source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33 #include "lib/messages_ctdb.h"
  34 #include "ctdbd_conn.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_SMB2
  38
  39 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  40 {
  41         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  42         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  43         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  44 }
  45
  46 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  47 {
  48         uint32_t i;
  49         uint32_t total_len = 0;
  50
  51         /*
  52          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  53          * Send and invalid parameter response if:
  54          * - The ChunkCount value is greater than
  55          *   ServerSideCopyMaxNumberofChunks
  56          */
  57         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  58                 return NT_STATUS_INVALID_PARAMETER;
  59         }
  60
  61         for (i = 0; i < cc_copy->chunk_count; i++) {
  62                 /*
  63                  * - The Length value in a single chunk is greater than
  64                  *   ServerSideCopyMaxChunkSize or equal to zero.
  65                  */
  66                 if ((cc_copy->chunks[i].length == 0)
  67                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  68                         return NT_STATUS_INVALID_PARAMETER;
  69                 }
  70                 total_len += cc_copy->chunks[i].length;
  71         }
  72         /*
  73          * - Sum of Lengths in all chunks is greater than
  74          *   ServerSideCopyMaxDataSize
  75          */
  76         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  77                 return NT_STATUS_INVALID_PARAMETER;
  78         }
  79
  80         return NT_STATUS_OK;
  81 }
  82
  83 struct fsctl_srv_copychunk_state {
  84         struct tevent_context *ev;
  85         struct connection_struct *conn;
  86         struct srv_copychunk_copy cc_copy;
  87         uint32_t current_chunk;
  88         NTSTATUS status;
  89         off_t total_written;
  90         uint32_t ctl_code;
  91         DATA_BLOB token;
  92         struct files_struct *src_fsp;
  93         struct files_struct *dst_fsp;
  94         enum {
  95                 COPYCHUNK_OUT_EMPTY = 0,
  96                 COPYCHUNK_OUT_LIMITS,
  97                 COPYCHUNK_OUT_RSP,
  98         } out_data;
  99 };
 100 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
 101
 102 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
 103
 104 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 105                                                    struct tevent_context *ev,
 106                                                    uint32_t ctl_code,
 107                                                    struct files_struct *dst_fsp,
 108                                                    DATA_BLOB *in_input,
 109                                                    size_t in_max_output,
 110                                                    struct smbd_smb2_request *smb2req)
 111 {
 112         struct tevent_req *req = NULL;
 113         struct fsctl_srv_copychunk_state *state = NULL;
 114         enum ndr_err_code ndr_ret;
 115         NTSTATUS status;
 116
 117         /* handler for both copy-chunk variants */
 118         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 119                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 120
 121         req = tevent_req_create(mem_ctx, &state,
 122                                 struct fsctl_srv_copychunk_state);
 123         if (req == NULL) {
 124                 return NULL;
 125         }
 126         *state = (struct fsctl_srv_copychunk_state) {
 127                 .conn = dst_fsp->conn,
 128                 .ev = ev,
 129                 .ctl_code = ctl_code,
 130                 .dst_fsp = dst_fsp,
 131         };
 132
 133         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 134                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 135                           "response %lu\n", (int)in_max_output,
 136                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 137                 state->status = NT_STATUS_INVALID_PARAMETER;
 138                 tevent_req_nterror(req, state->status);
 139                 return tevent_req_post(req, ev);
 140         }
 141
 142         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 143                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 144         if (ndr_ret != NDR_ERR_SUCCESS) {
 145                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 146                 state->status = NT_STATUS_INVALID_PARAMETER;
 147                 tevent_req_nterror(req, state->status);
 148                 return tevent_req_post(req, ev);
 149         }
 150
 151         state->token = data_blob_const(state->cc_copy.source_key,
 152                                        sizeof(state->cc_copy.source_key));
 153
 154         state->status = copychunk_check_limits(&state->cc_copy);
 155         if (!NT_STATUS_IS_OK(state->status)) {
 156                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 157                 state->out_data = COPYCHUNK_OUT_LIMITS;
 158                 tevent_req_nterror(req, state->status);
 159                 return tevent_req_post(req, ev);
 160         }
 161
 162         /* any errors from here onwards should carry copychunk response data */
 163         state->out_data = COPYCHUNK_OUT_RSP;
 164
 165         status = fsctl_srv_copychunk_loop(req);
 166         if (tevent_req_nterror(req, status)) {
 167                 return tevent_req_post(req, ev);
 168         }
 169
 170         return req;
 171 }
 172
 173 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 174 {
 175         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 176                 req, struct fsctl_srv_copychunk_state);
 177         struct tevent_req *subreq = NULL;
 178         uint32_t length = 0;
 179         off_t source_off = 0;
 180         off_t target_off = 0;
 181
 182         /*
 183          * chunk_count can be 0 which must either just do nothing returning
 184          * success saying number of copied chunks is 0 (verified against
 185          * Windows).
 186          *
 187          * Or it can be a special macOS copyfile request, so we send this into
 188          * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
 189          */
 190         if (state->cc_copy.chunk_count > 0) {
 191                 struct srv_copychunk *chunk = NULL;
 192
 193                 chunk = &state->cc_copy.chunks[state->current_chunk];
 194                 length = chunk->length;
 195                 source_off = chunk->source_off;
 196                 target_off = chunk->target_off;
 197         }
 198
 199         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 200                                          state,
 201                                          state->ev,
 202                                          state->ctl_code,
 203                                          &state->token,
 204                                          source_off,
 205                                          state->dst_fsp,
 206                                          target_off,
 207                                          length);
 208         if (tevent_req_nomem(subreq, req)) {
 209                 return NT_STATUS_NO_MEMORY;
 210         }
 211         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 212
 213         return NT_STATUS_OK;
 214 }
 215
 216 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 217 {
 218         struct tevent_req *req = tevent_req_callback_data(
 219                 subreq, struct tevent_req);
 220         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 221                 req, struct fsctl_srv_copychunk_state);
 222         off_t chunk_nwritten;
 223         NTSTATUS status;
 224
 225         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
 226                                          &chunk_nwritten);
 227         TALLOC_FREE(subreq);
 228         if (!NT_STATUS_IS_OK(status)) {
 229                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 230                         nt_errstr(status),
 231                         (unsigned int)state->current_chunk,
 232                         (unsigned int)state->cc_copy.chunk_count);
 233                 tevent_req_nterror(req, status);
 234                 return;
 235         }
 236
 237         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 238                   (unsigned int)state->current_chunk,
 239                   (unsigned int)state->cc_copy.chunk_count);
 240         state->total_written += chunk_nwritten;
 241
 242         if (state->cc_copy.chunk_count == 0) {
 243                 /*
 244                  * This must not produce an error but just return a chunk count
 245                  * of 0 in the response.
 246                  */
 247                 tevent_req_done(req);
 248                 return;
 249         }
 250
 251         state->current_chunk++;
 252         if (state->current_chunk == state->cc_copy.chunk_count) {
 253                 tevent_req_done(req);
 254                 return;
 255         }
 256
 257         status = fsctl_srv_copychunk_loop(req);
 258         if (tevent_req_nterror(req, status)) {
 259                 return;
 260         }
 261 }
 262
 263 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 264                                          struct srv_copychunk_rsp *cc_rsp,
 265                                          bool *pack_rsp)
 266 {
 267         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 268                                         struct fsctl_srv_copychunk_state);
 269         NTSTATUS status;
 270
 271         switch (state->out_data) {
 272         case COPYCHUNK_OUT_EMPTY:
 273                 *pack_rsp = false;
 274                 break;
 275         case COPYCHUNK_OUT_LIMITS:
 276                 /* 2.2.32.1 - send back our maximum transfer size limits */
 277                 copychunk_pack_limits(cc_rsp);
 278                 *pack_rsp = true;
 279                 break;
 280         case COPYCHUNK_OUT_RSP:
 281                 cc_rsp->chunks_written = state->current_chunk;
 282                 cc_rsp->chunk_bytes_written = 0;
 283                 cc_rsp->total_bytes_written = state->total_written;
 284                 *pack_rsp = true;
 285                 break;
 286         default:        /* not reached */
 287                 assert(1);
 288                 break;
 289         }
 290         status = tevent_req_simple_recv_ntstatus(req);
 291         return status;
 292 }
 293
 294 struct cluster_movable_ips {
 295         uint32_t array_len;
 296         uint32_t array_index;
 297         struct sockaddr_storage *ips;
 298 };
 299
 300 static int stash_cluster_movable_ips(uint32_t total_ip_count,
 301                                      const struct sockaddr_storage *ip,
 302                                      bool is_movable_ip,
 303                                      void *private_data)
 304 {
 305         struct cluster_movable_ips *cluster_movable_ips
 306                 = talloc_get_type_abort(private_data,
 307                                         struct cluster_movable_ips);
 308
 309         if (!is_movable_ip) {
 310                 return 0;
 311         }
 312
 313         if (cluster_movable_ips->array_len == 0) {
 314                 SMB_ASSERT(total_ip_count < INT_MAX);
 315                 cluster_movable_ips->ips
 316                         = talloc_zero_array(cluster_movable_ips,
 317                                             struct sockaddr_storage,
 318                                             total_ip_count);
 319                 if (cluster_movable_ips->ips == NULL) {
 320                         return ENOMEM;
 321                 }
 322                 cluster_movable_ips->array_len = total_ip_count;
 323         }
 324
 325         SMB_ASSERT(cluster_movable_ips->array_index
 326                                         < cluster_movable_ips->array_len);
 327
 328         cluster_movable_ips->ips[cluster_movable_ips->array_index] = *ip;
 329         cluster_movable_ips->array_index++;
 330
 331         return 0;
 332 }
 333
 334 static bool find_in_cluster_movable_ips(
 335                 struct cluster_movable_ips *cluster_movable_ips,
 336                 const struct sockaddr_storage *ifss)
 337 {
 338         struct samba_sockaddr srv_ip = {
 339                 .u = {
 340                         .ss = *ifss,
 341                 },
 342         };
 343         uint32_t i;
 344
 345         for (i = 0; i < cluster_movable_ips->array_index; i++) {
 346                 struct samba_sockaddr pub_ip = {
 347                         .u = {
 348                                 .ss = cluster_movable_ips->ips[i],
 349                         },
 350                 };
 351                 if (sockaddr_equal(&pub_ip.u.sa, &srv_ip.u.sa)) {
 352                         return true;
 353                 }
 354         }
 355         return false;
 356 }
 357
 358 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 359                                          struct tevent_context *ev,
 360                                          struct smbXsrv_connection *xconn,
 361                                          DATA_BLOB *in_input,
 362                                          uint32_t in_max_output,
 363                                          DATA_BLOB *out_output)
 364 {
 365         struct fsctl_net_iface_info *array = NULL;
 366         struct fsctl_net_iface_info *first = NULL;
 367         struct fsctl_net_iface_info *last = NULL;
 368         size_t i;
 369         size_t num_ifaces = iface_count();
 370         enum ndr_err_code ndr_err;
 371         struct cluster_movable_ips *cluster_movable_ips = NULL;
 372         int ret;
 373
 374         if (in_input->length != 0) {
 375                 return NT_STATUS_INVALID_PARAMETER;
 376         }
 377
 378         *out_output = data_blob_null;
 379
 380         array = talloc_zero_array(mem_ctx,
 381                                   struct fsctl_net_iface_info,
 382                                   num_ifaces);
 383         if (array == NULL) {
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386
 387         if (lp_clustering()) {
 388                 cluster_movable_ips = talloc_zero(array,
 389                                                   struct cluster_movable_ips);
 390                 if (cluster_movable_ips == NULL) {
 391                         TALLOC_FREE(array);
 392                         return NT_STATUS_NO_MEMORY;
 393                 }
 394                 ret = ctdbd_public_ip_foreach(messaging_ctdb_connection(),
 395                                               stash_cluster_movable_ips,
 396                                               cluster_movable_ips);
 397                 if (ret != 0) {
 398                         TALLOC_FREE(array);
 399                         return NT_STATUS_INTERNAL_ERROR;
 400                 }
 401         }
 402
 403         for (i=0; i < num_ifaces; i++) {
 404                 struct fsctl_net_iface_info *cur = &array[i];
 405                 const struct interface *iface = get_interface(i);
 406                 const struct sockaddr_storage *ifss = &iface->ip;
 407                 const void *ifptr = ifss;
 408                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 409                 struct tsocket_address *a = NULL;
 410                 char *addr;
 411                 bool ok;
 412
 413                 ret = tsocket_address_bsd_from_sockaddr(array,
 414                                         ifsa, sizeof(struct sockaddr_storage),
 415                                         &a);
 416                 if (ret != 0) {
 417                         NTSTATUS status = map_nt_error_from_unix_common(errno);
 418                         TALLOC_FREE(array);
 419                         return status;
 420                 }
 421
 422                 ok = tsocket_address_is_inet(a, "ip");
 423                 if (!ok) {
 424                         continue;
 425                 }
 426
 427                 addr = tsocket_address_inet_addr_string(a, array);
 428                 if (addr == NULL) {
 429                         TALLOC_FREE(array);
 430                         return NT_STATUS_NO_MEMORY;
 431                 }
 432
 433                 if (cluster_movable_ips != NULL) {
 434                         bool is_movable_ip = find_in_cluster_movable_ips(
 435                                                 cluster_movable_ips,
 436                                                 ifss);
 437                         if (is_movable_ip) {
 438                                 DBG_DEBUG("Interface [%s] - "
 439                                           "has movable public ip - "
 440                                           "skipping address [%s].\n",
 441                                           iface->name, addr);
 442                                 continue;
 443                         }
 444                 }
 445
 446                 cur->ifindex = iface->if_index;
 447                 if (cur->ifindex == 0) {
 448                         /*
 449                          * Did not get interface index from kernel,
 450                          * nor from the config. ==> Apply a common
 451                          * default value for these cases.
 452                          */
 453                         cur->ifindex = UINT32_MAX;
 454                 }
 455                 cur->capability = iface->capability;
 456                 cur->linkspeed = iface->linkspeed;
 457                 if (cur->linkspeed == 0) {
 458                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 459                                   "address [%s].\n", iface->name, addr);
 460                         continue;
 461                 }
 462
 463                 ok = tsocket_address_is_inet(a, "ipv4");
 464                 if (ok) {
 465                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 466                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 467                 }
 468                 ok = tsocket_address_is_inet(a, "ipv6");
 469                 if (ok) {
 470                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 471                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 472                 }
 473
 474                 if (first == NULL) {
 475                         first = cur;
 476                 }
 477                 if (last != NULL) {
 478                         last->next = cur;
 479                 }
 480                 last = cur;
 481         }
 482
 483         if (first == NULL) {
 484                 TALLOC_FREE(array);
 485                 return NT_STATUS_OK;
 486         }
 487
 488         if (DEBUGLEVEL >= 10) {
 489                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 490         }
 491
 492         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 493                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 494         TALLOC_FREE(array);
 495         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 496                 return ndr_map_error2ntstatus(ndr_err);
 497         }
 498
 499         return NT_STATUS_OK;
 500 }
 501
 502 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 503                                         struct tevent_context *ev,
 504                                         struct smbXsrv_connection *conn,
 505                                         DATA_BLOB *in_input,
 506                                         uint32_t in_max_output,
 507                                         DATA_BLOB *out_output,
 508                                         bool *disconnect)
 509 {
 510         uint32_t in_capabilities;
 511         DATA_BLOB in_guid_blob;
 512         struct GUID in_guid;
 513         uint16_t in_security_mode;
 514         uint16_t in_num_dialects;
 515         uint16_t dialect;
 516         struct GUID_ndr_buf out_guid_buf = { .buf = {0}, };
 517         NTSTATUS status;
 518         enum protocol_types protocol = PROTOCOL_NONE;
 519
 520         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
 521                 /*
 522                  * With SMB 2.02 we didn't get the
 523                  * capabitities, client guid, security mode
 524                  * and dialects the client would have offered.
 525                  *
 526                  * So we behave compatible with a true
 527                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
 528                  *
 529                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
 530                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
 531                  * starting with SMB 2.10, while Windows only supports
 532                  * it starting with SMB > 2.10.
 533                  */
 534                 return NT_STATUS_FILE_CLOSED;
 535         }
 536
 537         if (in_input->length < 0x18) {
 538                 return NT_STATUS_INVALID_PARAMETER;
 539         }
 540
 541         in_capabilities = IVAL(in_input->data, 0x00);
 542         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 543         in_security_mode = SVAL(in_input->data, 0x14);
 544         in_num_dialects = SVAL(in_input->data, 0x16);
 545
 546         if (in_input->length < (0x18 + in_num_dialects*2)) {
 547                 return NT_STATUS_INVALID_PARAMETER;
 548         }
 549
 550         if (in_max_output < 0x18) {
 551                 return NT_STATUS_BUFFER_TOO_SMALL;
 552         }
 553
 554         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 555         if (!NT_STATUS_IS_OK(status)) {
 556                 return status;
 557         }
 558
 559         /*
 560          * From: [MS-SMB2]
 561          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 562          *
 563          * The server MUST determine the greatest common dialect
 564          * between the dialects it implements and the Dialects array
 565          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 566          * matched, or if the value is not equal to Connection.Dialect,
 567          * the server MUST terminate the transport connection
 568          * and free the Connection object.
 569          */
 570         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 571                                                     in_num_dialects,
 572                                                     &dialect);
 573         if (conn->protocol != protocol) {
 574                 *disconnect = true;
 575                 return NT_STATUS_ACCESS_DENIED;
 576         }
 577
 578         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 579                 *disconnect = true;
 580                 return NT_STATUS_ACCESS_DENIED;
 581         }
 582
 583         if (in_security_mode != conn->smb2.client.security_mode) {
 584                 *disconnect = true;
 585                 return NT_STATUS_ACCESS_DENIED;
 586         }
 587
 588         if (in_capabilities != conn->smb2.client.capabilities) {
 589                 *disconnect = true;
 590                 return NT_STATUS_ACCESS_DENIED;
 591         }
 592
 593         status = GUID_to_ndr_buf(&conn->smb2.server.guid, &out_guid_buf);
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 return status;
 596         }
 597
 598         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 599         if (out_output->data == NULL) {
 600                 return NT_STATUS_NO_MEMORY;
 601         }
 602
 603         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 604         memcpy(out_output->data+0x04, out_guid_buf.buf, 16);
 605         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 606         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 607
 608         return NT_STATUS_OK;
 609 }
 610
 611 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 612 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
 613
 614 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 615                                          struct tevent_context *ev,
 616                                          struct tevent_req *req,
 617                                          struct smbd_smb2_ioctl_state *state)
 618 {
 619         struct tevent_req *subreq;
 620         NTSTATUS status;
 621
 622         switch (ctl_code) {
 623         /*
 624          * [MS-SMB2] 2.2.31
 625          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 626          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 627          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 628          * FILE_WRITE_DATA access.
 629          */
 630         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 631         case FSCTL_SRV_COPYCHUNK:
 632                 subreq = fsctl_srv_copychunk_send(state, ev,
 633                                                   ctl_code,
 634                                                   state->fsp,
 635                                                   &state->in_input,
 636                                                   state->in_max_output,
 637                                                   state->smb2req);
 638                 if (tevent_req_nomem(subreq, req)) {
 639                         return tevent_req_post(req, ev);
 640                 }
 641                 tevent_req_set_callback(subreq,
 642                                         smb2_ioctl_network_fs_copychunk_done,
 643                                         req);
 644                 return req;
 645                 break;
 646         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 647                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 648                 {
 649                         if (IS_IPC(state->smbreq->conn)) {
 650                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 651                         } else {
 652                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 653                         }
 654
 655                         tevent_req_nterror(req, status);
 656                         return tevent_req_post(req, ev);
 657                 }
 658
 659                 status = fsctl_network_iface_info(state, ev,
 660                                                   state->smbreq->xconn,
 661                                                   &state->in_input,
 662                                                   state->in_max_output,
 663                                                   &state->out_output);
 664                 if (!tevent_req_nterror(req, status)) {
 665                         tevent_req_done(req);
 666                 }
 667                 return tevent_req_post(req, ev);
 668                 break;
 669         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 670                 status = fsctl_validate_neg_info(state, ev,
 671                                                  state->smbreq->xconn,
 672                                                  &state->in_input,
 673                                                  state->in_max_output,
 674                                                  &state->out_output,
 675                                                  &state->disconnect);
 676                 if (!tevent_req_nterror(req, status)) {
 677                         tevent_req_done(req);
 678                 }
 679                 return tevent_req_post(req, ev);
 680                 break;
 681         case FSCTL_SRV_REQUEST_RESUME_KEY:
 682                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
 683                                                    ev,
 684                                                    state->fsp,
 685                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
 686                                                    0, 0, 0);
 687                 if (tevent_req_nomem(subreq, req)) {
 688                         return tevent_req_post(req, ev);
 689                 }
 690                 tevent_req_set_callback(
 691                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
 692                 return req;
 693
 694         default: {
 695                 uint8_t *out_data = NULL;
 696                 uint32_t out_data_len = 0;
 697
 698                 if (state->fsp == NULL) {
 699                         status = NT_STATUS_NOT_SUPPORTED;
 700                 } else {
 701                         status = SMB_VFS_FSCTL(state->fsp,
 702                                                state,
 703                                                ctl_code,
 704                                                state->smbreq->flags2,
 705                                                state->in_input.data,
 706                                                state->in_input.length,
 707                                                &out_data,
 708                                                state->in_max_output,
 709                                                &out_data_len);
 710                         state->out_output = data_blob_const(out_data, out_data_len);
 711                         if (NT_STATUS_IS_OK(status)) {
 712                                 tevent_req_done(req);
 713                                 return tevent_req_post(req, ev);
 714                         }
 715                 }
 716
 717                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 718                         if (IS_IPC(state->smbreq->conn)) {
 719                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 720                         } else {
 721                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 722                         }
 723                 }
 724
 725                 tevent_req_nterror(req, status);
 726                 return tevent_req_post(req, ev);
 727                 break;
 728         }
 729         }
 730
 731         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 732         return tevent_req_post(req, ev);
 733 }
 734
 735 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 736 {
 737         struct tevent_req *req = tevent_req_callback_data(subreq,
 738                                                           struct tevent_req);
 739         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 740                                                 struct smbd_smb2_ioctl_state);
 741         struct srv_copychunk_rsp cc_rsp;
 742         NTSTATUS status;
 743         bool pack_rsp = false;
 744
 745         ZERO_STRUCT(cc_rsp);
 746         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 747         TALLOC_FREE(subreq);
 748         if (pack_rsp == true) {
 749                 enum ndr_err_code ndr_ret;
 750                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 751                                                ioctl_state,
 752                                                &cc_rsp,
 753                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 754                 if (ndr_ret != NDR_ERR_SUCCESS) {
 755                         status = NT_STATUS_INTERNAL_ERROR;
 756                 }
 757         }
 758
 759         if (!tevent_req_nterror(req, status)) {
 760                 tevent_req_done(req);
 761         }
 762 }
 763
 764 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
 765 {
 766         struct tevent_req *req = tevent_req_callback_data(
 767                 subreq, struct tevent_req);
 768         struct smbd_smb2_ioctl_state *state = tevent_req_data(
 769                 req, struct smbd_smb2_ioctl_state);
 770         struct req_resume_key_rsp rkey_rsp;
 771         enum ndr_err_code ndr_ret;
 772         uint32_t flags;
 773         uint64_t xferlen;
 774         DATA_BLOB token;
 775         NTSTATUS status;
 776
 777         /*
 778          * Note that both flags and xferlen are not used with copy-chunk.
 779          */
 780         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
 781                                            state->fsp->conn,
 782                                            state,
 783                                            &flags,
 784                                            &xferlen,
 785                                            &token);
 786         TALLOC_FREE(subreq);
 787         if (tevent_req_nterror(req, status)) {
 788                 return;
 789         }
 790
 791         if (token.length != sizeof(rkey_rsp.resume_key)) {
 792                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 793                 return;
 794         }
 795
 796         ZERO_STRUCT(rkey_rsp);
 797         memcpy(rkey_rsp.resume_key, token.data, token.length);
 798
 799         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
 800                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 801         if (ndr_ret != NDR_ERR_SUCCESS) {
 802                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 803                 return;
 804         }
 805
 806         tevent_req_done(req);
 807         return;
 808 }