source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  35 {
  36         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  37         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  38         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  39 }
  40
  41 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  42 {
  43         uint32_t i;
  44         uint32_t total_len = 0;
  45
  46         /*
  47          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  48          * Send and invalid parameter response if:
  49          * - The ChunkCount value is greater than
  50          *   ServerSideCopyMaxNumberofChunks
  51          */
  52         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  53                 return NT_STATUS_INVALID_PARAMETER;
  54         }
  55
  56         for (i = 0; i < cc_copy->chunk_count; i++) {
  57                 /*
  58                  * - The Length value in a single chunk is greater than
  59                  *   ServerSideCopyMaxChunkSize or equal to zero.
  60                  */
  61                 if ((cc_copy->chunks[i].length == 0)
  62                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  63                         return NT_STATUS_INVALID_PARAMETER;
  64                 }
  65                 total_len += cc_copy->chunks[i].length;
  66         }
  67         /*
  68          * - Sum of Lengths in all chunks is greater than
  69          *   ServerSideCopyMaxDataSize
  70          */
  71         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         return NT_STATUS_OK;
  76 }
  77
  78 struct fsctl_srv_copychunk_state {
  79         struct tevent_context *ev;
  80         struct connection_struct *conn;
  81         struct srv_copychunk_copy cc_copy;
  82         uint32_t current_chunk;
  83         NTSTATUS status;
  84         off_t total_written;
  85         struct files_struct *src_fsp;
  86         struct files_struct *dst_fsp;
  87         enum {
  88                 COPYCHUNK_OUT_EMPTY = 0,
  89                 COPYCHUNK_OUT_LIMITS,
  90                 COPYCHUNK_OUT_RSP,
  91         } out_data;
  92         bool aapl_copyfile;
  93 };
  94 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  95
  96 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
  97                                         struct files_struct *src_fsp,
  98                                         struct files_struct *dst_fsp)
  99 {
 100         /*
 101          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 102          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 103          * the following are true:
 104          * - The Open.GrantedAccess of the destination file does not include
 105          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 106          */
 107         if (!CHECK_WRITE(dst_fsp)) {
 108                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 109                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 110                 return NT_STATUS_ACCESS_DENIED;
 111         }
 112         /*
 113          * - The Open.GrantedAccess of the destination file does not include
 114          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 115          */
 116         if ((ctl_code == FSCTL_SRV_COPYCHUNK) &&
 117             !CHECK_READ_IOCTL(dst_fsp)) {
 118                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 119                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 120                 return NT_STATUS_ACCESS_DENIED;
 121         }
 122         /*
 123          * - The Open.GrantedAccess of the source file does not include
 124          *   FILE_READ_DATA access.
 125          */
 126         if (!CHECK_READ_SMB2(src_fsp)) {
 127                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 128                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 129                 return NT_STATUS_ACCESS_DENIED;
 130         }
 131
 132         if (src_fsp->is_directory) {
 133                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 134                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 135                 return NT_STATUS_ACCESS_DENIED;
 136         }
 137
 138         if (dst_fsp->is_directory) {
 139                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 140                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 141                 return NT_STATUS_ACCESS_DENIED;
 142         }
 143
 144         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 145                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 146                 return NT_STATUS_ACCESS_DENIED;
 147         }
 148
 149         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 150                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 151                 return NT_STATUS_ACCESS_DENIED;
 152         }
 153
 154         return NT_STATUS_OK;
 155 }
 156
 157 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
 158
 159 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 160                                                    struct tevent_context *ev,
 161                                                    uint32_t ctl_code,
 162                                                    struct files_struct *dst_fsp,
 163                                                    DATA_BLOB *in_input,
 164                                                    size_t in_max_output,
 165                                                    struct smbd_smb2_request *smb2req)
 166 {
 167         struct tevent_req *req = NULL;
 168         struct fsctl_srv_copychunk_state *state = NULL;
 169         uint64_t src_persistent_h;
 170         uint64_t src_volatile_h;
 171         enum ndr_err_code ndr_ret;
 172         NTSTATUS status;
 173
 174         /* handler for both copy-chunk variants */
 175         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 176                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 177
 178         req = tevent_req_create(mem_ctx, &state,
 179                                 struct fsctl_srv_copychunk_state);
 180         if (req == NULL) {
 181                 return NULL;
 182         }
 183         *state = (struct fsctl_srv_copychunk_state) {
 184                 .conn = dst_fsp->conn,
 185                 .ev = ev,
 186         };
 187
 188         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 189                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 190                           "response %lu\n", (int)in_max_output,
 191                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 192                 state->status = NT_STATUS_INVALID_PARAMETER;
 193                 tevent_req_nterror(req, state->status);
 194                 return tevent_req_post(req, ev);
 195         }
 196
 197         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 198                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 199         if (ndr_ret != NDR_ERR_SUCCESS) {
 200                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 201                 state->status = NT_STATUS_INVALID_PARAMETER;
 202                 tevent_req_nterror(req, state->status);
 203                 return tevent_req_post(req, ev);
 204         }
 205
 206         /* persistent/volatile keys sent as the resume key */
 207         src_persistent_h = BVAL(state->cc_copy.source_key, 0);
 208         src_volatile_h = BVAL(state->cc_copy.source_key, 8);
 209         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 210         if (state->src_fsp == NULL) {
 211                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 212                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 213                 tevent_req_nterror(req, state->status);
 214                 return tevent_req_post(req, ev);
 215         }
 216
 217         state->dst_fsp = dst_fsp;
 218
 219         state->status = copychunk_check_handles(ctl_code,
 220                                                 state->src_fsp,
 221                                                 state->dst_fsp);
 222         if (!NT_STATUS_IS_OK(state->status)) {
 223                 tevent_req_nterror(req, state->status);
 224                 return tevent_req_post(req, ev);
 225         }
 226
 227         state->status = copychunk_check_limits(&state->cc_copy);
 228         if (!NT_STATUS_IS_OK(state->status)) {
 229                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 230                 state->out_data = COPYCHUNK_OUT_LIMITS;
 231                 tevent_req_nterror(req, state->status);
 232                 return tevent_req_post(req, ev);
 233         }
 234
 235         /* any errors from here onwards should carry copychunk response data */
 236         state->out_data = COPYCHUNK_OUT_RSP;
 237
 238         status = fsctl_srv_copychunk_loop(req);
 239         if (tevent_req_nterror(req, status)) {
 240                 return tevent_req_post(req, ev);
 241         }
 242
 243         return req;
 244 }
 245
 246 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 247 {
 248         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 249                 req, struct fsctl_srv_copychunk_state);
 250         struct tevent_req *subreq = NULL;
 251         uint32_t length = 0;
 252         off_t source_off = 0;
 253         off_t target_off = 0;
 254
 255         /*
 256          * chunk_count can be 0 which must either just do nothing returning
 257          * success saying number of copied chunks is 0 (verified against
 258          * Windows).
 259          *
 260          * Or it can be a special macOS copyfile request, so we send this into
 261          * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
 262          */
 263         if (state->cc_copy.chunk_count > 0) {
 264                 struct srv_copychunk *chunk = NULL;
 265
 266                 chunk = &state->cc_copy.chunks[state->current_chunk];
 267                 length = chunk->length;
 268                 source_off = chunk->source_off;
 269                 target_off = chunk->target_off;
 270         }
 271
 272         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 273                                          state,
 274                                          state->ev,
 275                                          state->src_fsp,
 276                                          source_off,
 277                                          state->dst_fsp,
 278                                          target_off,
 279                                          length,
 280                                          0);
 281         if (tevent_req_nomem(subreq, req)) {
 282                 return NT_STATUS_NO_MEMORY;
 283         }
 284         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 285
 286         return NT_STATUS_OK;
 287 }
 288
 289 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 290 {
 291         struct tevent_req *req = tevent_req_callback_data(
 292                 subreq, struct tevent_req);
 293         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 294                 req, struct fsctl_srv_copychunk_state);
 295         off_t chunk_nwritten;
 296         NTSTATUS status;
 297
 298         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
 299                                          &chunk_nwritten);
 300         TALLOC_FREE(subreq);
 301         if (!NT_STATUS_IS_OK(status)) {
 302                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 303                         nt_errstr(status),
 304                         (unsigned int)state->current_chunk,
 305                         (unsigned int)state->cc_copy.chunk_count);
 306                 tevent_req_nterror(req, status);
 307                 return;
 308         }
 309
 310         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 311                   (unsigned int)state->current_chunk,
 312                   (unsigned int)state->cc_copy.chunk_count);
 313         state->total_written += chunk_nwritten;
 314
 315         if (state->cc_copy.chunk_count == 0) {
 316                 /*
 317                  * This must not produce an error but just return a chunk count
 318                  * of 0 in the response.
 319                  */
 320                 tevent_req_done(req);
 321                 return;
 322         }
 323
 324         state->current_chunk++;
 325         if (state->current_chunk == state->cc_copy.chunk_count) {
 326                 tevent_req_done(req);
 327                 return;
 328         }
 329
 330         status = fsctl_srv_copychunk_loop(req);
 331         if (tevent_req_nterror(req, status)) {
 332                 return;
 333         }
 334 }
 335
 336 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 337                                          struct srv_copychunk_rsp *cc_rsp,
 338                                          bool *pack_rsp)
 339 {
 340         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 341                                         struct fsctl_srv_copychunk_state);
 342         NTSTATUS status;
 343
 344         switch (state->out_data) {
 345         case COPYCHUNK_OUT_EMPTY:
 346                 *pack_rsp = false;
 347                 break;
 348         case COPYCHUNK_OUT_LIMITS:
 349                 /* 2.2.32.1 - send back our maximum transfer size limits */
 350                 copychunk_pack_limits(cc_rsp);
 351                 *pack_rsp = true;
 352                 break;
 353         case COPYCHUNK_OUT_RSP:
 354                 cc_rsp->chunks_written = state->current_chunk;
 355                 cc_rsp->chunk_bytes_written = 0;
 356                 cc_rsp->total_bytes_written = state->total_written;
 357                 *pack_rsp = true;
 358                 break;
 359         default:        /* not reached */
 360                 assert(1);
 361                 break;
 362         }
 363         status = tevent_req_simple_recv_ntstatus(req);
 364         return status;
 365 }
 366
 367 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 368                                          struct tevent_context *ev,
 369                                          struct smbXsrv_connection *xconn,
 370                                          DATA_BLOB *in_input,
 371                                          uint32_t in_max_output,
 372                                          DATA_BLOB *out_output)
 373 {
 374         struct fsctl_net_iface_info *array = NULL;
 375         struct fsctl_net_iface_info *first = NULL;
 376         struct fsctl_net_iface_info *last = NULL;
 377         size_t i;
 378         size_t num_ifaces = iface_count();
 379         enum ndr_err_code ndr_err;
 380
 381         if (in_input->length != 0) {
 382                 return NT_STATUS_INVALID_PARAMETER;
 383         }
 384
 385         *out_output = data_blob_null;
 386
 387         array = talloc_zero_array(mem_ctx,
 388                                   struct fsctl_net_iface_info,
 389                                   num_ifaces);
 390         if (array == NULL) {
 391                 return NT_STATUS_NO_MEMORY;
 392         }
 393
 394         for (i=0; i < num_ifaces; i++) {
 395                 struct fsctl_net_iface_info *cur = &array[i];
 396                 const struct interface *iface = get_interface(i);
 397                 const struct sockaddr_storage *ifss = &iface->ip;
 398                 const void *ifptr = ifss;
 399                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 400                 struct tsocket_address *a = NULL;
 401                 char *addr;
 402                 bool ok;
 403                 int ret;
 404
 405                 ret = tsocket_address_bsd_from_sockaddr(array,
 406                                         ifsa, sizeof(struct sockaddr_storage),
 407                                         &a);
 408                 if (ret != 0) {
 409                         return map_nt_error_from_unix_common(errno);
 410                 }
 411
 412                 ok = tsocket_address_is_inet(a, "ip");
 413                 if (!ok) {
 414                         continue;
 415                 }
 416
 417                 addr = tsocket_address_inet_addr_string(a, array);
 418                 if (addr == NULL) {
 419                         TALLOC_FREE(array);
 420                         return NT_STATUS_NO_MEMORY;
 421                 }
 422
 423                 cur->ifindex = iface->if_index;
 424                 if (cur->ifindex == 0) {
 425                         /*
 426                          * Did not get interface index from kernel,
 427                          * nor from the config. ==> Apply a common
 428                          * default value for these cases.
 429                          */
 430                         cur->ifindex = UINT32_MAX;
 431                 }
 432                 cur->capability = iface->capability;
 433                 cur->linkspeed = iface->linkspeed;
 434                 if (cur->linkspeed == 0) {
 435                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 436                                   "address [%s].\n", iface->name, addr);
 437                         continue;
 438                 }
 439
 440                 ok = tsocket_address_is_inet(a, "ipv4");
 441                 if (ok) {
 442                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 443                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 444                 }
 445                 ok = tsocket_address_is_inet(a, "ipv6");
 446                 if (ok) {
 447                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 448                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 449                 }
 450
 451                 if (first == NULL) {
 452                         first = cur;
 453                 }
 454                 if (last != NULL) {
 455                         last->next = cur;
 456                 }
 457                 last = cur;
 458         }
 459
 460         if (first == NULL) {
 461                 TALLOC_FREE(array);
 462                 return NT_STATUS_OK;
 463         }
 464
 465         if (DEBUGLEVEL >= 10) {
 466                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 467         }
 468
 469         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 470                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 471         TALLOC_FREE(array);
 472         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 473                 return ndr_map_error2ntstatus(ndr_err);
 474         }
 475
 476         return NT_STATUS_OK;
 477 }
 478
 479 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 480                                         struct tevent_context *ev,
 481                                         struct smbXsrv_connection *conn,
 482                                         DATA_BLOB *in_input,
 483                                         uint32_t in_max_output,
 484                                         DATA_BLOB *out_output,
 485                                         bool *disconnect)
 486 {
 487         uint32_t in_capabilities;
 488         DATA_BLOB in_guid_blob;
 489         struct GUID in_guid;
 490         uint16_t in_security_mode;
 491         uint16_t in_num_dialects;
 492         uint16_t dialect;
 493         DATA_BLOB out_guid_blob;
 494         NTSTATUS status;
 495         enum protocol_types protocol = PROTOCOL_NONE;
 496
 497         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
 498                 /*
 499                  * With SMB 2.02 we didn't get the
 500                  * capabitities, client guid, security mode
 501                  * and dialects the client would have offered.
 502                  *
 503                  * So we behave compatible with a true
 504                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
 505                  *
 506                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
 507                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
 508                  * starting with SMB 2.10, while Windows only supports
 509                  * it starting with SMB > 2.10.
 510                  */
 511                 return NT_STATUS_FILE_CLOSED;
 512         }
 513
 514         if (in_input->length < 0x18) {
 515                 return NT_STATUS_INVALID_PARAMETER;
 516         }
 517
 518         in_capabilities = IVAL(in_input->data, 0x00);
 519         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 520         in_security_mode = SVAL(in_input->data, 0x14);
 521         in_num_dialects = SVAL(in_input->data, 0x16);
 522
 523         if (in_input->length < (0x18 + in_num_dialects*2)) {
 524                 return NT_STATUS_INVALID_PARAMETER;
 525         }
 526
 527         if (in_max_output < 0x18) {
 528                 return NT_STATUS_BUFFER_TOO_SMALL;
 529         }
 530
 531         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 532         if (!NT_STATUS_IS_OK(status)) {
 533                 return status;
 534         }
 535
 536         /*
 537          * From: [MS-SMB2]
 538          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 539          *
 540          * The server MUST determine the greatest common dialect
 541          * between the dialects it implements and the Dialects array
 542          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 543          * matched, or if the value is not equal to Connection.Dialect,
 544          * the server MUST terminate the transport connection
 545          * and free the Connection object.
 546          */
 547         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 548                                                     in_num_dialects,
 549                                                     &dialect);
 550         if (conn->protocol != protocol) {
 551                 *disconnect = true;
 552                 return NT_STATUS_ACCESS_DENIED;
 553         }
 554
 555         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 556                 *disconnect = true;
 557                 return NT_STATUS_ACCESS_DENIED;
 558         }
 559
 560         if (in_security_mode != conn->smb2.client.security_mode) {
 561                 *disconnect = true;
 562                 return NT_STATUS_ACCESS_DENIED;
 563         }
 564
 565         if (in_capabilities != conn->smb2.client.capabilities) {
 566                 *disconnect = true;
 567                 return NT_STATUS_ACCESS_DENIED;
 568         }
 569
 570         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 571                                   &out_guid_blob);
 572         if (!NT_STATUS_IS_OK(status)) {
 573                 return status;
 574         }
 575
 576         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 577         if (out_output->data == NULL) {
 578                 return NT_STATUS_NO_MEMORY;
 579         }
 580
 581         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 582         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 583         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 584         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 585
 586         return NT_STATUS_OK;
 587 }
 588
 589 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 590 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
 591
 592 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 593                                          struct tevent_context *ev,
 594                                          struct tevent_req *req,
 595                                          struct smbd_smb2_ioctl_state *state)
 596 {
 597         struct tevent_req *subreq;
 598         NTSTATUS status;
 599
 600         switch (ctl_code) {
 601         /*
 602          * [MS-SMB2] 2.2.31
 603          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 604          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 605          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 606          * FILE_WRITE_DATA access.
 607          */
 608         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 609         case FSCTL_SRV_COPYCHUNK:
 610                 subreq = fsctl_srv_copychunk_send(state, ev,
 611                                                   ctl_code,
 612                                                   state->fsp,
 613                                                   &state->in_input,
 614                                                   state->in_max_output,
 615                                                   state->smb2req);
 616                 if (tevent_req_nomem(subreq, req)) {
 617                         return tevent_req_post(req, ev);
 618                 }
 619                 tevent_req_set_callback(subreq,
 620                                         smb2_ioctl_network_fs_copychunk_done,
 621                                         req);
 622                 return req;
 623                 break;
 624         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 625                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 626                 {
 627                         if (IS_IPC(state->smbreq->conn)) {
 628                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 629                         } else {
 630                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 631                         }
 632
 633                         tevent_req_nterror(req, status);
 634                         return tevent_req_post(req, ev);
 635                 }
 636
 637                 status = fsctl_network_iface_info(state, ev,
 638                                                   state->smbreq->xconn,
 639                                                   &state->in_input,
 640                                                   state->in_max_output,
 641                                                   &state->out_output);
 642                 if (!tevent_req_nterror(req, status)) {
 643                         tevent_req_done(req);
 644                 }
 645                 return tevent_req_post(req, ev);
 646                 break;
 647         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 648                 status = fsctl_validate_neg_info(state, ev,
 649                                                  state->smbreq->xconn,
 650                                                  &state->in_input,
 651                                                  state->in_max_output,
 652                                                  &state->out_output,
 653                                                  &state->disconnect);
 654                 if (!tevent_req_nterror(req, status)) {
 655                         tevent_req_done(req);
 656                 }
 657                 return tevent_req_post(req, ev);
 658                 break;
 659         case FSCTL_SRV_REQUEST_RESUME_KEY:
 660                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
 661                                                    ev,
 662                                                    state->fsp,
 663                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
 664                                                    0, 0, 0);
 665                 if (tevent_req_nomem(subreq, req)) {
 666                         return tevent_req_post(req, ev);
 667                 }
 668                 tevent_req_set_callback(
 669                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
 670                 return req;
 671
 672         default: {
 673                 uint8_t *out_data = NULL;
 674                 uint32_t out_data_len = 0;
 675
 676                 if (state->fsp == NULL) {
 677                         status = NT_STATUS_NOT_SUPPORTED;
 678                 } else {
 679                         status = SMB_VFS_FSCTL(state->fsp,
 680                                                state,
 681                                                ctl_code,
 682                                                state->smbreq->flags2,
 683                                                state->in_input.data,
 684                                                state->in_input.length,
 685                                                &out_data,
 686                                                state->in_max_output,
 687                                                &out_data_len);
 688                         state->out_output = data_blob_const(out_data, out_data_len);
 689                         if (NT_STATUS_IS_OK(status)) {
 690                                 tevent_req_done(req);
 691                                 return tevent_req_post(req, ev);
 692                         }
 693                 }
 694
 695                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 696                         if (IS_IPC(state->smbreq->conn)) {
 697                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 698                         } else {
 699                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 700                         }
 701                 }
 702
 703                 tevent_req_nterror(req, status);
 704                 return tevent_req_post(req, ev);
 705                 break;
 706         }
 707         }
 708
 709         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 710         return tevent_req_post(req, ev);
 711 }
 712
 713 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 714 {
 715         struct tevent_req *req = tevent_req_callback_data(subreq,
 716                                                           struct tevent_req);
 717         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 718                                                 struct smbd_smb2_ioctl_state);
 719         struct srv_copychunk_rsp cc_rsp;
 720         NTSTATUS status;
 721         bool pack_rsp = false;
 722
 723         ZERO_STRUCT(cc_rsp);
 724         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 725         TALLOC_FREE(subreq);
 726         if (pack_rsp == true) {
 727                 enum ndr_err_code ndr_ret;
 728                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 729                                                ioctl_state,
 730                                                &cc_rsp,
 731                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 732                 if (ndr_ret != NDR_ERR_SUCCESS) {
 733                         status = NT_STATUS_INTERNAL_ERROR;
 734                 }
 735         }
 736
 737         if (!tevent_req_nterror(req, status)) {
 738                 tevent_req_done(req);
 739         }
 740 }
 741
 742 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
 743 {
 744         struct tevent_req *req = tevent_req_callback_data(
 745                 subreq, struct tevent_req);
 746         struct smbd_smb2_ioctl_state *state = tevent_req_data(
 747                 req, struct smbd_smb2_ioctl_state);
 748         struct req_resume_key_rsp rkey_rsp;
 749         enum ndr_err_code ndr_ret;
 750         DATA_BLOB token;
 751         NTSTATUS status;
 752
 753         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
 754                                            state->fsp->conn,
 755                                            state,
 756                                            &token);
 757         TALLOC_FREE(subreq);
 758         if (tevent_req_nterror(req, status)) {
 759                 return;
 760         }
 761
 762         if (token.length != sizeof(rkey_rsp.resume_key)) {
 763                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 764                 return;
 765         }
 766
 767         ZERO_STRUCT(rkey_rsp);
 768         memcpy(rkey_rsp.resume_key, token.data, token.length);
 769
 770         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
 771                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 772         if (ndr_ret != NDR_ERR_SUCCESS) {
 773                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 774                 return;
 775         }
 776
 777         tevent_req_done(req);
 778         return;
 779 }