source3/smbd/smb2_ioctl_network_fs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6    Copyright (C) David Disseldorp 2012
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smbd/smbd.h"
  24 #include "smbd/globals.h"
  25 #include "../libcli/smb/smb_common.h"
  26 #include "../libcli/security/security.h"
  27 #include "../lib/util/tevent_ntstatus.h"
  28 #include "include/ntioctl.h"
  29 #include "../librpc/ndr/libndr.h"
  30 #include "librpc/gen_ndr/ndr_ioctl.h"
  31 #include "smb2_ioctl_private.h"
  32 #include "../lib/tsocket/tsocket.h"
  33
  34 static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
  35 {
  36         cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
  37         cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
  38         cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
  39 }
  40
  41 static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
  42 {
  43         uint32_t i;
  44         uint32_t total_len = 0;
  45
  46         /*
  47          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
  48          * Send and invalid parameter response if:
  49          * - The ChunkCount value is greater than
  50          *   ServerSideCopyMaxNumberofChunks
  51          */
  52         if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
  53                 return NT_STATUS_INVALID_PARAMETER;
  54         }
  55
  56         for (i = 0; i < cc_copy->chunk_count; i++) {
  57                 /*
  58                  * - The Length value in a single chunk is greater than
  59                  *   ServerSideCopyMaxChunkSize or equal to zero.
  60                  */
  61                 if ((cc_copy->chunks[i].length == 0)
  62                  || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
  63                         return NT_STATUS_INVALID_PARAMETER;
  64                 }
  65                 total_len += cc_copy->chunks[i].length;
  66         }
  67         /*
  68          * - Sum of Lengths in all chunks is greater than
  69          *   ServerSideCopyMaxDataSize
  70          */
  71         if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
  72                 return NT_STATUS_INVALID_PARAMETER;
  73         }
  74
  75         return NT_STATUS_OK;
  76 }
  77
  78 struct fsctl_srv_copychunk_state {
  79         struct tevent_context *ev;
  80         struct connection_struct *conn;
  81         struct srv_copychunk_copy cc_copy;
  82         uint32_t current_chunk;
  83         uint32_t next_chunk;
  84         NTSTATUS status;
  85         off_t total_written;
  86         struct files_struct *src_fsp;
  87         struct files_struct *dst_fsp;
  88         enum {
  89                 COPYCHUNK_OUT_EMPTY = 0,
  90                 COPYCHUNK_OUT_LIMITS,
  91                 COPYCHUNK_OUT_RSP,
  92         } out_data;
  93         bool aapl_copyfile;
  94 };
  95 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
  96
  97 static NTSTATUS copychunk_check_handles(uint32_t ctl_code,
  98                                         struct files_struct *src_fsp,
  99                                         struct files_struct *dst_fsp,
 100                                         struct smb_request *smb1req)
 101 {
 102         /*
 103          * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
 104          * The server MUST fail the request with STATUS_ACCESS_DENIED if any of
 105          * the following are true:
 106          * - The Open.GrantedAccess of the destination file does not include
 107          *   FILE_WRITE_DATA or FILE_APPEND_DATA.
 108          */
 109         if (!CHECK_WRITE(dst_fsp)) {
 110                 DEBUG(5, ("copy chunk no write on dest handle (%s).\n",
 111                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 112                 return NT_STATUS_ACCESS_DENIED;
 113         }
 114         /*
 115          * - The Open.GrantedAccess of the destination file does not include
 116          *   FILE_READ_DATA, and the CtlCode is FSCTL_SRV_COPYCHUNK.
 117          */
 118         if ((ctl_code == FSCTL_SRV_COPYCHUNK) &&
 119             !CHECK_READ_IOCTL(dst_fsp, smb1req)) {
 120                 DEBUG(5, ("copy chunk no read on dest handle (%s).\n",
 121                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 122                 return NT_STATUS_ACCESS_DENIED;
 123         }
 124         /*
 125          * - The Open.GrantedAccess of the source file does not include
 126          *   FILE_READ_DATA access.
 127          */
 128         if (!CHECK_READ(src_fsp, smb1req)) {
 129                 DEBUG(5, ("copy chunk no read on src handle (%s).\n",
 130                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 131                 return NT_STATUS_ACCESS_DENIED;
 132         }
 133
 134         if (src_fsp->is_directory) {
 135                 DEBUG(5, ("copy chunk no read on src directory handle (%s).\n",
 136                         smb_fname_str_dbg(src_fsp->fsp_name) ));
 137                 return NT_STATUS_ACCESS_DENIED;
 138         }
 139
 140         if (dst_fsp->is_directory) {
 141                 DEBUG(5, ("copy chunk no read on dst directory handle (%s).\n",
 142                         smb_fname_str_dbg(dst_fsp->fsp_name) ));
 143                 return NT_STATUS_ACCESS_DENIED;
 144         }
 145
 146         if (IS_IPC(src_fsp->conn) || IS_IPC(dst_fsp->conn)) {
 147                 DEBUG(5, ("copy chunk no access on IPC$ handle.\n"));
 148                 return NT_STATUS_ACCESS_DENIED;
 149         }
 150
 151         if (IS_PRINT(src_fsp->conn) || IS_PRINT(dst_fsp->conn)) {
 152                 DEBUG(5, ("copy chunk no access on PRINT handle.\n"));
 153                 return NT_STATUS_ACCESS_DENIED;
 154         }
 155
 156         return NT_STATUS_OK;
 157 }
 158
 159 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
 160
 161 static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
 162                                                    struct tevent_context *ev,
 163                                                    uint32_t ctl_code,
 164                                                    struct files_struct *dst_fsp,
 165                                                    DATA_BLOB *in_input,
 166                                                    size_t in_max_output,
 167                                                    struct smbd_smb2_request *smb2req)
 168 {
 169         struct tevent_req *req = NULL;
 170         struct fsctl_srv_copychunk_state *state = NULL;
 171         uint64_t src_persistent_h;
 172         uint64_t src_volatile_h;
 173         enum ndr_err_code ndr_ret;
 174         NTSTATUS status;
 175
 176         /* handler for both copy-chunk variants */
 177         SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
 178                 || (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
 179
 180         req = tevent_req_create(mem_ctx, &state,
 181                                 struct fsctl_srv_copychunk_state);
 182         if (req == NULL) {
 183                 return NULL;
 184         }
 185         *state = (struct fsctl_srv_copychunk_state) {
 186                 .conn = dst_fsp->conn,
 187                 .ev = ev,
 188         };
 189
 190         if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
 191                 DEBUG(3, ("max output %d not large enough to hold copy chunk "
 192                           "response %lu\n", (int)in_max_output,
 193                           (unsigned long)sizeof(struct srv_copychunk_rsp)));
 194                 state->status = NT_STATUS_INVALID_PARAMETER;
 195                 tevent_req_nterror(req, state->status);
 196                 return tevent_req_post(req, ev);
 197         }
 198
 199         ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
 200                         (ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
 201         if (ndr_ret != NDR_ERR_SUCCESS) {
 202                 DEBUG(0, ("failed to unmarshall copy chunk req\n"));
 203                 state->status = NT_STATUS_INVALID_PARAMETER;
 204                 tevent_req_nterror(req, state->status);
 205                 return tevent_req_post(req, ev);
 206         }
 207
 208         /* persistent/volatile keys sent as the resume key */
 209         src_persistent_h = BVAL(state->cc_copy.source_key, 0);
 210         src_volatile_h = BVAL(state->cc_copy.source_key, 8);
 211         state->src_fsp = file_fsp_get(smb2req, src_persistent_h, src_volatile_h);
 212         if (state->src_fsp == NULL) {
 213                 DEBUG(3, ("invalid resume key in copy chunk req\n"));
 214                 state->status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
 215                 tevent_req_nterror(req, state->status);
 216                 return tevent_req_post(req, ev);
 217         }
 218
 219         state->dst_fsp = dst_fsp;
 220
 221         state->status = copychunk_check_handles(ctl_code,
 222                                                 state->src_fsp,
 223                                                 state->dst_fsp,
 224                                                 smb2req->smb1req);
 225         if (!NT_STATUS_IS_OK(state->status)) {
 226                 tevent_req_nterror(req, state->status);
 227                 return tevent_req_post(req, ev);
 228         }
 229
 230         state->status = copychunk_check_limits(&state->cc_copy);
 231         if (!NT_STATUS_IS_OK(state->status)) {
 232                 DEBUG(3, ("copy chunk req exceeds limits\n"));
 233                 state->out_data = COPYCHUNK_OUT_LIMITS;
 234                 tevent_req_nterror(req, state->status);
 235                 return tevent_req_post(req, ev);
 236         }
 237
 238         /* any errors from here onwards should carry copychunk response data */
 239         state->out_data = COPYCHUNK_OUT_RSP;
 240
 241         status = fsctl_srv_copychunk_loop(req);
 242         if (tevent_req_nterror(req, status)) {
 243                 return tevent_req_post(req, ev);
 244         }
 245
 246         return req;
 247 }
 248
 249 static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
 250 {
 251         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 252                 req, struct fsctl_srv_copychunk_state);
 253         struct tevent_req *subreq = NULL;
 254         struct srv_copychunk *chunk = NULL;
 255
 256         if (state->next_chunk > state->cc_copy.chunk_count) {
 257                 DBG_ERR("Copy-chunk loop next_chunk [%d] chunk_count [%d]\n",
 258                         state->next_chunk, state->cc_copy.chunk_count);
 259                 return NT_STATUS_INTERNAL_ERROR;
 260         }
 261
 262         if (state->cc_copy.chunk_count == 0) {
 263                 /*
 264                  * Process as OS X copyfile request. This is currently
 265                  * the only copychunk request with a chunk count of 0
 266                  * we will process.
 267                  */
 268                 if (!state->src_fsp->aapl_copyfile_supported ||
 269                     !state->dst_fsp->aapl_copyfile_supported)
 270                 {
 271                         /*
 272                          * This must not return an error but just a chunk count
 273                          * of 0 in the response.
 274                          */
 275                         tevent_req_done(req);
 276                         tevent_req_post(req, state->ev);
 277                         return NT_STATUS_OK;
 278                 }
 279                 state->aapl_copyfile = true;
 280
 281                 subreq = SMB_VFS_COPY_CHUNK_SEND(state->dst_fsp->conn,
 282                                                  state,
 283                                                  state->ev,
 284                                                  state->src_fsp,
 285                                                  0,
 286                                                  state->dst_fsp,
 287                                                  0,
 288                                                  0);
 289                 if (subreq == NULL) {
 290                         return NT_STATUS_NO_MEMORY;
 291                 }
 292                 tevent_req_set_callback(subreq,
 293                                         fsctl_srv_copychunk_vfs_done, req);
 294                 return NT_STATUS_OK;
 295         }
 296
 297         chunk = &state->cc_copy.chunks[state->current_chunk];
 298
 299         /*
 300          * Doing the increment and calculation for the next chunk here and not
 301          * in the done function, as a later commit will make this a more
 302          * sophisticated logic.
 303          */
 304         state->next_chunk++;
 305
 306         subreq = SMB_VFS_COPY_CHUNK_SEND(state->dst_fsp->conn,
 307                                          state,
 308                                          state->ev,
 309                                          state->src_fsp,
 310                                          chunk->source_off,
 311                                          state->dst_fsp,
 312                                          chunk->target_off,
 313                                          chunk->length);
 314         if (tevent_req_nomem(subreq, req)) {
 315                 return NT_STATUS_NO_MEMORY;
 316         }
 317         tevent_req_set_callback(subreq, fsctl_srv_copychunk_vfs_done, req);
 318
 319         return NT_STATUS_OK;
 320 }
 321
 322 static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
 323 {
 324         struct tevent_req *req = tevent_req_callback_data(
 325                 subreq, struct tevent_req);
 326         struct fsctl_srv_copychunk_state *state = tevent_req_data(
 327                 req, struct fsctl_srv_copychunk_state);
 328         off_t chunk_nwritten;
 329         NTSTATUS status;
 330
 331         status = SMB_VFS_COPY_CHUNK_RECV(state->conn, subreq,
 332                                          &chunk_nwritten);
 333         TALLOC_FREE(subreq);
 334         if (!NT_STATUS_IS_OK(status)) {
 335                 DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
 336                         nt_errstr(status),
 337                         (unsigned int)state->next_chunk,
 338                         (unsigned int)state->cc_copy.chunk_count);
 339                 tevent_req_nterror(req, status);
 340                 return;
 341         }
 342
 343         DBG_DEBUG("good copy chunk [%u] of [%u]\n",
 344                   (unsigned int)state->next_chunk,
 345                   (unsigned int)state->cc_copy.chunk_count);
 346         state->total_written += chunk_nwritten;
 347
 348         state->current_chunk = state->next_chunk;
 349
 350         if (state->next_chunk == state->cc_copy.chunk_count) {
 351                 tevent_req_done(req);
 352                 return;
 353         }
 354
 355         status = fsctl_srv_copychunk_loop(req);
 356         if (tevent_req_nterror(req, status)) {
 357                 return;
 358         }
 359 }
 360
 361 static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
 362                                          struct srv_copychunk_rsp *cc_rsp,
 363                                          bool *pack_rsp)
 364 {
 365         struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
 366                                         struct fsctl_srv_copychunk_state);
 367         NTSTATUS status;
 368
 369         switch (state->out_data) {
 370         case COPYCHUNK_OUT_EMPTY:
 371                 *pack_rsp = false;
 372                 break;
 373         case COPYCHUNK_OUT_LIMITS:
 374                 /* 2.2.32.1 - send back our maximum transfer size limits */
 375                 copychunk_pack_limits(cc_rsp);
 376                 *pack_rsp = true;
 377                 break;
 378         case COPYCHUNK_OUT_RSP:
 379                 if (state->aapl_copyfile == true) {
 380                         cc_rsp->chunks_written = 0;
 381                 } else {
 382                         cc_rsp->chunks_written = state->current_chunk;
 383                 }
 384                 cc_rsp->chunk_bytes_written = 0;
 385                 cc_rsp->total_bytes_written = state->total_written;
 386                 *pack_rsp = true;
 387                 break;
 388         default:        /* not reached */
 389                 assert(1);
 390                 break;
 391         }
 392         status = tevent_req_simple_recv_ntstatus(req);
 393         return status;
 394 }
 395
 396 static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
 397                                          struct tevent_context *ev,
 398                                          struct smbXsrv_connection *xconn,
 399                                          DATA_BLOB *in_input,
 400                                          uint32_t in_max_output,
 401                                          DATA_BLOB *out_output)
 402 {
 403         struct fsctl_net_iface_info *array = NULL;
 404         struct fsctl_net_iface_info *first = NULL;
 405         struct fsctl_net_iface_info *last = NULL;
 406         size_t i;
 407         size_t num_ifaces = iface_count();
 408         enum ndr_err_code ndr_err;
 409
 410         if (in_input->length != 0) {
 411                 return NT_STATUS_INVALID_PARAMETER;
 412         }
 413
 414         *out_output = data_blob_null;
 415
 416         array = talloc_zero_array(mem_ctx,
 417                                   struct fsctl_net_iface_info,
 418                                   num_ifaces);
 419         if (array == NULL) {
 420                 return NT_STATUS_NO_MEMORY;
 421         }
 422
 423         for (i=0; i < num_ifaces; i++) {
 424                 struct fsctl_net_iface_info *cur = &array[i];
 425                 const struct interface *iface = get_interface(i);
 426                 const struct sockaddr_storage *ifss = &iface->ip;
 427                 const void *ifptr = ifss;
 428                 const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
 429                 struct tsocket_address *a = NULL;
 430                 char *addr;
 431                 bool ok;
 432                 int ret;
 433
 434                 ret = tsocket_address_bsd_from_sockaddr(array,
 435                                         ifsa, sizeof(struct sockaddr_storage),
 436                                         &a);
 437                 if (ret != 0) {
 438                         return map_nt_error_from_unix_common(errno);
 439                 }
 440
 441                 ok = tsocket_address_is_inet(a, "ip");
 442                 if (!ok) {
 443                         continue;
 444                 }
 445
 446                 addr = tsocket_address_inet_addr_string(a, array);
 447                 if (addr == NULL) {
 448                         TALLOC_FREE(array);
 449                         return NT_STATUS_NO_MEMORY;
 450                 }
 451
 452                 cur->ifindex = iface->if_index;
 453                 if (cur->ifindex == 0) {
 454                         /*
 455                          * Did not get interface index from kernel,
 456                          * nor from the config. ==> Apply a common
 457                          * default value for these cases.
 458                          */
 459                         cur->ifindex = UINT32_MAX;
 460                 }
 461                 cur->capability = iface->capability;
 462                 cur->linkspeed = iface->linkspeed;
 463                 if (cur->linkspeed == 0) {
 464                         DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
 465                                   "address [%s].\n", iface->name, addr);
 466                         continue;
 467                 }
 468
 469                 ok = tsocket_address_is_inet(a, "ipv4");
 470                 if (ok) {
 471                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
 472                         cur->sockaddr.saddr.saddr_in.ipv4 = addr;
 473                 }
 474                 ok = tsocket_address_is_inet(a, "ipv6");
 475                 if (ok) {
 476                         cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
 477                         cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
 478                 }
 479
 480                 if (first == NULL) {
 481                         first = cur;
 482                 }
 483                 if (last != NULL) {
 484                         last->next = cur;
 485                 }
 486                 last = cur;
 487         }
 488
 489         if (first == NULL) {
 490                 TALLOC_FREE(array);
 491                 return NT_STATUS_OK;
 492         }
 493
 494         if (DEBUGLEVEL >= 10) {
 495                 NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
 496         }
 497
 498         ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
 499                         (ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
 500         TALLOC_FREE(array);
 501         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 502                 return ndr_map_error2ntstatus(ndr_err);
 503         }
 504
 505         return NT_STATUS_OK;
 506 }
 507
 508 static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
 509                                         struct tevent_context *ev,
 510                                         struct smbXsrv_connection *conn,
 511                                         DATA_BLOB *in_input,
 512                                         uint32_t in_max_output,
 513                                         DATA_BLOB *out_output,
 514                                         bool *disconnect)
 515 {
 516         uint32_t in_capabilities;
 517         DATA_BLOB in_guid_blob;
 518         struct GUID in_guid;
 519         uint16_t in_security_mode;
 520         uint16_t in_num_dialects;
 521         uint16_t dialect;
 522         DATA_BLOB out_guid_blob;
 523         NTSTATUS status;
 524         enum protocol_types protocol = PROTOCOL_NONE;
 525
 526         if (in_input->length < 0x18) {
 527                 return NT_STATUS_INVALID_PARAMETER;
 528         }
 529
 530         in_capabilities = IVAL(in_input->data, 0x00);
 531         in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
 532         in_security_mode = SVAL(in_input->data, 0x14);
 533         in_num_dialects = SVAL(in_input->data, 0x16);
 534
 535         if (in_input->length < (0x18 + in_num_dialects*2)) {
 536                 return NT_STATUS_INVALID_PARAMETER;
 537         }
 538
 539         if (in_max_output < 0x18) {
 540                 return NT_STATUS_BUFFER_TOO_SMALL;
 541         }
 542
 543         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 544         if (!NT_STATUS_IS_OK(status)) {
 545                 return status;
 546         }
 547
 548         /*
 549          * From: [MS-SMB2]
 550          * 3.3.5.15.12 Handling a Validate Negotiate Info Request
 551          *
 552          * The server MUST determine the greatest common dialect
 553          * between the dialects it implements and the Dialects array
 554          * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
 555          * matched, or if the value is not equal to Connection.Dialect,
 556          * the server MUST terminate the transport connection
 557          * and free the Connection object.
 558          */
 559         protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
 560                                                     in_num_dialects,
 561                                                     &dialect);
 562         if (conn->protocol != protocol) {
 563                 *disconnect = true;
 564                 return NT_STATUS_ACCESS_DENIED;
 565         }
 566
 567         if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
 568                 *disconnect = true;
 569                 return NT_STATUS_ACCESS_DENIED;
 570         }
 571
 572         if (in_security_mode != conn->smb2.client.security_mode) {
 573                 *disconnect = true;
 574                 return NT_STATUS_ACCESS_DENIED;
 575         }
 576
 577         if (in_capabilities != conn->smb2.client.capabilities) {
 578                 *disconnect = true;
 579                 return NT_STATUS_ACCESS_DENIED;
 580         }
 581
 582         status = GUID_to_ndr_blob(&conn->smb2.server.guid, mem_ctx,
 583                                   &out_guid_blob);
 584         if (!NT_STATUS_IS_OK(status)) {
 585                 return status;
 586         }
 587
 588         *out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
 589         if (out_output->data == NULL) {
 590                 return NT_STATUS_NO_MEMORY;
 591         }
 592
 593         SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
 594         memcpy(out_output->data+0x04, out_guid_blob.data, 16);
 595         SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
 596         SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
 597
 598         return NT_STATUS_OK;
 599 }
 600
 601 static NTSTATUS fsctl_srv_req_resume_key(TALLOC_CTX *mem_ctx,
 602                                          struct tevent_context *ev,
 603                                          struct files_struct *fsp,
 604                                          uint32_t in_max_output,
 605                                          DATA_BLOB *out_output)
 606 {
 607         struct req_resume_key_rsp rkey_rsp;
 608         enum ndr_err_code ndr_ret;
 609         DATA_BLOB output;
 610
 611         if (fsp == NULL) {
 612                 return NT_STATUS_FILE_CLOSED;
 613         }
 614
 615         ZERO_STRUCT(rkey_rsp);
 616         /* combine persistent and volatile handles for the resume key */
 617         SBVAL(rkey_rsp.resume_key, 0, fsp->op->global->open_persistent_id);
 618         SBVAL(rkey_rsp.resume_key, 8, fsp->op->global->open_volatile_id);
 619
 620         ndr_ret = ndr_push_struct_blob(&output, mem_ctx, &rkey_rsp,
 621                         (ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
 622         if (ndr_ret != NDR_ERR_SUCCESS) {
 623                 return NT_STATUS_INTERNAL_ERROR;
 624         }
 625
 626         if (in_max_output < output.length) {
 627                 DEBUG(1, ("max output %u too small for resume key rsp %ld\n",
 628                           (unsigned int)in_max_output, (long int)output.length));
 629                 return NT_STATUS_INVALID_PARAMETER;
 630         }
 631         *out_output = output;
 632
 633         return NT_STATUS_OK;
 634 }
 635
 636 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
 637
 638 struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
 639                                          struct tevent_context *ev,
 640                                          struct tevent_req *req,
 641                                          struct smbd_smb2_ioctl_state *state)
 642 {
 643         struct tevent_req *subreq;
 644         NTSTATUS status;
 645
 646         switch (ctl_code) {
 647         /*
 648          * [MS-SMB2] 2.2.31
 649          * FSCTL_SRV_COPYCHUNK is issued when a handle has
 650          * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
 651          * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
 652          * FILE_WRITE_DATA access.
 653          */
 654         case FSCTL_SRV_COPYCHUNK_WRITE: /* FALL THROUGH */
 655         case FSCTL_SRV_COPYCHUNK:
 656                 subreq = fsctl_srv_copychunk_send(state, ev,
 657                                                   ctl_code,
 658                                                   state->fsp,
 659                                                   &state->in_input,
 660                                                   state->in_max_output,
 661                                                   state->smb2req);
 662                 if (tevent_req_nomem(subreq, req)) {
 663                         return tevent_req_post(req, ev);
 664                 }
 665                 tevent_req_set_callback(subreq,
 666                                         smb2_ioctl_network_fs_copychunk_done,
 667                                         req);
 668                 return req;
 669                 break;
 670         case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
 671                 if (!state->smbreq->xconn->client->server_multi_channel_enabled)
 672                 {
 673                         if (IS_IPC(state->smbreq->conn)) {
 674                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 675                         } else {
 676                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 677                         }
 678
 679                         tevent_req_nterror(req, status);
 680                         return tevent_req_post(req, ev);
 681                 }
 682
 683                 status = fsctl_network_iface_info(state, ev,
 684                                                   state->smbreq->xconn,
 685                                                   &state->in_input,
 686                                                   state->in_max_output,
 687                                                   &state->out_output);
 688                 if (!tevent_req_nterror(req, status)) {
 689                         tevent_req_done(req);
 690                 }
 691                 return tevent_req_post(req, ev);
 692                 break;
 693         case FSCTL_VALIDATE_NEGOTIATE_INFO:
 694                 status = fsctl_validate_neg_info(state, ev,
 695                                                  state->smbreq->xconn,
 696                                                  &state->in_input,
 697                                                  state->in_max_output,
 698                                                  &state->out_output,
 699                                                  &state->disconnect);
 700                 if (!tevent_req_nterror(req, status)) {
 701                         tevent_req_done(req);
 702                 }
 703                 return tevent_req_post(req, ev);
 704                 break;
 705         case FSCTL_SRV_REQUEST_RESUME_KEY:
 706                 status = fsctl_srv_req_resume_key(state, ev, state->fsp,
 707                                                   state->in_max_output,
 708                                                   &state->out_output);
 709                 if (!tevent_req_nterror(req, status)) {
 710                         tevent_req_done(req);
 711                 }
 712                 return tevent_req_post(req, ev);
 713                 break;
 714         default: {
 715                 uint8_t *out_data = NULL;
 716                 uint32_t out_data_len = 0;
 717
 718                 if (state->fsp == NULL) {
 719                         status = NT_STATUS_NOT_SUPPORTED;
 720                 } else {
 721                         status = SMB_VFS_FSCTL(state->fsp,
 722                                                state,
 723                                                ctl_code,
 724                                                state->smbreq->flags2,
 725                                                state->in_input.data,
 726                                                state->in_input.length,
 727                                                &out_data,
 728                                                state->in_max_output,
 729                                                &out_data_len);
 730                         state->out_output = data_blob_const(out_data, out_data_len);
 731                         if (NT_STATUS_IS_OK(status)) {
 732                                 tevent_req_done(req);
 733                                 return tevent_req_post(req, ev);
 734                         }
 735                 }
 736
 737                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
 738                         if (IS_IPC(state->smbreq->conn)) {
 739                                 status = NT_STATUS_FS_DRIVER_REQUIRED;
 740                         } else {
 741                                 status = NT_STATUS_INVALID_DEVICE_REQUEST;
 742                         }
 743                 }
 744
 745                 tevent_req_nterror(req, status);
 746                 return tevent_req_post(req, ev);
 747                 break;
 748         }
 749         }
 750
 751         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
 752         return tevent_req_post(req, ev);
 753 }
 754
 755 static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
 756 {
 757         struct tevent_req *req = tevent_req_callback_data(subreq,
 758                                                           struct tevent_req);
 759         struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
 760                                                 struct smbd_smb2_ioctl_state);
 761         struct srv_copychunk_rsp cc_rsp;
 762         NTSTATUS status;
 763         bool pack_rsp = false;
 764
 765         ZERO_STRUCT(cc_rsp);
 766         status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
 767         TALLOC_FREE(subreq);
 768         if (pack_rsp == true) {
 769                 enum ndr_err_code ndr_ret;
 770                 ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
 771                                                ioctl_state,
 772                                                &cc_rsp,
 773                                 (ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
 774                 if (ndr_ret != NDR_ERR_SUCCESS) {
 775                         status = NT_STATUS_INTERNAL_ERROR;
 776                 }
 777         }
 778
 779         if (!tevent_req_nterror(req, status)) {
 780                 tevent_req_done(req);
 781         }
 782 }