source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32
  33 #define COPYCHUNK_MAX_CHUNKS    256             /* 2k8r2 & win8 = 256 */
  34 #define COPYCHUNK_MAX_CHUNK_LEN 1048576         /* 2k8r2 & win8 = 1048576 */
  35 #define COPYCHUNK_MAX_TOTAL_LEN 16777216        /* 2k8r2 & win8 = 16777216 */
  36 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  37 {
  38         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  39         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  40         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  41 }
  42
  43 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  44 {
  45         uint32_t i;
  46         uint32_t total_len = 0;
  47
  48         /*
  49          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  50          * Send and invalid parameter response if:
  51          * - The ChunkCount value is greater than
  52          *   ServerSideCopyMaxNumberofChunks
  53          */
  54         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  55                 return NT_STATUS_INVALID_PARAMETER;
  56         }
  57
  58         for (i = 0; i < cc_copy->chunk_count; i++) {
  59                 /*
  60                  * - The Length value in a single chunk is greater than
  61                  *   ServerSideCopyMaxChunkSize or equal to zero.
  62                  */
  63                 if ((cc_copy->chunks[i].length == 0)
  64                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  65                         return NT_STATUS_INVALID_PARAMETER;
  66                 }
  67                 total_len += cc_copy->chunks[i].length;
  68         }
  69         /*
  70          * - Sum of Lengths in all chunks is greater than
  71          *   ServerSideCopyMaxDataSize
  72          */
  73         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  74                 return NT_STATUS_INVALID_PARAMETER;
  75         }
  76
  77         return NT_STATUS_OK;
  78 }
  79
  80 struct fsctl_srv_copychunk_state {
  81         struct connection_struct *conn;
  82         uint32_t dispatch_count;
  83         uint32_t recv_count;
  84         uint32_t bad_recv_count;
  85         NTSTATUS status;
  86         off_t total_written;
  87         struct files_struct *src_fsp;
  88         struct files_struct *dst_fsp;
  89         enum {
  90                 COPYCHUNK_OUT_EMPTY = 0,
  91                 COPYCHUNK_OUT_LIMITS,
  92                 COPYCHUNK_OUT_RSP,
  93         } out_data;
  94         bool aapl_copyfile;
  95 };
  96 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  97
  98 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
  99                                         struct files_struct *src_fsp,
 100                                         struct files_struct *dst_fsp,
 101                                         struct smb_request *smb1req)
 102 {
 103         /*
 104          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 105          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 106          * the following are true:
 107          * - The Open.GrantedAccess of the destination file does not include
 108          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 109          */
 110         if (!CHECK_WRITE(dst_fsp)) {
 111                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 112                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 113                 return NT_STATUS_ACCESS_DENIED;
 114         }
 115         /*
 116          * - The Open.GrantedAccess of the destination file does not include
 117          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 118          */
 119         if ((ctl_code == FSCTL_SRV_COPYCHUNK)
 120           && !CHECK_READ(dst_fsp, smb1req)) {
 121                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 122                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 123                 return NT_STATUS_ACCESS_DENIED;
 124         }
 125         /*
 126          * - The Open.GrantedAccess of the source file does not include
 127          *   FILE_READ_DATA access.
 128          */
 129         if (!CHECK_READ(src_fsp, smb1req)) {
 130                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 131                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 132                 return NT_STATUS_ACCESS_DENIED;
 133         }
 134
 135         if (src_fsp->is_directory) {
 136                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 137                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 138                 return NT_STATUS_ACCESS_DENIED;
 139         }
 140
 141         if (dst_fsp->is_directory) {
 142                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 143                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 144                 return NT_STATUS_ACCESS_DENIED;
 145         }
 146
 147         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 148                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 149                 return NT_STATUS_ACCESS_DENIED;
 150         }
 151
 152         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 153                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 154                 return NT_STATUS_ACCESS_DENIED;
 155         }
 156
 157         return NT_STATUS_OK;
 158 }
 159
 160 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 161                                                    struct tevent_context *ev,
 162                                                    uint32_t ctl_code,
 163                                                    struct files_struct *dst_fsp,
 164                                                    DATA_BLOB *in_input,
 165                                                    size_t in_max_output,
 166                                                    struct smbd_smb2_request *smb2req)
 167 {
 168         struct tevent_req *req;
 169         struct srv_copychunk_copy cc_copy;
 170         enum ndr_err_code ndr_ret;
 171         uint64_t src_persistent_h;
 172         uint64_t src_volatile_h;
 173         int i;
 174         struct srv_copychunk *chunk;
 175         struct fsctl_srv_copychunk_state *state;
 176
 177         /* handler for both copy-chunk variants */
 178         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 179                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 180
 181         req = tevent_req_create(mem_ctx, &state,
 182                                 struct fsctl_srv_copychunk_state);
 183         if (req == NULL) {
 184                 return NULL;
 185         }
 186         state->conn = dst_fsp->conn;
 187
 188         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 189                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 190                           "response %lu\n", (int)in_max_output,
 191                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 192                 state->status = NT_STATUS_INVALID_PARAMETER;
 193                 tevent_req_nterror(req, state->status);
 194                 return tevent_req_post(req, ev);
 195         }
 196
 197         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
 198                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 199         if (ndr_ret != NDR_ERR_SUCCESS) {
 200                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 201                 state->status = NT_STATUS_INVALID_PARAMETER;
 202                 tevent_req_nterror(req, state->status);
 203                 return tevent_req_post(req, ev);
 204         }
 205
 206         /* persistent/volatile keys sent as the resume key */
 207         src_persistent_h = BVAL(cc_copy.source_key, 0);
 208         src_volatile_h = BVAL(cc_copy.source_key, 8);
 209         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 210         if (state->src_fsp == NULL) {
 211                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 212                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 213                 tevent_req_nterror(req, state->status);
 214                 return tevent_req_post(req, ev);
 215         }
 216
 217         state->dst_fsp = dst_fsp;
 218
 219         state->status = copychunk_check_handles(ctl_code,
 220                                                 state->src_fsp,
 221                                                 state->dst_fsp,
 222                                                 smb2req->smb1req);
 223         if (!NT_STATUS_IS_OK(state->status)) {
 224                 tevent_req_nterror(req, state->status);
 225                 return tevent_req_post(req, ev);
 226         }
 227
 228         state->status = copychunk_check_limits(&cc_copy);
 229         if (!NT_STATUS_IS_OK(state->status)) {
 230                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 231                 state->out_data = COPYCHUNK_OUT_LIMITS;
 232                 tevent_req_nterror(req, state->status);
 233                 return tevent_req_post(req, ev);
 234         }
 235
 236         /* any errors from here onwards should carry copychunk response data */
 237         state->out_data = COPYCHUNK_OUT_RSP;
 238
 239         if (cc_copy.chunk_count == 0) {
 240                 struct tevent_req *vfs_subreq;
 241                 /*
 242                  * Process as OS X copyfile request. This is currently
 243                  * the only copychunk request with a chunk count of 0
 244                  * we will process.
 245                  */
 246                 if (!state->src_fsp->aapl_copyfile_supported) {
 247                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 248                         return tevent_req_post(req, ev);
 249                 }
 250                 if (!state->dst_fsp->aapl_copyfile_supported) {
 251                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 252                         return tevent_req_post(req, ev);
 253                 }
 254                 state->aapl_copyfile = true;
 255                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 256                                                      state, ev,
 257                                                      state->src_fsp,
 258                                                      0,
 259                                                      state->dst_fsp,
 260                                                      0,
 261                                                      0);
 262                 if (tevent_req_nomem(vfs_subreq, req)) {
 263                         return tevent_req_post(req, ev);
 264                 }
 265                 tevent_req_set_callback(vfs_subreq,
 266                                         fsctl_srv_copychunk_vfs_done, req);
 267                 state->dispatch_count++;
 268                 return req;
 269         }
 270
 271         for (i = 0; i < cc_copy.chunk_count; i++) {
 272                 struct tevent_req *vfs_subreq;
 273                 chunk = &cc_copy.chunks[i];
 274                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 275                                                      state, ev,
 276                                                      state->src_fsp,
 277                                                      chunk->source_off,
 278                                                      state->dst_fsp,
 279                                                      chunk->target_off,
 280                                                      chunk->length);
 281                 if (vfs_subreq == NULL) {
 282                         DEBUG(0, ("VFS copy chunk send failed\n"));
 283                         state->status = NT_STATUS_NO_MEMORY;
 284                         if (state->dispatch_count == 0) {
 285                                 /* nothing dispatched, return immediately */
 286                                 tevent_req_nterror(req, state->status);
 287                                 return tevent_req_post(req, ev);
 288                         } else {
 289                                 /*
 290                                  * wait for dispatched to complete before
 291                                  * returning error.
 292                                  */
 293                                 break;
 294                         }
 295                 }
 296                 tevent_req_set_callback(vfs_subreq,
 297                                         fsctl_srv_copychunk_vfs_done, req);
 298                 state->dispatch_count++;
 299         }
 300
 301         return req;
 302 }
 303
 304 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 305 {
 306         struct tevent_req *req = tevent_req_callback_data(
 307                 subreq, struct tevent_req);
 308         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 309                                         struct fsctl_srv_copychunk_state);
 310         off_t chunk_nwritten;
 311         NTSTATUS status;
 312
 313         state->recv_count++;
 314         status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
 315                                          &chunk_nwritten);
 316         TALLOC_FREE(subreq);
 317         if (NT_STATUS_IS_OK(status)) {
 318                 DEBUG(10, ("good copy chunk recv %u of %u\n",
 319                            (unsigned int)state->recv_count,
 320                            (unsigned int)state->dispatch_count));
 321                 state->total_written += chunk_nwritten;
 322         } else {
 323                 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
 324                           (unsigned int)state->recv_count,
 325                           (unsigned int)state->dispatch_count,
 326                           nt_errstr(status)));
 327                 state->bad_recv_count++;
 328                 /* may overwrite previous failed status */
 329                 state->status = status;
 330         }
 331
 332         if (state->recv_count != state->dispatch_count) {
 333                 /*
 334                  * Wait for all VFS copy_chunk requests to complete, even
 335                  * if an error is received for a specific chunk.
 336                  */
 337                 return;
 338         }
 339
 340         if (!tevent_req_nterror(req, state->status)) {
 341                 tevent_req_done(req);
 342         }
 343 }
 344
 345 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 346                                          struct srv_copychunk_rsp *cc_rsp,
 347                                          bool *pack_rsp)
 348 {
 349         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 350                                         struct fsctl_srv_copychunk_state);
 351         NTSTATUS status;
 352
 353         switch (state->out_data) {
 354         case COPYCHUNK_OUT_EMPTY:
 355                 *pack_rsp = false;
 356                 break;
 357         case COPYCHUNK_OUT_LIMITS:
 358                 /* 2.2.32.1 - send back our maximum transfer size limits */
 359                 copychunk_pack_limits(cc_rsp);
 360                 *pack_rsp = true;
 361                 break;
 362         case COPYCHUNK_OUT_RSP:
 363                 if (state->aapl_copyfile == true) {
 364                         cc_rsp->chunks_written = 0;
 365                 } else {
 366                         cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
 367                 }
 368                 cc_rsp->chunk_bytes_written = 0;
 369                 cc_rsp->total_bytes_written = state->total_written;
 370                 *pack_rsp = true;
 371                 break;
 372         default:        /* not reached */
 373                 assert(1);
 374                 break;
 375         }
 376         status = state->status;
 377         tevent_req_received(req);
 378
 379         return status;
 380 }
 381
 382 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 383                                         struct tevent_context *ev,
 384                                         struct smbXsrv_connection *conn,
 385                                         DATA_BLOB *in_input,
 386                                         uint32_t in_max_output,
 387                                         DATA_BLOB *out_output,
 388                                         bool *disconnect)
 389 {
 390         uint32_t in_capabilities;
 391         DATA_BLOB in_guid_blob;
 392         struct GUID in_guid;
 393         uint16_t in_security_mode;
 394         uint16_t in_num_dialects;
 395         uint16_t dialect;
 396         DATA_BLOB out_guid_blob;
 397         NTSTATUS status;
 398         enum protocol_types protocol = PROTOCOL_NONE;
 399
 400         if (in_input->length < 0x18) {
 401                 return NT_STATUS_INVALID_PARAMETER;
 402         }
 403
 404         in_capabilities = IVAL(in_input->data, 0x00);
 405         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 406         in_security_mode = SVAL(in_input->data, 0x14);
 407         in_num_dialects = SVAL(in_input->data, 0x16);
 408
 409         if (in_input->length < (0x18 + in_num_dialects*2)) {
 410                 return NT_STATUS_INVALID_PARAMETER;
 411         }
 412
 413         if (in_max_output < 0x18) {
 414                 return NT_STATUS_BUFFER_TOO_SMALL;
 415         }
 416
 417         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 418         if (!NT_STATUS_IS_OK(status)) {
 419                 return status;
 420         }
 421
 422         /*
 423          * From: [MS-SMB2]
 424          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 425          *
 426          * The server MUST determine the greatest common dialect
 427          * between the dialects it implements and the Dialects array
 428          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 429          * matched, or if the value is not equal to Connection.Dialect,
 430          * the server MUST terminate the transport connection
 431          * and free the Connection object.
 432          */
 433         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 434                                                     in_num_dialects,
 435                                                     &dialect);
 436         if (conn->protocol != protocol) {
 437                 *disconnect = true;
 438                 return NT_STATUS_ACCESS_DENIED;
 439         }
 440
 441         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 442                 *disconnect = true;
 443                 return NT_STATUS_ACCESS_DENIED;
 444         }
 445
 446         if (in_security_mode != conn->smb2.client.security_mode) {
 447                 *disconnect = true;
 448                 return NT_STATUS_ACCESS_DENIED;
 449         }
 450
 451         if (in_capabilities != conn->smb2.client.capabilities) {
 452                 *disconnect = true;
 453                 return NT_STATUS_ACCESS_DENIED;
 454         }
 455
 456         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 457                                   &out_guid_blob);
 458         if (!NT_STATUS_IS_OK(status)) {
 459                 return status;
 460         }
 461
 462         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 463         if (out_output->data == NULL) {
 464                 return NT_STATUS_NO_MEMORY;
 465         }
 466
 467         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 468         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 469         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 470         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 471
 472         return NT_STATUS_OK;
 473 }
 474
 475 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
 476                                          struct tevent_context *ev,
 477                                          struct files_struct *fsp,
 478                                          uint32_t in_max_output,
 479                                          DATA_BLOB *out_output)
 480 {
 481         struct req_resume_key_rsp rkey_rsp;
 482         enum ndr_err_code ndr_ret;
 483         DATA_BLOB output;
 484
 485         if (fsp == NULL) {
 486                 return NT_STATUS_FILE_CLOSED;
 487         }
 488
 489         ZERO_STRUCT(rkey_rsp);
 490         /* combine persistent and volatile handles for the resume key */
 491         SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
 492         SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
 493
 494         ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
 495                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 496         if (ndr_ret != NDR_ERR_SUCCESS) {
 497                 return NT_STATUS_INTERNAL_ERROR;
 498         }
 499
 500         if (in_max_output < output.length) {
 501                 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
 502                           (unsigned int)in_max_output, (long int)output.length));
 503                 return NT_STATUS_INVALID_PARAMETER;
 504         }
 505         *out_output = output;
 506
 507         return NT_STATUS_OK;
 508 }
 509
 510 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 511
 512 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 513                                          struct tevent_context *ev,
 514                                          struct tevent_req *req,
 515                                          struct smbd_smb2_ioctl_state *state)
 516 {
 517         struct tevent_req *subreq;
 518         NTSTATUS status;
 519
 520         switch (ctl_code) {
 521         /*
 522          * [MS-SMB2] 2.2.31
 523          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 524          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 525          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 526          * FILE_WRITE_DATA access.
 527          */
 528         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 529         case FSCTL_SRV_COPYCHUNK:
 530                 subreq = fsctl_srv_copychunk_send(state, ev,
 531                                                   ctl_code,
 532                                                   state->fsp,
 533                                                   &state->in_input,
 534                                                   state->in_max_output,
 535                                                   state->smb2req);
 536                 if (tevent_req_nomem(subreq, req)) {
 537                         return tevent_req_post(req, ev);
 538                 }
 539                 tevent_req_set_callback(subreq,
 540                                         smb2_ioctl_network_fs_copychunk_done,
 541                                         req);
 542                 return req;
 543                 break;
 544         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 545                 status = fsctl_validate_neg_info(state, ev,
 546                                                  state->smbreq->xconn,
 547                                                  &state->in_input,
 548                                                  state->in_max_output,
 549                                                  &state->out_output,
 550                                                  &state->disconnect);
 551                 if (!tevent_req_nterror(req, status)) {
 552                         tevent_req_done(req);
 553                 }
 554                 return tevent_req_post(req, ev);
 555                 break;
 556         case FSCTL_SRV_REQUEST_RESUME_KEY:
 557                 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
 558                                                   state->in_max_output,
 559                                                   &state->out_output);
 560                 if (!tevent_req_nterror(req, status)) {
 561                         tevent_req_done(req);
 562                 }
 563                 return tevent_req_post(req, ev);
 564                 break;
 565         default: {
 566                 uint8_t *out_data = NULL;
 567                 uint32_t out_data_len = 0;
 568
 569                 if (state->fsp == NULL) {
 570                         status = NT_STATUS_NOT_SUPPORTED;
 571                 } else {
 572                         status = SMB_VFS_FSCTL(state->fsp,
 573                                                state,
 574                                                ctl_code,
 575                                                state->smbreq->flags2,
 576                                                state->in_input.data,
 577                                                state->in_input.length,
 578                                                &out_data,
 579                                                state->in_max_output,
 580                                                &out_data_len);
 581                         state->out_output = data_blob_const(out_data, out_data_len);
 582                         if (NT_STATUS_IS_OK(status)) {
 583                                 tevent_req_done(req);
 584                                 return tevent_req_post(req, ev);
 585                         }
 586                 }
 587
 588                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 589                         if (IS_IPC(state->smbreq->conn)) {
 590                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 591                         } else {
 592                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 593                         }
 594                 }
 595
 596                 tevent_req_nterror(req, status);
 597                 return tevent_req_post(req, ev);
 598                 break;
 599         }
 600         }
 601
 602         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 603         return tevent_req_post(req, ev);
 604 }
 605
 606 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 607 {
 608         struct tevent_req *req = tevent_req_callback_data(subreq,
 609                                                           struct tevent_req);
 610         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 611                                                 struct smbd_smb2_ioctl_state);
 612         struct srv_copychunk_rsp cc_rsp;
 613         NTSTATUS status;
 614         bool pack_rsp = false;
 615
 616         ZERO_STRUCT(cc_rsp);
 617         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 618         TALLOC_FREE(subreq);
 619         if (pack_rsp == true) {
 620                 enum ndr_err_code ndr_ret;
 621                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 622                                                ioctl_state,
 623                                                &cc_rsp,
 624                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 625                 if (ndr_ret != NDR_ERR_SUCCESS) {
 626                         status = NT_STATUS_INTERNAL_ERROR;
 627                 }
 628         }
 629
 630         if (!tevent_req_nterror(req, status)) {
 631                 tevent_req_done(req);
 632         }
 633 }