Adding upstream version 2:4.20.0+dfsg.upstream/2%4.20.0+dfsg

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 839 insertions, 0 deletions

diff --git a/source3/smbd/smb2_ioctl_network_fs.c b/source3/smbd/smb2_ioctl_network_fs.c
new file mode 100644
index 0000000..bcfa37f
--- /dev/null
+++ b/source3/smbd/smb2_ioctl_network_fs.c
@@ -0,0 +1,839 @@
+/*
+   Unix SMB/CIFS implementation.
+   Core SMB2 server
+
+   Copyright (C) Stefan Metzmacher 2009
+   Copyright (C) David Disseldorp 2012
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "../libcli/smb/smb_common.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "include/ntioctl.h"
+#include "../librpc/ndr/libndr.h"
+#include "librpc/gen_ndr/ndr_ioctl.h"
+#include "smb2_ioctl_private.h"
+#include "../lib/tsocket/tsocket.h"
+#include "lib/messages_ctdb.h"
+#include "ctdbd_conn.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_SMB2
+
+static void copychunk_pack_limits(struct srv_copychunk_rsp *cc_rsp)
+{
+	cc_rsp->chunks_written = COPYCHUNK_MAX_CHUNKS;
+	cc_rsp->chunk_bytes_written = COPYCHUNK_MAX_CHUNK_LEN;
+	cc_rsp->total_bytes_written = COPYCHUNK_MAX_TOTAL_LEN;
+}
+
+static NTSTATUS copychunk_check_limits(struct srv_copychunk_copy *cc_copy)
+{
+	uint32_t i;
+	uint32_t total_len = 0;
+
+	/*
+	 * [MS-SMB2] 3.3.5.15.6 Handling a Server-Side Data Copy Request
+	 * Send and invalid parameter response if:
+	 * - The ChunkCount value is greater than
+	 *   ServerSideCopyMaxNumberofChunks
+	 */
+	if (cc_copy->chunk_count > COPYCHUNK_MAX_CHUNKS) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	for (i = 0; i < cc_copy->chunk_count; i++) {
+		/*
+		 * - The Length value in a single chunk is greater than
+		 *   ServerSideCopyMaxChunkSize or equal to zero.
+		 */
+		if ((cc_copy->chunks[i].length == 0)
+		 || (cc_copy->chunks[i].length > COPYCHUNK_MAX_CHUNK_LEN)) {
+			return NT_STATUS_INVALID_PARAMETER;
+		}
+		total_len += cc_copy->chunks[i].length;
+	}
+	/*
+	 * - Sum of Lengths in all chunks is greater than
+	 *   ServerSideCopyMaxDataSize
+	 */
+	if (total_len > COPYCHUNK_MAX_TOTAL_LEN) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	return NT_STATUS_OK;
+}
+
+struct fsctl_srv_copychunk_state {
+	struct tevent_context *ev;
+	struct connection_struct *conn;
+	struct srv_copychunk_copy cc_copy;
+	uint32_t current_chunk;
+	NTSTATUS status;
+	off_t total_written;
+	uint32_t ctl_code;
+	DATA_BLOB token;
+	struct files_struct *src_fsp;
+	struct files_struct *dst_fsp;
+	enum {
+		COPYCHUNK_OUT_EMPTY = 0,
+		COPYCHUNK_OUT_LIMITS,
+		COPYCHUNK_OUT_RSP,
+	} out_data;
+};
+static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq);
+
+static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req);
+
+static struct tevent_req *fsctl_srv_copychunk_send(TALLOC_CTX *mem_ctx,
+						   struct tevent_context *ev,
+						   uint32_t ctl_code,
+						   struct files_struct *dst_fsp,
+						   DATA_BLOB *in_input,
+						   size_t in_max_output,
+						   struct smbd_smb2_request *smb2req)
+{
+	struct tevent_req *req = NULL;
+	struct fsctl_srv_copychunk_state *state = NULL;
+	enum ndr_err_code ndr_ret;
+	NTSTATUS status;
+
+	/* handler for both copy-chunk variants */
+	SMB_ASSERT((ctl_code == FSCTL_SRV_COPYCHUNK)
+		|| (ctl_code == FSCTL_SRV_COPYCHUNK_WRITE));
+
+	req = tevent_req_create(mem_ctx, &state,
+				struct fsctl_srv_copychunk_state);
+	if (req == NULL) {
+		return NULL;
+	}
+	*state = (struct fsctl_srv_copychunk_state) {
+		.conn = dst_fsp->conn,
+		.ev = ev,
+		.ctl_code = ctl_code,
+		.dst_fsp = dst_fsp,
+	};
+
+	if (in_max_output < sizeof(struct srv_copychunk_rsp)) {
+		DEBUG(3, ("max output %d not large enough to hold copy chunk "
+			  "response %lu\n", (int)in_max_output,
+			  (unsigned long)sizeof(struct srv_copychunk_rsp)));
+		state->status = NT_STATUS_INVALID_PARAMETER;
+		tevent_req_nterror(req, state->status);
+		return tevent_req_post(req, ev);
+	}
+
+	ndr_ret = ndr_pull_struct_blob(in_input, mem_ctx, &state->cc_copy,
+			(ndr_pull_flags_fn_t)ndr_pull_srv_copychunk_copy);
+	if (ndr_ret != NDR_ERR_SUCCESS) {
+		DEBUG(0, ("failed to unmarshall copy chunk req\n"));
+		state->status = NT_STATUS_INVALID_PARAMETER;
+		tevent_req_nterror(req, state->status);
+		return tevent_req_post(req, ev);
+	}
+
+	state->token = data_blob_const(state->cc_copy.source_key,
+				       sizeof(state->cc_copy.source_key));
+
+	state->status = copychunk_check_limits(&state->cc_copy);
+	if (!NT_STATUS_IS_OK(state->status)) {
+		DEBUG(3, ("copy chunk req exceeds limits\n"));
+		state->out_data = COPYCHUNK_OUT_LIMITS;
+		tevent_req_nterror(req, state->status);
+		return tevent_req_post(req, ev);
+	}
+
+	/* any errors from here onwards should carry copychunk response data */
+	state->out_data = COPYCHUNK_OUT_RSP;
+
+	status = fsctl_srv_copychunk_loop(req);
+	if (tevent_req_nterror(req, status)) {
+		return tevent_req_post(req, ev);
+	}
+
+	return req;
+}
+
+static NTSTATUS fsctl_srv_copychunk_loop(struct tevent_req *req)
+{
+	struct fsctl_srv_copychunk_state *state = tevent_req_data(
+		req, struct fsctl_srv_copychunk_state);
+	struct tevent_req *subreq = NULL;
+	uint32_t length = 0;
+	off_t source_off = 0;
+	off_t target_off = 0;
+
+	/*
+	 * chunk_count can be 0 which must either just do nothing returning
+	 * success saying number of copied chunks is 0 (verified against
+	 * Windows).
+	 *
+	 * Or it can be a special macOS copyfile request, so we send this into
+	 * the VFS, vfs_fruit if loaded implements the macOS copyile semantics.
+	 */
+	if (state->cc_copy.chunk_count > 0) {
+		struct srv_copychunk *chunk = NULL;
+
+		chunk = &state->cc_copy.chunks[state->current_chunk];
+		length = chunk->length;
+		source_off = chunk->source_off;
+		target_off = chunk->target_off;
+	}
+
+	subreq = SMB_VFS_OFFLOAD_WRITE_SEND(state->dst_fsp->conn,
+					 state,
+					 state->ev,
+					 state->ctl_code,
+					 &state->token,
+					 source_off,
+					 state->dst_fsp,
+					 target_off,
+					 length);
+	if (tevent_req_nomem(subreq, req)) {
+		return NT_STATUS_NO_MEMORY;
+	}
+	tevent_req_set_callback(subreq,	fsctl_srv_copychunk_vfs_done, req);
+
+	return NT_STATUS_OK;
+}
+
+static void fsctl_srv_copychunk_vfs_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct fsctl_srv_copychunk_state *state = tevent_req_data(
+		req, struct fsctl_srv_copychunk_state);
+	off_t chunk_nwritten;
+	NTSTATUS status;
+
+	status = SMB_VFS_OFFLOAD_WRITE_RECV(state->conn, subreq,
+					 &chunk_nwritten);
+	TALLOC_FREE(subreq);
+	if (!NT_STATUS_IS_OK(status)) {
+		DBG_ERR("copy chunk failed [%s] chunk [%u] of [%u]\n",
+			nt_errstr(status),
+			(unsigned int)state->current_chunk,
+			(unsigned int)state->cc_copy.chunk_count);
+		tevent_req_nterror(req, status);
+		return;
+	}
+
+	DBG_DEBUG("good copy chunk [%u] of [%u]\n",
+		  (unsigned int)state->current_chunk,
+		  (unsigned int)state->cc_copy.chunk_count);
+	state->total_written += chunk_nwritten;
+
+	if (state->cc_copy.chunk_count == 0) {
+		/*
+		 * This must not produce an error but just return a chunk count
+		 * of 0 in the response.
+		 */
+		tevent_req_done(req);
+		return;
+	}
+
+	state->current_chunk++;
+	if (state->current_chunk == state->cc_copy.chunk_count) {
+		tevent_req_done(req);
+		return;
+	}
+
+	status = fsctl_srv_copychunk_loop(req);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
+}
+
+static NTSTATUS fsctl_srv_copychunk_recv(struct tevent_req *req,
+					 struct srv_copychunk_rsp *cc_rsp,
+					 bool *pack_rsp)
+{
+	struct fsctl_srv_copychunk_state *state = tevent_req_data(req,
+					struct fsctl_srv_copychunk_state);
+	NTSTATUS status;
+
+	switch (state->out_data) {
+	case COPYCHUNK_OUT_EMPTY:
+		*pack_rsp = false;
+		break;
+	case COPYCHUNK_OUT_LIMITS:
+		/* 2.2.32.1 - send back our maximum transfer size limits */
+		copychunk_pack_limits(cc_rsp);
+		*pack_rsp = true;
+		break;
+	case COPYCHUNK_OUT_RSP:
+		cc_rsp->chunks_written = state->current_chunk;
+		cc_rsp->chunk_bytes_written = 0;
+		cc_rsp->total_bytes_written = state->total_written;
+		*pack_rsp = true;
+		break;
+	default:	/* not reached */
+		assert(1);
+		break;
+	}
+	status = tevent_req_simple_recv_ntstatus(req);
+	return status;
+}
+
+struct cluster_movable_ips {
+	uint32_t array_len;
+	uint32_t array_index;
+	struct sockaddr_storage *ips;
+};
+
+static int stash_cluster_movable_ips(uint32_t total_ip_count,
+				     const struct sockaddr_storage *ip,
+				     bool is_movable_ip,
+				     void *private_data)
+{
+	struct cluster_movable_ips *cluster_movable_ips
+		= talloc_get_type_abort(private_data,
+					struct cluster_movable_ips);
+
+	if (!is_movable_ip) {
+		return 0;
+	}
+
+	if (cluster_movable_ips->array_len == 0) {
+		SMB_ASSERT(total_ip_count < INT_MAX);
+		cluster_movable_ips->ips
+			= talloc_zero_array(cluster_movable_ips,
+					    struct sockaddr_storage,
+					    total_ip_count);
+		if (cluster_movable_ips->ips == NULL) {
+			return ENOMEM;
+		}
+		cluster_movable_ips->array_len = total_ip_count;
+	}
+
+	SMB_ASSERT(cluster_movable_ips->array_index
+					< cluster_movable_ips->array_len);
+
+	cluster_movable_ips->ips[cluster_movable_ips->array_index] = *ip;
+	cluster_movable_ips->array_index++;
+
+	return 0;
+}
+
+static bool find_in_cluster_movable_ips(
+		struct cluster_movable_ips *cluster_movable_ips,
+		const struct sockaddr_storage *ifss)
+{
+	struct samba_sockaddr srv_ip = {
+		.u = {
+			.ss = *ifss,
+		},
+	};
+	uint32_t i;
+
+	for (i = 0; i < cluster_movable_ips->array_index; i++) {
+		struct samba_sockaddr pub_ip = {
+			.u = {
+				.ss = cluster_movable_ips->ips[i],
+			},
+		};
+		if (sockaddr_equal(&pub_ip.u.sa, &srv_ip.u.sa)) {
+			return true;
+		}
+	}
+	return false;
+}
+
+static NTSTATUS fsctl_network_iface_info(TALLOC_CTX *mem_ctx,
+					 struct tevent_context *ev,
+					 struct smbXsrv_connection *xconn,
+					 DATA_BLOB *in_input,
+					 uint32_t in_max_output,
+					 DATA_BLOB *out_output)
+{
+	struct samba_sockaddr xconn_srv_addr = { .sa_socklen = 0, };
+	struct fsctl_net_iface_info *array = NULL;
+	struct fsctl_net_iface_info *first = NULL;
+	struct fsctl_net_iface_info *last = NULL;
+	size_t i;
+	size_t num_ifaces;
+	enum ndr_err_code ndr_err;
+	struct cluster_movable_ips *cluster_movable_ips = NULL;
+	ssize_t sret;
+	int ret;
+
+	if (in_input->length != 0) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	/*
+	 * The list of probed interfaces might have changed, we might need to
+	 * refresh local_interfaces to get up-to-date network information, and
+	 * respond to clients which sent FSCTL_QUERY_NETWORK_INTERFACE_INFO.
+	 * For example, network speed is changed, interfaces count is changed
+	 * (some link down or link up), and etc.
+	 */
+	load_interfaces();
+	num_ifaces = iface_count();
+
+	*out_output = data_blob_null;
+
+	array = talloc_zero_array(mem_ctx,
+				  struct fsctl_net_iface_info,
+				  num_ifaces);
+	if (array == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	if (lp_clustering()) {
+		cluster_movable_ips = talloc_zero(array,
+						  struct cluster_movable_ips);
+		if (cluster_movable_ips == NULL) {
+			TALLOC_FREE(array);
+			return NT_STATUS_NO_MEMORY;
+		}
+		ret = ctdbd_public_ip_foreach(messaging_ctdb_connection(),
+					      stash_cluster_movable_ips,
+					      cluster_movable_ips);
+		if (ret != 0) {
+			TALLOC_FREE(array);
+			return NT_STATUS_INTERNAL_ERROR;
+		}
+	}
+
+	sret = tsocket_address_bsd_sockaddr(xconn->local_address,
+					    &xconn_srv_addr.u.sa,
+					    sizeof(xconn_srv_addr.u.ss));
+	if (sret < 0) {
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+	xconn_srv_addr.sa_socklen = sret;
+
+	for (i=0; i < num_ifaces; i++) {
+		struct fsctl_net_iface_info *cur = &array[i];
+		const struct interface *iface = get_interface(i);
+		const struct sockaddr_storage *ifss = &iface->ip;
+		const void *ifptr = ifss;
+		const struct sockaddr *ifsa = (const struct sockaddr *)ifptr;
+		struct tsocket_address *a = NULL;
+		char *addr;
+		bool ok;
+
+		ret = tsocket_address_bsd_from_sockaddr(array,
+					ifsa, sizeof(struct sockaddr_storage),
+					&a);
+		if (ret != 0) {
+			NTSTATUS status = map_nt_error_from_unix_common(errno);
+			TALLOC_FREE(array);
+			return status;
+		}
+
+		ok = tsocket_address_is_inet(a, "ip");
+		if (!ok) {
+			continue;
+		}
+
+		addr = tsocket_address_inet_addr_string(a, array);
+		if (addr == NULL) {
+			TALLOC_FREE(array);
+			return NT_STATUS_NO_MEMORY;
+		}
+
+		if (sockaddr_equal(ifsa, &xconn_srv_addr.u.sa)) {
+			/*
+			 * We can announce the ip of the current connection even
+			 * if it is a moveable cluster address... as the client
+			 * is already connected to it.
+			 *
+			 * It means in a typical ctdb cluster, where we
+			 * only have public addresses, the client can at least
+			 * have more than one multichannel'ed connection to the
+			 * public ip.
+			 */
+		} else if (cluster_movable_ips != NULL) {
+			bool is_movable_ip = find_in_cluster_movable_ips(
+						cluster_movable_ips,
+						ifss);
+			if (is_movable_ip) {
+				DBG_DEBUG("Interface [%s] - "
+					  "has movable public ip - "
+					  "skipping address [%s].\n",
+					  iface->name, addr);
+				continue;
+			}
+		}
+
+		cur->ifindex = iface->if_index;
+		if (cur->ifindex == 0) {
+			/*
+			 * Did not get interface index from kernel,
+			 * nor from the config. ==> Apply a common
+			 * default value for these cases.
+			 */
+			cur->ifindex = UINT32_MAX;
+		}
+		cur->capability = iface->capability;
+		cur->linkspeed = iface->linkspeed;
+		if (cur->linkspeed == 0) {
+			DBG_DEBUG("Link speed 0 on interface [%s] - skipping "
+				  "address [%s].\n", iface->name, addr);
+			continue;
+		}
+
+		ok = tsocket_address_is_inet(a, "ipv4");
+		if (ok) {
+			cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET;
+			cur->sockaddr.saddr.saddr_in.ipv4 = addr;
+		}
+		ok = tsocket_address_is_inet(a, "ipv6");
+		if (ok) {
+			cur->sockaddr.family = FSCTL_NET_IFACE_AF_INET6;
+			cur->sockaddr.saddr.saddr_in6.ipv6 = addr;
+		}
+
+		if (first == NULL) {
+			first = cur;
+		}
+		if (last != NULL) {
+			last->next = cur;
+		}
+		last = cur;
+	}
+
+	if (first == NULL) {
+		TALLOC_FREE(array);
+		return NT_STATUS_OK;
+	}
+
+	if (DEBUGLEVEL >= 10) {
+		NDR_PRINT_DEBUG(fsctl_net_iface_info, first);
+	}
+
+	ndr_err = ndr_push_struct_blob(out_output, mem_ctx, first,
+			(ndr_push_flags_fn_t)ndr_push_fsctl_net_iface_info);
+	TALLOC_FREE(array);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return ndr_map_error2ntstatus(ndr_err);
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS fsctl_validate_neg_info(TALLOC_CTX *mem_ctx,
+				        struct tevent_context *ev,
+				        struct smbXsrv_connection *conn,
+				        DATA_BLOB *in_input,
+				        uint32_t in_max_output,
+				        DATA_BLOB *out_output,
+					bool *disconnect)
+{
+	uint32_t in_capabilities;
+	DATA_BLOB in_guid_blob;
+	struct GUID in_guid;
+	uint16_t in_security_mode;
+	uint16_t in_num_dialects;
+	uint16_t dialect;
+	struct GUID_ndr_buf out_guid_buf = { .buf = {0}, };
+	NTSTATUS status;
+	enum protocol_types protocol = PROTOCOL_NONE;
+
+	if (lp_server_max_protocol() <= PROTOCOL_SMB2_02) {
+		/*
+		 * With SMB 2.02 we didn't get the
+		 * capabitities, client guid, security mode
+		 * and dialects the client would have offered.
+		 *
+		 * So we behave compatible with a true
+		 * SMB 2.02 server and return NT_STATUS_FILE_CLOSED.
+		 *
+		 * As SMB >= 2.10 offers the two phase SMB2 Negotiate
+		 * we keep supporting FSCTL_VALIDATE_NEGOTIATE_INFO
+		 * starting with SMB 2.10, while Windows only supports
+		 * it starting with SMB > 2.10.
+		 */
+		return NT_STATUS_FILE_CLOSED;
+	}
+
+	if (in_input->length < 0x18) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	in_capabilities = IVAL(in_input->data, 0x00);
+	in_guid_blob = data_blob_const(in_input->data + 0x04, 16);
+	in_security_mode = SVAL(in_input->data, 0x14);
+	in_num_dialects = SVAL(in_input->data, 0x16);
+
+	if (in_input->length < (0x18 + in_num_dialects*2)) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	if (in_max_output < 0x18) {
+		return NT_STATUS_BUFFER_TOO_SMALL;
+	}
+
+	status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	/*
+	 * From: [MS-SMB2]
+	 * 3.3.5.15.12 Handling a Validate Negotiate Info Request
+	 *
+	 * The server MUST determine the greatest common dialect
+	 * between the dialects it implements and the Dialects array
+	 * of the VALIDATE_NEGOTIATE_INFO request. If no dialect is
+	 * matched, or if the value is not equal to Connection.Dialect,
+	 * the server MUST terminate the transport connection
+	 * and free the Connection object.
+	 */
+	protocol = smbd_smb2_protocol_dialect_match(in_input->data + 0x18,
+						    in_num_dialects,
+						    &dialect);
+	if (conn->protocol != protocol) {
+		*disconnect = true;
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	if (!GUID_equal(&in_guid, &conn->smb2.client.guid)) {
+		*disconnect = true;
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	if (in_security_mode != conn->smb2.client.security_mode) {
+		*disconnect = true;
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	if (in_capabilities != conn->smb2.client.capabilities) {
+		*disconnect = true;
+		return NT_STATUS_ACCESS_DENIED;
+	}
+
+	status = GUID_to_ndr_buf(&conn->smb2.server.guid, &out_guid_buf);
+	if (!NT_STATUS_IS_OK(status)) {
+		return status;
+	}
+
+	*out_output = data_blob_talloc(mem_ctx, NULL, 0x18);
+	if (out_output->data == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	SIVAL(out_output->data, 0x00, conn->smb2.server.capabilities);
+	memcpy(out_output->data+0x04, out_guid_buf.buf, 16);
+	SSVAL(out_output->data, 0x14, conn->smb2.server.security_mode);
+	SSVAL(out_output->data, 0x16, conn->smb2.server.dialect);
+
+	return NT_STATUS_OK;
+}
+
+static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq);
+static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq);
+
+struct tevent_req *smb2_ioctl_network_fs(uint32_t ctl_code,
+					 struct tevent_context *ev,
+					 struct tevent_req *req,
+					 struct smbd_smb2_ioctl_state *state)
+{
+	struct tevent_req *subreq;
+	NTSTATUS status;
+
+	switch (ctl_code) {
+	/*
+	 * [MS-SMB2] 2.2.31
+	 * FSCTL_SRV_COPYCHUNK is issued when a handle has
+	 * FILE_READ_DATA and FILE_WRITE_DATA access to the file;
+	 * FSCTL_SRV_COPYCHUNK_WRITE is issued when a handle only has
+	 * FILE_WRITE_DATA access.
+	 */
+	case FSCTL_SRV_COPYCHUNK_WRITE:	/* FALL THROUGH */
+	case FSCTL_SRV_COPYCHUNK:
+		subreq = fsctl_srv_copychunk_send(state, ev,
+						  ctl_code,
+						  state->fsp,
+						  &state->in_input,
+						  state->in_max_output,
+						  state->smb2req);
+		if (tevent_req_nomem(subreq, req)) {
+			return tevent_req_post(req, ev);
+		}
+		tevent_req_set_callback(subreq,
+					smb2_ioctl_network_fs_copychunk_done,
+					req);
+		return req;
+		break;
+	case FSCTL_QUERY_NETWORK_INTERFACE_INFO:
+		if (!state->smbreq->xconn->client->server_multi_channel_enabled)
+		{
+			if (IS_IPC(state->smbreq->conn)) {
+				status = NT_STATUS_FS_DRIVER_REQUIRED;
+			} else {
+				status = NT_STATUS_INVALID_DEVICE_REQUEST;
+			}
+
+			tevent_req_nterror(req, status);
+			return tevent_req_post(req, ev);
+		}
+
+		status = fsctl_network_iface_info(state, ev,
+						  state->smbreq->xconn,
+						  &state->in_input,
+						  state->in_max_output,
+						  &state->out_output);
+		if (!tevent_req_nterror(req, status)) {
+			tevent_req_done(req);
+		}
+		return tevent_req_post(req, ev);
+		break;
+	case FSCTL_VALIDATE_NEGOTIATE_INFO:
+		status = fsctl_validate_neg_info(state, ev,
+						 state->smbreq->xconn,
+						 &state->in_input,
+						 state->in_max_output,
+						 &state->out_output,
+						 &state->disconnect);
+		if (!tevent_req_nterror(req, status)) {
+			tevent_req_done(req);
+		}
+		return tevent_req_post(req, ev);
+		break;
+	case FSCTL_SRV_REQUEST_RESUME_KEY:
+		subreq = SMB_VFS_OFFLOAD_READ_SEND(state,
+						   ev,
+						   state->fsp,
+						   FSCTL_SRV_REQUEST_RESUME_KEY,
+						   0, 0, 0);
+		if (tevent_req_nomem(subreq, req)) {
+			return tevent_req_post(req, ev);
+		}
+		tevent_req_set_callback(
+			subreq, smb2_ioctl_network_fs_offload_read_done, req);
+		return req;
+
+	default: {
+		uint8_t *out_data = NULL;
+		uint32_t out_data_len = 0;
+
+		if (state->fsp == NULL) {
+			status = NT_STATUS_NOT_SUPPORTED;
+		} else {
+			status = SMB_VFS_FSCTL(state->fsp,
+					       state,
+					       ctl_code,
+					       state->smbreq->flags2,
+					       state->in_input.data,
+					       state->in_input.length,
+					       &out_data,
+					       state->in_max_output,
+					       &out_data_len);
+			state->out_output = data_blob_const(out_data, out_data_len);
+			if (NT_STATUS_IS_OK(status)) {
+				tevent_req_done(req);
+				return tevent_req_post(req, ev);
+			}
+		}
+
+		if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
+			if (IS_IPC(state->smbreq->conn)) {
+				status = NT_STATUS_FS_DRIVER_REQUIRED;
+			} else {
+				status = NT_STATUS_INVALID_DEVICE_REQUEST;
+			}
+		}
+
+		tevent_req_nterror(req, status);
+		return tevent_req_post(req, ev);
+		break;
+	}
+	}
+
+	tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+	return tevent_req_post(req, ev);
+}
+
+static void smb2_ioctl_network_fs_copychunk_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(subreq,
+							  struct tevent_req);
+	struct smbd_smb2_ioctl_state *ioctl_state = tevent_req_data(req,
+						struct smbd_smb2_ioctl_state);
+	struct srv_copychunk_rsp cc_rsp;
+	NTSTATUS status;
+	bool pack_rsp = false;
+
+	ZERO_STRUCT(cc_rsp);
+	status = fsctl_srv_copychunk_recv(subreq, &cc_rsp, &pack_rsp);
+	TALLOC_FREE(subreq);
+	if (pack_rsp == true) {
+		enum ndr_err_code ndr_ret;
+		ndr_ret = ndr_push_struct_blob(&ioctl_state->out_output,
+					       ioctl_state,
+					       &cc_rsp,
+				(ndr_push_flags_fn_t)ndr_push_srv_copychunk_rsp);
+		if (ndr_ret != NDR_ERR_SUCCESS) {
+			status = NT_STATUS_INTERNAL_ERROR;
+		}
+	}
+
+	if (!tevent_req_nterror(req, status)) {
+		tevent_req_done(req);
+	}
+}
+
+static void smb2_ioctl_network_fs_offload_read_done(struct tevent_req *subreq)
+{
+	struct tevent_req *req = tevent_req_callback_data(
+		subreq, struct tevent_req);
+	struct smbd_smb2_ioctl_state *state = tevent_req_data(
+		req, struct smbd_smb2_ioctl_state);
+	struct req_resume_key_rsp rkey_rsp;
+	enum ndr_err_code ndr_ret;
+	uint32_t flags;
+	uint64_t xferlen;
+	DATA_BLOB token;
+	NTSTATUS status;
+
+	/*
+	 * Note that both flags and xferlen are not used with copy-chunk.
+	 */
+	status = SMB_VFS_OFFLOAD_READ_RECV(subreq,
+					   state->fsp->conn,
+					   state,
+					   &flags,
+					   &xferlen,
+					   &token);
+	TALLOC_FREE(subreq);
+	if (tevent_req_nterror(req, status)) {
+		return;
+	}
+
+	if (token.length != sizeof(rkey_rsp.resume_key)) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	ZERO_STRUCT(rkey_rsp);
+	memcpy(rkey_rsp.resume_key, token.data, token.length);
+
+	ndr_ret = ndr_push_struct_blob(&state->out_output, state, &rkey_rsp,
+			(ndr_push_flags_fn_t)ndr_push_req_resume_key_rsp);
+	if (ndr_ret != NDR_ERR_SUCCESS) {
+		tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
+		return;
+	}
+
+	tevent_req_done(req);
+	return;
+}