source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 #define COPYCHUNK_MAX_CHUNKS    256             /* 2k8r2 & win8 = 256 */
  35 #define COPYCHUNK_MAX_CHUNK_LEN 1048576         /* 2k8r2 & win8 = 1048576 */
  36 #define COPYCHUNK_MAX_TOTAL_LEN 16777216        /* 2k8r2 & win8 = 16777216 */
  37 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  38 {
  39         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  40         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  41         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  42 }
  43
  44 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  45 {
  46         uint32_t i;
  47         uint32_t total_len = 0;
  48
  49         /*
  50          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  51          * Send and invalid parameter response if:
  52          * - The ChunkCount value is greater than
  53          *   ServerSideCopyMaxNumberofChunks
  54          */
  55         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  56                 return NT_STATUS_INVALID_PARAMETER;
  57         }
  58
  59         for (i = 0; i < cc_copy->chunk_count; i++) {
  60                 /*
  61                  * - The Length value in a single chunk is greater than
  62                  *   ServerSideCopyMaxChunkSize or equal to zero.
  63                  */
  64                 if ((cc_copy->chunks[i].length == 0)
  65                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  66                         return NT_STATUS_INVALID_PARAMETER;
  67                 }
  68                 total_len += cc_copy->chunks[i].length;
  69         }
  70         /*
  71          * - Sum of Lengths in all chunks is greater than
  72          *   ServerSideCopyMaxDataSize
  73          */
  74         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  75                 return NT_STATUS_INVALID_PARAMETER;
  76         }
  77
  78         return NT_STATUS_OK;
  79 }
  80
  81 struct fsctl_srv_copychunk_state {
  82         struct connection_struct *conn;
  83         uint32_t dispatch_count;
  84         uint32_t recv_count;
  85         uint32_t bad_recv_count;
  86         NTSTATUS status;
  87         off_t total_written;
  88         struct files_struct *src_fsp;
  89         struct files_struct *dst_fsp;
  90         enum {
  91                 COPYCHUNK_OUT_EMPTY = 0,
  92                 COPYCHUNK_OUT_LIMITS,
  93                 COPYCHUNK_OUT_RSP,
  94         } out_data;
  95         bool aapl_copyfile;
  96 };
  97 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  98
  99 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
 100                                         struct files_struct *src_fsp,
 101                                         struct files_struct *dst_fsp,
 102                                         struct smb_request *smb1req)
 103 {
 104         /*
 105          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 106          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 107          * the following are true:
 108          * - The Open.GrantedAccess of the destination file does not include
 109          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 110          */
 111         if (!CHECK_WRITE(dst_fsp)) {
 112                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 113                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 114                 return NT_STATUS_ACCESS_DENIED;
 115         }
 116         /*
 117          * - The Open.GrantedAccess of the destination file does not include
 118          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 119          */
 120         if ((ctl_code == FSCTL_SRV_COPYCHUNK) &&
 121             !CHECK_READ_IOCTL(dst_fsp, smb1req)) {
 122                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 123                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 124                 return NT_STATUS_ACCESS_DENIED;
 125         }
 126         /*
 127          * - The Open.GrantedAccess of the source file does not include
 128          *   FILE_READ_DATA access.
 129          */
 130         if (!CHECK_READ(src_fsp, smb1req)) {
 131                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 132                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 133                 return NT_STATUS_ACCESS_DENIED;
 134         }
 135
 136         if (src_fsp->is_directory) {
 137                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 138                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 139                 return NT_STATUS_ACCESS_DENIED;
 140         }
 141
 142         if (dst_fsp->is_directory) {
 143                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 144                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 145                 return NT_STATUS_ACCESS_DENIED;
 146         }
 147
 148         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 149                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 150                 return NT_STATUS_ACCESS_DENIED;
 151         }
 152
 153         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 154                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 155                 return NT_STATUS_ACCESS_DENIED;
 156         }
 157
 158         return NT_STATUS_OK;
 159 }
 160
 161 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 162                                                    struct tevent_context *ev,
 163                                                    uint32_t ctl_code,
 164                                                    struct files_struct *dst_fsp,
 165                                                    DATA_BLOB *in_input,
 166                                                    size_t in_max_output,
 167                                                    struct smbd_smb2_request *smb2req)
 168 {
 169         struct tevent_req *req;
 170         struct srv_copychunk_copy cc_copy;
 171         enum ndr_err_code ndr_ret;
 172         uint64_t src_persistent_h;
 173         uint64_t src_volatile_h;
 174         int i;
 175         struct srv_copychunk *chunk;
 176         struct fsctl_srv_copychunk_state *state;
 177
 178         /* handler for both copy-chunk variants */
 179         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 180                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 181
 182         req = tevent_req_create(mem_ctx, &state,
 183                                 struct fsctl_srv_copychunk_state);
 184         if (req == NULL) {
 185                 return NULL;
 186         }
 187         state->conn = dst_fsp->conn;
 188
 189         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 190                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 191                           "response %lu\n", (int)in_max_output,
 192                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 193                 state->status = NT_STATUS_INVALID_PARAMETER;
 194                 tevent_req_nterror(req, state->status);
 195                 return tevent_req_post(req, ev);
 196         }
 197
 198         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &cc_copy,
 199                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 200         if (ndr_ret != NDR_ERR_SUCCESS) {
 201                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 202                 state->status = NT_STATUS_INVALID_PARAMETER;
 203                 tevent_req_nterror(req, state->status);
 204                 return tevent_req_post(req, ev);
 205         }
 206
 207         /* persistent/volatile keys sent as the resume key */
 208         src_persistent_h = BVAL(cc_copy.source_key, 0);
 209         src_volatile_h = BVAL(cc_copy.source_key, 8);
 210         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 211         if (state->src_fsp == NULL) {
 212                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 213                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 214                 tevent_req_nterror(req, state->status);
 215                 return tevent_req_post(req, ev);
 216         }
 217
 218         state->dst_fsp = dst_fsp;
 219
 220         state->status = copychunk_check_handles(ctl_code,
 221                                                 state->src_fsp,
 222                                                 state->dst_fsp,
 223                                                 smb2req->smb1req);
 224         if (!NT_STATUS_IS_OK(state->status)) {
 225                 tevent_req_nterror(req, state->status);
 226                 return tevent_req_post(req, ev);
 227         }
 228
 229         state->status = copychunk_check_limits(&cc_copy);
 230         if (!NT_STATUS_IS_OK(state->status)) {
 231                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 232                 state->out_data = COPYCHUNK_OUT_LIMITS;
 233                 tevent_req_nterror(req, state->status);
 234                 return tevent_req_post(req, ev);
 235         }
 236
 237         /* any errors from here onwards should carry copychunk response data */
 238         state->out_data = COPYCHUNK_OUT_RSP;
 239
 240         if (cc_copy.chunk_count == 0) {
 241                 struct tevent_req *vfs_subreq;
 242                 /*
 243                  * Process as OS X copyfile request. This is currently
 244                  * the only copychunk request with a chunk count of 0
 245                  * we will process.
 246                  */
 247                 if (!state->src_fsp->aapl_copyfile_supported) {
 248                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 249                         return tevent_req_post(req, ev);
 250                 }
 251                 if (!state->dst_fsp->aapl_copyfile_supported) {
 252                         tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 253                         return tevent_req_post(req, ev);
 254                 }
 255                 state->aapl_copyfile = true;
 256                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 257                                                      state, ev,
 258                                                      state->src_fsp,
 259                                                      0,
 260                                                      state->dst_fsp,
 261                                                      0,
 262                                                      0);
 263                 if (tevent_req_nomem(vfs_subreq, req)) {
 264                         return tevent_req_post(req, ev);
 265                 }
 266                 tevent_req_set_callback(vfs_subreq,
 267                                         fsctl_srv_copychunk_vfs_done, req);
 268                 state->dispatch_count++;
 269                 return req;
 270         }
 271
 272         for (i = 0; i < cc_copy.chunk_count; i++) {
 273                 struct tevent_req *vfs_subreq;
 274                 chunk = &cc_copy.chunks[i];
 275                 vfs_subreq = SMB_VFS_COPY_CHUNK_SEND(dst_fsp->conn,
 276                                                      state, ev,
 277                                                      state->src_fsp,
 278                                                      chunk->source_off,
 279                                                      state->dst_fsp,
 280                                                      chunk->target_off,
 281                                                      chunk->length);
 282                 if (vfs_subreq == NULL) {
 283                         DEBUG(0, ("VFS copy chunk send failed\n"));
 284                         state->status = NT_STATUS_NO_MEMORY;
 285                         if (state->dispatch_count == 0) {
 286                                 /* nothing dispatched, return immediately */
 287                                 tevent_req_nterror(req, state->status);
 288                                 return tevent_req_post(req, ev);
 289                         } else {
 290                                 /*
 291                                  * wait for dispatched to complete before
 292                                  * returning error.
 293                                  */
 294                                 break;
 295                         }
 296                 }
 297                 tevent_req_set_callback(vfs_subreq,
 298                                         fsctl_srv_copychunk_vfs_done, req);
 299                 state->dispatch_count++;
 300         }
 301
 302         return req;
 303 }
 304
 305 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 306 {
 307         struct tevent_req *req = tevent_req_callback_data(
 308                 subreq, struct tevent_req);
 309         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 310                                         struct fsctl_srv_copychunk_state);
 311         off_t chunk_nwritten;
 312         NTSTATUS status;
 313
 314         state->recv_count++;
 315         status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
 316                                          &chunk_nwritten);
 317         TALLOC_FREE(subreq);
 318         if (NT_STATUS_IS_OK(status)) {
 319                 DEBUG(10, ("good copy chunk recv %u of %u\n",
 320                            (unsigned int)state->recv_count,
 321                            (unsigned int)state->dispatch_count));
 322                 state->total_written += chunk_nwritten;
 323         } else {
 324                 DEBUG(0, ("bad status in copy chunk recv %u of %u: %s\n",
 325                           (unsigned int)state->recv_count,
 326                           (unsigned int)state->dispatch_count,
 327                           nt_errstr(status)));
 328                 state->bad_recv_count++;
 329                 /* may overwrite previous failed status */
 330                 state->status = status;
 331         }
 332
 333         if (state->recv_count != state->dispatch_count) {
 334                 /*
 335                  * Wait for all VFS copy_chunk requests to complete, even
 336                  * if an error is received for a specific chunk.
 337                  */
 338                 return;
 339         }
 340
 341         if (!tevent_req_nterror(req, state->status)) {
 342                 tevent_req_done(req);
 343         }
 344 }
 345
 346 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 347                                          struct srv_copychunk_rsp *cc_rsp,
 348                                          bool *pack_rsp)
 349 {
 350         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 351                                         struct fsctl_srv_copychunk_state);
 352         NTSTATUS status;
 353
 354         switch (state->out_data) {
 355         case COPYCHUNK_OUT_EMPTY:
 356                 *pack_rsp = false;
 357                 break;
 358         case COPYCHUNK_OUT_LIMITS:
 359                 /* 2.2.32.1 - send back our maximum transfer size limits */
 360                 copychunk_pack_limits(cc_rsp);
 361                 *pack_rsp = true;
 362                 break;
 363         case COPYCHUNK_OUT_RSP:
 364                 if (state->aapl_copyfile == true) {
 365                         cc_rsp->chunks_written = 0;
 366                 } else {
 367                         cc_rsp->chunks_written = state->recv_count - state->bad_recv_count;
 368                 }
 369                 cc_rsp->chunk_bytes_written = 0;
 370                 cc_rsp->total_bytes_written = state->total_written;
 371                 *pack_rsp = true;
 372                 break;
 373         default:        /* not reached */
 374                 assert(1);
 375                 break;
 376         }
 377         status = state->status;
 378         tevent_req_received(req);
 379
 380         return status;
 381 }
 382
 383 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 384                                          struct tevent_context *ev,
 385                                          struct smbXsrv_connection *xconn,
 386                                          DATA_BLOB *in_input,
 387                                          uint32_t in_max_output,
 388                                          DATA_BLOB *out_output)
 389 {
 390         struct fsctl_net_iface_info *array = NULL;
 391         struct fsctl_net_iface_info *first = NULL;
 392         struct fsctl_net_iface_info *last = NULL;
 393         size_t i;
 394         size_t num_ifaces = iface_count();
 395         enum ndr_err_code ndr_err;
 396
 397         if (in_input->length != 0) {
 398                 return NT_STATUS_INVALID_PARAMETER;
 399         }
 400
 401         *out_output = data_blob_null;
 402
 403         array = talloc_zero_array(mem_ctx,
 404                                   struct fsctl_net_iface_info,
 405                                   num_ifaces);
 406         if (array == NULL) {
 407                 return NT_STATUS_NO_MEMORY;
 408         }
 409
 410         for (i=0; i < num_ifaces; i++) {
 411                 struct fsctl_net_iface_info *cur = &array[i];
 412                 const struct interface *iface = get_interface(i);
 413                 const struct sockaddr_storage *ifss = &iface->ip;
 414                 const void *ifptr = ifss;
 415                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 416                 struct tsocket_address *a = NULL;
 417                 char *addr;
 418                 bool ok;
 419                 int ret;
 420
 421                 ret = tsocket_address_bsd_from_sockaddr(array,
 422                                         ifsa, sizeof(struct sockaddr_storage),
 423                                         &a);
 424                 if (ret != 0) {
 425                         return map_nt_error_from_unix_common(errno);
 426                 }
 427
 428                 ok = tsocket_address_is_inet(a, "ip");
 429                 if (!ok) {
 430                         continue;
 431                 }
 432
 433                 addr = tsocket_address_inet_addr_string(a, array);
 434                 if (addr == NULL) {
 435                         TALLOC_FREE(array);
 436                         return NT_STATUS_NO_MEMORY;
 437                 }
 438
 439                 cur->ifindex = iface->if_index;
 440                 if (cur->ifindex == 0) {
 441                         /*
 442                          * Did not get interface index from kernel,
 443                          * nor from the config. ==> Apply a common
 444                          * default value for these cases.
 445                          */
 446                         cur->ifindex = UINT32_MAX;
 447                 }
 448                 cur->capability = iface->capability;
 449                 cur->linkspeed = iface->linkspeed;
 450                 if (cur->linkspeed == 0) {
 451                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 452                                   "address [%s].\n", iface->name, addr);
 453                         continue;
 454                 }
 455
 456                 ok = tsocket_address_is_inet(a, "ipv4");
 457                 if (ok) {
 458                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 459                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 460                 }
 461                 ok = tsocket_address_is_inet(a, "ipv6");
 462                 if (ok) {
 463                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 464                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 465                 }
 466
 467                 if (first == NULL) {
 468                         first = cur;
 469                 }
 470                 if (last != NULL) {
 471                         last->next = cur;
 472                 }
 473                 last = cur;
 474         }
 475
 476         if (first == NULL) {
 477                 TALLOC_FREE(array);
 478                 return NT_STATUS_OK;
 479         }
 480
 481         if (DEBUGLEVEL >= 10) {
 482                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 483         }
 484
 485         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 486                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 487         TALLOC_FREE(array);
 488         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 489                 return ndr_map_error2ntstatus(ndr_err);
 490         }
 491
 492         return NT_STATUS_OK;
 493 }
 494
 495 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 496                                         struct tevent_context *ev,
 497                                         struct smbXsrv_connection *conn,
 498                                         DATA_BLOB *in_input,
 499                                         uint32_t in_max_output,
 500                                         DATA_BLOB *out_output,
 501                                         bool *disconnect)
 502 {
 503         uint32_t in_capabilities;
 504         DATA_BLOB in_guid_blob;
 505         struct GUID in_guid;
 506         uint16_t in_security_mode;
 507         uint16_t in_num_dialects;
 508         uint16_t dialect;
 509         DATA_BLOB out_guid_blob;
 510         NTSTATUS status;
 511         enum protocol_types protocol = PROTOCOL_NONE;
 512
 513         if (in_input->length < 0x18) {
 514                 return NT_STATUS_INVALID_PARAMETER;
 515         }
 516
 517         in_capabilities = IVAL(in_input->data, 0x00);
 518         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 519         in_security_mode = SVAL(in_input->data, 0x14);
 520         in_num_dialects = SVAL(in_input->data, 0x16);
 521
 522         if (in_input->length < (0x18 + in_num_dialects*2)) {
 523                 return NT_STATUS_INVALID_PARAMETER;
 524         }
 525
 526         if (in_max_output < 0x18) {
 527                 return NT_STATUS_BUFFER_TOO_SMALL;
 528         }
 529
 530         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 531         if (!NT_STATUS_IS_OK(status)) {
 532                 return status;
 533         }
 534
 535         /*
 536          * From: [MS-SMB2]
 537          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 538          *
 539          * The server MUST determine the greatest common dialect
 540          * between the dialects it implements and the Dialects array
 541          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 542          * matched, or if the value is not equal to Connection.Dialect,
 543          * the server MUST terminate the transport connection
 544          * and free the Connection object.
 545          */
 546         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 547                                                     in_num_dialects,
 548                                                     &dialect);
 549         if (conn->protocol != protocol) {
 550                 *disconnect = true;
 551                 return NT_STATUS_ACCESS_DENIED;
 552         }
 553
 554         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 555                 *disconnect = true;
 556                 return NT_STATUS_ACCESS_DENIED;
 557         }
 558
 559         if (in_security_mode != conn->smb2.client.security_mode) {
 560                 *disconnect = true;
 561                 return NT_STATUS_ACCESS_DENIED;
 562         }
 563
 564         if (in_capabilities != conn->smb2.client.capabilities) {
 565                 *disconnect = true;
 566                 return NT_STATUS_ACCESS_DENIED;
 567         }
 568
 569         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 570                                   &out_guid_blob);
 571         if (!NT_STATUS_IS_OK(status)) {
 572                 return status;
 573         }
 574
 575         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 576         if (out_output->data == NULL) {
 577                 return NT_STATUS_NO_MEMORY;
 578         }
 579
 580         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 581         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 582         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 583         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 584
 585         return NT_STATUS_OK;
 586 }
 587
 588 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
 589                                          struct tevent_context *ev,
 590                                          struct files_struct *fsp,
 591                                          uint32_t in_max_output,
 592                                          DATA_BLOB *out_output)
 593 {
 594         struct req_resume_key_rsp rkey_rsp;
 595         enum ndr_err_code ndr_ret;
 596         DATA_BLOB output;
 597
 598         if (fsp == NULL) {
 599                 return NT_STATUS_FILE_CLOSED;
 600         }
 601
 602         ZERO_STRUCT(rkey_rsp);
 603         /* combine persistent and volatile handles for the resume key */
 604         SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
 605         SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
 606
 607         ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
 608                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 609         if (ndr_ret != NDR_ERR_SUCCESS) {
 610                 return NT_STATUS_INTERNAL_ERROR;
 611         }
 612
 613         if (in_max_output < output.length) {
 614                 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
 615                           (unsigned int)in_max_output, (long int)output.length));
 616                 return NT_STATUS_INVALID_PARAMETER;
 617         }
 618         *out_output = output;
 619
 620         return NT_STATUS_OK;
 621 }
 622
 623 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 624
 625 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 626                                          struct tevent_context *ev,
 627                                          struct tevent_req *req,
 628                                          struct smbd_smb2_ioctl_state *state)
 629 {
 630         struct tevent_req *subreq;
 631         NTSTATUS status;
 632
 633         switch (ctl_code) {
 634         /*
 635          * [MS-SMB2] 2.2.31
 636          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 637          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 638          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 639          * FILE_WRITE_DATA access.
 640          */
 641         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 642         case FSCTL_SRV_COPYCHUNK:
 643                 subreq = fsctl_srv_copychunk_send(state, ev,
 644                                                   ctl_code,
 645                                                   state->fsp,
 646                                                   &state->in_input,
 647                                                   state->in_max_output,
 648                                                   state->smb2req);
 649                 if (tevent_req_nomem(subreq, req)) {
 650                         return tevent_req_post(req, ev);
 651                 }
 652                 tevent_req_set_callback(subreq,
 653                                         smb2_ioctl_network_fs_copychunk_done,
 654                                         req);
 655                 return req;
 656                 break;
 657         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 658                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 659                 {
 660                         if (IS_IPC(state->smbreq->conn)) {
 661                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 662                         } else {
 663                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 664                         }
 665
 666                         tevent_req_nterror(req, status);
 667                         return tevent_req_post(req, ev);
 668                 }
 669
 670                 status = fsctl_network_iface_info(state, ev,
 671                                                   state->smbreq->xconn,
 672                                                   &state->in_input,
 673                                                   state->in_max_output,
 674                                                   &state->out_output);
 675                 if (!tevent_req_nterror(req, status)) {
 676                         tevent_req_done(req);
 677                 }
 678                 return tevent_req_post(req, ev);
 679                 break;
 680         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 681                 status = fsctl_validate_neg_info(state, ev,
 682                                                  state->smbreq->xconn,
 683                                                  &state->in_input,
 684                                                  state->in_max_output,
 685                                                  &state->out_output,
 686                                                  &state->disconnect);
 687                 if (!tevent_req_nterror(req, status)) {
 688                         tevent_req_done(req);
 689                 }
 690                 return tevent_req_post(req, ev);
 691                 break;
 692         case FSCTL_SRV_REQUEST_RESUME_KEY:
 693                 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
 694                                                   state->in_max_output,
 695                                                   &state->out_output);
 696                 if (!tevent_req_nterror(req, status)) {
 697                         tevent_req_done(req);
 698                 }
 699                 return tevent_req_post(req, ev);
 700                 break;
 701         default: {
 702                 uint8_t *out_data = NULL;
 703                 uint32_t out_data_len = 0;
 704
 705                 if (state->fsp == NULL) {
 706                         status = NT_STATUS_NOT_SUPPORTED;
 707                 } else {
 708                         status = SMB_VFS_FSCTL(state->fsp,
 709                                                state,
 710                                                ctl_code,
 711                                                state->smbreq->flags2,
 712                                                state->in_input.data,
 713                                                state->in_input.length,
 714                                                &out_data,
 715                                                state->in_max_output,
 716                                                &out_data_len);
 717                         state->out_output = data_blob_const(out_data, out_data_len);
 718                         if (NT_STATUS_IS_OK(status)) {
 719                                 tevent_req_done(req);
 720                                 return tevent_req_post(req, ev);
 721                         }
 722                 }
 723
 724                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 725                         if (IS_IPC(state->smbreq->conn)) {
 726                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 727                         } else {
 728                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 729                         }
 730                 }
 731
 732                 tevent_req_nterror(req, status);
 733                 return tevent_req_post(req, ev);
 734                 break;
 735         }
 736         }
 737
 738         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 739         return tevent_req_post(req, ev);
 740 }
 741
 742 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 743 {
 744         struct tevent_req *req = tevent_req_callback_data(subreq,
 745                                                           struct tevent_req);
 746         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 747                                                 struct smbd_smb2_ioctl_state);
 748         struct srv_copychunk_rsp cc_rsp;
 749         NTSTATUS status;
 750         bool pack_rsp = false;
 751
 752         ZERO_STRUCT(cc_rsp);
 753         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 754         TALLOC_FREE(subreq);
 755         if (pack_rsp == true) {
 756                 enum ndr_err_code ndr_ret;
 757                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 758                                                ioctl_state,
 759                                                &cc_rsp,
 760                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 761                 if (ndr_ret != NDR_ERR_SUCCESS) {
 762                         status = NT_STATUS_INTERNAL_ERROR;
 763                 }
 764         }
 765
 766         if (!tevent_req_nterror(req, status)) {
 767                 tevent_req_done(req);
 768         }
 769 }