source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 #undef DBGC_CLASS
  35 #define DBGC_CLASS DBGC_SMB2
  36
  37 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  38 {
  39         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  40         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  41         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  42 }
  43
  44 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  45 {
  46         uint32_t i;
  47         uint32_t total_len = 0;
  48
  49         /*
  50          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  51          * Send and invalid parameter response if:
  52          * - The ChunkCount value is greater than
  53          *   ServerSideCopyMaxNumberofChunks
  54          */
  55         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  56                 return NT_STATUS_INVALID_PARAMETER;
  57         }
  58
  59         for (i = 0; i < cc_copy->chunk_count; i++) {
  60                 /*
  61                  * - The Length value in a single chunk is greater than
  62                  *   ServerSideCopyMaxChunkSize or equal to zero.
  63                  */
  64                 if ((cc_copy->chunks[i].length == 0)
  65                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  66                         return NT_STATUS_INVALID_PARAMETER;
  67                 }
  68                 total_len += cc_copy->chunks[i].length;
  69         }
  70         /*
  71          * - Sum of Lengths in all chunks is greater than
  72          *   ServerSideCopyMaxDataSize
  73          */
  74         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  75                 return NT_STATUS_INVALID_PARAMETER;
  76         }
  77
  78         return NT_STATUS_OK;
  79 }
  80
  81 struct fsctl_srv_copychunk_state {
  82         struct tevent_context *ev;
  83         struct connection_struct *conn;
  84         struct srv_copychunk_copy cc_copy;
  85         uint32_t current_chunk;
  86         NTSTATUS status;
  87         off_t total_written;
  88         uint32_t ctl_code;
  89         DATA_BLOB token;
  90         struct files_struct *src_fsp;
  91         struct files_struct *dst_fsp;
  92         enum {
  93                 COPYCHUNK_OUT_EMPTY = 0,
  94                 COPYCHUNK_OUT_LIMITS,
  95                 COPYCHUNK_OUT_RSP,
  96         } out_data;
  97         bool aapl_copyfile;
  98 };
  99 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
 100
 101 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
 102
 103 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 104                                                    struct tevent_context *ev,
 105                                                    uint32_t ctl_code,
 106                                                    struct files_struct *dst_fsp,
 107                                                    DATA_BLOB *in_input,
 108                                                    size_t in_max_output,
 109                                                    struct smbd_smb2_request *smb2req)
 110 {
 111         struct tevent_req *req = NULL;
 112         struct fsctl_srv_copychunk_state *state = NULL;
 113         enum ndr_err_code ndr_ret;
 114         NTSTATUS status;
 115
 116         /* handler for both copy-chunk variants */
 117         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 118                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 119
 120         req = tevent_req_create(mem_ctx, &state,
 121                                 struct fsctl_srv_copychunk_state);
 122         if (req == NULL) {
 123                 return NULL;
 124         }
 125         *state = (struct fsctl_srv_copychunk_state) {
 126                 .conn = dst_fsp->conn,
 127                 .ev = ev,
 128                 .ctl_code = ctl_code,
 129                 .dst_fsp = dst_fsp,
 130         };
 131
 132         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 133                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 134                           "response %lu\n", (int)in_max_output,
 135                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 136                 state->status = NT_STATUS_INVALID_PARAMETER;
 137                 tevent_req_nterror(req, state->status);
 138                 return tevent_req_post(req, ev);
 139         }
 140
 141         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 142                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 143         if (ndr_ret != NDR_ERR_SUCCESS) {
 144                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 145                 state->status = NT_STATUS_INVALID_PARAMETER;
 146                 tevent_req_nterror(req, state->status);
 147                 return tevent_req_post(req, ev);
 148         }
 149
 150         state->token = data_blob_const(state->cc_copy.source_key,
 151                                        sizeof(state->cc_copy.source_key));
 152
 153         state->status = copychunk_check_limits(&state->cc_copy);
 154         if (!NT_STATUS_IS_OK(state->status)) {
 155                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 156                 state->out_data = COPYCHUNK_OUT_LIMITS;
 157                 tevent_req_nterror(req, state->status);
 158                 return tevent_req_post(req, ev);
 159         }
 160
 161         /* any errors from here onwards should carry copychunk response data */
 162         state->out_data = COPYCHUNK_OUT_RSP;
 163
 164         status = fsctl_srv_copychunk_loop(req);
 165         if (tevent_req_nterror(req, status)) {
 166                 return tevent_req_post(req, ev);
 167         }
 168
 169         return req;
 170 }
 171
 172 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 173 {
 174         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 175                 req, struct fsctl_srv_copychunk_state);
 176         struct tevent_req *subreq = NULL;
 177         uint32_t length = 0;
 178         off_t source_off = 0;
 179         off_t target_off = 0;
 180
 181         /*
 182          * chunk_count can be 0 which must either just do nothing returning
 183          * success saying number of copied chunks is 0 (verified against
 184          * Windows).
 185          *
 186          * Or it can be a special macOS copyfile request, so we send this into
 187          * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
 188          */
 189         if (state->cc_copy.chunk_count > 0) {
 190                 struct srv_copychunk *chunk = NULL;
 191
 192                 chunk = &state->cc_copy.chunks[state->current_chunk];
 193                 length = chunk->length;
 194                 source_off = chunk->source_off;
 195                 target_off = chunk->target_off;
 196         }
 197
 198         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 199                                          state,
 200                                          state->ev,
 201                                          state->ctl_code,
 202                                          &state->token,
 203                                          source_off,
 204                                          state->dst_fsp,
 205                                          target_off,
 206                                          length);
 207         if (tevent_req_nomem(subreq, req)) {
 208                 return NT_STATUS_NO_MEMORY;
 209         }
 210         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 211
 212         return NT_STATUS_OK;
 213 }
 214
 215 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 216 {
 217         struct tevent_req *req = tevent_req_callback_data(
 218                 subreq, struct tevent_req);
 219         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 220                 req, struct fsctl_srv_copychunk_state);
 221         off_t chunk_nwritten;
 222         NTSTATUS status;
 223
 224         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
 225                                          &chunk_nwritten);
 226         TALLOC_FREE(subreq);
 227         if (!NT_STATUS_IS_OK(status)) {
 228                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 229                         nt_errstr(status),
 230                         (unsigned int)state->current_chunk,
 231                         (unsigned int)state->cc_copy.chunk_count);
 232                 tevent_req_nterror(req, status);
 233                 return;
 234         }
 235
 236         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 237                   (unsigned int)state->current_chunk,
 238                   (unsigned int)state->cc_copy.chunk_count);
 239         state->total_written += chunk_nwritten;
 240
 241         if (state->cc_copy.chunk_count == 0) {
 242                 /*
 243                  * This must not produce an error but just return a chunk count
 244                  * of 0 in the response.
 245                  */
 246                 tevent_req_done(req);
 247                 return;
 248         }
 249
 250         state->current_chunk++;
 251         if (state->current_chunk == state->cc_copy.chunk_count) {
 252                 tevent_req_done(req);
 253                 return;
 254         }
 255
 256         status = fsctl_srv_copychunk_loop(req);
 257         if (tevent_req_nterror(req, status)) {
 258                 return;
 259         }
 260 }
 261
 262 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 263                                          struct srv_copychunk_rsp *cc_rsp,
 264                                          bool *pack_rsp)
 265 {
 266         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 267                                         struct fsctl_srv_copychunk_state);
 268         NTSTATUS status;
 269
 270         switch (state->out_data) {
 271         case COPYCHUNK_OUT_EMPTY:
 272                 *pack_rsp = false;
 273                 break;
 274         case COPYCHUNK_OUT_LIMITS:
 275                 /* 2.2.32.1 - send back our maximum transfer size limits */
 276                 copychunk_pack_limits(cc_rsp);
 277                 *pack_rsp = true;
 278                 break;
 279         case COPYCHUNK_OUT_RSP:
 280                 cc_rsp->chunks_written = state->current_chunk;
 281                 cc_rsp->chunk_bytes_written = 0;
 282                 cc_rsp->total_bytes_written = state->total_written;
 283                 *pack_rsp = true;
 284                 break;
 285         default:        /* not reached */
 286                 assert(1);
 287                 break;
 288         }
 289         status = tevent_req_simple_recv_ntstatus(req);
 290         return status;
 291 }
 292
 293 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 294                                          struct tevent_context *ev,
 295                                          struct smbXsrv_connection *xconn,
 296                                          DATA_BLOB *in_input,
 297                                          uint32_t in_max_output,
 298                                          DATA_BLOB *out_output)
 299 {
 300         struct fsctl_net_iface_info *array = NULL;
 301         struct fsctl_net_iface_info *first = NULL;
 302         struct fsctl_net_iface_info *last = NULL;
 303         size_t i;
 304         size_t num_ifaces = iface_count();
 305         enum ndr_err_code ndr_err;
 306
 307         if (in_input->length != 0) {
 308                 return NT_STATUS_INVALID_PARAMETER;
 309         }
 310
 311         *out_output = data_blob_null;
 312
 313         array = talloc_zero_array(mem_ctx,
 314                                   struct fsctl_net_iface_info,
 315                                   num_ifaces);
 316         if (array == NULL) {
 317                 return NT_STATUS_NO_MEMORY;
 318         }
 319
 320         for (i=0; i < num_ifaces; i++) {
 321                 struct fsctl_net_iface_info *cur = &array[i];
 322                 const struct interface *iface = get_interface(i);
 323                 const struct sockaddr_storage *ifss = &iface->ip;
 324                 const void *ifptr = ifss;
 325                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 326                 struct tsocket_address *a = NULL;
 327                 char *addr;
 328                 bool ok;
 329                 int ret;
 330
 331                 ret = tsocket_address_bsd_from_sockaddr(array,
 332                                         ifsa, sizeof(struct sockaddr_storage),
 333                                         &a);
 334                 if (ret != 0) {
 335                         return map_nt_error_from_unix_common(errno);
 336                 }
 337
 338                 ok = tsocket_address_is_inet(a, "ip");
 339                 if (!ok) {
 340                         continue;
 341                 }
 342
 343                 addr = tsocket_address_inet_addr_string(a, array);
 344                 if (addr == NULL) {
 345                         TALLOC_FREE(array);
 346                         return NT_STATUS_NO_MEMORY;
 347                 }
 348
 349                 cur->ifindex = iface->if_index;
 350                 if (cur->ifindex == 0) {
 351                         /*
 352                          * Did not get interface index from kernel,
 353                          * nor from the config. ==> Apply a common
 354                          * default value for these cases.
 355                          */
 356                         cur->ifindex = UINT32_MAX;
 357                 }
 358                 cur->capability = iface->capability;
 359                 cur->linkspeed = iface->linkspeed;
 360                 if (cur->linkspeed == 0) {
 361                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 362                                   "address [%s].\n", iface->name, addr);
 363                         continue;
 364                 }
 365
 366                 ok = tsocket_address_is_inet(a, "ipv4");
 367                 if (ok) {
 368                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 369                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 370                 }
 371                 ok = tsocket_address_is_inet(a, "ipv6");
 372                 if (ok) {
 373                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 374                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 375                 }
 376
 377                 if (first == NULL) {
 378                         first = cur;
 379                 }
 380                 if (last != NULL) {
 381                         last->next = cur;
 382                 }
 383                 last = cur;
 384         }
 385
 386         if (first == NULL) {
 387                 TALLOC_FREE(array);
 388                 return NT_STATUS_OK;
 389         }
 390
 391         if (DEBUGLEVEL >= 10) {
 392                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 393         }
 394
 395         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 396                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 397         TALLOC_FREE(array);
 398         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 399                 return ndr_map_error2ntstatus(ndr_err);
 400         }
 401
 402         return NT_STATUS_OK;
 403 }
 404
 405 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 406                                         struct tevent_context *ev,
 407                                         struct smbXsrv_connection *conn,
 408                                         DATA_BLOB *in_input,
 409                                         uint32_t in_max_output,
 410                                         DATA_BLOB *out_output,
 411                                         bool *disconnect)
 412 {
 413         uint32_t in_capabilities;
 414         DATA_BLOB in_guid_blob;
 415         struct GUID in_guid;
 416         uint16_t in_security_mode;
 417         uint16_t in_num_dialects;
 418         uint16_t dialect;
 419         DATA_BLOB out_guid_blob;
 420         NTSTATUS status;
 421         enum protocol_types protocol = PROTOCOL_NONE;
 422
 423         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
 424                 /*
 425                  * With SMB 2.02 we didn't get the
 426                  * capabitities, client guid, security mode
 427                  * and dialects the client would have offered.
 428                  *
 429                  * So we behave compatible with a true
 430                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
 431                  *
 432                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
 433                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
 434                  * starting with SMB 2.10, while Windows only supports
 435                  * it starting with SMB > 2.10.
 436                  */
 437                 return NT_STATUS_FILE_CLOSED;
 438         }
 439
 440         if (in_input->length < 0x18) {
 441                 return NT_STATUS_INVALID_PARAMETER;
 442         }
 443
 444         in_capabilities = IVAL(in_input->data, 0x00);
 445         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 446         in_security_mode = SVAL(in_input->data, 0x14);
 447         in_num_dialects = SVAL(in_input->data, 0x16);
 448
 449         if (in_input->length < (0x18 + in_num_dialects*2)) {
 450                 return NT_STATUS_INVALID_PARAMETER;
 451         }
 452
 453         if (in_max_output < 0x18) {
 454                 return NT_STATUS_BUFFER_TOO_SMALL;
 455         }
 456
 457         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 458         if (!NT_STATUS_IS_OK(status)) {
 459                 return status;
 460         }
 461
 462         /*
 463          * From: [MS-SMB2]
 464          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 465          *
 466          * The server MUST determine the greatest common dialect
 467          * between the dialects it implements and the Dialects array
 468          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 469          * matched, or if the value is not equal to Connection.Dialect,
 470          * the server MUST terminate the transport connection
 471          * and free the Connection object.
 472          */
 473         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 474                                                     in_num_dialects,
 475                                                     &dialect);
 476         if (conn->protocol != protocol) {
 477                 *disconnect = true;
 478                 return NT_STATUS_ACCESS_DENIED;
 479         }
 480
 481         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 482                 *disconnect = true;
 483                 return NT_STATUS_ACCESS_DENIED;
 484         }
 485
 486         if (in_security_mode != conn->smb2.client.security_mode) {
 487                 *disconnect = true;
 488                 return NT_STATUS_ACCESS_DENIED;
 489         }
 490
 491         if (in_capabilities != conn->smb2.client.capabilities) {
 492                 *disconnect = true;
 493                 return NT_STATUS_ACCESS_DENIED;
 494         }
 495
 496         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 497                                   &out_guid_blob);
 498         if (!NT_STATUS_IS_OK(status)) {
 499                 return status;
 500         }
 501
 502         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 503         if (out_output->data == NULL) {
 504                 return NT_STATUS_NO_MEMORY;
 505         }
 506
 507         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 508         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 509         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 510         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 511
 512         return NT_STATUS_OK;
 513 }
 514
 515 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 516 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
 517
 518 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 519                                          struct tevent_context *ev,
 520                                          struct tevent_req *req,
 521                                          struct smbd_smb2_ioctl_state *state)
 522 {
 523         struct tevent_req *subreq;
 524         NTSTATUS status;
 525
 526         switch (ctl_code) {
 527         /*
 528          * [MS-SMB2] 2.2.31
 529          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 530          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 531          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 532          * FILE_WRITE_DATA access.
 533          */
 534         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 535         case FSCTL_SRV_COPYCHUNK:
 536                 subreq = fsctl_srv_copychunk_send(state, ev,
 537                                                   ctl_code,
 538                                                   state->fsp,
 539                                                   &state->in_input,
 540                                                   state->in_max_output,
 541                                                   state->smb2req);
 542                 if (tevent_req_nomem(subreq, req)) {
 543                         return tevent_req_post(req, ev);
 544                 }
 545                 tevent_req_set_callback(subreq,
 546                                         smb2_ioctl_network_fs_copychunk_done,
 547                                         req);
 548                 return req;
 549                 break;
 550         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 551                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 552                 {
 553                         if (IS_IPC(state->smbreq->conn)) {
 554                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 555                         } else {
 556                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 557                         }
 558
 559                         tevent_req_nterror(req, status);
 560                         return tevent_req_post(req, ev);
 561                 }
 562
 563                 status = fsctl_network_iface_info(state, ev,
 564                                                   state->smbreq->xconn,
 565                                                   &state->in_input,
 566                                                   state->in_max_output,
 567                                                   &state->out_output);
 568                 if (!tevent_req_nterror(req, status)) {
 569                         tevent_req_done(req);
 570                 }
 571                 return tevent_req_post(req, ev);
 572                 break;
 573         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 574                 status = fsctl_validate_neg_info(state, ev,
 575                                                  state->smbreq->xconn,
 576                                                  &state->in_input,
 577                                                  state->in_max_output,
 578                                                  &state->out_output,
 579                                                  &state->disconnect);
 580                 if (!tevent_req_nterror(req, status)) {
 581                         tevent_req_done(req);
 582                 }
 583                 return tevent_req_post(req, ev);
 584                 break;
 585         case FSCTL_SRV_REQUEST_RESUME_KEY:
 586                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
 587                                                    ev,
 588                                                    state->fsp,
 589                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
 590                                                    0, 0, 0);
 591                 if (tevent_req_nomem(subreq, req)) {
 592                         return tevent_req_post(req, ev);
 593                 }
 594                 tevent_req_set_callback(
 595                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
 596                 return req;
 597
 598         default: {
 599                 uint8_t *out_data = NULL;
 600                 uint32_t out_data_len = 0;
 601
 602                 if (state->fsp == NULL) {
 603                         status = NT_STATUS_NOT_SUPPORTED;
 604                 } else {
 605                         status = SMB_VFS_FSCTL(state->fsp,
 606                                                state,
 607                                                ctl_code,
 608                                                state->smbreq->flags2,
 609                                                state->in_input.data,
 610                                                state->in_input.length,
 611                                                &out_data,
 612                                                state->in_max_output,
 613                                                &out_data_len);
 614                         state->out_output = data_blob_const(out_data, out_data_len);
 615                         if (NT_STATUS_IS_OK(status)) {
 616                                 tevent_req_done(req);
 617                                 return tevent_req_post(req, ev);
 618                         }
 619                 }
 620
 621                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 622                         if (IS_IPC(state->smbreq->conn)) {
 623                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 624                         } else {
 625                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 626                         }
 627                 }
 628
 629                 tevent_req_nterror(req, status);
 630                 return tevent_req_post(req, ev);
 631                 break;
 632         }
 633         }
 634
 635         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 636         return tevent_req_post(req, ev);
 637 }
 638
 639 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 640 {
 641         struct tevent_req *req = tevent_req_callback_data(subreq,
 642                                                           struct tevent_req);
 643         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 644                                                 struct smbd_smb2_ioctl_state);
 645         struct srv_copychunk_rsp cc_rsp;
 646         NTSTATUS status;
 647         bool pack_rsp = false;
 648
 649         ZERO_STRUCT(cc_rsp);
 650         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 651         TALLOC_FREE(subreq);
 652         if (pack_rsp == true) {
 653                 enum ndr_err_code ndr_ret;
 654                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 655                                                ioctl_state,
 656                                                &cc_rsp,
 657                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 658                 if (ndr_ret != NDR_ERR_SUCCESS) {
 659                         status = NT_STATUS_INTERNAL_ERROR;
 660                 }
 661         }
 662
 663         if (!tevent_req_nterror(req, status)) {
 664                 tevent_req_done(req);
 665         }
 666 }
 667
 668 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
 669 {
 670         struct tevent_req *req = tevent_req_callback_data(
 671                 subreq, struct tevent_req);
 672         struct smbd_smb2_ioctl_state *state = tevent_req_data(
 673                 req, struct smbd_smb2_ioctl_state);
 674         struct req_resume_key_rsp rkey_rsp;
 675         enum ndr_err_code ndr_ret;
 676         DATA_BLOB token;
 677         NTSTATUS status;
 678
 679         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
 680                                            state->fsp->conn,
 681                                            state,
 682                                            &token);
 683         TALLOC_FREE(subreq);
 684         if (tevent_req_nterror(req, status)) {
 685                 return;
 686         }
 687
 688         if (token.length != sizeof(rkey_rsp.resume_key)) {
 689                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 690                 return;
 691         }
 692
 693         ZERO_STRUCT(rkey_rsp);
 694         memcpy(rkey_rsp.resume_key, token.data, token.length);
 695
 696         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
 697                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 698         if (ndr_ret != NDR_ERR_SUCCESS) {
 699                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 700                 return;
 701         }
 702
 703         tevent_req_done(req);
 704         return;
 705 }