xref: /titanic_41/usr/src/uts/common/fs/smbsrv/smb_delete.c (revision e11c3f44f531fdff80941ce57c065d2ae861cefc)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <smbsrv/smb_incl.h>
27 #include <smbsrv/smb_fsops.h>
28 #include <smbsrv/smbinfo.h>
29 #include <sys/nbmlock.h>
30 
31 static int smb_delete_check_path(smb_request_t *, boolean_t *);
32 static int smb_delete_single_file(smb_request_t *, smb_error_t *);
33 static int smb_delete_multiple_files(smb_request_t *, smb_error_t *);
34 static int smb_delete_find_fname(smb_request_t *, uint32_t *);
35 static int smb_delete_check_attr(smb_request_t *, smb_error_t *);
36 static int smb_delete_remove_file(smb_request_t *, smb_error_t *);
37 
38 static void smb_delete_error(smb_error_t *, uint32_t, uint16_t, uint16_t);
39 
40 /*
41  * smb_com_delete
42  *
43  * The delete file message is sent to delete a data file. The appropriate
44  * Tid and additional pathname are passed. Read only files may not be
45  * deleted, the read-only attribute must be reset prior to file deletion.
46  *
47  * NT supports a hidden permission known as File Delete Child (FDC). If
48  * the user has FullControl access to a directory, the user is permitted
49  * to delete any object in the directory regardless of the permissions
50  * on the object.
51  *
52  * Client Request                     Description
53  * ================================== =================================
54  * UCHAR WordCount;                   Count of parameter words = 1
55  * USHORT SearchAttributes;
56  * USHORT ByteCount;                  Count of data bytes; min = 2
57  * UCHAR BufferFormat;                0x04
58  * STRING FileName[];                 File name
59  *
60  * Multiple files may be deleted in response to a single request as
61  * SMB_COM_DELETE supports wildcards
62  *
63  * SearchAttributes indicates the attributes that the target file(s) must
64  * have. If the attribute is zero then only normal files are deleted. If
65  * the system file or hidden attributes are specified then the delete is
66  * inclusive -both the specified type(s) of files and normal files are
67  * deleted. Attributes are described in the "Attribute Encoding" section
68  * of this document.
69  *
70  * If bit0 of the Flags2 field of the SMB header is set, a pattern is
71  * passed in, and the file has a long name, then the passed pattern  much
72  * match the long file name for the delete to succeed. If bit0 is clear, a
73  * pattern is passed in, and the file has a long name, then the passed
74  * pattern must match the file's short name for the deletion to succeed.
75  *
76  * Server Response                    Description
77  * ================================== =================================
78  * UCHAR WordCount;                   Count of parameter words = 0
79  * USHORT ByteCount;                  Count of data bytes = 0
80  *
81  * 4.2.10.1  Errors
82  *
83  * ERRDOS/ERRbadpath
84  * ERRDOS/ERRbadfile
85  * ERRDOS/ERRnoaccess
86  * ERRDOS/ERRbadshare	# returned by NT for files that are already open
87  * ERRHRD/ERRnowrite
88  * ERRSRV/ERRaccess
89  * ERRSRV/ERRinvdevice
90  * ERRSRV/ERRinvid
91  * ERRSRV/ERRbaduid
92  */
93 smb_sdrc_t
94 smb_pre_delete(smb_request_t *sr)
95 {
96 	int rc;
97 	smb_fqi_t *fqi;
98 
99 	fqi = &sr->arg.dirop.fqi;
100 
101 	if ((rc = smbsr_decode_vwv(sr, "w", &fqi->srch_attr)) == 0)
102 		rc = smbsr_decode_data(sr, "%S", sr, &fqi->path);
103 
104 	DTRACE_SMB_2(op__Delete__start, smb_request_t *, sr, smb_fqi_t *, fqi);
105 
106 	return ((rc == 0) ? SDRC_SUCCESS : SDRC_ERROR);
107 }
108 
109 void
110 smb_post_delete(smb_request_t *sr)
111 {
112 	DTRACE_SMB_1(op__Delete__done, smb_request_t *, sr);
113 }
114 
115 /*
116  * smb_com_delete
117  *
118  * 1. pre-process pathname -  smb_delete_check_path()
119  *    checks dot, bad path syntax, wildcards in path
120  *
121  * 2. process the path to get directory node & last_comp,
122  *    store these in fqi
123  *    - If smb_pathname_reduce cannot find the specified path,
124  *      the error (ENOTDIR) is translated to NT_STATUS_OBJECT_PATH_NOT_FOUND
125  *      if the target is a single file (no wildcards).  If there are
126  *      wildcards in the last_comp, NT_STATUS_OBJECT_NAME_NOT_FOUND is
127  *      used instead.
128  *    - If the directory node is the mount point and the last component
129  *      is ".." NT_STATUS_OBJECT_PATH_SYNTAX_BAD is returned.
130  *
131  * 3. check access permissions
132  *
133  * 4. invoke the appropriate deletion routine to find and remove
134  *    the specified file(s).
135  *    - if target is a single file (no wildcards) - smb_delete_single_file
136  *    - if the target contains wildcards - smb_delete_multiple_files
137  *
138  * Returns: SDRC_SUCCESS or SDRC_ERROR
139  */
140 smb_sdrc_t
141 smb_com_delete(smb_request_t *sr)
142 {
143 	int rc;
144 	smb_error_t err;
145 	uint32_t status;
146 	boolean_t wildcards;
147 	smb_fqi_t *fqi;
148 
149 	fqi = &sr->arg.dirop.fqi;
150 
151 	if (smb_delete_check_path(sr, &wildcards) != 0)
152 		return (SDRC_ERROR);
153 
154 	rc = smb_pathname_reduce(sr, sr->user_cr, fqi->path,
155 	    sr->tid_tree->t_snode, sr->tid_tree->t_snode,
156 	    &fqi->dir_snode, fqi->last_comp);
157 	if (rc == 0) {
158 		if (fqi->dir_snode->vp->v_type != VDIR) {
159 			smb_node_release(fqi->dir_snode);
160 			rc = ENOTDIR;
161 		}
162 	}
163 	if (rc != 0) {
164 		if (rc == ENOTDIR) {
165 			if (wildcards)
166 				status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
167 			else
168 				status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
169 			smbsr_error(sr, status, ERRDOS, ERROR_FILE_NOT_FOUND);
170 		} else {
171 			smbsr_errno(sr, rc);
172 		}
173 
174 		return (SDRC_ERROR);
175 	}
176 
177 	if ((fqi->dir_snode == sr->tid_tree->t_snode) &&
178 	    (strcmp(fqi->last_comp, "..") == 0)) {
179 		smb_node_release(fqi->dir_snode);
180 		smbsr_error(sr, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
181 		    ERRDOS, ERROR_BAD_PATHNAME);
182 		return (SDRC_ERROR);
183 	}
184 
185 	rc = smb_fsop_access(sr, sr->user_cr, fqi->dir_snode,
186 	    FILE_LIST_DIRECTORY);
187 	if (rc != 0) {
188 		smb_node_release(fqi->dir_snode);
189 		smbsr_error(sr, NT_STATUS_ACCESS_DENIED,
190 		    ERRDOS, ERROR_ACCESS_DENIED);
191 		return (SDRC_ERROR);
192 	}
193 
194 	if (wildcards)
195 		rc = smb_delete_multiple_files(sr, &err);
196 	else
197 		rc = smb_delete_single_file(sr, &err);
198 
199 	smb_node_release(fqi->dir_snode);
200 
201 	if (rc != 0)
202 		smbsr_set_error(sr, &err);
203 	else
204 		rc = smbsr_encode_empty_result(sr);
205 
206 	return (rc == 0 ? SDRC_SUCCESS : SDRC_ERROR);
207 }
208 
209 /*
210  * smb_delete_single_file
211  *
212  * Find the specified file and, if its attributes match the search
213  * criteria, delete it.
214  *
215  * Returns 0 - success (file deleted)
216  *        -1 - error, err is populated with error details
217  */
218 static int
219 smb_delete_single_file(smb_request_t *sr, smb_error_t *err)
220 {
221 	smb_fqi_t *fqi;
222 	smb_attr_t ret_attr;
223 	uint32_t status;
224 
225 	fqi = &sr->arg.dirop.fqi;
226 
227 	status = smb_validate_object_name(fqi->path, 0);
228 	if (status != NT_STATUS_SUCCESS) {
229 		smb_delete_error(err, status, ERRDOS, ERROR_INVALID_NAME);
230 		return (-1);
231 	}
232 
233 	if (smb_fsop_lookup_name(sr, sr->user_cr, 0, sr->tid_tree->t_snode,
234 	    fqi->dir_snode, fqi->last_comp, &fqi->last_snode, &ret_attr) != 0) {
235 		smb_delete_error(err, NT_STATUS_OBJECT_NAME_NOT_FOUND,
236 		    ERRDOS, ERROR_FILE_NOT_FOUND);
237 		return (-1);
238 	}
239 
240 	if (smb_delete_check_attr(sr, err) != 0) {
241 		smb_node_release(fqi->last_snode);
242 		return (-1);
243 	}
244 
245 	if (smb_delete_remove_file(sr, err) != 0) {
246 		smb_node_release(fqi->last_snode);
247 		return (-1);
248 	}
249 
250 	smb_node_release(fqi->last_snode);
251 	return (0);
252 }
253 
254 /*
255  * smb_delete_multiple_files
256  *
257  * For each matching file found by smb_delete_find_name:
258  * 1. lookup file
259  * 2. check the file's attributes
260  *    - The search ends with an error if a readonly file
261  *      (NT_STATUS_CANNOT_DELETE) is matched.
262  *    - The search ends (but not an error) if a directory is
263  *      matched and the request's search did not include
264  *      directories.
265  *    - Otherwise, if smb_delete_check_attr fails the file
266  *      is skipped and the search continues (at step 1)
267  * 3. delete the file
268  *
269  * Returns 0 - success
270  *        -1 - error, err is populated with error details
271  */
272 static int
273 smb_delete_multiple_files(smb_request_t *sr, smb_error_t *err)
274 {
275 	int rc, deleted = 0;
276 	uint32_t cookie = 0;
277 	smb_fqi_t *fqi;
278 	smb_attr_t ret_attr;
279 
280 	fqi = &sr->arg.dirop.fqi;
281 
282 	for (;;) {
283 		rc = smb_delete_find_fname(sr, &cookie);
284 		if (rc != 0)
285 			break;
286 
287 		rc = smb_fsop_lookup_name(sr, sr->user_cr, 0,
288 		    sr->tid_tree->t_snode, fqi->dir_snode,
289 		    fqi->last_comp_od, &fqi->last_snode, &ret_attr);
290 		if (rc != 0)
291 			break;
292 
293 		if (smb_delete_check_attr(sr, err) != 0) {
294 			smb_node_release(fqi->last_snode);
295 			if (err->status == NT_STATUS_CANNOT_DELETE) {
296 				return (-1);
297 			}
298 			if ((err->status == NT_STATUS_FILE_IS_A_DIRECTORY) &&
299 			    (SMB_SEARCH_DIRECTORY(fqi->srch_attr) != 0))
300 				break;
301 			continue;
302 		}
303 
304 		if (smb_delete_remove_file(sr, err) == 0) {
305 			++deleted;
306 			smb_node_release(fqi->last_snode);
307 			continue;
308 		}
309 		if (err->status == NT_STATUS_OBJECT_NAME_NOT_FOUND) {
310 			smb_node_release(fqi->last_snode);
311 			continue;
312 		}
313 
314 		smb_node_release(fqi->last_snode);
315 		return (-1);
316 	}
317 
318 
319 	if ((rc != 0) && (rc != ENOENT)) {
320 		smbsr_map_errno(rc, err);
321 		return (-1);
322 	}
323 
324 	if (deleted == 0) {
325 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
326 		    ERRDOS, ERROR_FILE_NOT_FOUND);
327 		return (-1);
328 	}
329 
330 	return (0);
331 }
332 
333 /*
334  * smb_delete_find_fname
335  *
336  * Find next filename that matches search pattern (fqi->last_comp)
337  * and save it in fqi->last_comp_od.
338  *
339  * Returns: 0 - success
340  *          errno
341  */
342 static int
343 smb_delete_find_fname(smb_request_t *sr, uint32_t *cookie)
344 {
345 	int rc, n_name;
346 	ino64_t fileid;
347 	smb_fqi_t *fqi;
348 	char name83[SMB_SHORTNAMELEN];
349 	char shortname[SMB_SHORTNAMELEN];
350 	boolean_t ignore_case;
351 
352 	fqi = &sr->arg.dirop.fqi;
353 
354 	ignore_case = SMB_TREE_IS_CASEINSENSITIVE(sr);
355 
356 	for (;;) {
357 		n_name = sizeof (fqi->last_comp_od)  - 1;
358 
359 		rc = smb_fsop_readdir(sr, sr->user_cr, fqi->dir_snode, cookie,
360 		    fqi->last_comp_od, &n_name, &fileid, NULL, NULL, NULL);
361 
362 		if (rc != 0)
363 			return (rc);
364 
365 		/* check for EOF */
366 		if (n_name == 0)
367 			return (ENOENT);
368 
369 		fqi->last_comp_od[n_name] = '\0';
370 
371 		if (smb_match_name(fileid, fqi->last_comp_od, shortname, name83,
372 		    fqi->last_comp, ignore_case))
373 			return (0);
374 	}
375 }
376 
377 /*
378  * smb_delete_check_attr
379  *
380  * Check file's dos atributes to ensure that
381  * 1. the file is not a directory - NT_STATUS_FILE_IS_A_DIRECTORY
382  * 2. the file is not readonly - NT_STATUS_CANNOT_DELETE
383  * 3. the file's dos attributes comply with the specified search attributes
384  *     If the file is either hidden or system and those attributes
385  *     are not specified in the search attributes - NT_STATUS_NO_SUCH_FILE
386  *
387  * Returns: 0 - file's attributes pass all checks
388  *         -1 - err populated with error details
389  */
390 static int
391 smb_delete_check_attr(smb_request_t *sr, smb_error_t *err)
392 {
393 	smb_fqi_t *fqi;
394 	smb_node_t *node;
395 	uint16_t dosattr, sattr;
396 
397 	fqi = &sr->arg.dirop.fqi;
398 	sattr = fqi->srch_attr;
399 	node = fqi->last_snode;
400 	dosattr = smb_node_get_dosattr(node);
401 
402 	if (dosattr & FILE_ATTRIBUTE_DIRECTORY) {
403 		smb_delete_error(err, NT_STATUS_FILE_IS_A_DIRECTORY,
404 		    ERRDOS, ERROR_ACCESS_DENIED);
405 		return (-1);
406 	}
407 
408 	if (SMB_PATHFILE_IS_READONLY(sr, node)) {
409 		smb_delete_error(err, NT_STATUS_CANNOT_DELETE,
410 		    ERRDOS, ERROR_ACCESS_DENIED);
411 		return (-1);
412 	}
413 
414 	if ((dosattr & FILE_ATTRIBUTE_HIDDEN) && !(SMB_SEARCH_HIDDEN(sattr))) {
415 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
416 		    ERRDOS, ERROR_FILE_NOT_FOUND);
417 		return (-1);
418 	}
419 
420 	if ((dosattr & FILE_ATTRIBUTE_SYSTEM) && !(SMB_SEARCH_SYSTEM(sattr))) {
421 		smb_delete_error(err, NT_STATUS_NO_SUCH_FILE,
422 		    ERRDOS, ERROR_FILE_NOT_FOUND);
423 		return (-1);
424 	}
425 
426 	return (0);
427 }
428 
429 /*
430  * smb_delete_remove_file
431  *
432  * For consistency with Windows 2000, the range check should be done
433  * after checking for sharing violations.  Attempting to delete a
434  * locked file will result in sharing violation, which is the same
435  * thing that will happen if you try to delete a non-locked open file.
436  *
437  * Note that windows 2000 rejects lock requests on open files that
438  * have been opened with metadata open modes.  The error is
439  * STATUS_ACCESS_DENIED.
440  *
441  * NT does not always close a file immediately, which can cause the
442  * share and access checking to fail (the node refcnt is greater
443  * than one), and the file doesn't get deleted. Breaking the oplock
444  * before share and access checking gives the client a chance to
445  * close the file.
446  *
447  * Returns: 0 - success
448  *         -1 - error, err populated with error details
449  */
450 static int
451 smb_delete_remove_file(smb_request_t *sr, smb_error_t *err)
452 {
453 	int rc;
454 	uint32_t status;
455 	smb_fqi_t *fqi;
456 	smb_node_t *node;
457 
458 	fqi = &sr->arg.dirop.fqi;
459 	node = fqi->last_snode;
460 
461 	smb_oplock_break(node);
462 
463 	smb_node_start_crit(node, RW_READER);
464 
465 	status = smb_node_delete_check(node);
466 	if (status != NT_STATUS_SUCCESS) {
467 		smb_delete_error(err, NT_STATUS_SHARING_VIOLATION,
468 		    ERRDOS, ERROR_SHARING_VIOLATION);
469 		smb_node_end_crit(node);
470 		return (-1);
471 	}
472 
473 	status = smb_range_check(sr, node, 0, UINT64_MAX, B_TRUE);
474 	if (status != NT_STATUS_SUCCESS) {
475 		smb_delete_error(err, NT_STATUS_ACCESS_DENIED,
476 		    ERRDOS, ERROR_ACCESS_DENIED);
477 		smb_node_end_crit(node);
478 		return (-1);
479 	}
480 
481 	rc = smb_fsop_remove(sr, sr->user_cr, node->dir_snode,
482 	    node->od_name, 1);
483 	if (rc != 0) {
484 		if (rc == ENOENT)
485 			smb_delete_error(err, NT_STATUS_OBJECT_NAME_NOT_FOUND,
486 			    ERRDOS, ERROR_FILE_NOT_FOUND);
487 		else
488 			smbsr_map_errno(rc, err);
489 
490 		smb_node_end_crit(node);
491 		return (-1);
492 	}
493 
494 	smb_node_end_crit(node);
495 	return (0);
496 }
497 
498 
499 /*
500  * smb_delete_check_path
501  *
502  * Perform initial validation on the pathname and last_comp.
503  *
504  * wildcards in path:
505  * Wildcards in the path (excluding the last_comp) should result
506  * in NT_STATUS_OBJECT_NAME_INVALID.
507  *
508  * bad path syntax:
509  * On unix .. at the root of a file system links to the root. Thus
510  * an attempt to lookup "/../../.." will be the same as looking up "/"
511  * CIFs clients expect the above to result in
512  * NT_STATUS_OBJECT_PATH_SYNTAX_BAD. It is currently not possible
513  * (and questionable if it's desirable) to deal with all cases
514  * but paths beginning with \\.. are handled. See bad_paths[].
515  * Cases like "\\dir\\..\\.." will be caught and handled after the
516  * pnreduce.  Cases like "\\dir\\..\\..\\filename" will still result
517  * in "\\filename" which is contrary to windows behavior.
518  *
519  * dot:
520  * A filename of '.' should result in NT_STATUS_OBJECT_NAME_INVALID
521  * Any wildcard filename that resolves to '.' should result in
522  * NT_STATUS_OBJECT_NAME_INVALID if the search attributes include
523  * FILE_ATTRIBUTE_DIRECTORY
524  *
525  * Returns:
526  *   0:  path is valid. Sets *wildcard to TRUE if wildcard delete
527  *	         i.e. if wildcards in last component
528  *  -1: path is invalid. Sets error information in sr.
529  */
530 static int
531 smb_delete_check_path(smb_request_t *sr, boolean_t *wildcard)
532 {
533 	smb_fqi_t *fqi = &sr->arg.dirop.fqi;
534 	char *p, *last_comp;
535 	int i, wildcards;
536 
537 	struct {
538 		char *name;
539 		int len;
540 	} *bad, bad_paths[] = {
541 		{"\\..\0", 4},
542 		{"\\..\\", 4},
543 		{"..\0", 3},
544 		{"..\\", 3}
545 	};
546 
547 	/* check for wildcards in path */
548 	wildcards = smb_convert_unicode_wildcards(fqi->path);
549 
550 	/* find last component, strip trailing '\\' */
551 	p = fqi->path + strlen(fqi->path) - 1;
552 	while (*p == '\\') {
553 		*p = '\0';
554 		--p;
555 	}
556 	if ((p = strrchr(fqi->path, '\\')) == NULL) {
557 		last_comp = fqi->path;
558 	} else {
559 		last_comp = ++p;
560 
561 		/* wildcards in path > wildcards in last_comp */
562 		if (smb_convert_unicode_wildcards(last_comp) != wildcards) {
563 			smbsr_error(sr, NT_STATUS_OBJECT_NAME_INVALID,
564 			    ERRDOS, ERROR_INVALID_NAME);
565 			return (-1);
566 		}
567 	}
568 
569 	/* path above the mount point */
570 	for (i = 0; i < sizeof (bad_paths) / sizeof (bad_paths[0]); ++i) {
571 		bad = &bad_paths[i];
572 		if (strncmp(fqi->path, bad->name, bad->len) == 0) {
573 			smbsr_error(sr, NT_STATUS_OBJECT_PATH_SYNTAX_BAD,
574 			    ERRDOS, ERROR_BAD_PATHNAME);
575 			return (-1);
576 		}
577 	}
578 
579 	/* last component is, or resolves to, '.' (dot) */
580 	if ((strcmp(last_comp, ".") == 0) ||
581 	    (SMB_SEARCH_DIRECTORY(fqi->srch_attr) &&
582 	    (smb_match(last_comp, ".")))) {
583 		smbsr_error(sr, NT_STATUS_OBJECT_NAME_INVALID,
584 		    ERRDOS, ERROR_INVALID_NAME);
585 		return (-1);
586 	}
587 
588 	*wildcard = (wildcards != 0);
589 	return (0);
590 }
591 
592 /*
593  * smb_delete_error
594  */
595 static void
596 smb_delete_error(smb_error_t *err,
597     uint32_t status, uint16_t errcls, uint16_t errcode)
598 {
599 	err->severity = ERROR_SEVERITY_ERROR;
600 	err->status = status;
601 	err->errcls = errcls;
602 	err->errcode = errcode;
603 }
604