source: vendor/current/source3/smbd/smb2_read.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 17.8 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19*/
20
21#include "includes.h"
22#include "system/filesys.h"
23#include "smbd/smbd.h"
24#include "smbd/globals.h"
25#include "../libcli/smb/smb_common.h"
26#include "libcli/security/security.h"
27#include "../lib/util/tevent_ntstatus.h"
28#include "rpc_server/srv_pipe_hnd.h"
29#include "lib/util/sys_rw_data.h"
30
31static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
32 struct tevent_context *ev,
33 struct smbd_smb2_request *smb2req,
34 struct files_struct *in_fsp,
35 uint8_t in_flags,
36 uint32_t in_length,
37 uint64_t in_offset,
38 uint32_t in_minimum,
39 uint32_t in_remaining);
40static NTSTATUS smbd_smb2_read_recv(struct tevent_req *req,
41 TALLOC_CTX *mem_ctx,
42 DATA_BLOB *out_data,
43 uint32_t *out_remaining);
44
45static void smbd_smb2_request_read_done(struct tevent_req *subreq);
46NTSTATUS smbd_smb2_request_process_read(struct smbd_smb2_request *req)
47{
48 struct smbXsrv_connection *xconn = req->xconn;
49 NTSTATUS status;
50 const uint8_t *inbody;
51 uint8_t in_flags;
52 uint32_t in_length;
53 uint64_t in_offset;
54 uint64_t in_file_id_persistent;
55 uint64_t in_file_id_volatile;
56 struct files_struct *in_fsp;
57 uint32_t in_minimum_count;
58 uint32_t in_remaining_bytes;
59 struct tevent_req *subreq;
60
61 status = smbd_smb2_request_verify_sizes(req, 0x31);
62 if (!NT_STATUS_IS_OK(status)) {
63 return smbd_smb2_request_error(req, status);
64 }
65 inbody = SMBD_SMB2_IN_BODY_PTR(req);
66
67 if (xconn->protocol >= PROTOCOL_SMB3_02) {
68 in_flags = CVAL(inbody, 0x03);
69 } else {
70 in_flags = 0;
71 }
72 in_length = IVAL(inbody, 0x04);
73 in_offset = BVAL(inbody, 0x08);
74 in_file_id_persistent = BVAL(inbody, 0x10);
75 in_file_id_volatile = BVAL(inbody, 0x18);
76 in_minimum_count = IVAL(inbody, 0x20);
77 in_remaining_bytes = IVAL(inbody, 0x28);
78
79 /* check the max read size */
80 if (in_length > xconn->smb2.server.max_read) {
81 DEBUG(2,("smbd_smb2_request_process_read: "
82 "client ignored max read: %s: 0x%08X: 0x%08X\n",
83 __location__, in_length, xconn->smb2.server.max_read));
84 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
85 }
86
87 status = smbd_smb2_request_verify_creditcharge(req, in_length);
88 if (!NT_STATUS_IS_OK(status)) {
89 return smbd_smb2_request_error(req, status);
90 }
91
92 in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
93 if (in_fsp == NULL) {
94 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
95 }
96
97 subreq = smbd_smb2_read_send(req, req->sconn->ev_ctx,
98 req, in_fsp,
99 in_flags,
100 in_length,
101 in_offset,
102 in_minimum_count,
103 in_remaining_bytes);
104 if (subreq == NULL) {
105 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
106 }
107 tevent_req_set_callback(subreq, smbd_smb2_request_read_done, req);
108
109 return smbd_smb2_request_pending_queue(req, subreq, 500);
110}
111
112static void smbd_smb2_request_read_done(struct tevent_req *subreq)
113{
114 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
115 struct smbd_smb2_request);
116 DATA_BLOB outbody;
117 DATA_BLOB outdyn;
118 uint8_t out_data_offset;
119 DATA_BLOB out_data_buffer = data_blob_null;
120 uint32_t out_data_remaining = 0;
121 NTSTATUS status;
122 NTSTATUS error; /* transport error */
123
124 status = smbd_smb2_read_recv(subreq,
125 req,
126 &out_data_buffer,
127 &out_data_remaining);
128 TALLOC_FREE(subreq);
129 if (!NT_STATUS_IS_OK(status)) {
130 error = smbd_smb2_request_error(req, status);
131 if (!NT_STATUS_IS_OK(error)) {
132 smbd_server_connection_terminate(req->xconn,
133 nt_errstr(error));
134 return;
135 }
136 return;
137 }
138
139 out_data_offset = SMB2_HDR_BODY + 0x10;
140
141 outbody = smbd_smb2_generate_outbody(req, 0x10);
142 if (outbody.data == NULL) {
143 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
144 if (!NT_STATUS_IS_OK(error)) {
145 smbd_server_connection_terminate(req->xconn,
146 nt_errstr(error));
147 return;
148 }
149 return;
150 }
151
152 SSVAL(outbody.data, 0x00, 0x10 + 1); /* struct size */
153 SCVAL(outbody.data, 0x02,
154 out_data_offset); /* data offset */
155 SCVAL(outbody.data, 0x03, 0); /* reserved */
156 SIVAL(outbody.data, 0x04,
157 out_data_buffer.length); /* data length */
158 SIVAL(outbody.data, 0x08,
159 out_data_remaining); /* data remaining */
160 SIVAL(outbody.data, 0x0C, 0); /* reserved */
161
162 outdyn = out_data_buffer;
163
164 error = smbd_smb2_request_done(req, outbody, &outdyn);
165 if (!NT_STATUS_IS_OK(error)) {
166 smbd_server_connection_terminate(req->xconn,
167 nt_errstr(error));
168 return;
169 }
170}
171
172struct smbd_smb2_read_state {
173 struct smbd_smb2_request *smb2req;
174 struct smb_request *smbreq;
175 files_struct *fsp;
176 uint8_t in_flags;
177 uint32_t in_length;
178 uint64_t in_offset;
179 uint32_t in_minimum;
180 DATA_BLOB out_headers;
181 uint8_t _out_hdr_buf[NBT_HDR_SIZE + SMB2_HDR_BODY + 0x10];
182 DATA_BLOB out_data;
183 uint32_t out_remaining;
184};
185
186static int smb2_smb2_read_state_deny_destructor(struct smbd_smb2_read_state *state)
187{
188 return -1;
189}
190
191/* struct smbd_smb2_read_state destructor. Send the SMB2_READ data. */
192static int smb2_sendfile_send_data(struct smbd_smb2_read_state *state)
193{
194 struct lock_struct lock;
195 uint32_t in_length = state->in_length;
196 uint64_t in_offset = state->in_offset;
197 files_struct *fsp = state->fsp;
198 const DATA_BLOB *hdr = state->smb2req->queue_entry.sendfile_header;
199 NTSTATUS *pstatus = state->smb2req->queue_entry.sendfile_status;
200 struct smbXsrv_connection *xconn = state->smb2req->xconn;
201 ssize_t nread;
202 ssize_t ret;
203 int saved_errno;
204
205 nread = SMB_VFS_SENDFILE(xconn->transport.sock,
206 fsp,
207 hdr,
208 in_offset,
209 in_length);
210 DEBUG(10,("smb2_sendfile_send_data: SMB_VFS_SENDFILE returned %d on file %s\n",
211 (int)nread,
212 fsp_str_dbg(fsp) ));
213
214 if (nread == -1) {
215 saved_errno = errno;
216
217 /*
218 * Returning ENOSYS means no data at all was sent.
219 Do this as a normal read. */
220 if (errno == ENOSYS) {
221 goto normal_read;
222 }
223
224 if (errno == EINTR) {
225 /*
226 * Special hack for broken Linux with no working sendfile. If we
227 * return EINTR we sent the header but not the rest of the data.
228 * Fake this up by doing read/write calls.
229 */
230 set_use_sendfile(SNUM(fsp->conn), false);
231 nread = fake_sendfile(xconn, fsp, in_offset, in_length);
232 if (nread == -1) {
233 saved_errno = errno;
234 DEBUG(0,("smb2_sendfile_send_data: fake_sendfile "
235 "failed for file %s (%s) for client %s. "
236 "Terminating\n",
237 fsp_str_dbg(fsp), strerror(saved_errno),
238 smbXsrv_connection_dbg(xconn)));
239 *pstatus = map_nt_error_from_unix_common(saved_errno);
240 return 0;
241 }
242 goto out;
243 }
244
245 DEBUG(0,("smb2_sendfile_send_data: sendfile failed for file "
246 "%s (%s) for client %s. Terminating\n",
247 fsp_str_dbg(fsp), strerror(saved_errno),
248 smbXsrv_connection_dbg(xconn)));
249 *pstatus = map_nt_error_from_unix_common(saved_errno);
250 return 0;
251 } else if (nread == 0) {
252 /*
253 * Some sendfile implementations return 0 to indicate
254 * that there was a short read, but nothing was
255 * actually written to the socket. In this case,
256 * fallback to the normal read path so the header gets
257 * the correct byte count.
258 */
259 DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
260 "falling back to the normal read: %s\n",
261 fsp_str_dbg(fsp)));
262 goto normal_read;
263 }
264
265 /*
266 * We got a short read
267 */
268 goto out;
269
270normal_read:
271 /* Send out the header. */
272 ret = write_data(xconn->transport.sock,
273 (const char *)hdr->data, hdr->length);
274 if (ret != hdr->length) {
275 saved_errno = errno;
276 DEBUG(0,("smb2_sendfile_send_data: write_data failed for file "
277 "%s (%s) for client %s. Terminating\n",
278 fsp_str_dbg(fsp), strerror(saved_errno),
279 smbXsrv_connection_dbg(xconn)));
280 *pstatus = map_nt_error_from_unix_common(saved_errno);
281 return 0;
282 }
283 nread = fake_sendfile(xconn, fsp, in_offset, in_length);
284 if (nread == -1) {
285 saved_errno = errno;
286 DEBUG(0,("smb2_sendfile_send_data: fake_sendfile "
287 "failed for file %s (%s) for client %s. "
288 "Terminating\n",
289 fsp_str_dbg(fsp), strerror(saved_errno),
290 smbXsrv_connection_dbg(xconn)));
291 *pstatus = map_nt_error_from_unix_common(saved_errno);
292 return 0;
293 }
294
295 out:
296
297 if (nread < in_length) {
298 ret = sendfile_short_send(xconn, fsp, nread,
299 hdr->length, in_length);
300 if (ret == -1) {
301 saved_errno = errno;
302 DEBUG(0,("%s: sendfile_short_send "
303 "failed for file %s (%s) for client %s. "
304 "Terminating\n",
305 __func__,
306 fsp_str_dbg(fsp), strerror(saved_errno),
307 smbXsrv_connection_dbg(xconn)));
308 *pstatus = map_nt_error_from_unix_common(saved_errno);
309 return 0;
310 }
311 }
312
313 init_strict_lock_struct(fsp,
314 fsp->op->global->open_persistent_id,
315 in_offset,
316 in_length,
317 READ_LOCK,
318 &lock);
319
320 SMB_VFS_STRICT_UNLOCK(fsp->conn, fsp, &lock);
321
322 *pstatus = NT_STATUS_OK;
323 return 0;
324}
325
326static NTSTATUS schedule_smb2_sendfile_read(struct smbd_smb2_request *smb2req,
327 struct smbd_smb2_read_state *state)
328{
329 files_struct *fsp = state->fsp;
330
331 /*
332 * We cannot use sendfile if...
333 * We were not configured to do so OR
334 * Signing is active OR
335 * This is a compound SMB2 operation OR
336 * fsp is a STREAM file OR
337 * We're using a write cache OR
338 * It's not a regular file OR
339 * Requested offset is greater than file size OR
340 * there's not enough data in the file.
341 * Phew :-). Luckily this means most
342 * reads on most normal files. JRA.
343 */
344
345 if (!lp__use_sendfile(SNUM(fsp->conn)) ||
346 smb2req->do_signing ||
347 smb2req->do_encryption ||
348 smb2req->in.vector_count >= (2*SMBD_SMB2_NUM_IOV_PER_REQ) ||
349 (fsp->base_fsp != NULL) ||
350 (fsp->wcp != NULL) ||
351 (!S_ISREG(fsp->fsp_name->st.st_ex_mode)) ||
352 (state->in_offset >= fsp->fsp_name->st.st_ex_size) ||
353 (fsp->fsp_name->st.st_ex_size < state->in_offset + state->in_length))
354 {
355 return NT_STATUS_RETRY;
356 }
357
358 /* We've already checked there's this amount of data
359 to read. */
360 state->out_data.length = state->in_length;
361 state->out_remaining = 0;
362
363 state->out_headers = data_blob_const(state->_out_hdr_buf,
364 sizeof(state->_out_hdr_buf));
365 return NT_STATUS_OK;
366}
367
368static void smbd_smb2_read_pipe_done(struct tevent_req *subreq);
369
370/*******************************************************************
371 Common read complete processing function for both synchronous and
372 asynchronous reads.
373*******************************************************************/
374
375NTSTATUS smb2_read_complete(struct tevent_req *req, ssize_t nread, int err)
376{
377 struct smbd_smb2_read_state *state = tevent_req_data(req,
378 struct smbd_smb2_read_state);
379 files_struct *fsp = state->fsp;
380
381 if (nread < 0) {
382 NTSTATUS status = map_nt_error_from_unix(err);
383
384 DEBUG( 3,( "smb2_read_complete: file %s nread = %d. "
385 "Error = %s (NTSTATUS %s)\n",
386 fsp_str_dbg(fsp),
387 (int)nread,
388 strerror(err),
389 nt_errstr(status)));
390
391 return status;
392 }
393 if (nread == 0 && state->in_length != 0) {
394 DEBUG(5,("smb2_read_complete: read_file[%s] end of file\n",
395 fsp_str_dbg(fsp)));
396 return NT_STATUS_END_OF_FILE;
397 }
398
399 if (nread < state->in_minimum) {
400 DEBUG(5,("smb2_read_complete: read_file[%s] read less %d than "
401 "minimum requested %u. Returning end of file\n",
402 fsp_str_dbg(fsp),
403 (int)nread,
404 (unsigned int)state->in_minimum));
405 return NT_STATUS_END_OF_FILE;
406 }
407
408 DEBUG(3,("smbd_smb2_read: %s, file %s, length=%lu offset=%lu read=%lu\n",
409 fsp_fnum_dbg(fsp),
410 fsp_str_dbg(fsp),
411 (unsigned long)state->in_length,
412 (unsigned long)state->in_offset,
413 (unsigned long)nread));
414
415 state->out_data.length = nread;
416 state->out_remaining = 0;
417
418 return NT_STATUS_OK;
419}
420
421static bool smbd_smb2_read_cancel(struct tevent_req *req)
422{
423 struct smbd_smb2_read_state *state =
424 tevent_req_data(req,
425 struct smbd_smb2_read_state);
426
427 return cancel_smb2_aio(state->smbreq);
428}
429
430static struct tevent_req *smbd_smb2_read_send(TALLOC_CTX *mem_ctx,
431 struct tevent_context *ev,
432 struct smbd_smb2_request *smb2req,
433 struct files_struct *fsp,
434 uint8_t in_flags,
435 uint32_t in_length,
436 uint64_t in_offset,
437 uint32_t in_minimum,
438 uint32_t in_remaining)
439{
440 NTSTATUS status;
441 struct tevent_req *req = NULL;
442 struct smbd_smb2_read_state *state = NULL;
443 struct smb_request *smbreq = NULL;
444 connection_struct *conn = smb2req->tcon->compat;
445 ssize_t nread = -1;
446 struct lock_struct lock;
447 int saved_errno;
448
449 req = tevent_req_create(mem_ctx, &state,
450 struct smbd_smb2_read_state);
451 if (req == NULL) {
452 return NULL;
453 }
454 state->smb2req = smb2req;
455 state->in_flags = in_flags;
456 state->in_length = in_length;
457 state->in_offset = in_offset;
458 state->in_minimum = in_minimum;
459 state->out_data = data_blob_null;
460 state->out_remaining = 0;
461
462 DEBUG(10,("smbd_smb2_read: %s - %s\n",
463 fsp_str_dbg(fsp), fsp_fnum_dbg(fsp)));
464
465 smbreq = smbd_smb2_fake_smb_request(smb2req);
466 if (tevent_req_nomem(smbreq, req)) {
467 return tevent_req_post(req, ev);
468 }
469 state->smbreq = smbreq;
470
471 if (fsp->is_directory) {
472 tevent_req_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
473 return tevent_req_post(req, ev);
474 }
475
476 state->fsp = fsp;
477
478 if (IS_IPC(smbreq->conn)) {
479 struct tevent_req *subreq = NULL;
480
481 state->out_data = data_blob_talloc(state, NULL, in_length);
482 if (in_length > 0 && tevent_req_nomem(state->out_data.data, req)) {
483 return tevent_req_post(req, ev);
484 }
485
486 if (!fsp_is_np(fsp)) {
487 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
488 return tevent_req_post(req, ev);
489 }
490
491 subreq = np_read_send(state, ev,
492 fsp->fake_file_handle,
493 state->out_data.data,
494 state->out_data.length);
495 if (tevent_req_nomem(subreq, req)) {
496 return tevent_req_post(req, ev);
497 }
498 tevent_req_set_callback(subreq,
499 smbd_smb2_read_pipe_done,
500 req);
501 return req;
502 }
503
504 if (!CHECK_READ(fsp, smbreq)) {
505 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
506 return tevent_req_post(req, ev);
507 }
508
509 status = schedule_smb2_aio_read(fsp->conn,
510 smbreq,
511 fsp,
512 state,
513 &state->out_data,
514 (off_t)in_offset,
515 (size_t)in_length);
516
517 if (NT_STATUS_IS_OK(status)) {
518 /*
519 * Doing an async read, allow this
520 * request to be canceled
521 */
522 tevent_req_set_cancel_fn(req, smbd_smb2_read_cancel);
523 return req;
524 }
525
526 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
527 /* Real error in setting up aio. Fail. */
528 tevent_req_nterror(req, status);
529 return tevent_req_post(req, ev);
530 }
531
532 /* Fallback to synchronous. */
533
534 init_strict_lock_struct(fsp,
535 fsp->op->global->open_persistent_id,
536 in_offset,
537 in_length,
538 READ_LOCK,
539 &lock);
540
541 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
542 tevent_req_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
543 return tevent_req_post(req, ev);
544 }
545
546 /* Try sendfile in preference. */
547 status = schedule_smb2_sendfile_read(smb2req, state);
548 if (NT_STATUS_IS_OK(status)) {
549 tevent_req_done(req);
550 return tevent_req_post(req, ev);
551 } else {
552 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
553 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
554 tevent_req_nterror(req, status);
555 return tevent_req_post(req, ev);
556 }
557 }
558
559 /* Ok, read into memory. Allocate the out buffer. */
560 state->out_data = data_blob_talloc(state, NULL, in_length);
561 if (in_length > 0 && tevent_req_nomem(state->out_data.data, req)) {
562 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
563 return tevent_req_post(req, ev);
564 }
565
566 nread = read_file(fsp,
567 (char *)state->out_data.data,
568 in_offset,
569 in_length);
570
571 saved_errno = errno;
572
573 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
574
575 DEBUG(10,("smbd_smb2_read: file %s, %s, offset=%llu "
576 "len=%llu returned %lld\n",
577 fsp_str_dbg(fsp),
578 fsp_fnum_dbg(fsp),
579 (unsigned long long)in_offset,
580 (unsigned long long)in_length,
581 (long long)nread));
582
583 status = smb2_read_complete(req, nread, saved_errno);
584 if (!NT_STATUS_IS_OK(status)) {
585 tevent_req_nterror(req, status);
586 } else {
587 /* Success. */
588 tevent_req_done(req);
589 }
590 return tevent_req_post(req, ev);
591}
592
593static void smbd_smb2_read_pipe_done(struct tevent_req *subreq)
594{
595 struct tevent_req *req = tevent_req_callback_data(subreq,
596 struct tevent_req);
597 struct smbd_smb2_read_state *state = tevent_req_data(req,
598 struct smbd_smb2_read_state);
599 NTSTATUS status;
600 ssize_t nread = -1;
601 bool is_data_outstanding;
602
603 status = np_read_recv(subreq, &nread, &is_data_outstanding);
604 TALLOC_FREE(subreq);
605 if (!NT_STATUS_IS_OK(status)) {
606 NTSTATUS old = status;
607 status = nt_status_np_pipe(old);
608 tevent_req_nterror(req, status);
609 return;
610 }
611
612 if (nread == 0 && state->out_data.length != 0) {
613 tevent_req_nterror(req, NT_STATUS_END_OF_FILE);
614 return;
615 }
616
617 state->out_data.length = nread;
618 state->out_remaining = 0;
619
620 /*
621 * TODO: add STATUS_BUFFER_OVERFLOW handling, once we also
622 * handle it in SMB1 pipe_read_andx_done().
623 */
624
625 tevent_req_done(req);
626}
627
628static NTSTATUS smbd_smb2_read_recv(struct tevent_req *req,
629 TALLOC_CTX *mem_ctx,
630 DATA_BLOB *out_data,
631 uint32_t *out_remaining)
632{
633 NTSTATUS status;
634 struct smbd_smb2_read_state *state = tevent_req_data(req,
635 struct smbd_smb2_read_state);
636
637 if (tevent_req_is_nterror(req, &status)) {
638 tevent_req_received(req);
639 return status;
640 }
641
642 *out_data = state->out_data;
643 talloc_steal(mem_ctx, out_data->data);
644 *out_remaining = state->out_remaining;
645
646 if (state->out_headers.length > 0) {
647 talloc_steal(mem_ctx, state);
648 talloc_set_destructor(state, smb2_smb2_read_state_deny_destructor);
649 tevent_req_received(req);
650 state->smb2req->queue_entry.sendfile_header = &state->out_headers;
651 talloc_set_destructor(state, smb2_sendfile_send_data);
652 } else {
653 tevent_req_received(req);
654 }
655
656 return NT_STATUS_OK;
657}
Note: See TracBrowser for help on using the repository browser.