INFO:
294 info_level = SMB_FIND_ID_FULL_DIRECTORY_INFO;
295 break;
296
297 default:
298 tevent_req_nterror(req, NT_STATUS_INVALID_INFO_CLASS);
299 return tevent_req_post(req, ev);
300 }
301
302 if (in_flags & SMB2_CONTINUE_FLAG_REOPEN) {
303 dptr_CloseDir(fsp);
304 }
305
306 if (fsp->dptr == NULL) {
307 bool wcard_has_wild;
308
309 if (!(fsp->access_mask & SEC_DIR_LIST)) {
310 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
311 return tevent_req_post(req, ev);
312 }
313
314 wcard_has_wild = ms_has_wild(in_file_name);
315
316 status = dptr_create(conn,
317 fsp,
318 fsp->fsp_name->base_name,
319 false, /* old_handle */
320 false, /* expect_close */
321 0, /* spid */
322 in_file_name, /* wcard */
323 wcard_has_wild,
324 dirtype,
325 &fsp->dptr);
326 if (!NT_STATUS_IS_OK(status)) {
327 tevent_req_nterror(req, status);
328 return tevent_req_post(req, ev);
329 }
330
331 empty_status = NT_STATUS_NO_SUCH_FILE;
332 } else {
333 empty_status = STATUS_NO_MORE_FILES;
334 }
335
336 if (in_flags & SMB2_CONTINUE_FLAG_RESTART) {
337 dptr_SeekDir(fsp->dptr, 0);
338 }
339
340 if (in_flags & SMB2_CONTINUE_FLAG_SINGLE) {
341 max_count = 1;
342 } else {
343 max_count = UINT16_MAX;
344 }
345
346#define DIR_ENTRY_SAFETY_MARGIN 4096
347
348 state->out_output_buffer = data_blob_talloc(state, NULL,
349 in_output_buffer_length + DIR_ENTRY_SAFETY_MARGIN);
350 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
351 return tevent_req_post(req, ev);
352 }
353
354 state->out_output_buffer.length = 0;
355 pdata = (char *)state->out_output_buffer.data;
356 base_data = pdata;
357 /*
358 * end_data must include the safety margin as it's what is
359 * used to determine if pushed strings have been truncated.
360 */
361 end_data = pdata + in_output_buffer_length + DIR_ENTRY_SAFETY_MARGIN - 1;
362 last_entry_off = 0;
363 off = 0;
364 num = 0;
365
366 DEBUG(8,("smbd_smb2_find_send: dirpath=<%s> dontdescend=<%s>, "
367 "in_output_buffer_length = %u\n",
368 fsp->fsp_name->base_name, lp_dontdescend(SNUM(conn)),
369 (unsigned int)in_output_buffer_length ));
370 if (in_list(fsp->fsp_name->base_name,lp_dontdescend(SNUM(conn)),
371 conn->case_sensitive)) {
372 dont_descend = true;
373 }
374
375 ask_sharemode = lp_parm_bool(SNUM(conn),
376 "smbd", "search ask sharemode",
377 true);
378
379 while (true) {
380 bool ok;
381 bool got_exact_match = false;
382 bool out_of_space = false;
383 int space_remaining = in_output_buffer_length - off;
384
385 SMB_ASSERT(space_remaining >= 0);
386
387 ok = smbd_dirptr_lanman2_entry(state,
388 conn,
389 fsp->dptr,
390 smbreq->flags2,
391 in_file_name,
392 dirtype,
393 info_level,
394 false, /* requires_resume_key */
395 dont_descend,
396 ask_sharemode,
397 8, /* align to 8 bytes */
398 false, /* no padding */
399 &pdata,
400 base_data,
401 end_data,
402 space_remaining,
403 &out_of_space,
404 &got_exact_match,
405 &last_entry_off,
406 NULL);
407
408 off = (int)PTR_DIFF(pdata, base_data);
409
410 if (!ok) {
411 if (num > 0) {
412 SIVAL(state->out_output_buffer.data, last_entry_off, 0);
413 tevent_req_done(req);
414 return tevent_req_post(req, ev);
415 } else if (out_of_space) {
416 tevent_req_nterror(req, NT_STATUS_INFO_LENGTH_MISMATCH);
417 return tevent_req_post(req, ev);
418 } else {
419 tevent_req_nterror(req, empty_status);
420 return tevent_req_post(req, ev);
421 }
422 }
423
424 num++;
425 state->out_output_buffer.length = off;
426
427 if (num < max_count) {
428 continue;
429 }
430
431 SIVAL(state->out_output_buffer.data, last_entry_off, 0);
432 tevent_req_done(req);
433 return tevent_req_post(req, ev);
434 }
435
436 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
437 return tevent_req_post(req, ev);
438}
439
440static NTSTATUS smbd_smb2_find_recv(struct tevent_req *req,
441 TALLOC_CTX *mem_ctx,
442 DATA_BLOB *out_output_buffer)
443{
444 NTSTATUS status;
445 struct smbd_smb2_find_state *state = tevent_req_data(req,
446 struct smbd_smb2_find_state);
447
448 if (tevent_req_is_nterror(req, &status)) {
449 tevent_req_received(req);
450 return status;
451 }
452
453 *out_output_buffer = state->out_output_buffer;
454 talloc_steal(mem_ctx, out_output_buffer->data);
455
456 tevent_req_received(req);
457 return NT_STATUS_OK;
458}
Note: See TracBrowser for help on using the repository browser.