source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  35 {
  36         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  37         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  38         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  39 }
  40
  41 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  42 {
  43         uint32_t i;
  44         uint32_t total_len = 0;
  45
  46         /*
  47          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  48          * Send and invalid parameter response if:
  49          * - The ChunkCount value is greater than
  50          *   ServerSideCopyMaxNumberofChunks
  51          */
  52         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  53                 return NT_STATUS_INVALID_PARAMETER;
  54         }
  55
  56         for (i = 0; i < cc_copy->chunk_count; i++) {
  57                 /*
  58                  * - The Length value in a single chunk is greater than
  59                  *   ServerSideCopyMaxChunkSize or equal to zero.
  60                  */
  61                 if ((cc_copy->chunks[i].length == 0)
  62                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  63                         return NT_STATUS_INVALID_PARAMETER;
  64                 }
  65                 total_len += cc_copy->chunks[i].length;
  66         }
  67         /*
  68          * - Sum of Lengths in all chunks is greater than
  69          *   ServerSideCopyMaxDataSize
  70          */
  71         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         return NT_STATUS_OK;
  76 }
  77
  78 struct fsctl_srv_copychunk_state {
  79         struct tevent_context *ev;
  80         struct connection_struct *conn;
  81         struct srv_copychunk_copy cc_copy;
  82         uint32_t current_chunk;
  83         NTSTATUS status;
  84         off_t total_written;
  85         uint32_t ctl_code;
  86         DATA_BLOB token;
  87         struct files_struct *src_fsp;
  88         struct files_struct *dst_fsp;
  89         enum {
  90                 COPYCHUNK_OUT_EMPTY = 0,
  91                 COPYCHUNK_OUT_LIMITS,
  92                 COPYCHUNK_OUT_RSP,
  93         } out_data;
  94         bool aapl_copyfile;
  95 };
  96 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  97
  98 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
  99
 100 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 101                                                    struct tevent_context *ev,
 102                                                    uint32_t ctl_code,
 103                                                    struct files_struct *dst_fsp,
 104                                                    DATA_BLOB *in_input,
 105                                                    size_t in_max_output,
 106                                                    struct smbd_smb2_request *smb2req)
 107 {
 108         struct tevent_req *req = NULL;
 109         struct fsctl_srv_copychunk_state *state = NULL;
 110         enum ndr_err_code ndr_ret;
 111         NTSTATUS status;
 112
 113         /* handler for both copy-chunk variants */
 114         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 115                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 116
 117         req = tevent_req_create(mem_ctx, &state,
 118                                 struct fsctl_srv_copychunk_state);
 119         if (req == NULL) {
 120                 return NULL;
 121         }
 122         *state = (struct fsctl_srv_copychunk_state) {
 123                 .conn = dst_fsp->conn,
 124                 .ev = ev,
 125                 .ctl_code = ctl_code,
 126                 .dst_fsp = dst_fsp,
 127         };
 128
 129         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 130                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 131                           "response %lu\n", (int)in_max_output,
 132                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 133                 state->status = NT_STATUS_INVALID_PARAMETER;
 134                 tevent_req_nterror(req, state->status);
 135                 return tevent_req_post(req, ev);
 136         }
 137
 138         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 139                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 140         if (ndr_ret != NDR_ERR_SUCCESS) {
 141                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 142                 state->status = NT_STATUS_INVALID_PARAMETER;
 143                 tevent_req_nterror(req, state->status);
 144                 return tevent_req_post(req, ev);
 145         }
 146
 147         state->token = data_blob_const(state->cc_copy.source_key,
 148                                        sizeof(state->cc_copy.source_key));
 149
 150         state->status = copychunk_check_limits(&state->cc_copy);
 151         if (!NT_STATUS_IS_OK(state->status)) {
 152                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 153                 state->out_data = COPYCHUNK_OUT_LIMITS;
 154                 tevent_req_nterror(req, state->status);
 155                 return tevent_req_post(req, ev);
 156         }
 157
 158         /* any errors from here onwards should carry copychunk response data */
 159         state->out_data = COPYCHUNK_OUT_RSP;
 160
 161         status = fsctl_srv_copychunk_loop(req);
 162         if (tevent_req_nterror(req, status)) {
 163                 return tevent_req_post(req, ev);
 164         }
 165
 166         return req;
 167 }
 168
 169 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 170 {
 171         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 172                 req, struct fsctl_srv_copychunk_state);
 173         struct tevent_req *subreq = NULL;
 174         uint32_t length = 0;
 175         off_t source_off = 0;
 176         off_t target_off = 0;
 177
 178         /*
 179          * chunk_count can be 0 which must either just do nothing returning
 180          * success saying number of copied chunks is 0 (verified against
 181          * Windows).
 182          *
 183          * Or it can be a special macOS copyfile request, so we send this into
 184          * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
 185          */
 186         if (state->cc_copy.chunk_count > 0) {
 187                 struct srv_copychunk *chunk = NULL;
 188
 189                 chunk = &state->cc_copy.chunks[state->current_chunk];
 190                 length = chunk->length;
 191                 source_off = chunk->source_off;
 192                 target_off = chunk->target_off;
 193         }
 194
 195         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 196                                          state,
 197                                          state->ev,
 198                                          state->ctl_code,
 199                                          &state->token,
 200                                          source_off,
 201                                          state->dst_fsp,
 202                                          target_off,
 203                                          length);
 204         if (tevent_req_nomem(subreq, req)) {
 205                 return NT_STATUS_NO_MEMORY;
 206         }
 207         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 208
 209         return NT_STATUS_OK;
 210 }
 211
 212 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 213 {
 214         struct tevent_req *req = tevent_req_callback_data(
 215                 subreq, struct tevent_req);
 216         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 217                 req, struct fsctl_srv_copychunk_state);
 218         off_t chunk_nwritten;
 219         NTSTATUS status;
 220
 221         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
 222                                          &chunk_nwritten);
 223         TALLOC_FREE(subreq);
 224         if (!NT_STATUS_IS_OK(status)) {
 225                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 226                         nt_errstr(status),
 227                         (unsigned int)state->current_chunk,
 228                         (unsigned int)state->cc_copy.chunk_count);
 229                 tevent_req_nterror(req, status);
 230                 return;
 231         }
 232
 233         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 234                   (unsigned int)state->current_chunk,
 235                   (unsigned int)state->cc_copy.chunk_count);
 236         state->total_written += chunk_nwritten;
 237
 238         if (state->cc_copy.chunk_count == 0) {
 239                 /*
 240                  * This must not produce an error but just return a chunk count
 241                  * of 0 in the response.
 242                  */
 243                 tevent_req_done(req);
 244                 return;
 245         }
 246
 247         state->current_chunk++;
 248         if (state->current_chunk == state->cc_copy.chunk_count) {
 249                 tevent_req_done(req);
 250                 return;
 251         }
 252
 253         status = fsctl_srv_copychunk_loop(req);
 254         if (tevent_req_nterror(req, status)) {
 255                 return;
 256         }
 257 }
 258
 259 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 260                                          struct srv_copychunk_rsp *cc_rsp,
 261                                          bool *pack_rsp)
 262 {
 263         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 264                                         struct fsctl_srv_copychunk_state);
 265         NTSTATUS status;
 266
 267         switch (state->out_data) {
 268         case COPYCHUNK_OUT_EMPTY:
 269                 *pack_rsp = false;
 270                 break;
 271         case COPYCHUNK_OUT_LIMITS:
 272                 /* 2.2.32.1 - send back our maximum transfer size limits */
 273                 copychunk_pack_limits(cc_rsp);
 274                 *pack_rsp = true;
 275                 break;
 276         case COPYCHUNK_OUT_RSP:
 277                 cc_rsp->chunks_written = state->current_chunk;
 278                 cc_rsp->chunk_bytes_written = 0;
 279                 cc_rsp->total_bytes_written = state->total_written;
 280                 *pack_rsp = true;
 281                 break;
 282         default:        /* not reached */
 283                 assert(1);
 284                 break;
 285         }
 286         status = tevent_req_simple_recv_ntstatus(req);
 287         return status;
 288 }
 289
 290 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 291                                          struct tevent_context *ev,
 292                                          struct smbXsrv_connection *xconn,
 293                                          DATA_BLOB *in_input,
 294                                          uint32_t in_max_output,
 295                                          DATA_BLOB *out_output)
 296 {
 297         struct fsctl_net_iface_info *array = NULL;
 298         struct fsctl_net_iface_info *first = NULL;
 299         struct fsctl_net_iface_info *last = NULL;
 300         size_t i;
 301         size_t num_ifaces = iface_count();
 302         enum ndr_err_code ndr_err;
 303
 304         if (in_input->length != 0) {
 305                 return NT_STATUS_INVALID_PARAMETER;
 306         }
 307
 308         *out_output = data_blob_null;
 309
 310         array = talloc_zero_array(mem_ctx,
 311                                   struct fsctl_net_iface_info,
 312                                   num_ifaces);
 313         if (array == NULL) {
 314                 return NT_STATUS_NO_MEMORY;
 315         }
 316
 317         for (i=0; i < num_ifaces; i++) {
 318                 struct fsctl_net_iface_info *cur = &array[i];
 319                 const struct interface *iface = get_interface(i);
 320                 const struct sockaddr_storage *ifss = &iface->ip;
 321                 const void *ifptr = ifss;
 322                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 323                 struct tsocket_address *a = NULL;
 324                 char *addr;
 325                 bool ok;
 326                 int ret;
 327
 328                 ret = tsocket_address_bsd_from_sockaddr(array,
 329                                         ifsa, sizeof(struct sockaddr_storage),
 330                                         &a);
 331                 if (ret != 0) {
 332                         return map_nt_error_from_unix_common(errno);
 333                 }
 334
 335                 ok = tsocket_address_is_inet(a, "ip");
 336                 if (!ok) {
 337                         continue;
 338                 }
 339
 340                 addr = tsocket_address_inet_addr_string(a, array);
 341                 if (addr == NULL) {
 342                         TALLOC_FREE(array);
 343                         return NT_STATUS_NO_MEMORY;
 344                 }
 345
 346                 cur->ifindex = iface->if_index;
 347                 if (cur->ifindex == 0) {
 348                         /*
 349                          * Did not get interface index from kernel,
 350                          * nor from the config. ==> Apply a common
 351                          * default value for these cases.
 352                          */
 353                         cur->ifindex = UINT32_MAX;
 354                 }
 355                 cur->capability = iface->capability;
 356                 cur->linkspeed = iface->linkspeed;
 357                 if (cur->linkspeed == 0) {
 358                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 359                                   "address [%s].\n", iface->name, addr);
 360                         continue;
 361                 }
 362
 363                 ok = tsocket_address_is_inet(a, "ipv4");
 364                 if (ok) {
 365                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 366                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 367                 }
 368                 ok = tsocket_address_is_inet(a, "ipv6");
 369                 if (ok) {
 370                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 371                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 372                 }
 373
 374                 if (first == NULL) {
 375                         first = cur;
 376                 }
 377                 if (last != NULL) {
 378                         last->next = cur;
 379                 }
 380                 last = cur;
 381         }
 382
 383         if (first == NULL) {
 384                 TALLOC_FREE(array);
 385                 return NT_STATUS_OK;
 386         }
 387
 388         if (DEBUGLEVEL >= 10) {
 389                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 390         }
 391
 392         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 393                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 394         TALLOC_FREE(array);
 395         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 396                 return ndr_map_error2ntstatus(ndr_err);
 397         }
 398
 399         return NT_STATUS_OK;
 400 }
 401
 402 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 403                                         struct tevent_context *ev,
 404                                         struct smbXsrv_connection *conn,
 405                                         DATA_BLOB *in_input,
 406                                         uint32_t in_max_output,
 407                                         DATA_BLOB *out_output,
 408                                         bool *disconnect)
 409 {
 410         uint32_t in_capabilities;
 411         DATA_BLOB in_guid_blob;
 412         struct GUID in_guid;
 413         uint16_t in_security_mode;
 414         uint16_t in_num_dialects;
 415         uint16_t dialect;
 416         DATA_BLOB out_guid_blob;
 417         NTSTATUS status;
 418         enum protocol_types protocol = PROTOCOL_NONE;
 419
 420         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
 421                 /*
 422                  * With SMB 2.02 we didn't get the
 423                  * capabitities, client guid, security mode
 424                  * and dialects the client would have offered.
 425                  *
 426                  * So we behave compatible with a true
 427                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
 428                  *
 429                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
 430                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
 431                  * starting with SMB 2.10, while Windows only supports
 432                  * it starting with SMB > 2.10.
 433                  */
 434                 return NT_STATUS_FILE_CLOSED;
 435         }
 436
 437         if (in_input->length < 0x18) {
 438                 return NT_STATUS_INVALID_PARAMETER;
 439         }
 440
 441         in_capabilities = IVAL(in_input->data, 0x00);
 442         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 443         in_security_mode = SVAL(in_input->data, 0x14);
 444         in_num_dialects = SVAL(in_input->data, 0x16);
 445
 446         if (in_input->length < (0x18 + in_num_dialects*2)) {
 447                 return NT_STATUS_INVALID_PARAMETER;
 448         }
 449
 450         if (in_max_output < 0x18) {
 451                 return NT_STATUS_BUFFER_TOO_SMALL;
 452         }
 453
 454         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 return status;
 457         }
 458
 459         /*
 460          * From: [MS-SMB2]
 461          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 462          *
 463          * The server MUST determine the greatest common dialect
 464          * between the dialects it implements and the Dialects array
 465          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 466          * matched, or if the value is not equal to Connection.Dialect,
 467          * the server MUST terminate the transport connection
 468          * and free the Connection object.
 469          */
 470         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 471                                                     in_num_dialects,
 472                                                     &dialect);
 473         if (conn->protocol != protocol) {
 474                 *disconnect = true;
 475                 return NT_STATUS_ACCESS_DENIED;
 476         }
 477
 478         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 479                 *disconnect = true;
 480                 return NT_STATUS_ACCESS_DENIED;
 481         }
 482
 483         if (in_security_mode != conn->smb2.client.security_mode) {
 484                 *disconnect = true;
 485                 return NT_STATUS_ACCESS_DENIED;
 486         }
 487
 488         if (in_capabilities != conn->smb2.client.capabilities) {
 489                 *disconnect = true;
 490                 return NT_STATUS_ACCESS_DENIED;
 491         }
 492
 493         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 494                                   &out_guid_blob);
 495         if (!NT_STATUS_IS_OK(status)) {
 496                 return status;
 497         }
 498
 499         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 500         if (out_output->data == NULL) {
 501                 return NT_STATUS_NO_MEMORY;
 502         }
 503
 504         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 505         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 506         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 507         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 508
 509         return NT_STATUS_OK;
 510 }
 511
 512 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 513 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
 514
 515 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 516                                          struct tevent_context *ev,
 517                                          struct tevent_req *req,
 518                                          struct smbd_smb2_ioctl_state *state)
 519 {
 520         struct tevent_req *subreq;
 521         NTSTATUS status;
 522
 523         switch (ctl_code) {
 524         /*
 525          * [MS-SMB2] 2.2.31
 526          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 527          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 528          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 529          * FILE_WRITE_DATA access.
 530          */
 531         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 532         case FSCTL_SRV_COPYCHUNK:
 533                 subreq = fsctl_srv_copychunk_send(state, ev,
 534                                                   ctl_code,
 535                                                   state->fsp,
 536                                                   &state->in_input,
 537                                                   state->in_max_output,
 538                                                   state->smb2req);
 539                 if (tevent_req_nomem(subreq, req)) {
 540                         return tevent_req_post(req, ev);
 541                 }
 542                 tevent_req_set_callback(subreq,
 543                                         smb2_ioctl_network_fs_copychunk_done,
 544                                         req);
 545                 return req;
 546                 break;
 547         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 548                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 549                 {
 550                         if (IS_IPC(state->smbreq->conn)) {
 551                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 552                         } else {
 553                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 554                         }
 555
 556                         tevent_req_nterror(req, status);
 557                         return tevent_req_post(req, ev);
 558                 }
 559
 560                 status = fsctl_network_iface_info(state, ev,
 561                                                   state->smbreq->xconn,
 562                                                   &state->in_input,
 563                                                   state->in_max_output,
 564                                                   &state->out_output);
 565                 if (!tevent_req_nterror(req, status)) {
 566                         tevent_req_done(req);
 567                 }
 568                 return tevent_req_post(req, ev);
 569                 break;
 570         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 571                 status = fsctl_validate_neg_info(state, ev,
 572                                                  state->smbreq->xconn,
 573                                                  &state->in_input,
 574                                                  state->in_max_output,
 575                                                  &state->out_output,
 576                                                  &state->disconnect);
 577                 if (!tevent_req_nterror(req, status)) {
 578                         tevent_req_done(req);
 579                 }
 580                 return tevent_req_post(req, ev);
 581                 break;
 582         case FSCTL_SRV_REQUEST_RESUME_KEY:
 583                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
 584                                                    ev,
 585                                                    state->fsp,
 586                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
 587                                                    0, 0, 0);
 588                 if (tevent_req_nomem(subreq, req)) {
 589                         return tevent_req_post(req, ev);
 590                 }
 591                 tevent_req_set_callback(
 592                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
 593                 return req;
 594
 595         default: {
 596                 uint8_t *out_data = NULL;
 597                 uint32_t out_data_len = 0;
 598
 599                 if (state->fsp == NULL) {
 600                         status = NT_STATUS_NOT_SUPPORTED;
 601                 } else {
 602                         status = SMB_VFS_FSCTL(state->fsp,
 603                                                state,
 604                                                ctl_code,
 605                                                state->smbreq->flags2,
 606                                                state->in_input.data,
 607                                                state->in_input.length,
 608                                                &out_data,
 609                                                state->in_max_output,
 610                                                &out_data_len);
 611                         state->out_output = data_blob_const(out_data, out_data_len);
 612                         if (NT_STATUS_IS_OK(status)) {
 613                                 tevent_req_done(req);
 614                                 return tevent_req_post(req, ev);
 615                         }
 616                 }
 617
 618                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 619                         if (IS_IPC(state->smbreq->conn)) {
 620                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 621                         } else {
 622                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 623                         }
 624                 }
 625
 626                 tevent_req_nterror(req, status);
 627                 return tevent_req_post(req, ev);
 628                 break;
 629         }
 630         }
 631
 632         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 633         return tevent_req_post(req, ev);
 634 }
 635
 636 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 637 {
 638         struct tevent_req *req = tevent_req_callback_data(subreq,
 639                                                           struct tevent_req);
 640         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 641                                                 struct smbd_smb2_ioctl_state);
 642         struct srv_copychunk_rsp cc_rsp;
 643         NTSTATUS status;
 644         bool pack_rsp = false;
 645
 646         ZERO_STRUCT(cc_rsp);
 647         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 648         TALLOC_FREE(subreq);
 649         if (pack_rsp == true) {
 650                 enum ndr_err_code ndr_ret;
 651                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 652                                                ioctl_state,
 653                                                &cc_rsp,
 654                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 655                 if (ndr_ret != NDR_ERR_SUCCESS) {
 656                         status = NT_STATUS_INTERNAL_ERROR;
 657                 }
 658         }
 659
 660         if (!tevent_req_nterror(req, status)) {
 661                 tevent_req_done(req);
 662         }
 663 }
 664
 665 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
 666 {
 667         struct tevent_req *req = tevent_req_callback_data(
 668                 subreq, struct tevent_req);
 669         struct smbd_smb2_ioctl_state *state = tevent_req_data(
 670                 req, struct smbd_smb2_ioctl_state);
 671         struct req_resume_key_rsp rkey_rsp;
 672         enum ndr_err_code ndr_ret;
 673         DATA_BLOB token;
 674         NTSTATUS status;
 675
 676         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
 677                                            state->fsp->conn,
 678                                            state,
 679                                            &token);
 680         TALLOC_FREE(subreq);
 681         if (tevent_req_nterror(req, status)) {
 682                 return;
 683         }
 684
 685         if (token.length != sizeof(rkey_rsp.resume_key)) {
 686                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 687                 return;
 688         }
 689
 690         ZERO_STRUCT(rkey_rsp);
 691         memcpy(rkey_rsp.resume_key, token.data, token.length);
 692
 693         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
 694                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 695         if (ndr_ret != NDR_ERR_SUCCESS) {
 696                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 697                 return;
 698         }
 699
 700         tevent_req_done(req);
 701         return;
 702 }