xref: /illumos-gate/usr/src/uts/common/fs/smbsrv/smb_delete.c (revision 47842382d52f28aa3173aa6b511781c322ccb6a2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <smbsrv/smb_incl.h>
27 #include <smbsrv/smb_fsops.h>
28 #include <smbsrv/smbinfo.h>
29 #include <sys/nbmlock.h>
30 
31 static int smb_delete_check_path(smb_request_t *, boolean_t *);
32 static int smb_delete_single_file(smb_request_t *, smb_error_t *);
33 static int smb_delete_multiple_files(smb_request_t *, smb_error_t *);
34 static int smb_delete_find_fname(smb_request_t *, smb_odir_t *);
35 static int smb_delete_check_attr(smb_request_t *, smb_error_t *);
36 static int smb_delete_remove_file(smb_request_t *, smb_error_t *);
37 
38 static void smb_delete_error(smb_error_t *, uint32_t, uint16_t, uint16_t);
39 
40 /*
41  * smb_com_delete
42  *
43  * The delete file message is sent to delete a data file. The appropriate
44  * Tid and additional pathname are passed. Read only files may not be
45  * deleted, the read-only attribute must be reset prior to file deletion.
46  *
47  * NT supports a hidden permission known as File Delete Child (FDC). If
48  * the user has FullControl access to a directory, the user is permitted
49  * to delete any object in the directory regardless of the permissions
50  * on the object.
51  *
52  * Client Request                     Description
53  * ================================== =================================
54  * UCHAR WordCount;                   Count of parameter words = 1
55  * USHORT SearchAttributes;
56  * USHORT ByteCount;                  Count of data bytes; min = 2
57  * UCHAR BufferFormat;                0x04
58  * STRING FileName[];                 File name
59  *
60  * Multiple files may be deleted in response to a single request as
61  * SMB_COM_DELETE supports wildcards
62  *
63  * SearchAttributes indicates the attributes that the target file(s) must
64  * have. If the attribute is zero then only normal files are deleted. If
65  * the system file or hidden attributes are specified then the delete is
66  * inclusive -both the specified type(s) of files and normal files are
67  * deleted. Attributes are described in the "Attribute Encoding" section
68  * of this document.
69  *
70  * If bit0 of the Flags2 field of the SMB header is set, a pattern is
71  * passed in, and the file has a long name, then the passed pattern  much
72  * match the long file name for the delete to succeed. If bit0 is clear, a
73  * pattern is passed in, and the file has a long name, then the passed
74  * pattern must match the file's short name for the deletion to succeed.
75  *
76  * Server Response                    Description
77  * ================================== =================================
78  * UCHAR WordCount;                   Count of parameter words = 0
79  * USHORT ByteCount;                  Count of data bytes = 0
80  *
81  * 4.2.10.1  Errors
82  *
83  * ERRDOS/ERRbadpath
84  * ERRDOS/ERRbadfile
85  * ERRDOS/ERRnoaccess
86  * ERRDOS/ERRbadshare	# returned by NT for files that are already open
87  * ERRHRD/ERRnowrite
88  * ERRSRV/ERRaccess
89  * ERRSRV/ERRinvdevice
90  * ERRSRV/ERRinvid
91  * ERRSRV/ERRbaduid
92  */
93 smb_sdrc_t
94 smb_pre_delete(smb_request_t *sr)
95 {
96 	int rc;
97 	smb_fqi_t *fqi;
98 
99 	fqi = &sr->arg.dirop.fqi;
100 
101 	if ((rc = smbsr_decode_vwv(sr, "w", &fqi->srch_attr)) == 0)
102 		rc = smbsr_decode_data(sr, "%S", sr, &fqi->path);
103 
104 	DTRACE_SMB_2(op__Delete__start, smb_request_t *, sr, smb_fqi_t *, fqi);
105 
106 	return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
107 }
108 
109 void
110 smb_post_delete(smb_request_t *sr)
111 {
112 	DTRACE_SMB_1(op__Delete__done, smb_request_t *, sr);
113 }
114 
115 /*
116  * smb_com_delete
117  *
118  * 1. pre-process pathname -  smb_delete_check_path()
119  *    checks dot, bad path syntax, wildcards in path
120  *
121  * 2. process the path to get directory node & last_comp,
122  *    store these in fqi
123  *    - If smb_pathname_reduce cannot find the specified path,
124  *      the error (ENOTDIR) is translated to NT_STATUS_OBJECT_PATH_NOT_FOUND
125  *      if the target is a single file (no wildcards).  If there are
126  *      wildcards in the last_comp, NT_STATUS_OBJECT_NAME_NOT_FOUND is
127  *      used instead.
128  *    - If the directory node is the mount point and the last component
129  *      is ".." NT_STATUS_OBJECT_PATH_SYNTAX_BAD is returned.
130  *
131  * 3. check access permissions
132  *
133  * 4. invoke the appropriate deletion routine to find and remove
134  *    the specified file(s).
135  *    - if target is a single file (no wildcards) - smb_delete_single_file
136  *    - if the target contains wildcards - smb_delete_multiple_files
137  *
138  * Returns: SDRC_SUCCESS or SDRC_ERROR
139  */
140 smb_sdrc_t
141 smb_com_delete(smb_request_t *sr)
142 {
143 	int rc;
144 	smb_error_t err;
145 	uint32_t status;
146 	boolean_t wildcards;
147 	smb_fqi_t *fqi;
148 
149 	fqi = &sr->arg.dirop.fqi;
150 
151 	if (smb_delete_check_path(sr, &wildcards) != 0)
152 		return (SDRC_ERROR);
153 
154 	rc = smb_pathname_reduce(sr, sr->user_cr, fqi->path,
155 	    sr->tid_tree->t_snode, sr->tid_tree->t_snode,
156 	    &fqi->dir_snode, fqi->last_comp);
157 	if (rc == 0) {
158 		if (fqi->dir_snode->vp->v_type != VDIR) {
159 			smb_node_release(fqi->dir_snode);
160 			rc = ENOTDIR;
161 		}
162 	}
163 	if (rc != 0) {
164 		if (rc == ENOTDIR) {
165 			if (wildcards)
166 				status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
167 			else
168 				status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
169 			smbsr_error(sr, status, ERRDOS, ERROR_FILE_NOT_FOUND);
170 		} else {
171 			smbsr_errno(sr, rc);
172 		}
173 
174 		return (SDRC_ERROR);
175 	}
176 
177 	if ((fqi->dir_snode == sr->tid_tree->t_snode) &&
178 	    (strcmp(fqi->last_comp, "..") == 0)) {
179 		smb_node_release(fqi->dir_snode);
180 		smbsr_error(sr, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
181 		    ERRDOS, ERROR_BAD_PATHNAME);
182 		return (SDRC_ERROR);
183 	}
184 
185 	rc = smb_fsop_access(sr, sr->user_cr, fqi->dir_snode,
186 	    FILE_LIST_DIRECTORY);
187 	if (rc != 0) {
188 		smb_node_release(fqi->dir_snode);
189 		smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
190 		    ERRDOS, ERROR_ACCESS_DENIED);
191 		return (SDRC_ERROR);
192 	}
193 
194 	if (wildcards)
195 		rc = smb_delete_multiple_files(sr, &err);
196 	else
197 		rc = smb_delete_single_file(sr, &err);
198 
199 	smb_node_release(fqi->dir_snode);
200 
201 	if (rc != 0)
202 		smbsr_set_error(sr, &err);
203 	else
204 		rc = smbsr_encode_empty_result(sr);
205 
206 	return (rc == 0 ? SDRC_SUCCESS : SDRC_ERROR);
207 }
208 
209 /*
210  * smb_delete_single_file
211  *
212  * Find the specified file and, if its attributes match the search
213  * criteria, delete it.
214  *
215  * Returns 0 - success (file deleted)
216  *        -1 - error, err is populated with error details
217  */
218 static int
219 smb_delete_single_file(smb_request_t *sr, smb_error_t *err)
220 {
221 	smb_fqi_t *fqi;
222 	smb_attr_t ret_attr;
223 	uint32_t status;
224 
225 	fqi = &sr->arg.dirop.fqi;
226 
227 	status = smb_validate_object_name(fqi->path, 0);
228 	if (status != NT_STATUS_SUCCESS) {
229 		smb_delete_error(err, status, ERRDOS, ERROR_INVALID_NAME);
230 		return (-1);
231 	}
232 
233 	if (smb_fsop_lookup_name(sr, sr->user_cr, 0, sr->tid_tree->t_snode,
234 	    fqi->dir_snode, fqi->last_comp, &fqi->last_snode, &ret_attr) != 0) {
235 		smb_delete_error(err, NT_STATUS_OBJECT_NAME_NOT_FOUND,
236 		    ERRDOS, ERROR_FILE_NOT_FOUND);
237 		return (-1);
238 	}
239 
240 	if (smb_delete_check_attr(sr, err) != 0) {
241 		smb_node_release(fqi->last_snode);
242 		return (-1);
243 	}
244 
245 	if (smb_delete_remove_file(sr, err) != 0) {
246 		smb_node_release(fqi->last_snode);
247 		return (-1);
248 	}
249 
250 	smb_node_release(fqi->last_snode);
251 	return (0);
252 }
253 
254 /*
255  * smb_delete_multiple_files
256  *
257  * For each matching file found by smb_delete_find_fname:
258  * 1. lookup file
259  * 2. check the file's attributes
260  *    - The search ends with an error if a readonly file
261  *      (NT_STATUS_CANNOT_DELETE) is matched.
262  *    - The search ends (but not an error) if a directory is
263  *      matched and the request's search did not include
264  *      directories.
265  *    - Otherwise, if smb_delete_check_attr fails the file
266  *      is skipped and the search continues (at step 1)
267  * 3. delete the file
268  *
269  * Returns 0 - success
270  *        -1 - error, err is populated with error details
271  */
272 static int
273 smb_delete_multiple_files(smb_request_t *sr, smb_error_t *err)
274 {
275 	int rc, deleted = 0;
276 	smb_fqi_t *fqi;
277 	smb_attr_t ret_attr;
278 	uint16_t odid;
279 	smb_odir_t *od;
280 
281 	fqi = &sr->arg.dirop.fqi;
282 
283 	/*
284 	 * Specify all search attributes (SMB_SEARCH_ATTRIBUTES) so that
285 	 * delete-specific checking can be done (smb_delete_check_attr).
286 	 */
287 	if ((odid = smb_odir_open(sr, fqi->path, SMB_SEARCH_ATTRIBUTES)) == 0)
288 		return (-1);
289 	if ((od = smb_tree_lookup_odir(sr->tid_tree, odid)) == NULL)
290 		return (-1);
291 
292 	for (;;) {
293 		rc = smb_delete_find_fname(sr, od);
294 		if (rc != 0)
295 			break;
296 
297 		rc = smb_fsop_lookup_name(sr, sr->user_cr, 0,
298 		    sr->tid_tree->t_snode, fqi->dir_snode,
299 		    fqi->last_comp_od, &fqi->last_snode, &ret_attr);
300 		if (rc != 0)
301 			break;
302 
303 		if (smb_delete_check_attr(sr, err) != 0) {
304 			smb_node_release(fqi->last_snode);
305 			if (err->status == NT_STATUS_CANNOT_DELETE) {
306 				smb_odir_release(od);
307 				smb_odir_close(od);
308 				return (-1);
309 			}
310 			if ((err->status == NT_STATUS_FILE_IS_A_DIRECTORY) &&
311 			    (SMB_SEARCH_DIRECTORY(fqi->srch_attr) != 0))
312 				break;
313 			continue;
314 		}
315 
316 		if (smb_delete_remove_file(sr, err) == 0) {
317 			++deleted;
318 			smb_node_release(fqi->last_snode);
319 			continue;
320 		}
321 		if (err->status == NT_STATUS_OBJECT_NAME_NOT_FOUND) {
322 			smb_node_release(fqi->last_snode);
323 			continue;
324 		}
325 
326 		smb_odir_release(od);
327 		smb_odir_close(od);
328 		smb_node_release(fqi->last_snode);
329 		return (-1);
330 	}
331 
332 	smb_odir_release(od);
333 	smb_odir_close(od);
334 
335 	if ((rc != 0) && (rc != ENOENT)) {
336 		smbsr_map_errno(rc, err);
337 		return (-1);
338 	}
339 
340 	if (deleted == 0) {
341 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
342 		    ERRDOS, ERROR_FILE_NOT_FOUND);
343 		return (-1);
344 	}
345 
346 	return (0);
347 }
348 
349 /*
350  * smb_delete_find_fname
351  *
352  * Find next filename that matches search pattern (fqi->last_comp)
353  * and save it in fqi->last_comp_od.
354  *
355  * Case insensitivity note:
356  * If the tree is case insensitive and there's a case conflict
357  * with the name returned from smb_odir_read, smb_delete_find_fname
358  * performs case conflict name mangling to produce a unique filename.
359  * This ensures that any subsequent smb_fsop_lookup, (which will
360  * find the first case insensitive match) will find the correct file.
361  *
362  * Returns: 0 - success
363  *          errno
364  */
365 static int
366 smb_delete_find_fname(smb_request_t *sr, smb_odir_t *od)
367 {
368 	int		rc;
369 	smb_odirent_t	*odirent;
370 	boolean_t	eos;
371 	char		*name;
372 	char		shortname[SMB_SHORTNAMELEN];
373 	char		name83[SMB_SHORTNAMELEN];
374 	smb_fqi_t	*fqi;
375 
376 	fqi = &sr->arg.dirop.fqi;
377 	odirent = kmem_alloc(sizeof (smb_odirent_t), KM_SLEEP);
378 
379 	rc = smb_odir_read(sr, od, odirent, &eos);
380 	if (rc != 0) {
381 		kmem_free(odirent, sizeof (smb_odirent_t));
382 		return (rc);
383 	}
384 	if (eos) {
385 		kmem_free(odirent, sizeof (smb_odirent_t));
386 		return (ENOENT);
387 	}
388 
389 	/* if case conflict, force mangle and use shortname */
390 	if ((od->d_ignore_case) && (odirent->od_eflags & ED_CASE_CONFLICT)) {
391 		(void) smb_mangle_name(odirent->od_ino, odirent->od_name,
392 		    shortname, name83, 1);
393 		name = shortname;
394 	} else {
395 		name = odirent->od_name;
396 	}
397 	(void) strlcpy(fqi->last_comp_od, name, sizeof (fqi->last_comp_od));
398 
399 	kmem_free(odirent, sizeof (smb_odirent_t));
400 	return (0);
401 }
402 
403 /*
404  * smb_delete_check_attr
405  *
406  * Check file's dos atributes to ensure that
407  * 1. the file is not a directory - NT_STATUS_FILE_IS_A_DIRECTORY
408  * 2. the file is not readonly - NT_STATUS_CANNOT_DELETE
409  * 3. the file's dos attributes comply with the specified search attributes
410  *     If the file is either hidden or system and those attributes
411  *     are not specified in the search attributes - NT_STATUS_NO_SUCH_FILE
412  *
413  * Returns: 0 - file's attributes pass all checks
414  *         -1 - err populated with error details
415  */
416 static int
417 smb_delete_check_attr(smb_request_t *sr, smb_error_t *err)
418 {
419 	smb_fqi_t *fqi;
420 	smb_node_t *node;
421 	uint16_t dosattr, sattr;
422 
423 	fqi = &sr->arg.dirop.fqi;
424 	sattr = fqi->srch_attr;
425 	node = fqi->last_snode;
426 	dosattr = smb_node_get_dosattr(node);
427 
428 	if (dosattr & FILE_ATTRIBUTE_DIRECTORY) {
429 		smb_delete_error(err, NT_STATUS_FILE_IS_A_DIRECTORY,
430 		    ERRDOS, ERROR_ACCESS_DENIED);
431 		return (-1);
432 	}
433 
434 	if (SMB_PATHFILE_IS_READONLY(sr, node)) {
435 		smb_delete_error(err, NT_STATUS_CANNOT_DELETE,
436 		    ERRDOS, ERROR_ACCESS_DENIED);
437 		return (-1);
438 	}
439 
440 	if ((dosattr & FILE_ATTRIBUTE_HIDDEN) && !(SMB_SEARCH_HIDDEN(sattr))) {
441 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
442 		    ERRDOS, ERROR_FILE_NOT_FOUND);
443 		return (-1);
444 	}
445 
446 	if ((dosattr & FILE_ATTRIBUTE_SYSTEM) && !(SMB_SEARCH_SYSTEM(sattr))) {
447 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
448 		    ERRDOS, ERROR_FILE_NOT_FOUND);
449 		return (-1);
450 	}
451 
452 	return (0);
453 }
454 
455 /*
456  * smb_delete_remove_file
457  *
458  * For consistency with Windows 2000, the range check should be done
459  * after checking for sharing violations.  Attempting to delete a
460  * locked file will result in sharing violation, which is the same
461  * thing that will happen if you try to delete a non-locked open file.
462  *
463  * Note that windows 2000 rejects lock requests on open files that
464  * have been opened with metadata open modes.  The error is
465  * STATUS_ACCESS_DENIED.
466  *
467  * NT does not always close a file immediately, which can cause the
468  * share and access checking to fail (the node refcnt is greater
469  * than one), and the file doesn't get deleted. Breaking the oplock
470  * before share and access checking gives the client a chance to
471  * close the file.
472  *
473  * Returns: 0 - success
474  *         -1 - error, err populated with error details
475  */
476 static int
477 smb_delete_remove_file(smb_request_t *sr, smb_error_t *err)
478 {
479 	int rc;
480 	uint32_t status;
481 	smb_fqi_t *fqi;
482 	smb_node_t *node;
483 
484 	fqi = &sr->arg.dirop.fqi;
485 	node = fqi->last_snode;
486 
487 	smb_oplock_break(node);
488 
489 	smb_node_start_crit(node, RW_READER);
490 
491 	status = smb_node_delete_check(node);
492 	if (status != NT_STATUS_SUCCESS) {
493 		smb_delete_error(err, NT_STATUS_SHARING_VIOLATION,
494 		    ERRDOS, ERROR_SHARING_VIOLATION);
495 		smb_node_end_crit(node);
496 		return (-1);
497 	}
498 
499 	status = smb_range_check(sr, node, 0, UINT64_MAX, B_TRUE);
500 	if (status != NT_STATUS_SUCCESS) {
501 		smb_delete_error(err, NT_STATUS_ACCESS_DENIED,
502 		    ERRDOS, ERROR_ACCESS_DENIED);
503 		smb_node_end_crit(node);
504 		return (-1);
505 	}
506 
507 	rc = smb_fsop_remove(sr, sr->user_cr, node->dir_snode,
508 	    node->od_name, 1);
509 	if (rc != 0) {
510 		if (rc == ENOENT)
511 			smb_delete_error(err, NT_STATUS_OBJECT_NAME_NOT_FOUND,
512 			    ERRDOS, ERROR_FILE_NOT_FOUND);
513 		else
514 			smbsr_map_errno(rc, err);
515 
516 		smb_node_end_crit(node);
517 		return (-1);
518 	}
519 
520 	smb_node_end_crit(node);
521 	return (0);
522 }
523 
524 
525 /*
526  * smb_delete_check_path
527  *
528  * Perform initial validation on the pathname and last_comp.
529  *
530  * wildcards in path:
531  * Wildcards in the path (excluding the last_comp) should result
532  * in NT_STATUS_OBJECT_NAME_INVALID.
533  *
534  * bad path syntax:
535  * On unix .. at the root of a file system links to the root. Thus
536  * an attempt to lookup "/../../.." will be the same as looking up "/"
537  * CIFs clients expect the above to result in
538  * NT_STATUS_OBJECT_PATH_SYNTAX_BAD. It is currently not possible
539  * (and questionable if it's desirable) to deal with all cases
540  * but paths beginning with \\.. are handled. See bad_paths[].
541  * Cases like "\\dir\\..\\.." will be caught and handled after the
542  * pnreduce.  Cases like "\\dir\\..\\..\\filename" will still result
543  * in "\\filename" which is contrary to windows behavior.
544  *
545  * dot:
546  * A filename of '.' should result in NT_STATUS_OBJECT_NAME_INVALID
547  * Any wildcard filename that resolves to '.' should result in
548  * NT_STATUS_OBJECT_NAME_INVALID if the search attributes include
549  * FILE_ATTRIBUTE_DIRECTORY
550  *
551  * Returns:
552  *   0:  path is valid. Sets *wildcard to TRUE if wildcard delete
553  *	         i.e. if wildcards in last component
554  *  -1: path is invalid. Sets error information in sr.
555  */
556 static int
557 smb_delete_check_path(smb_request_t *sr, boolean_t *wildcard)
558 {
559 	smb_fqi_t *fqi = &sr->arg.dirop.fqi;
560 	char *p, *last_comp;
561 	int i, wildcards;
562 
563 	struct {
564 		char *name;
565 		int len;
566 	} *bad, bad_paths[] = {
567 		{"\\..\0", 4},
568 		{"\\..\\", 4},
569 		{"..\0", 3},
570 		{"..\\", 3}
571 	};
572 
573 	/* check for wildcards in path */
574 	wildcards = smb_convert_unicode_wildcards(fqi->path);
575 
576 	/* find last component, strip trailing '\\' */
577 	p = fqi->path + strlen(fqi->path) - 1;
578 	while (*p == '\\') {
579 		*p = '\0';
580 		--p;
581 	}
582 	if ((p = strrchr(fqi->path, '\\')) == NULL) {
583 		last_comp = fqi->path;
584 	} else {
585 		last_comp = ++p;
586 
587 		/* wildcards in path > wildcards in last_comp */
588 		if (smb_convert_unicode_wildcards(last_comp) != wildcards) {
589 			smbsr_error(sr, NT_STATUS_OBJECT_NAME_INVALID,
590 			    ERRDOS, ERROR_INVALID_NAME);
591 			return (-1);
592 		}
593 	}
594 
595 	/* path above the mount point */
596 	for (i = 0; i < sizeof (bad_paths) / sizeof (bad_paths[0]); ++i) {
597 		bad = &bad_paths[i];
598 		if (strncmp(fqi->path, bad->name, bad->len) == 0) {
599 			smbsr_error(sr, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
600 			    ERRDOS, ERROR_BAD_PATHNAME);
601 			return (-1);
602 		}
603 	}
604 
605 	/* last component is, or resolves to, '.' (dot) */
606 	if ((strcmp(last_comp, ".") == 0) ||
607 	    (SMB_SEARCH_DIRECTORY(fqi->srch_attr) &&
608 	    (smb_match(last_comp, ".")))) {
609 		smbsr_error(sr, NT_STATUS_OBJECT_NAME_INVALID,
610 		    ERRDOS, ERROR_INVALID_NAME);
611 		return (-1);
612 	}
613 
614 	*wildcard = (wildcards != 0);
615 	return (0);
616 }
617 
618 /*
619  * smb_delete_error
620  */
621 static void
622 smb_delete_error(smb_error_t *err,
623     uint32_t status, uint16_t errcls, uint16_t errcode)
624 {
625 	err->severity = ERROR_SEVERITY_ERROR;
626 	err->status = status;
627 	err->errcls = errcls;
628 	err->errcode = errcode;
629 }
630