1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
26  */
27 
28 /*
29  * Dispatch function for SMB2_QUERY_DIRECTORY
30  *
31  * Similar to smb_trans2_find.c (from SMB1)
32  */
33 
34 #include <smbsrv/smb2_kproto.h>
35 
36 /*
37  * Args (and other state) that we carry around among the
38  * various functions involved in SMB2 Query Directory.
39  */
40 typedef struct smb2_find_args {
41 	uint32_t fa_maxdata;
42 	uint8_t fa_infoclass;
43 	uint8_t fa_fflags;
44 	uint16_t fa_maxcount;
45 	uint16_t fa_eos;	/* End Of Search */
46 	uint16_t fa_fixedsize;	/* size of fixed part of a returned entry */
47 	uint32_t fa_lastkey;	/* Last resume key */
48 	int fa_last_entry;	/* offset of last entry */
49 } smb2_find_args_t;
50 
51 static uint32_t smb2_find_entries(smb_request_t *,
52     smb_odir_t *, smb2_find_args_t *);
53 static uint32_t smb2_find_mbc_encode(smb_request_t *,
54     smb_fileinfo_t *, smb2_find_args_t *);
55 
56 /*
57  * Tunable parameter to limit the maximum
58  * number of entries to be returned.
59  */
60 uint16_t smb2_find_max = 128;
61 
62 smb_sdrc_t
63 smb2_query_dir(smb_request_t *sr)
64 {
65 	smb2_find_args_t		args;
66 	smb_odir_resume_t	odir_resume;
67 	smb_ofile_t *of = NULL;
68 	smb_odir_t *od = NULL;
69 	char *pattern = NULL;
70 	uint16_t StructSize;
71 	uint32_t FileIndex;
72 	uint16_t NameOffset;
73 	uint16_t NameLength;
74 	smb2fid_t smb2fid;
75 	uint16_t sattr = SMB_SEARCH_ATTRIBUTES;
76 	uint16_t DataOff;
77 	uint32_t DataLen;
78 	uint32_t status;
79 	int skip, rc = 0;
80 
81 	bzero(&args, sizeof (args));
82 	bzero(&odir_resume, sizeof (odir_resume));
83 
84 	/*
85 	 * SMB2 Query Directory request
86 	 */
87 	rc = smb_mbc_decodef(
88 	    &sr->smb_data, "wbblqqwwl",
89 	    &StructSize,		/* w */
90 	    &args.fa_infoclass,		/* b */
91 	    &args.fa_fflags,		/* b */
92 	    &FileIndex,			/* l */
93 	    &smb2fid.persistent,	/* q */
94 	    &smb2fid.temporal,		/* q */
95 	    &NameOffset,		/* w */
96 	    &NameLength,		/* w */
97 	    &args.fa_maxdata);		/* l */
98 	if (rc || StructSize != 33)
99 		return (SDRC_ERROR);
100 
101 	status = smb2sr_lookup_fid(sr, &smb2fid);
102 	if (status)
103 		goto errout;
104 	of = sr->fid_ofile;
105 
106 	/*
107 	 * If there's an input buffer (search pattern), decode it.
108 	 * Two times MAXNAMELEN because it represents the UNICODE string
109 	 * length in bytes.
110 	 */
111 	if (NameLength >= (2 * MAXNAMELEN)) {
112 		status = NT_STATUS_OBJECT_PATH_INVALID;
113 		goto errout;
114 	}
115 	if (NameLength != 0) {
116 		/*
117 		 * We're normally positioned at the pattern now,
118 		 * but there could be some padding before it.
119 		 */
120 		skip = (sr->smb2_cmd_hdr + NameOffset) -
121 		    sr->smb_data.chain_offset;
122 		if (skip < 0) {
123 			status = NT_STATUS_OBJECT_PATH_INVALID;
124 			goto errout;
125 		}
126 		if (skip > 0)
127 			(void) smb_mbc_decodef(&sr->smb_data, "#.", skip);
128 		rc = smb_mbc_decodef(&sr->smb_data, "%#U", sr,
129 		    NameLength, &pattern);
130 		if (rc || pattern == NULL) {
131 			status = NT_STATUS_OBJECT_PATH_INVALID;
132 			goto errout;
133 		}
134 	} else
135 		pattern = "*";
136 
137 	/*
138 	 * Setup the output buffer.
139 	 */
140 	if (args.fa_maxdata > smb2_max_trans)
141 		args.fa_maxdata = smb2_max_trans;
142 	sr->raw_data.max_bytes = args.fa_maxdata;
143 
144 	/*
145 	 * Get the mininum size of entries we will return, which
146 	 * lets us estimate the number of entries we'll need.
147 	 * This should be the size with a one character name.
148 	 * Compare w/ smb2_find_get_maxdata().
149 	 *
150 	 * Also use this opportunity to validate fa_infoclass.
151 	 */
152 
153 	switch (args.fa_infoclass) {
154 	case FileDirectoryInformation:		/* 1 */
155 		args.fa_fixedsize = 64;
156 		break;
157 	case FileFullDirectoryInformation:	/* 2 */
158 		args.fa_fixedsize = 68;
159 		break;
160 	case FileBothDirectoryInformation:	/* 3 */
161 		args.fa_fixedsize = 94;
162 		break;
163 	case FileNamesInformation:		/* 12 */
164 		args.fa_fixedsize = 12;
165 		break;
166 	case FileIdBothDirectoryInformation:	/* 37 */
167 		args.fa_fixedsize = 96;
168 		break;
169 	case FileIdFullDirectoryInformation:	/* 38 */
170 		args.fa_fixedsize = 84;
171 		break;
172 	default:
173 		status = NT_STATUS_INVALID_INFO_CLASS;
174 		goto errout;
175 	}
176 
177 	args.fa_maxcount = args.fa_maxdata / (args.fa_fixedsize + 4);
178 	if (args.fa_maxcount == 0)
179 		args.fa_maxcount = 1;
180 	if ((smb2_find_max != 0) && (args.fa_maxcount > smb2_find_max))
181 		args.fa_maxcount = smb2_find_max;
182 	if (args.fa_fflags & SMB2_QDIR_FLAG_SINGLE)
183 		args.fa_maxcount = 1;
184 
185 	/*
186 	 * If this ofile does not have an odir yet, get one.
187 	 */
188 	mutex_enter(&of->f_mutex);
189 	if ((od = of->f_odir) == NULL) {
190 		status = smb_odir_openfh(sr, pattern, sattr, &od);
191 		of->f_odir = od;
192 	}
193 	mutex_exit(&of->f_mutex);
194 	if (od == NULL) {
195 		if (status == 0)
196 			status = NT_STATUS_INTERNAL_ERROR;
197 		goto errout;
198 	}
199 
200 	/*
201 	 * "Reopen" sets a new pattern and restart.
202 	 */
203 	if (args.fa_fflags & SMB2_QDIR_FLAG_REOPEN) {
204 		smb_odir_reopen(od, pattern, sattr);
205 	}
206 
207 	/*
208 	 * Set the correct position in the directory.
209 	 */
210 	if (args.fa_fflags & SMB2_QDIR_FLAG_RESTART) {
211 		odir_resume.or_type = SMB_ODIR_RESUME_COOKIE;
212 		odir_resume.or_cookie = 0;
213 	} else if (args.fa_fflags & SMB2_QDIR_FLAG_INDEX) {
214 		odir_resume.or_type = SMB_ODIR_RESUME_COOKIE;
215 		odir_resume.or_cookie = FileIndex;
216 	} else {
217 		odir_resume.or_type = SMB_ODIR_RESUME_CONT;
218 	}
219 	smb_odir_resume_at(od, &odir_resume);
220 	of->f_seek_pos = od->d_offset;
221 
222 	/*
223 	 * The real work of readdir and format conversion.
224 	 */
225 	status = smb2_find_entries(sr, od, &args);
226 
227 	of->f_seek_pos = od->d_offset;
228 
229 	if (status == NT_STATUS_NO_MORE_FILES) {
230 		if (args.fa_fflags & SMB2_QDIR_FLAG_SINGLE) {
231 			status = NT_STATUS_NO_SUCH_FILE;
232 			goto errout;
233 		}
234 		/*
235 		 * This is not an error, but a warning that can be
236 		 * used to tell the client that this data return
237 		 * is the last of the enumeration.  Returning this
238 		 * warning now (with the data) saves the client a
239 		 * round trip that would otherwise be needed to
240 		 * find out it's at the end.
241 		 */
242 		sr->smb2_status = status;
243 		status = 0;
244 	}
245 	if (status)
246 		goto errout;
247 
248 	/*
249 	 * SMB2 Query Directory reply
250 	 */
251 	StructSize = 9;
252 	DataOff = SMB2_HDR_SIZE + 8;
253 	DataLen = MBC_LENGTH(&sr->raw_data);
254 	rc = smb_mbc_encodef(
255 	    &sr->reply, "wwlC",
256 	    StructSize,		/* w */
257 	    DataOff,		/* w */
258 	    DataLen,		/* l */
259 	    &sr->raw_data);	/* C */
260 	if (DataLen == 0)
261 		(void) smb_mbc_encodef(&sr->reply, ".");
262 	if (rc == 0)
263 		return (SDRC_SUCCESS);
264 	status = NT_STATUS_UNSUCCESSFUL;
265 
266 errout:
267 	smb2sr_put_error(sr, status);
268 	return (SDRC_SUCCESS);
269 }
270 
271 /*
272  * smb2_find_entries
273  *
274  * Find and encode up to args->fa_maxcount directory entries.
275  *
276  * Returns:
277  *   NT status
278  */
279 static uint32_t
280 smb2_find_entries(smb_request_t *sr, smb_odir_t *od, smb2_find_args_t *args)
281 {
282 	smb_fileinfo_t	fileinfo;
283 	smb_odir_resume_t odir_resume;
284 	uint16_t	count;
285 	uint16_t	minsize;
286 	uint32_t	status = 0;
287 	int		rc = -1;
288 
289 	/*
290 	 * Let's stop when the remaining space will not hold a
291 	 * minimum size entry.  That's the fixed part plus the
292 	 * storage size of a 1 char unicode string.
293 	 */
294 	minsize = args->fa_fixedsize + 2;
295 
296 	count = 0;
297 	while (count < args->fa_maxcount) {
298 
299 		if (!MBC_ROOM_FOR(&sr->raw_data, minsize)) {
300 			status = NT_STATUS_BUFFER_OVERFLOW;
301 			break;
302 		}
303 
304 		rc = smb_odir_read_fileinfo(sr, od, &fileinfo, &args->fa_eos);
305 		if (rc == ENOENT) {
306 			status = NT_STATUS_NO_MORE_FILES;
307 			break;
308 		}
309 		if (rc != 0) {
310 			status = smb_errno2status(rc);
311 			break;
312 		}
313 		if (args->fa_eos != 0) {
314 			/* The readdir call hit the end. */
315 			status = NT_STATUS_NO_MORE_FILES;
316 			break;
317 		}
318 
319 		status = smb2_find_mbc_encode(sr, &fileinfo, args);
320 		if (status) {
321 			/*
322 			 * We read a directory entry but failed to
323 			 * copy it into the output buffer.  Rewind
324 			 * the directory pointer so this will be
325 			 * the first entry read next time.
326 			 */
327 			bzero(&odir_resume, sizeof (odir_resume));
328 			odir_resume.or_type = SMB_ODIR_RESUME_COOKIE;
329 			odir_resume.or_cookie = args->fa_lastkey;
330 			smb_odir_resume_at(od, &odir_resume);
331 			break;
332 		}
333 
334 		/*
335 		 * Save the offset of the next entry we'll read.
336 		 * If we fail copying, we'll need this offset.
337 		 */
338 		args->fa_lastkey = fileinfo.fi_cookie;
339 		++count;
340 	}
341 
342 	if (count == 0) {
343 		ASSERT(status != 0);
344 	} else {
345 		/*
346 		 * We copied some directory entries, but stopped for
347 		 * NT_STATUS_NO_MORE_FILES, or something.
348 		 *
349 		 * Per [MS-FSCC] sec. 2.4, the last entry in the
350 		 * enumeration MUST have its NextEntryOffset value
351 		 * set to zero.  Overwrite that in the last entry.
352 		 */
353 		(void) smb_mbc_poke(&sr->raw_data,
354 		    args->fa_last_entry, "l", 0);
355 		status = 0;
356 	}
357 
358 	return (status);
359 }
360 
361 /*
362  * smb2_mbc_encode
363  *
364  * This function encodes the mbc for one directory entry.
365  *
366  * The function returns -1 when the max data requested by client
367  * is reached. If the entry is valid and successful encoded, 0
368  * will be returned; otherwise, 1 will be returned.
369  *
370  * We always null terminate the filename. The space for the null
371  * is included in the maxdata calculation and is therefore included
372  * in the next_entry_offset. namelen is the unterminated length of
373  * the filename. For levels except STANDARD and EA_SIZE, if the
374  * filename is ascii the name length returned to the client should
375  * include the null terminator. Otherwise the length returned to
376  * the client should not include the terminator.
377  *
378  * Returns: 0 - data successfully encoded
379  *      NT status
380  */
381 static uint32_t
382 smb2_find_mbc_encode(smb_request_t *sr, smb_fileinfo_t *fileinfo,
383 	smb2_find_args_t *args)
384 {
385 	uint8_t		buf83[26];
386 	smb_msgbuf_t	mb;
387 	int		namelen, padsz;
388 	int		shortlen = 0;
389 	int		rc, starting_offset;
390 	uint32_t	next_entry_offset;
391 	uint32_t	mb_flags = SMB_MSGBUF_UNICODE;
392 	uint32_t	resume_key;
393 
394 	namelen = smb_wcequiv_strlen(fileinfo->fi_name);
395 	if (namelen == -1)
396 		return (NT_STATUS_INTERNAL_ERROR);
397 
398 	/*
399 	 * Keep track of where the last entry starts so we can
400 	 * come back and poke the NextEntryOffset field.  Also,
401 	 * after enumeration finishes, the caller uses this to
402 	 * poke the last entry again with zero to mark it as
403 	 * the end of the enumeration.
404 	 */
405 	starting_offset = sr->raw_data.chain_offset;
406 
407 	/*
408 	 * Technically (per MS-SMB2) resume keys are optional.
409 	 * Windows doesn't need them, but MacOS does.
410 	 */
411 	resume_key = fileinfo->fi_cookie;
412 
413 	/*
414 	 * This switch handles all the "information levels" (formats)
415 	 * that we support.  Note that all formats have the file name
416 	 * placed after some fixed-size data, and the code to write
417 	 * the file name is factored out at the end of this switch.
418 	 */
419 	switch (args->fa_infoclass) {
420 
421 	/* See also: SMB_FIND_FILE_DIRECTORY_INFO */
422 	case FileDirectoryInformation:		/* 1 */
423 		rc = smb_mbc_encodef(
424 		    &sr->raw_data, "llTTTTqqll",
425 		    0,	/* NextEntryOffset (set later) */
426 		    resume_key,
427 		    &fileinfo->fi_crtime,
428 		    &fileinfo->fi_atime,
429 		    &fileinfo->fi_mtime,
430 		    &fileinfo->fi_ctime,
431 		    fileinfo->fi_size,
432 		    fileinfo->fi_alloc_size,
433 		    fileinfo->fi_dosattr,
434 		    namelen);
435 		break;
436 
437 	/* See also: SMB_FIND_FILE_FULL_DIRECTORY_INFO */
438 	case FileFullDirectoryInformation:	/* 2 */
439 		rc = smb_mbc_encodef(
440 		    &sr->raw_data, "llTTTTqqlll",
441 		    0,	/* NextEntryOffset (set later) */
442 		    resume_key,
443 		    &fileinfo->fi_crtime,
444 		    &fileinfo->fi_atime,
445 		    &fileinfo->fi_mtime,
446 		    &fileinfo->fi_ctime,
447 		    fileinfo->fi_size,
448 		    fileinfo->fi_alloc_size,
449 		    fileinfo->fi_dosattr,
450 		    namelen,
451 		    0L);	/* EaSize */
452 		break;
453 
454 	/* See also: SMB_FIND_FILE_ID_FULL_DIRECTORY_INFO */
455 	case FileIdFullDirectoryInformation:	/* 38 */
456 		rc = smb_mbc_encodef(
457 		    &sr->raw_data, "llTTTTqqllllq",
458 		    0,	/* NextEntryOffset (set later) */
459 		    resume_key,
460 		    &fileinfo->fi_crtime,
461 		    &fileinfo->fi_atime,
462 		    &fileinfo->fi_mtime,
463 		    &fileinfo->fi_ctime,
464 		    fileinfo->fi_size,
465 		    fileinfo->fi_alloc_size,
466 		    fileinfo->fi_dosattr,
467 		    namelen,
468 		    0L,		/* EaSize */
469 		    0L,		/* reserved */
470 		    fileinfo->fi_nodeid);
471 		break;
472 
473 	/* See also: SMB_FIND_FILE_BOTH_DIRECTORY_INFO */
474 	case FileBothDirectoryInformation:	/* 3 */
475 		bzero(buf83, sizeof (buf83));
476 		smb_msgbuf_init(&mb, buf83, sizeof (buf83), mb_flags);
477 		if (!smb_msgbuf_encode(&mb, "U", fileinfo->fi_shortname))
478 			shortlen = smb_wcequiv_strlen(fileinfo->fi_shortname);
479 
480 		rc = smb_mbc_encodef(
481 		    &sr->raw_data, "llTTTTqqlllb.24c",
482 		    0,	/* NextEntryOffset (set later) */
483 		    resume_key,
484 		    &fileinfo->fi_crtime,
485 		    &fileinfo->fi_atime,
486 		    &fileinfo->fi_mtime,
487 		    &fileinfo->fi_ctime,
488 		    fileinfo->fi_size,
489 		    fileinfo->fi_alloc_size,
490 		    fileinfo->fi_dosattr,
491 		    namelen,
492 		    0L,		/* EaSize */
493 		    shortlen,
494 		    buf83);
495 
496 		smb_msgbuf_term(&mb);
497 		break;
498 
499 	/* See also: SMB_FIND_FILE_ID_BOTH_DIRECTORY_INFO */
500 	case FileIdBothDirectoryInformation:	/* 37 */
501 		bzero(buf83, sizeof (buf83));
502 		smb_msgbuf_init(&mb, buf83, sizeof (buf83), mb_flags);
503 		if (!smb_msgbuf_encode(&mb, "U", fileinfo->fi_shortname))
504 			shortlen = smb_wcequiv_strlen(fileinfo->fi_shortname);
505 
506 		rc = smb_mbc_encodef(
507 		    &sr->raw_data, "llTTTTqqlllb.24c..q",
508 		    0,	/* NextEntryOffset (set later) */
509 		    resume_key,
510 		    &fileinfo->fi_crtime,
511 		    &fileinfo->fi_atime,
512 		    &fileinfo->fi_mtime,
513 		    &fileinfo->fi_ctime,
514 		    fileinfo->fi_size,		/* q */
515 		    fileinfo->fi_alloc_size,	/* q */
516 		    fileinfo->fi_dosattr,	/* l */
517 		    namelen,			/* l */
518 		    0L,		/* EaSize	   l */
519 		    shortlen,			/* b. */
520 		    buf83,			/* 24c */
521 		    /* reserved			   .. */
522 		    fileinfo->fi_nodeid);	/* q */
523 
524 		smb_msgbuf_term(&mb);
525 		break;
526 
527 	/* See also: SMB_FIND_FILE_NAMES_INFO */
528 	case FileNamesInformation:		/* 12 */
529 		rc = smb_mbc_encodef(
530 		    &sr->raw_data, "lll",
531 		    0,	/* NextEntryOffset (set later) */
532 		    resume_key,
533 		    namelen);
534 		break;
535 
536 	default:
537 		return (NT_STATUS_INVALID_INFO_CLASS);
538 	}
539 	if (rc)	/* smb_mbc_encodef failed */
540 		return (NT_STATUS_BUFFER_OVERFLOW);
541 
542 	/*
543 	 * At this point we have written all the fixed-size data
544 	 * for the specified info. class.  Now put the name and
545 	 * alignment padding, and then patch the NextEntryOffset.
546 	 * Also store this offset for the caller so they can
547 	 * patch this (again) to zero on the very last entry.
548 	 */
549 	rc = smb_mbc_encodef(
550 	    &sr->raw_data, "U",
551 	    fileinfo->fi_name);
552 	if (rc)
553 		return (NT_STATUS_BUFFER_OVERFLOW);
554 
555 	/* Next entry needs to be 8-byte aligned. */
556 	padsz = sr->raw_data.chain_offset & 7;
557 	if (padsz) {
558 		padsz = 8 - padsz;
559 		(void) smb_mbc_encodef(&sr->raw_data, "#.", padsz);
560 	}
561 	next_entry_offset = sr->raw_data.chain_offset -	starting_offset;
562 	(void) smb_mbc_poke(&sr->raw_data, starting_offset, "l",
563 	    next_entry_offset);
564 	args->fa_last_entry = starting_offset;
565 
566 	return (0);
567 }
568