source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  35 {
  36         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  37         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  38         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  39 }
  40
  41 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  42 {
  43         uint32_t i;
  44         uint32_t total_len = 0;
  45
  46         /*
  47          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  48          * Send and invalid parameter response if:
  49          * - The ChunkCount value is greater than
  50          *   ServerSideCopyMaxNumberofChunks
  51          */
  52         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  53                 return NT_STATUS_INVALID_PARAMETER;
  54         }
  55
  56         for (i = 0; i < cc_copy->chunk_count; i++) {
  57                 /*
  58                  * - The Length value in a single chunk is greater than
  59                  *   ServerSideCopyMaxChunkSize or equal to zero.
  60                  */
  61                 if ((cc_copy->chunks[i].length == 0)
  62                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  63                         return NT_STATUS_INVALID_PARAMETER;
  64                 }
  65                 total_len += cc_copy->chunks[i].length;
  66         }
  67         /*
  68          * - Sum of Lengths in all chunks is greater than
  69          *   ServerSideCopyMaxDataSize
  70          */
  71         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         return NT_STATUS_OK;
  76 }
  77
  78 struct fsctl_srv_copychunk_state {
  79         struct tevent_context *ev;
  80         struct connection_struct *conn;
  81         struct srv_copychunk_copy cc_copy;
  82         uint32_t current_chunk;
  83         uint32_t next_chunk;
  84         NTSTATUS status;
  85         off_t total_written;
  86         struct files_struct *src_fsp;
  87         struct files_struct *dst_fsp;
  88         enum {
  89                 COPYCHUNK_OUT_EMPTY = 0,
  90                 COPYCHUNK_OUT_LIMITS,
  91                 COPYCHUNK_OUT_RSP,
  92         } out_data;
  93         bool aapl_copyfile;
  94 };
  95 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  96
  97 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
  98                                         struct files_struct *src_fsp,
  99                                         struct files_struct *dst_fsp,
 100                                         struct smb_request *smb1req)
 101 {
 102         /*
 103          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 104          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 105          * the following are true:
 106          * - The Open.GrantedAccess of the destination file does not include
 107          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 108          */
 109         if (!CHECK_WRITE(dst_fsp)) {
 110                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 111                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 112                 return NT_STATUS_ACCESS_DENIED;
 113         }
 114         /*
 115          * - The Open.GrantedAccess of the destination file does not include
 116          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 117          */
 118         if ((ctl_code == FSCTL_SRV_COPYCHUNK) &&
 119             !CHECK_READ_IOCTL(dst_fsp)) {
 120                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 121                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 122                 return NT_STATUS_ACCESS_DENIED;
 123         }
 124         /*
 125          * - The Open.GrantedAccess of the source file does not include
 126          *   FILE_READ_DATA access.
 127          */
 128         if (!CHECK_READ_SMB2(src_fsp)) {
 129                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 130                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 131                 return NT_STATUS_ACCESS_DENIED;
 132         }
 133
 134         if (src_fsp->is_directory) {
 135                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 136                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 137                 return NT_STATUS_ACCESS_DENIED;
 138         }
 139
 140         if (dst_fsp->is_directory) {
 141                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 142                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 143                 return NT_STATUS_ACCESS_DENIED;
 144         }
 145
 146         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 147                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 148                 return NT_STATUS_ACCESS_DENIED;
 149         }
 150
 151         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 152                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 153                 return NT_STATUS_ACCESS_DENIED;
 154         }
 155
 156         return NT_STATUS_OK;
 157 }
 158
 159 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
 160
 161 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 162                                                    struct tevent_context *ev,
 163                                                    uint32_t ctl_code,
 164                                                    struct files_struct *dst_fsp,
 165                                                    DATA_BLOB *in_input,
 166                                                    size_t in_max_output,
 167                                                    struct smbd_smb2_request *smb2req)
 168 {
 169         struct tevent_req *req = NULL;
 170         struct fsctl_srv_copychunk_state *state = NULL;
 171         uint64_t src_persistent_h;
 172         uint64_t src_volatile_h;
 173         enum ndr_err_code ndr_ret;
 174         NTSTATUS status;
 175
 176         /* handler for both copy-chunk variants */
 177         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 178                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 179
 180         req = tevent_req_create(mem_ctx, &state,
 181                                 struct fsctl_srv_copychunk_state);
 182         if (req == NULL) {
 183                 return NULL;
 184         }
 185         *state = (struct fsctl_srv_copychunk_state) {
 186                 .conn = dst_fsp->conn,
 187                 .ev = ev,
 188         };
 189
 190         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 191                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 192                           "response %lu\n", (int)in_max_output,
 193                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 194                 state->status = NT_STATUS_INVALID_PARAMETER;
 195                 tevent_req_nterror(req, state->status);
 196                 return tevent_req_post(req, ev);
 197         }
 198
 199         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 200                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 201         if (ndr_ret != NDR_ERR_SUCCESS) {
 202                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 203                 state->status = NT_STATUS_INVALID_PARAMETER;
 204                 tevent_req_nterror(req, state->status);
 205                 return tevent_req_post(req, ev);
 206         }
 207
 208         /* persistent/volatile keys sent as the resume key */
 209         src_persistent_h = BVAL(state->cc_copy.source_key, 0);
 210         src_volatile_h = BVAL(state->cc_copy.source_key, 8);
 211         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 212         if (state->src_fsp == NULL) {
 213                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 214                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 215                 tevent_req_nterror(req, state->status);
 216                 return tevent_req_post(req, ev);
 217         }
 218
 219         state->dst_fsp = dst_fsp;
 220
 221         state->status = copychunk_check_handles(ctl_code,
 222                                                 state->src_fsp,
 223                                                 state->dst_fsp,
 224                                                 smb2req->smb1req);
 225         if (!NT_STATUS_IS_OK(state->status)) {
 226                 tevent_req_nterror(req, state->status);
 227                 return tevent_req_post(req, ev);
 228         }
 229
 230         state->status = copychunk_check_limits(&state->cc_copy);
 231         if (!NT_STATUS_IS_OK(state->status)) {
 232                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 233                 state->out_data = COPYCHUNK_OUT_LIMITS;
 234                 tevent_req_nterror(req, state->status);
 235                 return tevent_req_post(req, ev);
 236         }
 237
 238         /* any errors from here onwards should carry copychunk response data */
 239         state->out_data = COPYCHUNK_OUT_RSP;
 240
 241         status = fsctl_srv_copychunk_loop(req);
 242         if (tevent_req_nterror(req, status)) {
 243                 return tevent_req_post(req, ev);
 244         }
 245
 246         return req;
 247 }
 248
 249 /*
 250  * Work out the next IO request from the remaining chunks starting with
 251  * state->current_chunk. Chunks with left to right adjacent ranges can be merged
 252  * into a single IO request.
 253  */
 254 static uint32_t next_merged_io(struct fsctl_srv_copychunk_state *state)
 255 {
 256         struct srv_copychunk *chunk = NULL;
 257         uint32_t length;
 258         off_t next_src_offset;
 259         off_t next_dst_offset;
 260
 261         /*
 262          * We're expected to process at least one chunk and return it's length,
 263          * so let's do this first.
 264          */
 265
 266         chunk = &state->cc_copy.chunks[state->current_chunk];
 267         length = chunk->length;
 268         state->next_chunk++;
 269
 270         /*
 271          * Now process subsequent chunks merging chunks as long as ranges are
 272          * adjacent and the source file size is not exceeded (this is needed
 273          * for error reporting).
 274          */
 275
 276         next_src_offset = chunk->source_off + chunk->length;
 277         next_dst_offset = chunk->target_off + chunk->length;
 278
 279         while (state->next_chunk < state->cc_copy.chunk_count) {
 280                 chunk = &state->cc_copy.chunks[state->next_chunk];
 281
 282                 if ((chunk->source_off != next_src_offset) ||
 283                     (chunk->target_off != next_dst_offset))
 284                 {
 285                         /* Not adjacent, stop merging */
 286                         break;
 287                 }
 288
 289                 next_src_offset += chunk->length;
 290                 next_dst_offset += chunk->length;
 291
 292                 if (next_src_offset > state->src_fsp->fsp_name->st.st_ex_size) {
 293                         /* Source filesize exceeded, stop merging */
 294                         break;
 295                 }
 296
 297                 /*
 298                  * Found a mergable chunk, merge it and continue searching.
 299                  * Note: this can't wrap, limits were already checked in
 300                  * copychunk_check_limits().
 301                  */
 302                 length += chunk->length;
 303
 304                 state->next_chunk++;
 305         }
 306
 307         return length;
 308 }
 309
 310 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 311 {
 312         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 313                 req, struct fsctl_srv_copychunk_state);
 314         struct tevent_req *subreq = NULL;
 315         struct srv_copychunk *chunk = NULL;
 316         uint32_t length;
 317
 318         if (state->next_chunk > state->cc_copy.chunk_count) {
 319                 DBG_ERR("Copy-chunk loop next_chunk [%d] chunk_count [%d]\n",
 320                         state->next_chunk, state->cc_copy.chunk_count);
 321                 return NT_STATUS_INTERNAL_ERROR;
 322         }
 323
 324         if (state->cc_copy.chunk_count == 0) {
 325                 /*
 326                  * Process as OS X copyfile request. This is currently
 327                  * the only copychunk request with a chunk count of 0
 328                  * we will process.
 329                  */
 330                 if (!state->src_fsp->aapl_copyfile_supported ||
 331                     !state->dst_fsp->aapl_copyfile_supported)
 332                 {
 333                         /*
 334                          * This must not produce an error but just return a
 335                          * chunk count of 0 in the response.
 336                          */
 337                         tevent_req_done(req);
 338                         tevent_req_post(req, state->ev);
 339                         return NT_STATUS_OK;
 340                 }
 341                 state->aapl_copyfile = true;
 342
 343                 subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 344                                                  state,
 345                                                  state->ev,
 346                                                  state->src_fsp,
 347                                                  0,
 348                                                  state->dst_fsp,
 349                                                  0,
 350                                                  0,
 351                                                  0);
 352                 if (subreq == NULL) {
 353                         return NT_STATUS_NO_MEMORY;
 354                 }
 355                 tevent_req_set_callback(subreq,
 356                                         fsctl_srv_copychunk_vfs_done, req);
 357                 return NT_STATUS_OK;
 358         }
 359
 360         chunk = &state->cc_copy.chunks[state->current_chunk];
 361         length = next_merged_io(state);
 362
 363         subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
 364                                          state,
 365                                          state->ev,
 366                                          state->src_fsp,
 367                                          chunk->source_off,
 368                                          state->dst_fsp,
 369                                          chunk->target_off,
 370                                          length,
 371                                          0);
 372         if (tevent_req_nomem(subreq, req)) {
 373                 return NT_STATUS_NO_MEMORY;
 374         }
 375         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 376
 377         return NT_STATUS_OK;
 378 }
 379
 380 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 381 {
 382         struct tevent_req *req = tevent_req_callback_data(
 383                 subreq, struct tevent_req);
 384         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 385                 req, struct fsctl_srv_copychunk_state);
 386         off_t chunk_nwritten;
 387         NTSTATUS status;
 388
 389         status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
 390                                          &chunk_nwritten);
 391         TALLOC_FREE(subreq);
 392         if (!NT_STATUS_IS_OK(status)) {
 393                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 394                         nt_errstr(status),
 395                         (unsigned int)state->next_chunk,
 396                         (unsigned int)state->cc_copy.chunk_count);
 397                 tevent_req_nterror(req, status);
 398                 return;
 399         }
 400
 401         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 402                   (unsigned int)state->next_chunk,
 403                   (unsigned int)state->cc_copy.chunk_count);
 404         state->total_written += chunk_nwritten;
 405
 406         state->current_chunk = state->next_chunk;
 407         if (state->current_chunk == state->cc_copy.chunk_count) {
 408                 tevent_req_done(req);
 409                 return;
 410         }
 411
 412         status = fsctl_srv_copychunk_loop(req);
 413         if (tevent_req_nterror(req, status)) {
 414                 return;
 415         }
 416 }
 417
 418 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 419                                          struct srv_copychunk_rsp *cc_rsp,
 420                                          bool *pack_rsp)
 421 {
 422         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 423                                         struct fsctl_srv_copychunk_state);
 424         NTSTATUS status;
 425
 426         switch (state->out_data) {
 427         case COPYCHUNK_OUT_EMPTY:
 428                 *pack_rsp = false;
 429                 break;
 430         case COPYCHUNK_OUT_LIMITS:
 431                 /* 2.2.32.1 - send back our maximum transfer size limits */
 432                 copychunk_pack_limits(cc_rsp);
 433                 *pack_rsp = true;
 434                 break;
 435         case COPYCHUNK_OUT_RSP:
 436                 if (state->aapl_copyfile == true) {
 437                         cc_rsp->chunks_written = 0;
 438                 } else {
 439                         cc_rsp->chunks_written = state->current_chunk;
 440                 }
 441                 cc_rsp->chunk_bytes_written = 0;
 442                 cc_rsp->total_bytes_written = state->total_written;
 443                 *pack_rsp = true;
 444                 break;
 445         default:        /* not reached */
 446                 assert(1);
 447                 break;
 448         }
 449         status = tevent_req_simple_recv_ntstatus(req);
 450         return status;
 451 }
 452
 453 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 454                                          struct tevent_context *ev,
 455                                          struct smbXsrv_connection *xconn,
 456                                          DATA_BLOB *in_input,
 457                                          uint32_t in_max_output,
 458                                          DATA_BLOB *out_output)
 459 {
 460         struct fsctl_net_iface_info *array = NULL;
 461         struct fsctl_net_iface_info *first = NULL;
 462         struct fsctl_net_iface_info *last = NULL;
 463         size_t i;
 464         size_t num_ifaces = iface_count();
 465         enum ndr_err_code ndr_err;
 466
 467         if (in_input->length != 0) {
 468                 return NT_STATUS_INVALID_PARAMETER;
 469         }
 470
 471         *out_output = data_blob_null;
 472
 473         array = talloc_zero_array(mem_ctx,
 474                                   struct fsctl_net_iface_info,
 475                                   num_ifaces);
 476         if (array == NULL) {
 477                 return NT_STATUS_NO_MEMORY;
 478         }
 479
 480         for (i=0; i < num_ifaces; i++) {
 481                 struct fsctl_net_iface_info *cur = &array[i];
 482                 const struct interface *iface = get_interface(i);
 483                 const struct sockaddr_storage *ifss = &iface->ip;
 484                 const void *ifptr = ifss;
 485                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 486                 struct tsocket_address *a = NULL;
 487                 char *addr;
 488                 bool ok;
 489                 int ret;
 490
 491                 ret = tsocket_address_bsd_from_sockaddr(array,
 492                                         ifsa, sizeof(struct sockaddr_storage),
 493                                         &a);
 494                 if (ret != 0) {
 495                         return map_nt_error_from_unix_common(errno);
 496                 }
 497
 498                 ok = tsocket_address_is_inet(a, "ip");
 499                 if (!ok) {
 500                         continue;
 501                 }
 502
 503                 addr = tsocket_address_inet_addr_string(a, array);
 504                 if (addr == NULL) {
 505                         TALLOC_FREE(array);
 506                         return NT_STATUS_NO_MEMORY;
 507                 }
 508
 509                 cur->ifindex = iface->if_index;
 510                 if (cur->ifindex == 0) {
 511                         /*
 512                          * Did not get interface index from kernel,
 513                          * nor from the config. ==> Apply a common
 514                          * default value for these cases.
 515                          */
 516                         cur->ifindex = UINT32_MAX;
 517                 }
 518                 cur->capability = iface->capability;
 519                 cur->linkspeed = iface->linkspeed;
 520                 if (cur->linkspeed == 0) {
 521                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 522                                   "address [%s].\n", iface->name, addr);
 523                         continue;
 524                 }
 525
 526                 ok = tsocket_address_is_inet(a, "ipv4");
 527                 if (ok) {
 528                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 529                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 530                 }
 531                 ok = tsocket_address_is_inet(a, "ipv6");
 532                 if (ok) {
 533                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 534                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 535                 }
 536
 537                 if (first == NULL) {
 538                         first = cur;
 539                 }
 540                 if (last != NULL) {
 541                         last->next = cur;
 542                 }
 543                 last = cur;
 544         }
 545
 546         if (first == NULL) {
 547                 TALLOC_FREE(array);
 548                 return NT_STATUS_OK;
 549         }
 550
 551         if (DEBUGLEVEL >= 10) {
 552                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 553         }
 554
 555         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 556                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 557         TALLOC_FREE(array);
 558         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 559                 return ndr_map_error2ntstatus(ndr_err);
 560         }
 561
 562         return NT_STATUS_OK;
 563 }
 564
 565 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 566                                         struct tevent_context *ev,
 567                                         struct smbXsrv_connection *conn,
 568                                         DATA_BLOB *in_input,
 569                                         uint32_t in_max_output,
 570                                         DATA_BLOB *out_output,
 571                                         bool *disconnect)
 572 {
 573         uint32_t in_capabilities;
 574         DATA_BLOB in_guid_blob;
 575         struct GUID in_guid;
 576         uint16_t in_security_mode;
 577         uint16_t in_num_dialects;
 578         uint16_t dialect;
 579         DATA_BLOB out_guid_blob;
 580         NTSTATUS status;
 581         enum protocol_types protocol = PROTOCOL_NONE;
 582
 583         if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
 584                 /*
 585                  * With SMB 2.02 we didn't get the
 586                  * capabitities, client guid, security mode
 587                  * and dialects the client would have offered.
 588                  *
 589                  * So we behave compatible with a true
 590                  * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
 591                  *
 592                  * As SMB >= 2.10 offers the two phase SMB2 Negotiate
 593                  * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
 594                  * starting with SMB 2.10, while Windows only supports
 595                  * it starting with SMB > 2.10.
 596                  */
 597                 return NT_STATUS_FILE_CLOSED;
 598         }
 599
 600         if (in_input->length < 0x18) {
 601                 return NT_STATUS_INVALID_PARAMETER;
 602         }
 603
 604         in_capabilities = IVAL(in_input->data, 0x00);
 605         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 606         in_security_mode = SVAL(in_input->data, 0x14);
 607         in_num_dialects = SVAL(in_input->data, 0x16);
 608
 609         if (in_input->length < (0x18 + in_num_dialects*2)) {
 610                 return NT_STATUS_INVALID_PARAMETER;
 611         }
 612
 613         if (in_max_output < 0x18) {
 614                 return NT_STATUS_BUFFER_TOO_SMALL;
 615         }
 616
 617         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 618         if (!NT_STATUS_IS_OK(status)) {
 619                 return status;
 620         }
 621
 622         /*
 623          * From: [MS-SMB2]
 624          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 625          *
 626          * The server MUST determine the greatest common dialect
 627          * between the dialects it implements and the Dialects array
 628          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 629          * matched, or if the value is not equal to Connection.Dialect,
 630          * the server MUST terminate the transport connection
 631          * and free the Connection object.
 632          */
 633         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 634                                                     in_num_dialects,
 635                                                     &dialect);
 636         if (conn->protocol != protocol) {
 637                 *disconnect = true;
 638                 return NT_STATUS_ACCESS_DENIED;
 639         }
 640
 641         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 642                 *disconnect = true;
 643                 return NT_STATUS_ACCESS_DENIED;
 644         }
 645
 646         if (in_security_mode != conn->smb2.client.security_mode) {
 647                 *disconnect = true;
 648                 return NT_STATUS_ACCESS_DENIED;
 649         }
 650
 651         if (in_capabilities != conn->smb2.client.capabilities) {
 652                 *disconnect = true;
 653                 return NT_STATUS_ACCESS_DENIED;
 654         }
 655
 656         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 657                                   &out_guid_blob);
 658         if (!NT_STATUS_IS_OK(status)) {
 659                 return status;
 660         }
 661
 662         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 663         if (out_output->data == NULL) {
 664                 return NT_STATUS_NO_MEMORY;
 665         }
 666
 667         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 668         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 669         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 670         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 671
 672         return NT_STATUS_OK;
 673 }
 674
 675 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 676 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
 677
 678 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 679                                          struct tevent_context *ev,
 680                                          struct tevent_req *req,
 681                                          struct smbd_smb2_ioctl_state *state)
 682 {
 683         struct tevent_req *subreq;
 684         NTSTATUS status;
 685
 686         switch (ctl_code) {
 687         /*
 688          * [MS-SMB2] 2.2.31
 689          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 690          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 691          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 692          * FILE_WRITE_DATA access.
 693          */
 694         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 695         case FSCTL_SRV_COPYCHUNK:
 696                 subreq = fsctl_srv_copychunk_send(state, ev,
 697                                                   ctl_code,
 698                                                   state->fsp,
 699                                                   &state->in_input,
 700                                                   state->in_max_output,
 701                                                   state->smb2req);
 702                 if (tevent_req_nomem(subreq, req)) {
 703                         return tevent_req_post(req, ev);
 704                 }
 705                 tevent_req_set_callback(subreq,
 706                                         smb2_ioctl_network_fs_copychunk_done,
 707                                         req);
 708                 return req;
 709                 break;
 710         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 711                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 712                 {
 713                         if (IS_IPC(state->smbreq->conn)) {
 714                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 715                         } else {
 716                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 717                         }
 718
 719                         tevent_req_nterror(req, status);
 720                         return tevent_req_post(req, ev);
 721                 }
 722
 723                 status = fsctl_network_iface_info(state, ev,
 724                                                   state->smbreq->xconn,
 725                                                   &state->in_input,
 726                                                   state->in_max_output,
 727                                                   &state->out_output);
 728                 if (!tevent_req_nterror(req, status)) {
 729                         tevent_req_done(req);
 730                 }
 731                 return tevent_req_post(req, ev);
 732                 break;
 733         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 734                 status = fsctl_validate_neg_info(state, ev,
 735                                                  state->smbreq->xconn,
 736                                                  &state->in_input,
 737                                                  state->in_max_output,
 738                                                  &state->out_output,
 739                                                  &state->disconnect);
 740                 if (!tevent_req_nterror(req, status)) {
 741                         tevent_req_done(req);
 742                 }
 743                 return tevent_req_post(req, ev);
 744                 break;
 745         case FSCTL_SRV_REQUEST_RESUME_KEY:
 746                 subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
 747                                                    ev,
 748                                                    state->fsp,
 749                                                    FSCTL_SRV_REQUEST_RESUME_KEY,
 750                                                    0, 0, 0);
 751                 if (tevent_req_nomem(subreq, req)) {
 752                         return tevent_req_post(req, ev);
 753                 }
 754                 tevent_req_set_callback(
 755                         subreq, smb2_ioctl_network_fs_offload_read_done, req);
 756                 return req;
 757
 758         default: {
 759                 uint8_t *out_data = NULL;
 760                 uint32_t out_data_len = 0;
 761
 762                 if (state->fsp == NULL) {
 763                         status = NT_STATUS_NOT_SUPPORTED;
 764                 } else {
 765                         status = SMB_VFS_FSCTL(state->fsp,
 766                                                state,
 767                                                ctl_code,
 768                                                state->smbreq->flags2,
 769                                                state->in_input.data,
 770                                                state->in_input.length,
 771                                                &out_data,
 772                                                state->in_max_output,
 773                                                &out_data_len);
 774                         state->out_output = data_blob_const(out_data, out_data_len);
 775                         if (NT_STATUS_IS_OK(status)) {
 776                                 tevent_req_done(req);
 777                                 return tevent_req_post(req, ev);
 778                         }
 779                 }
 780
 781                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 782                         if (IS_IPC(state->smbreq->conn)) {
 783                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 784                         } else {
 785                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 786                         }
 787                 }
 788
 789                 tevent_req_nterror(req, status);
 790                 return tevent_req_post(req, ev);
 791                 break;
 792         }
 793         }
 794
 795         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 796         return tevent_req_post(req, ev);
 797 }
 798
 799 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 800 {
 801         struct tevent_req *req = tevent_req_callback_data(subreq,
 802                                                           struct tevent_req);
 803         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 804                                                 struct smbd_smb2_ioctl_state);
 805         struct srv_copychunk_rsp cc_rsp;
 806         NTSTATUS status;
 807         bool pack_rsp = false;
 808
 809         ZERO_STRUCT(cc_rsp);
 810         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 811         TALLOC_FREE(subreq);
 812         if (pack_rsp == true) {
 813                 enum ndr_err_code ndr_ret;
 814                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 815                                                ioctl_state,
 816                                                &cc_rsp,
 817                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 818                 if (ndr_ret != NDR_ERR_SUCCESS) {
 819                         status = NT_STATUS_INTERNAL_ERROR;
 820                 }
 821         }
 822
 823         if (!tevent_req_nterror(req, status)) {
 824                 tevent_req_done(req);
 825         }
 826 }
 827
 828 static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
 829 {
 830         struct tevent_req *req = tevent_req_callback_data(
 831                 subreq, struct tevent_req);
 832         struct smbd_smb2_ioctl_state *state = tevent_req_data(
 833                 req, struct smbd_smb2_ioctl_state);
 834         struct req_resume_key_rsp rkey_rsp;
 835         enum ndr_err_code ndr_ret;
 836         DATA_BLOB token;
 837         NTSTATUS status;
 838
 839         status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
 840                                            state->fsp->conn,
 841                                            state,
 842                                            &token);
 843         TALLOC_FREE(subreq);
 844         if (tevent_req_nterror(req, status)) {
 845                 return;
 846         }
 847
 848         if (token.length != sizeof(rkey_rsp.resume_key)) {
 849                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 850                 return;
 851         }
 852
 853         ZERO_STRUCT(rkey_rsp);
 854         memcpy(rkey_rsp.resume_key, token.data, token.length);
 855
 856         ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
 857                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 858         if (ndr_ret != NDR_ERR_SUCCESS) {
 859                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 860                 return;
 861         }
 862
 863         tevent_req_done(req);
 864         return;
 865 }