source: vendor/current/source3/smbd/smb2_notify.c@ 740

Last change on this file since 740 was 740, checked in by Silvan Scherrer, 12 years ago

Samba Server: update vendor to 3.6.0
File size: 11.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
4
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "smbd/smbd.h"
24#include "smbd/globals.h"
25#include "../libcli/smb/smb_common.h"
26#include "../lib/util/tevent_ntstatus.h"
27
28struct smbd_smb2_notify_state {
29 struct smbd_smb2_request *smb2req;
30 struct smb_request *smbreq;
31 struct tevent_immediate *im;
32 NTSTATUS status;
33 DATA_BLOB out_output_buffer;
34};
35
36static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
37 struct tevent_context *ev,
38 struct smbd_smb2_request *smb2req,
39 uint16_t in_flags,
40 uint32_t in_output_buffer_length,
41 uint64_t in_file_id_volatile,
42 uint64_t in_completion_filter);
43static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
44 TALLOC_CTX *mem_ctx,
45 DATA_BLOB *out_output_buffer);
46
47static void smbd_smb2_request_notify_done(struct tevent_req *subreq);
48NTSTATUS smbd_smb2_request_process_notify(struct smbd_smb2_request *req)
49{
50 const uint8_t *inhdr;
51 const uint8_t *inbody;
52 int i = req->current_idx;
53 size_t expected_body_size = 0x20;
54 size_t body_size;
55 uint16_t in_flags;
56 uint32_t in_output_buffer_length;
57 uint64_t in_file_id_persistent;
58 uint64_t in_file_id_volatile;
59 uint64_t in_completion_filter;
60 struct tevent_req *subreq;
61
62 inhdr = (const uint8_t *)req->in.vector[i+0].iov_base;
63 if (req->in.vector[i+1].iov_len != (expected_body_size & 0xFFFFFFFE)) {
64 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
65 }
66
67 inbody = (const uint8_t *)req->in.vector[i+1].iov_base;
68
69 body_size = SVAL(inbody, 0x00);
70 if (body_size != expected_body_size) {
71 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
72 }
73
74 in_flags = SVAL(inbody, 0x02);
75 in_output_buffer_length = IVAL(inbody, 0x04);
76 in_file_id_persistent = BVAL(inbody, 0x08);
77 in_file_id_volatile = BVAL(inbody, 0x10);
78 in_completion_filter = IVAL(inbody, 0x18);
79
80 /*
81 * 0x00010000 is what Windows 7 uses,
82 * Windows 2008 uses 0x00080000
83 */
84 if (in_output_buffer_length > lp_smb2_max_trans()) {
85 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
86 }
87
88 if (req->compat_chain_fsp) {
89 /* skip check */
90 } else if (in_file_id_persistent != in_file_id_volatile) {
91 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
92 }
93
94 subreq = smbd_smb2_notify_send(req,
95 req->sconn->smb2.event_ctx,
96 req,
97 in_flags,
98 in_output_buffer_length,
99 in_file_id_volatile,
100 in_completion_filter);
101 if (subreq == NULL) {
102 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
103 }
104 tevent_req_set_callback(subreq, smbd_smb2_request_notify_done, req);
105
106 return smbd_smb2_request_pending_queue(req, subreq);
107}
108
109static void smbd_smb2_request_notify_done(struct tevent_req *subreq)
110{
111 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
112 struct smbd_smb2_request);
113 int i = req->current_idx;
114 uint8_t *outhdr;
115 DATA_BLOB outbody;
116 DATA_BLOB outdyn;
117 uint16_t out_output_buffer_offset;
118 DATA_BLOB out_output_buffer = data_blob_null;
119 NTSTATUS status;
120 NTSTATUS error; /* transport error */
121
122 if (req->cancelled) {
123 struct smbd_smb2_notify_state *state = tevent_req_data(subreq,
124 struct smbd_smb2_notify_state);
125 const uint8_t *inhdr = (const uint8_t *)req->in.vector[i].iov_base;
126 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
127
128 DEBUG(10,("smbd_smb2_request_notify_done: cancelled mid %llu\n",
129 (unsigned long long)mid ));
130 error = smbd_smb2_request_error(req, NT_STATUS_CANCELLED);
131 if (!NT_STATUS_IS_OK(error)) {
132 smbd_server_connection_terminate(req->sconn,
133 nt_errstr(error));
134 return;
135 }
136 TALLOC_FREE(state->im);
137 return;
138 }
139
140 status = smbd_smb2_notify_recv(subreq,
141 req,
142 &out_output_buffer);
143 TALLOC_FREE(subreq);
144 if (!NT_STATUS_IS_OK(status)) {
145 error = smbd_smb2_request_error(req, status);
146 if (!NT_STATUS_IS_OK(error)) {
147 smbd_server_connection_terminate(req->sconn,
148 nt_errstr(error));
149 return;
150 }
151 return;
152 }
153
154 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
155
156 outhdr = (uint8_t *)req->out.vector[i].iov_base;
157
158 outbody = data_blob_talloc(req->out.vector, NULL, 0x08);
159 if (outbody.data == NULL) {
160 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
161 if (!NT_STATUS_IS_OK(error)) {
162 smbd_server_connection_terminate(req->sconn,
163 nt_errstr(error));
164 return;
165 }
166 return;
167 }
168
169 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
170 SSVAL(outbody.data, 0x02,
171 out_output_buffer_offset); /* output buffer offset */
172 SIVAL(outbody.data, 0x04,
173 out_output_buffer.length); /* output buffer length */
174
175 outdyn = out_output_buffer;
176
177 error = smbd_smb2_request_done(req, outbody, &outdyn);
178 if (!NT_STATUS_IS_OK(error)) {
179 smbd_server_connection_terminate(req->sconn,
180 nt_errstr(error));
181 return;
182 }
183}
184
185static void smbd_smb2_notify_reply(struct smb_request *smbreq,
186 NTSTATUS error_code,
187 uint8_t *buf, size_t len);
188static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
189 struct tevent_immediate *im,
190 void *private_data);
191static bool smbd_smb2_notify_cancel(struct tevent_req *req);
192
193static struct tevent_req *smbd_smb2_notify_send(TALLOC_CTX *mem_ctx,
194 struct tevent_context *ev,
195 struct smbd_smb2_request *smb2req,
196 uint16_t in_flags,
197 uint32_t in_output_buffer_length,
198 uint64_t in_file_id_volatile,
199 uint64_t in_completion_filter)
200{
201 struct tevent_req *req;
202 struct smbd_smb2_notify_state *state;
203 struct smb_request *smbreq;
204 connection_struct *conn = smb2req->tcon->compat_conn;
205 files_struct *fsp;
206 bool recursive = (in_flags & 0x0001) ? true : false;
207 NTSTATUS status;
208
209 req = tevent_req_create(mem_ctx, &state,
210 struct smbd_smb2_notify_state);
211 if (req == NULL) {
212 return NULL;
213 }
214 state->smb2req = smb2req;
215 state->status = NT_STATUS_INTERNAL_ERROR;
216 state->out_output_buffer = data_blob_null;
217 state->im = NULL;
218
219 DEBUG(10,("smbd_smb2_notify_send: file_id[0x%016llX]\n",
220 (unsigned long long)in_file_id_volatile));
221
222 smbreq = smbd_smb2_fake_smb_request(smb2req);
223 if (tevent_req_nomem(smbreq, req)) {
224 return tevent_req_post(req, ev);
225 }
226
227 state->smbreq = smbreq;
228 smbreq->async_priv = (void *)req;
229
230 fsp = file_fsp(smbreq, (uint16_t)in_file_id_volatile);
231 if (fsp == NULL) {
232 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
233 return tevent_req_post(req, ev);
234 }
235 if (conn != fsp->conn) {
236 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
237 return tevent_req_post(req, ev);
238 }
239 if (smb2req->session->vuid != fsp->vuid) {
240 tevent_req_nterror(req, NT_STATUS_FILE_CLOSED);
241 return tevent_req_post(req, ev);
242 }
243
244 {
245 char *filter_string;
246
247 filter_string = notify_filter_string(NULL, in_completion_filter);
248 if (tevent_req_nomem(filter_string, req)) {
249 return tevent_req_post(req, ev);
250 }
251
252 DEBUG(3,("smbd_smb2_notify_send: notify change "
253 "called on %s, filter = %s, recursive = %d\n",
254 fsp_str_dbg(fsp), filter_string, recursive));
255
256 TALLOC_FREE(filter_string);
257 }
258
259 if ((!fsp->is_directory) || (conn != fsp->conn)) {
260 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
261 return tevent_req_post(req, ev);
262 }
263
264 if (fsp->notify == NULL) {
265
266 status = change_notify_create(fsp,
267 in_completion_filter,
268 recursive);
269 if (!NT_STATUS_IS_OK(status)) {
270 DEBUG(10, ("change_notify_create returned %s\n",
271 nt_errstr(status)));
272 tevent_req_nterror(req, status);
273 return tevent_req_post(req, ev);
274 }
275 }
276
277 if (fsp->notify->num_changes != 0) {
278
279 /*
280 * We've got changes pending, respond immediately
281 */
282
283 /*
284 * TODO: write a torture test to check the filtering behaviour
285 * here.
286 */
287
288 change_notify_reply(smbreq,
289 NT_STATUS_OK,
290 in_output_buffer_length,
291 fsp->notify,
292 smbd_smb2_notify_reply);
293
294 /*
295 * change_notify_reply() above has independently
296 * called tevent_req_done().
297 */
298 return tevent_req_post(req, ev);
299 }
300
301 state->im = tevent_create_immediate(state);
302 if (tevent_req_nomem(state->im, req)) {
303 return tevent_req_post(req, ev);
304 }
305
306 /*
307 * No changes pending, queue the request
308 */
309
310 status = change_notify_add_request(smbreq,
311 in_output_buffer_length,
312 in_completion_filter,
313 recursive, fsp,
314 smbd_smb2_notify_reply);
315 if (!NT_STATUS_IS_OK(status)) {
316 tevent_req_nterror(req, status);
317 return tevent_req_post(req, ev);
318 }
319
320 /* allow this request to be canceled */
321 tevent_req_set_cancel_fn(req, smbd_smb2_notify_cancel);
322
323 return req;
324}
325
326static void smbd_smb2_notify_reply(struct smb_request *smbreq,
327 NTSTATUS error_code,
328 uint8_t *buf, size_t len)
329{
330 struct tevent_req *req = talloc_get_type_abort(smbreq->async_priv,
331 struct tevent_req);
332 struct smbd_smb2_notify_state *state = tevent_req_data(req,
333 struct smbd_smb2_notify_state);
334
335 state->status = error_code;
336 if (!NT_STATUS_IS_OK(error_code)) {
337 /* nothing */
338 } else if (len == 0) {
339 state->status = STATUS_NOTIFY_ENUM_DIR;
340 } else {
341 state->out_output_buffer = data_blob_talloc(state, buf, len);
342 if (state->out_output_buffer.data == NULL) {
343 state->status = NT_STATUS_NO_MEMORY;
344 }
345 }
346
347 if (state->im == NULL) {
348 smbd_smb2_notify_reply_trigger(NULL, NULL, req);
349 return;
350 }
351
352 /*
353 * if this is called async, we need to go via an immediate event
354 * because the caller replies on the smb_request (a child of req
355 * being arround after calling this function
356 */
357 tevent_schedule_immediate(state->im,
358 state->smb2req->sconn->smb2.event_ctx,
359 smbd_smb2_notify_reply_trigger,
360 req);
361}
362
363static void smbd_smb2_notify_reply_trigger(struct tevent_context *ctx,
364 struct tevent_immediate *im,
365 void *private_data)
366{
367 struct tevent_req *req = talloc_get_type_abort(private_data,
368 struct tevent_req);
369 struct smbd_smb2_notify_state *state = tevent_req_data(req,
370 struct smbd_smb2_notify_state);
371
372 if (!NT_STATUS_IS_OK(state->status)) {
373 tevent_req_nterror(req, state->status);
374 return;
375 }
376
377 tevent_req_done(req);
378}
379
380static bool smbd_smb2_notify_cancel(struct tevent_req *req)
381{
382 struct smbd_smb2_notify_state *state = tevent_req_data(req,
383 struct smbd_smb2_notify_state);
384
385 smbd_notify_cancel_by_smbreq(state->smbreq);
386
387 state->smb2req->cancelled = true;
388 tevent_req_done(req);
389 return true;
390}
391
392static NTSTATUS smbd_smb2_notify_recv(struct tevent_req *req,
393 TALLOC_CTX *mem_ctx,
394 DATA_BLOB *out_output_buffer)
395{
396 NTSTATUS status;
397 struct smbd_smb2_notify_state *state = tevent_req_data(req,
398 struct smbd_smb2_notify_state);
399
400 if (tevent_req_is_nterror(req, &status)) {
401 tevent_req_received(req);
402 return status;
403 }
404
405 *out_output_buffer = state->out_output_buffer;
406 talloc_steal(mem_ctx, out_output_buffer->data);
407
408 tevent_req_received(req);
409 return NT_STATUS_OK;
410}
Note: See TracBrowser for help on using the repository browser.