CVE-2020-25719 mit-samba: Add mit_samba_princ_needs_pac()
[Samba.git] / source3 / smbd / smb2_getinfo.c
blob6df4a37af179b3ba2ac14e26fd5ba4fe42a52dee
1 /*
2 Unix SMB/CIFS implementation.
3 Core SMB2 server
5 Copyright (C) Stefan Metzmacher 2009
6 Copyright (C) Jeremy Allison 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "includes.h"
23 #include "smbd/smbd.h"
24 #include "smbd/globals.h"
25 #include "../libcli/smb/smb_common.h"
26 #include "trans2.h"
27 #include "../lib/util/tevent_ntstatus.h"
28 #include "librpc/gen_ndr/ndr_quota.h"
29 #include "librpc/gen_ndr/ndr_security.h"
31 #undef DBGC_CLASS
32 #define DBGC_CLASS DBGC_SMB2
34 static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx,
35 struct tevent_context *ev,
36 struct smbd_smb2_request *smb2req,
37 struct files_struct *in_fsp,
38 uint8_t in_info_type,
39 uint8_t in_file_info_class,
40 uint32_t in_output_buffer_length,
41 DATA_BLOB in_input_buffer,
42 uint32_t in_additional_information,
43 uint32_t in_flags);
44 static NTSTATUS smbd_smb2_getinfo_recv(struct tevent_req *req,
45 TALLOC_CTX *mem_ctx,
46 DATA_BLOB *out_output_buffer,
47 NTSTATUS *p_call_status);
49 static void smbd_smb2_request_getinfo_done(struct tevent_req *subreq);
50 NTSTATUS smbd_smb2_request_process_getinfo(struct smbd_smb2_request *req)
52 struct smbXsrv_connection *xconn = req->xconn;
53 NTSTATUS status;
54 const uint8_t *inbody;
55 uint8_t in_info_type;
56 uint8_t in_file_info_class;
57 uint32_t in_output_buffer_length;
58 uint16_t in_input_buffer_offset;
59 uint32_t in_input_buffer_length;
60 DATA_BLOB in_input_buffer;
61 uint32_t in_additional_information;
62 uint32_t in_flags;
63 uint64_t in_file_id_persistent;
64 uint64_t in_file_id_volatile;
65 struct files_struct *in_fsp;
66 struct tevent_req *subreq;
68 status = smbd_smb2_request_verify_sizes(req, 0x29);
69 if (!NT_STATUS_IS_OK(status)) {
70 return smbd_smb2_request_error(req, status);
72 inbody = SMBD_SMB2_IN_BODY_PTR(req);
74 in_info_type = CVAL(inbody, 0x02);
75 in_file_info_class = CVAL(inbody, 0x03);
76 in_output_buffer_length = IVAL(inbody, 0x04);
77 in_input_buffer_offset = SVAL(inbody, 0x08);
78 /* 0x0A 2 bytes reserved */
79 in_input_buffer_length = IVAL(inbody, 0x0C);
80 in_additional_information = IVAL(inbody, 0x10);
81 in_flags = IVAL(inbody, 0x14);
82 in_file_id_persistent = BVAL(inbody, 0x18);
83 in_file_id_volatile = BVAL(inbody, 0x20);
85 if (in_input_buffer_offset == 0 && in_input_buffer_length == 0) {
86 /* This is ok */
87 } else if (in_input_buffer_offset !=
88 (SMB2_HDR_BODY + SMBD_SMB2_IN_BODY_LEN(req))) {
89 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
92 if (in_input_buffer_length > SMBD_SMB2_IN_DYN_LEN(req)) {
93 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
96 in_input_buffer.data = SMBD_SMB2_IN_DYN_PTR(req);
97 in_input_buffer.length = in_input_buffer_length;
99 if (in_input_buffer.length > xconn->smb2.server.max_trans) {
100 DEBUG(2,("smbd_smb2_request_process_getinfo: "
101 "client ignored max trans: %s: 0x%08X: 0x%08X\n",
102 __location__, (unsigned)in_input_buffer.length,
103 (unsigned)xconn->smb2.server.max_trans));
104 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
106 if (in_output_buffer_length > xconn->smb2.server.max_trans) {
107 DEBUG(2,("smbd_smb2_request_process_getinfo: "
108 "client ignored max trans: %s: 0x%08X: 0x%08X\n",
109 __location__, in_output_buffer_length,
110 xconn->smb2.server.max_trans));
111 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
114 status = smbd_smb2_request_verify_creditcharge(req,
115 MAX(in_input_buffer.length,in_output_buffer_length));
116 if (!NT_STATUS_IS_OK(status)) {
117 return smbd_smb2_request_error(req, status);
120 in_fsp = file_fsp_smb2(req, in_file_id_persistent, in_file_id_volatile);
121 if (in_fsp == NULL) {
122 return smbd_smb2_request_error(req, NT_STATUS_FILE_CLOSED);
125 subreq = smbd_smb2_getinfo_send(req, req->sconn->ev_ctx,
126 req, in_fsp,
127 in_info_type,
128 in_file_info_class,
129 in_output_buffer_length,
130 in_input_buffer,
131 in_additional_information,
132 in_flags);
133 if (subreq == NULL) {
134 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
136 tevent_req_set_callback(subreq, smbd_smb2_request_getinfo_done, req);
138 return smbd_smb2_request_pending_queue(req, subreq, 500);
141 static void smbd_smb2_request_getinfo_done(struct tevent_req *subreq)
143 struct smbd_smb2_request *req = tevent_req_callback_data(subreq,
144 struct smbd_smb2_request);
145 DATA_BLOB outbody;
146 DATA_BLOB outdyn;
147 uint16_t out_output_buffer_offset;
148 DATA_BLOB out_output_buffer = data_blob_null;
149 NTSTATUS status;
150 NTSTATUS call_status = NT_STATUS_OK;
151 NTSTATUS error; /* transport error */
153 status = smbd_smb2_getinfo_recv(subreq,
154 req,
155 &out_output_buffer,
156 &call_status);
157 TALLOC_FREE(subreq);
158 if (!NT_STATUS_IS_OK(status)) {
159 error = smbd_smb2_request_error(req, status);
160 if (!NT_STATUS_IS_OK(error)) {
161 smbd_server_connection_terminate(req->xconn,
162 nt_errstr(error));
163 return;
165 return;
168 /* some GetInfo responses set STATUS_BUFFER_OVERFLOW and return partial,
169 but valid data */
170 if (!(NT_STATUS_IS_OK(call_status) ||
171 NT_STATUS_EQUAL(call_status, STATUS_BUFFER_OVERFLOW))) {
172 /* Return a specific error with data. */
173 error = smbd_smb2_request_error_ex(req,
174 call_status,
175 &out_output_buffer,
176 __location__);
177 if (!NT_STATUS_IS_OK(error)) {
178 smbd_server_connection_terminate(req->xconn,
179 nt_errstr(error));
180 return;
182 return;
185 out_output_buffer_offset = SMB2_HDR_BODY + 0x08;
187 outbody = smbd_smb2_generate_outbody(req, 0x08);
188 if (outbody.data == NULL) {
189 error = smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
190 if (!NT_STATUS_IS_OK(error)) {
191 smbd_server_connection_terminate(req->xconn,
192 nt_errstr(error));
193 return;
195 return;
198 SSVAL(outbody.data, 0x00, 0x08 + 1); /* struct size */
199 SSVAL(outbody.data, 0x02,
200 out_output_buffer_offset); /* output buffer offset */
201 SIVAL(outbody.data, 0x04,
202 out_output_buffer.length); /* output buffer length */
204 outdyn = out_output_buffer;
206 error = smbd_smb2_request_done_ex(req, call_status, outbody, &outdyn, __location__);
207 if (!NT_STATUS_IS_OK(error)) {
208 smbd_server_connection_terminate(req->xconn,
209 nt_errstr(error));
210 return;
214 struct smbd_smb2_getinfo_state {
215 struct smbd_smb2_request *smb2req;
216 NTSTATUS status;
217 DATA_BLOB out_output_buffer;
220 static void smb2_ipc_getinfo(struct tevent_req *req,
221 struct smbd_smb2_getinfo_state *state,
222 struct tevent_context *ev,
223 uint8_t in_info_type,
224 uint8_t in_file_info_class)
226 /* We want to reply to SMB2_GETINFO_FILE
227 with a class of SMB2_FILE_STANDARD_INFO as
228 otherwise a Win7 client issues this request
229 twice (2xroundtrips) if we return NOT_SUPPORTED.
230 NB. We do the same for SMB1 in call_trans2qpipeinfo() */
232 if (in_info_type == 0x01 && /* SMB2_GETINFO_FILE */
233 in_file_info_class == 0x05) { /* SMB2_FILE_STANDARD_INFO */
234 state->out_output_buffer = data_blob_talloc(state,
235 NULL, 24);
236 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
237 return;
240 memset(state->out_output_buffer.data,0,24);
241 SOFF_T(state->out_output_buffer.data,0,4096LL);
242 SIVAL(state->out_output_buffer.data,16,1);
243 SIVAL(state->out_output_buffer.data,20,1);
244 tevent_req_done(req);
245 } else {
246 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
250 static struct tevent_req *smbd_smb2_getinfo_send(TALLOC_CTX *mem_ctx,
251 struct tevent_context *ev,
252 struct smbd_smb2_request *smb2req,
253 struct files_struct *fsp,
254 uint8_t in_info_type,
255 uint8_t in_file_info_class,
256 uint32_t in_output_buffer_length,
257 DATA_BLOB in_input_buffer,
258 uint32_t in_additional_information,
259 uint32_t in_flags)
261 struct tevent_req *req;
262 struct smbd_smb2_getinfo_state *state;
263 struct smb_request *smbreq;
264 connection_struct *conn = smb2req->tcon->compat;
265 NTSTATUS status;
267 req = tevent_req_create(mem_ctx, &state,
268 struct smbd_smb2_getinfo_state);
269 if (req == NULL) {
270 return NULL;
272 state->smb2req = smb2req;
273 state->status = NT_STATUS_OK;
274 state->out_output_buffer = data_blob_null;
276 DEBUG(10,("smbd_smb2_getinfo_send: %s - %s\n",
277 fsp_str_dbg(fsp), fsp_fnum_dbg(fsp)));
279 smbreq = smbd_smb2_fake_smb_request(smb2req);
280 if (tevent_req_nomem(smbreq, req)) {
281 return tevent_req_post(req, ev);
284 if (IS_IPC(conn)) {
285 smb2_ipc_getinfo(req, state, ev,
286 in_info_type, in_file_info_class);
287 return tevent_req_post(req, ev);
290 switch (in_info_type) {
291 case SMB2_0_INFO_FILE:
293 uint16_t file_info_level;
294 char *data = NULL;
295 unsigned int data_size = 0;
296 bool delete_pending = false;
297 struct timespec write_time_ts;
298 struct file_id fileid;
299 struct ea_list *ea_list = NULL;
300 int lock_data_count = 0;
301 char *lock_data = NULL;
302 size_t fixed_portion;
304 ZERO_STRUCT(write_time_ts);
306 switch (in_file_info_class) {
307 case FSCC_FILE_FULL_EA_INFORMATION:
308 file_info_level = SMB2_FILE_FULL_EA_INFORMATION;
309 break;
311 case FSCC_FILE_ALL_INFORMATION:
312 file_info_level = SMB2_FILE_ALL_INFORMATION;
313 break;
315 default:
316 /* the levels directly map to the passthru levels */
317 file_info_level = in_file_info_class + 1000;
318 break;
321 switch (file_info_level) {
322 case SMB_FILE_NORMALIZED_NAME_INFORMATION:
323 if (smb2req->xconn->protocol < PROTOCOL_SMB3_11) {
324 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
325 return tevent_req_post(req, ev);
327 break;
330 if (fsp->fake_file_handle) {
332 * This is actually for the QUOTA_FAKE_FILE --metze
335 /* We know this name is ok, it's already passed the checks. */
337 } else if (fsp_get_pathref_fd(fsp) == -1) {
339 * This is actually a QFILEINFO on a directory
340 * handle (returned from an NT SMB). NT5.0 seems
341 * to do this call. JRA.
344 if (fsp->fsp_name->flags & SMB_FILENAME_POSIX_PATH) {
345 /* Always do lstat for UNIX calls. */
346 if (SMB_VFS_LSTAT(conn, fsp->fsp_name)) {
347 DEBUG(3,("smbd_smb2_getinfo_send: "
348 "SMB_VFS_LSTAT of %s failed "
349 "(%s)\n", fsp_str_dbg(fsp),
350 strerror(errno)));
351 status = map_nt_error_from_unix(errno);
352 tevent_req_nterror(req, status);
353 return tevent_req_post(req, ev);
355 } else if (SMB_VFS_STAT(conn, fsp->fsp_name)) {
356 DEBUG(3,("smbd_smb2_getinfo_send: "
357 "SMB_VFS_STAT of %s failed (%s)\n",
358 fsp_str_dbg(fsp),
359 strerror(errno)));
360 status = map_nt_error_from_unix(errno);
361 tevent_req_nterror(req, status);
362 return tevent_req_post(req, ev);
365 if (lp_smbd_getinfo_ask_sharemode(SNUM(conn))) {
366 fileid = vfs_file_id_from_sbuf(
367 conn, &fsp->fsp_name->st);
368 get_file_infos(fileid, fsp->name_hash,
369 &delete_pending,
370 &write_time_ts);
372 } else {
374 * Original code - this is an open file.
377 if (SMB_VFS_FSTAT(fsp, &fsp->fsp_name->st) != 0) {
378 DEBUG(3, ("smbd_smb2_getinfo_send: "
379 "fstat of %s failed (%s)\n",
380 fsp_fnum_dbg(fsp), strerror(errno)));
381 status = map_nt_error_from_unix(errno);
382 tevent_req_nterror(req, status);
383 return tevent_req_post(req, ev);
385 if (lp_smbd_getinfo_ask_sharemode(SNUM(conn))) {
386 fileid = vfs_file_id_from_sbuf(
387 conn, &fsp->fsp_name->st);
388 get_file_infos(fileid, fsp->name_hash,
389 &delete_pending,
390 &write_time_ts);
394 status = smbd_do_qfilepathinfo(conn, state,
395 smbreq,
396 file_info_level,
397 fsp,
398 fsp->fsp_name,
399 delete_pending,
400 write_time_ts,
401 ea_list,
402 lock_data_count,
403 lock_data,
404 STR_UNICODE,
405 in_output_buffer_length,
406 &fixed_portion,
407 &data,
408 &data_size);
409 if (!NT_STATUS_IS_OK(status)) {
410 SAFE_FREE(data);
411 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) {
412 status = NT_STATUS_INVALID_INFO_CLASS;
414 tevent_req_nterror(req, status);
415 return tevent_req_post(req, ev);
417 if (in_output_buffer_length < fixed_portion) {
418 SAFE_FREE(data);
419 tevent_req_nterror(
420 req, NT_STATUS_INFO_LENGTH_MISMATCH);
421 return tevent_req_post(req, ev);
423 if (data_size > 0) {
424 state->out_output_buffer = data_blob_talloc(state,
425 data,
426 data_size);
427 SAFE_FREE(data);
428 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
429 return tevent_req_post(req, ev);
431 if (data_size > in_output_buffer_length) {
432 state->out_output_buffer.length =
433 in_output_buffer_length;
434 status = STATUS_BUFFER_OVERFLOW;
437 SAFE_FREE(data);
438 break;
441 case SMB2_0_INFO_FILESYSTEM:
443 uint16_t file_info_level;
444 char *data = NULL;
445 int data_size = 0;
446 size_t fixed_portion;
448 /* the levels directly map to the passthru levels */
449 file_info_level = in_file_info_class + 1000;
451 status = smbd_do_qfsinfo(smb2req->xconn, conn, state,
452 file_info_level,
453 STR_UNICODE,
454 in_output_buffer_length,
455 &fixed_portion,
456 fsp->fsp_name,
457 &data,
458 &data_size);
459 /* some responses set STATUS_BUFFER_OVERFLOW and return
460 partial, but valid data */
461 if (!(NT_STATUS_IS_OK(status) ||
462 NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW))) {
463 SAFE_FREE(data);
464 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_LEVEL)) {
465 status = NT_STATUS_INVALID_INFO_CLASS;
467 tevent_req_nterror(req, status);
468 return tevent_req_post(req, ev);
470 if (in_output_buffer_length < fixed_portion) {
471 SAFE_FREE(data);
472 tevent_req_nterror(
473 req, NT_STATUS_INFO_LENGTH_MISMATCH);
474 return tevent_req_post(req, ev);
476 if (data_size > 0) {
477 state->out_output_buffer = data_blob_talloc(state,
478 data,
479 data_size);
480 SAFE_FREE(data);
481 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
482 return tevent_req_post(req, ev);
484 if (data_size > in_output_buffer_length) {
485 state->out_output_buffer.length =
486 in_output_buffer_length;
487 status = STATUS_BUFFER_OVERFLOW;
490 SAFE_FREE(data);
491 break;
494 case SMB2_0_INFO_SECURITY:
496 uint8_t *p_marshalled_sd = NULL;
497 size_t sd_size = 0;
499 status = smbd_do_query_security_desc(conn,
500 state,
501 fsp,
502 /* Security info wanted. */
503 in_additional_information &
504 SMB_SUPPORTED_SECINFO_FLAGS,
505 in_output_buffer_length,
506 &p_marshalled_sd,
507 &sd_size);
509 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
510 /* Return needed size. */
511 state->out_output_buffer = data_blob_talloc(state,
512 NULL,
514 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
515 return tevent_req_post(req, ev);
517 SIVAL(state->out_output_buffer.data,0,(uint32_t)sd_size);
518 state->status = NT_STATUS_BUFFER_TOO_SMALL;
519 break;
521 if (!NT_STATUS_IS_OK(status)) {
522 DEBUG(10,("smbd_smb2_getinfo_send: "
523 "smbd_do_query_security_desc of %s failed "
524 "(%s)\n", fsp_str_dbg(fsp),
525 nt_errstr(status)));
526 tevent_req_nterror(req, status);
527 return tevent_req_post(req, ev);
530 if (sd_size > 0) {
531 state->out_output_buffer = data_blob_talloc(state,
532 p_marshalled_sd,
533 sd_size);
534 if (tevent_req_nomem(state->out_output_buffer.data, req)) {
535 return tevent_req_post(req, ev);
538 break;
541 case SMB2_0_INFO_QUOTA: {
542 #ifdef HAVE_SYS_QUOTAS
543 struct smb2_query_quota_info info;
544 enum ndr_err_code err;
545 uint8_t *data = NULL;
546 uint32_t data_size = 0;
547 struct ndr_pull *ndr_pull = NULL;
548 DATA_BLOB sid_buf = data_blob_null;
549 TALLOC_CTX *tmp_ctx = talloc_init("geninfo_quota");
550 bool ok;
552 if (!tmp_ctx) {
553 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
554 return tevent_req_post(req, ev);
557 ok = check_fsp_ntquota_handle(conn, smbreq, fsp);
558 if (!ok) {
559 DBG_INFO("no valid QUOTA HANDLE\n");
560 TALLOC_FREE(tmp_ctx);
561 tevent_req_nterror(req, NT_STATUS_INVALID_HANDLE);
562 return tevent_req_post(req, ev);
565 ndr_pull = ndr_pull_init_blob(&in_input_buffer, tmp_ctx);
566 if (!ndr_pull) {
567 TALLOC_FREE(tmp_ctx);
568 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
569 return tevent_req_post(req, ev);
572 err = ndr_pull_smb2_query_quota_info(ndr_pull,
573 NDR_SCALARS | NDR_BUFFERS,
574 &info);
576 if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
577 DBG_DEBUG("failed to pull smb2_query_quota_info\n");
578 TALLOC_FREE(tmp_ctx);
579 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
580 return tevent_req_post(req, ev);
583 DBG_DEBUG("quota list returnsingle %u, restartscan %u, "
584 "sid_list_length %u, start_sid_length %u, "
585 "startsidoffset %u\n",
586 (unsigned int)info.return_single,
587 (unsigned int)info.restart_scan,
588 (unsigned int)info.sid_list_length,
589 (unsigned int)info.start_sid_length,
590 (unsigned int)info.start_sid_offset);
592 /* Currently we do not support the single start sid format */
593 if (info.start_sid_length != 0 || info.start_sid_offset != 0 ) {
594 DBG_INFO("illegal single sid query\n");
595 TALLOC_FREE(tmp_ctx);
596 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
597 return tevent_req_post(req, ev);
600 if (in_input_buffer.length < ndr_pull->offset) {
601 DBG_INFO("Invalid buffer length\n");
602 TALLOC_FREE(tmp_ctx);
603 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
604 return tevent_req_post(req, ev);
607 sid_buf.data = in_input_buffer.data + ndr_pull->offset;
608 sid_buf.length = in_input_buffer.length - ndr_pull->offset;
610 status = smbd_do_query_getinfo_quota(tmp_ctx,
611 fsp,
612 info.restart_scan,
613 info.return_single,
614 info.sid_list_length,
615 &sid_buf,
616 in_output_buffer_length,
617 &data,
618 &data_size);
620 if (!NT_STATUS_IS_OK(status)) {
621 TALLOC_FREE(tmp_ctx);
622 tevent_req_nterror(req, status);
623 return tevent_req_post(req, ev);
626 state->out_output_buffer =
627 data_blob_talloc(state, data, data_size);
628 status = NT_STATUS_OK;
629 TALLOC_FREE(tmp_ctx);
630 break;
631 #else
632 tevent_req_nterror(req, NT_STATUS_NOT_SUPPORTED);
633 return tevent_req_post(req, ev);
634 #endif
637 default:
638 DEBUG(10,("smbd_smb2_getinfo_send: "
639 "unknown in_info_type of %u "
640 " for file %s\n",
641 (unsigned int)in_info_type,
642 fsp_str_dbg(fsp) ));
644 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
645 return tevent_req_post(req, ev);
648 state->status = status;
649 tevent_req_done(req);
650 return tevent_req_post(req, ev);
653 static NTSTATUS smbd_smb2_getinfo_recv(struct tevent_req *req,
654 TALLOC_CTX *mem_ctx,
655 DATA_BLOB *out_output_buffer,
656 NTSTATUS *pstatus)
658 NTSTATUS status;
659 struct smbd_smb2_getinfo_state *state = tevent_req_data(req,
660 struct smbd_smb2_getinfo_state);
662 if (tevent_req_is_nterror(req, &status)) {
663 tevent_req_received(req);
664 return status;
667 *out_output_buffer = state->out_output_buffer;
668 talloc_steal(mem_ctx, out_output_buffer->data);
669 *pstatus = state->status;
671 tevent_req_received(req);
672 return NT_STATUS_OK;