libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "../libcli/smb/smb_common.h"
  29 #include "../libcli/smb/smb_seal.h"
  30 #include "../libcli/smb/smb_signing.h"
  31 #include "../libcli/smb/read_smb.h"
  32 #include "smbXcli_base.h"
  33 #include "librpc/ndr/libndr.h"
  34
  35 struct smbXcli_conn;
  36 struct smbXcli_req;
  37 struct smbXcli_session;
  38
  39 struct smbXcli_conn {
  40         int read_fd;
  41         int write_fd;
  42         struct sockaddr_storage local_ss;
  43         struct sockaddr_storage remote_ss;
  44         const char *remote_name;
  45
  46         struct tevent_queue *outgoing;
  47         struct tevent_req **pending;
  48         struct tevent_req *read_smb_req;
  49
  50         enum protocol_types protocol;
  51         bool allow_signing;
  52         bool desire_signing;
  53         bool mandatory_signing;
  54
  55         /*
  56          * The incoming dispatch function should return:
  57          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  58          * - NT_STATUS_OK, if no more processing is desired, e.g.
  59          *                 the dispatch function called
  60          *                 tevent_req_done().
  61          * - All other return values disconnect the connection.
  62          */
  63         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  64                                       TALLOC_CTX *tmp_mem,
  65                                       uint8_t *inbuf);
  66
  67         struct {
  68                 struct {
  69                         uint32_t capabilities;
  70                         uint32_t max_xmit;
  71                 } client;
  72
  73                 struct {
  74                         uint32_t capabilities;
  75                         uint32_t max_xmit;
  76                         uint16_t max_mux;
  77                         uint16_t security_mode;
  78                         bool readbraw;
  79                         bool writebraw;
  80                         bool lockread;
  81                         bool writeunlock;
  82                         uint32_t session_key;
  83                         struct GUID guid;
  84                         DATA_BLOB gss_blob;
  85                         uint8_t challenge[8];
  86                         const char *workgroup;
  87                         const char *name;
  88                         int time_zone;
  89                         NTTIME system_time;
  90                 } server;
  91
  92                 uint32_t capabilities;
  93                 uint32_t max_xmit;
  94
  95                 uint16_t mid;
  96
  97                 struct smb_signing_state *signing;
  98                 struct smb_trans_enc_state *trans_enc;
  99
 100                 struct tevent_req *read_braw_req;
 101         } smb1;
 102
 103         struct {
 104                 struct {
 105                         uint32_t capabilities;
 106                         uint16_t security_mode;
 107                         struct GUID guid;
 108                 } client;
 109
 110                 struct {
 111                         uint32_t capabilities;
 112                         uint16_t security_mode;
 113                         struct GUID guid;
 114                         uint32_t max_trans_size;
 115                         uint32_t max_read_size;
 116                         uint32_t max_write_size;
 117                         NTTIME system_time;
 118                         NTTIME start_time;
 119                         DATA_BLOB gss_blob;
 120                 } server;
 121
 122                 uint64_t mid;
 123                 uint16_t cur_credits;
 124                 uint16_t max_credits;
 125         } smb2;
 126
 127         struct smbXcli_session *sessions;
 128 };
 129
 130 struct smbXcli_session {
 131         struct smbXcli_session *prev, *next;
 132         struct smbXcli_conn *conn;
 133
 134         struct {
 135                 uint64_t session_id;
 136                 uint16_t session_flags;
 137                 DATA_BLOB application_key;
 138                 DATA_BLOB signing_key;
 139                 bool should_sign;
 140                 bool should_encrypt;
 141                 DATA_BLOB encryption_key;
 142                 DATA_BLOB decryption_key;
 143                 uint64_t channel_nonce;
 144                 uint64_t channel_next;
 145                 DATA_BLOB channel_signing_key;
 146         } smb2;
 147 };
 148
 149 struct smbXcli_req_state {
 150         struct tevent_context *ev;
 151         struct smbXcli_conn *conn;
 152         struct smbXcli_session *session; /* maybe NULL */
 153
 154         uint8_t length_hdr[4];
 155
 156         bool one_way;
 157
 158         uint8_t *inbuf;
 159
 160         struct {
 161                 /* Space for the header including the wct */
 162                 uint8_t hdr[HDR_VWV];
 163
 164                 /*
 165                  * For normal requests, smb1cli_req_send chooses a mid.
 166                  * SecondaryV trans requests need to use the mid of the primary
 167                  * request, so we need a place to store it.
 168                  * Assume it is set if != 0.
 169                  */
 170                 uint16_t mid;
 171
 172                 uint16_t *vwv;
 173                 uint8_t bytecount_buf[2];
 174
 175 #define MAX_SMB_IOV 10
 176                 /* length_hdr, hdr, words, byte_count, buffers */
 177                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 178                 int iov_count;
 179
 180                 bool one_way_seqnum;
 181                 uint32_t seqnum;
 182                 struct tevent_req **chained_requests;
 183
 184                 uint8_t recv_cmd;
 185                 NTSTATUS recv_status;
 186                 /* always an array of 3 talloc elements */
 187                 struct iovec *recv_iov;
 188         } smb1;
 189
 190         struct {
 191                 const uint8_t *fixed;
 192                 uint16_t fixed_len;
 193                 const uint8_t *dyn;
 194                 uint32_t dyn_len;
 195
 196                 uint8_t transform[SMB2_TF_HDR_SIZE];
 197                 uint8_t hdr[SMB2_HDR_BODY];
 198                 uint8_t pad[7]; /* padding space for compounding */
 199
 200                 /*
 201                  * always an array of 3 talloc elements
 202                  * (without a SMB2_TRANSFORM header!)
 203                  *
 204                  * HDR, BODY, DYN
 205                  */
 206                 struct iovec *recv_iov;
 207
 208                 uint16_t credit_charge;
 209
 210                 bool should_sign;
 211                 bool should_encrypt;
 212
 213                 bool signing_skipped;
 214                 bool notify_async;
 215                 bool got_async;
 216         } smb2;
 217 };
 218
 219 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 220 {
 221         /*
 222          * NT_STATUS_OK, means we do not notify the callers
 223          */
 224         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 225
 226         while (conn->sessions) {
 227                 conn->sessions->conn = NULL;
 228                 DLIST_REMOVE(conn->sessions, conn->sessions);
 229         }
 230
 231         if (conn->smb1.trans_enc) {
 232                 TALLOC_FREE(conn->smb1.trans_enc);
 233         }
 234
 235         return 0;
 236 }
 237
 238 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 239                                          int fd,
 240                                          const char *remote_name,
 241                                          enum smb_signing_setting signing_state,
 242                                          uint32_t smb1_capabilities,
 243                                          struct GUID *client_guid,
 244                                          uint32_t smb2_capabilities)
 245 {
 246         struct smbXcli_conn *conn = NULL;
 247         void *ss = NULL;
 248         struct sockaddr *sa = NULL;
 249         socklen_t sa_length;
 250         int ret;
 251
 252         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 253         if (!conn) {
 254                 return NULL;
 255         }
 256
 257         conn->read_fd = fd;
 258         conn->write_fd = dup(fd);
 259         if (conn->write_fd == -1) {
 260                 goto error;
 261         }
 262
 263         conn->remote_name = talloc_strdup(conn, remote_name);
 264         if (conn->remote_name == NULL) {
 265                 goto error;
 266         }
 267
 268
 269         ss = (void *)&conn->local_ss;
 270         sa = (struct sockaddr *)ss;
 271         sa_length = sizeof(conn->local_ss);
 272         ret = getsockname(fd, sa, &sa_length);
 273         if (ret == -1) {
 274                 goto error;
 275         }
 276         ss = (void *)&conn->remote_ss;
 277         sa = (struct sockaddr *)ss;
 278         sa_length = sizeof(conn->remote_ss);
 279         ret = getpeername(fd, sa, &sa_length);
 280         if (ret == -1) {
 281                 goto error;
 282         }
 283
 284         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 285         if (conn->outgoing == NULL) {
 286                 goto error;
 287         }
 288         conn->pending = NULL;
 289
 290         conn->protocol = PROTOCOL_NONE;
 291
 292         switch (signing_state) {
 293         case SMB_SIGNING_OFF:
 294                 /* never */
 295                 conn->allow_signing = false;
 296                 conn->desire_signing = false;
 297                 conn->mandatory_signing = false;
 298                 break;
 299         case SMB_SIGNING_DEFAULT:
 300         case SMB_SIGNING_IF_REQUIRED:
 301                 /* if the server requires it */
 302                 conn->allow_signing = true;
 303                 conn->desire_signing = false;
 304                 conn->mandatory_signing = false;
 305                 break;
 306         case SMB_SIGNING_REQUIRED:
 307                 /* always */
 308                 conn->allow_signing = true;
 309                 conn->desire_signing = true;
 310                 conn->mandatory_signing = true;
 311                 break;
 312         }
 313
 314         conn->smb1.client.capabilities = smb1_capabilities;
 315         conn->smb1.client.max_xmit = UINT16_MAX;
 316
 317         conn->smb1.capabilities = conn->smb1.client.capabilities;
 318         conn->smb1.max_xmit = 1024;
 319
 320         conn->smb1.mid = 1;
 321
 322         /* initialise signing */
 323         conn->smb1.signing = smb_signing_init(conn,
 324                                               conn->allow_signing,
 325                                               conn->desire_signing,
 326                                               conn->mandatory_signing);
 327         if (!conn->smb1.signing) {
 328                 goto error;
 329         }
 330
 331         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 332         if (conn->mandatory_signing) {
 333                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 334         }
 335         if (client_guid) {
 336                 conn->smb2.client.guid = *client_guid;
 337         }
 338         conn->smb2.client.capabilities = smb2_capabilities;
 339
 340         conn->smb2.cur_credits = 1;
 341         conn->smb2.max_credits = 0;
 342
 343         talloc_set_destructor(conn, smbXcli_conn_destructor);
 344         return conn;
 345
 346  error:
 347         if (conn->write_fd != -1) {
 348                 close(conn->write_fd);
 349         }
 350         TALLOC_FREE(conn);
 351         return NULL;
 352 }
 353
 354 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 355 {
 356         if (conn == NULL) {
 357                 return false;
 358         }
 359
 360         if (conn->read_fd == -1) {
 361                 return false;
 362         }
 363
 364         return true;
 365 }
 366
 367 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 368 {
 369         return conn->protocol;
 370 }
 371
 372 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 373 {
 374         if (conn->protocol >= PROTOCOL_SMB2_02) {
 375                 return true;
 376         }
 377
 378         if (conn->smb1.capabilities & CAP_UNICODE) {
 379                 return true;
 380         }
 381
 382         return false;
 383 }
 384
 385 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 386 {
 387         set_socket_options(conn->read_fd, options);
 388 }
 389
 390 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 391 {
 392         return &conn->local_ss;
 393 }
 394
 395 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 396 {
 397         return &conn->remote_ss;
 398 }
 399
 400 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 401 {
 402         return conn->remote_name;
 403 }
 404
 405 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 406 {
 407         if (conn->protocol >= PROTOCOL_SMB2_02) {
 408                 /*
 409                  * TODO...
 410                  */
 411                 return 1;
 412         }
 413
 414         return conn->smb1.server.max_mux;
 415 }
 416
 417 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 418 {
 419         if (conn->protocol >= PROTOCOL_SMB2_02) {
 420                 return conn->smb2.server.system_time;
 421         }
 422
 423         return conn->smb1.server.system_time;
 424 }
 425
 426 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 427 {
 428         if (conn->protocol >= PROTOCOL_SMB2_02) {
 429                 return &conn->smb2.server.gss_blob;
 430         }
 431
 432         return &conn->smb1.server.gss_blob;
 433 }
 434
 435 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 436 {
 437         if (conn->protocol >= PROTOCOL_SMB2_02) {
 438                 return &conn->smb2.server.guid;
 439         }
 440
 441         return &conn->smb1.server.guid;
 442 }
 443
 444 struct smbXcli_conn_samba_suicide_state {
 445         struct smbXcli_conn *conn;
 446         struct iovec iov;
 447         uint8_t buf[9];
 448 };
 449
 450 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 451
 452 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 453                                                    struct tevent_context *ev,
 454                                                    struct smbXcli_conn *conn,
 455                                                    uint8_t exitcode)
 456 {
 457         struct tevent_req *req, *subreq;
 458         struct smbXcli_conn_samba_suicide_state *state;
 459
 460         req = tevent_req_create(mem_ctx, &state,
 461                                 struct smbXcli_conn_samba_suicide_state);
 462         if (req == NULL) {
 463                 return NULL;
 464         }
 465         state->conn = conn;
 466         SIVAL(state->buf, 4, 0x74697865);
 467         SCVAL(state->buf, 8, exitcode);
 468         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 469
 470         state->iov.iov_base = state->buf;
 471         state->iov.iov_len = sizeof(state->buf);
 472
 473         subreq = writev_send(state, ev, conn->outgoing, conn->write_fd,
 474                              false, &state->iov, 1);
 475         if (tevent_req_nomem(subreq, req)) {
 476                 return tevent_req_post(req, ev);
 477         }
 478         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 479         return req;
 480 }
 481
 482 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 483 {
 484         struct tevent_req *req = tevent_req_callback_data(
 485                 subreq, struct tevent_req);
 486         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 487                 req, struct smbXcli_conn_samba_suicide_state);
 488         ssize_t nwritten;
 489         int err;
 490
 491         nwritten = writev_recv(subreq, &err);
 492         TALLOC_FREE(subreq);
 493         if (nwritten == -1) {
 494                 NTSTATUS status = map_nt_error_from_unix_common(err);
 495                 smbXcli_conn_disconnect(state->conn, status);
 496                 return;
 497         }
 498         tevent_req_done(req);
 499 }
 500
 501 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 502 {
 503         return tevent_req_simple_recv_ntstatus(req);
 504 }
 505
 506 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 507                                     uint8_t exitcode)
 508 {
 509         TALLOC_CTX *frame = talloc_stackframe();
 510         struct tevent_context *ev;
 511         struct tevent_req *req;
 512         NTSTATUS status = NT_STATUS_NO_MEMORY;
 513         bool ok;
 514
 515         if (smbXcli_conn_has_async_calls(conn)) {
 516                 /*
 517                  * Can't use sync call while an async call is in flight
 518                  */
 519                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 520                 goto fail;
 521         }
 522         ev = tevent_context_init(frame);
 523         if (ev == NULL) {
 524                 goto fail;
 525         }
 526         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 527         if (req == NULL) {
 528                 goto fail;
 529         }
 530         ok = tevent_req_poll(req, ev);
 531         if (!ok) {
 532                 status = map_nt_error_from_unix_common(errno);
 533                 goto fail;
 534         }
 535         status = smbXcli_conn_samba_suicide_recv(req);
 536  fail:
 537         TALLOC_FREE(frame);
 538         return status;
 539 }
 540
 541 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 542 {
 543         return conn->smb1.capabilities;
 544 }
 545
 546 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 547 {
 548         return conn->smb1.max_xmit;
 549 }
 550
 551 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 552 {
 553         return conn->smb1.server.session_key;
 554 }
 555
 556 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 557 {
 558         return conn->smb1.server.challenge;
 559 }
 560
 561 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 562 {
 563         return conn->smb1.server.security_mode;
 564 }
 565
 566 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 567 {
 568         return conn->smb1.server.readbraw;
 569 }
 570
 571 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 572 {
 573         return conn->smb1.server.writebraw;
 574 }
 575
 576 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 577 {
 578         return conn->smb1.server.lockread;
 579 }
 580
 581 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 582 {
 583         return conn->smb1.server.writeunlock;
 584 }
 585
 586 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 587 {
 588         return conn->smb1.server.time_zone;
 589 }
 590
 591 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 592                                    const DATA_BLOB user_session_key,
 593                                    const DATA_BLOB response)
 594 {
 595         return smb_signing_activate(conn->smb1.signing,
 596                                     user_session_key,
 597                                     response);
 598 }
 599
 600 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 601                                 const uint8_t *buf, uint32_t seqnum)
 602 {
 603         return smb_signing_check_pdu(conn->smb1.signing, buf, seqnum);
 604 }
 605
 606 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 607 {
 608         return smb_signing_is_active(conn->smb1.signing);
 609 }
 610
 611 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 612                                  struct smb_trans_enc_state *es)
 613 {
 614         /* Replace the old state, if any. */
 615         if (conn->smb1.trans_enc) {
 616                 TALLOC_FREE(conn->smb1.trans_enc);
 617         }
 618         conn->smb1.trans_enc = es;
 619 }
 620
 621 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 622 {
 623         return common_encryption_on(conn->smb1.trans_enc);
 624 }
 625
 626
 627 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 628 {
 629         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 630         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 631
 632         if (NT_STATUS_IS_OK(status)) {
 633                 return NT_STATUS_OK;
 634         }
 635
 636         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 637                 return status;
 638         }
 639
 640         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 641 }
 642
 643 /**
 644  * Is the SMB command able to hold an AND_X successor
 645  * @param[in] cmd       The SMB command in question
 646  * @retval Can we add a chained request after "cmd"?
 647  */
 648 bool smb1cli_is_andx_req(uint8_t cmd)
 649 {
 650         switch (cmd) {
 651         case SMBtconX:
 652         case SMBlockingX:
 653         case SMBopenX:
 654         case SMBreadX:
 655         case SMBwriteX:
 656         case SMBsesssetupX:
 657         case SMBulogoffX:
 658         case SMBntcreateX:
 659                 return true;
 660                 break;
 661         default:
 662                 break;
 663         }
 664
 665         return false;
 666 }
 667
 668 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 669 {
 670         size_t num_pending = talloc_array_length(conn->pending);
 671         uint16_t result;
 672
 673         while (true) {
 674                 size_t i;
 675
 676                 result = conn->smb1.mid++;
 677                 if ((result == 0) || (result == 0xffff)) {
 678                         continue;
 679                 }
 680
 681                 for (i=0; i<num_pending; i++) {
 682                         if (result == smb1cli_req_mid(conn->pending[i])) {
 683                                 break;
 684                         }
 685                 }
 686
 687                 if (i == num_pending) {
 688                         return result;
 689                 }
 690         }
 691 }
 692
 693 void smbXcli_req_unset_pending(struct tevent_req *req)
 694 {
 695         struct smbXcli_req_state *state =
 696                 tevent_req_data(req,
 697                 struct smbXcli_req_state);
 698         struct smbXcli_conn *conn = state->conn;
 699         size_t num_pending = talloc_array_length(conn->pending);
 700         size_t i;
 701
 702         if (state->smb1.mid != 0) {
 703                 /*
 704                  * This is a [nt]trans[2] request which waits
 705                  * for more than one reply.
 706                  */
 707                 return;
 708         }
 709
 710         talloc_set_destructor(req, NULL);
 711
 712         if (num_pending == 1) {
 713                 /*
 714                  * The pending read_smb tevent_req is a child of
 715                  * conn->pending. So if nothing is pending anymore, we need to
 716                  * delete the socket read fde.
 717                  */
 718                 TALLOC_FREE(conn->pending);
 719                 conn->read_smb_req = NULL;
 720                 return;
 721         }
 722
 723         for (i=0; i<num_pending; i++) {
 724                 if (req == conn->pending[i]) {
 725                         break;
 726                 }
 727         }
 728         if (i == num_pending) {
 729                 /*
 730                  * Something's seriously broken. Just returning here is the
 731                  * right thing nevertheless, the point of this routine is to
 732                  * remove ourselves from conn->pending.
 733                  */
 734                 return;
 735         }
 736
 737         /*
 738          * Remove ourselves from the conn->pending array
 739          */
 740         for (; i < (num_pending - 1); i++) {
 741                 conn->pending[i] = conn->pending[i+1];
 742         }
 743
 744         /*
 745          * No NULL check here, we're shrinking by sizeof(void *), and
 746          * talloc_realloc just adjusts the size for this.
 747          */
 748         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
 749                                        num_pending - 1);
 750         return;
 751 }
 752
 753 static int smbXcli_req_destructor(struct tevent_req *req)
 754 {
 755         struct smbXcli_req_state *state =
 756                 tevent_req_data(req,
 757                 struct smbXcli_req_state);
 758
 759         /*
 760          * Make sure we really remove it from
 761          * the pending array on destruction.
 762          */
 763         state->smb1.mid = 0;
 764         smbXcli_req_unset_pending(req);
 765         return 0;
 766 }
 767
 768 static bool smb1cli_req_cancel(struct tevent_req *req);
 769 static bool smb2cli_req_cancel(struct tevent_req *req);
 770
 771 static bool smbXcli_req_cancel(struct tevent_req *req)
 772 {
 773         struct smbXcli_req_state *state =
 774                 tevent_req_data(req,
 775                 struct smbXcli_req_state);
 776
 777         if (!smbXcli_conn_is_connected(state->conn)) {
 778                 return false;
 779         }
 780
 781         if (state->conn->protocol == PROTOCOL_NONE) {
 782                 return false;
 783         }
 784
 785         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
 786                 return smb2cli_req_cancel(req);
 787         }
 788
 789         return smb1cli_req_cancel(req);
 790 }
 791
 792 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
 793
 794 bool smbXcli_req_set_pending(struct tevent_req *req)
 795 {
 796         struct smbXcli_req_state *state =
 797                 tevent_req_data(req,
 798                 struct smbXcli_req_state);
 799         struct smbXcli_conn *conn;
 800         struct tevent_req **pending;
 801         size_t num_pending;
 802
 803         conn = state->conn;
 804
 805         if (!smbXcli_conn_is_connected(conn)) {
 806                 return false;
 807         }
 808
 809         num_pending = talloc_array_length(conn->pending);
 810
 811         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
 812                                  num_pending+1);
 813         if (pending == NULL) {
 814                 return false;
 815         }
 816         pending[num_pending] = req;
 817         conn->pending = pending;
 818         talloc_set_destructor(req, smbXcli_req_destructor);
 819         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
 820
 821         if (!smbXcli_conn_receive_next(conn)) {
 822                 /*
 823                  * the caller should notify the current request
 824                  *
 825                  * And all other pending requests get notified
 826                  * by smbXcli_conn_disconnect().
 827                  */
 828                 smbXcli_req_unset_pending(req);
 829                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
 830                 return false;
 831         }
 832
 833         return true;
 834 }
 835
 836 static void smbXcli_conn_received(struct tevent_req *subreq);
 837
 838 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
 839 {
 840         size_t num_pending = talloc_array_length(conn->pending);
 841         struct tevent_req *req;
 842         struct smbXcli_req_state *state;
 843
 844         if (conn->read_smb_req != NULL) {
 845                 return true;
 846         }
 847
 848         if (num_pending == 0) {
 849                 if (conn->smb2.mid < UINT64_MAX) {
 850                         /* no more pending requests, so we are done for now */
 851                         return true;
 852                 }
 853
 854                 /*
 855                  * If there are no more SMB2 requests possible,
 856                  * because we are out of message ids,
 857                  * we need to disconnect.
 858                  */
 859                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
 860                 return true;
 861         }
 862
 863         req = conn->pending[0];
 864         state = tevent_req_data(req, struct smbXcli_req_state);
 865
 866         /*
 867          * We're the first ones, add the read_smb request that waits for the
 868          * answer from the server
 869          */
 870         conn->read_smb_req = read_smb_send(conn->pending,
 871                                            state->ev,
 872                                            conn->read_fd);
 873         if (conn->read_smb_req == NULL) {
 874                 return false;
 875         }
 876         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
 877         return true;
 878 }
 879
 880 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
 881 {
 882         tevent_queue_stop(conn->outgoing);
 883
 884         if (conn->read_fd != -1) {
 885                 close(conn->read_fd);
 886         }
 887         if (conn->write_fd != -1) {
 888                 close(conn->write_fd);
 889         }
 890         conn->read_fd = -1;
 891         conn->write_fd = -1;
 892
 893         /*
 894          * Cancel all pending requests. We do not do a for-loop walking
 895          * conn->pending because that array changes in
 896          * smbXcli_req_unset_pending.
 897          */
 898         while (talloc_array_length(conn->pending) > 0) {
 899                 struct tevent_req *req;
 900                 struct smbXcli_req_state *state;
 901                 struct tevent_req **chain;
 902                 size_t num_chained;
 903                 size_t i;
 904
 905                 req = conn->pending[0];
 906                 state = tevent_req_data(req, struct smbXcli_req_state);
 907
 908                 if (state->smb1.chained_requests == NULL) {
 909                         /*
 910                          * We're dead. No point waiting for trans2
 911                          * replies.
 912                          */
 913                         state->smb1.mid = 0;
 914
 915                         smbXcli_req_unset_pending(req);
 916
 917                         if (NT_STATUS_IS_OK(status)) {
 918                                 /* do not notify the callers */
 919                                 continue;
 920                         }
 921
 922                         /*
 923                          * we need to defer the callback, because we may notify
 924                          * more then one caller.
 925                          */
 926                         tevent_req_defer_callback(req, state->ev);
 927                         tevent_req_nterror(req, status);
 928                         continue;
 929                 }
 930
 931                 chain = talloc_move(conn, &state->smb1.chained_requests);
 932                 num_chained = talloc_array_length(chain);
 933
 934                 for (i=0; i<num_chained; i++) {
 935                         req = chain[i];
 936                         state = tevent_req_data(req, struct smbXcli_req_state);
 937
 938                         /*
 939                          * We're dead. No point waiting for trans2
 940                          * replies.
 941                          */
 942                         state->smb1.mid = 0;
 943
 944                         smbXcli_req_unset_pending(req);
 945
 946                         if (NT_STATUS_IS_OK(status)) {
 947                                 /* do not notify the callers */
 948                                 continue;
 949                         }
 950
 951                         /*
 952                          * we need to defer the callback, because we may notify
 953                          * more than one caller.
 954                          */
 955                         tevent_req_defer_callback(req, state->ev);
 956                         tevent_req_nterror(req, status);
 957                 }
 958                 TALLOC_FREE(chain);
 959         }
 960 }
 961
 962 /*
 963  * Fetch a smb request's mid. Only valid after the request has been sent by
 964  * smb1cli_req_send().
 965  */
 966 uint16_t smb1cli_req_mid(struct tevent_req *req)
 967 {
 968         struct smbXcli_req_state *state =
 969                 tevent_req_data(req,
 970                 struct smbXcli_req_state);
 971
 972         if (state->smb1.mid != 0) {
 973                 return state->smb1.mid;
 974         }
 975
 976         return SVAL(state->smb1.hdr, HDR_MID);
 977 }
 978
 979 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
 980 {
 981         struct smbXcli_req_state *state =
 982                 tevent_req_data(req,
 983                 struct smbXcli_req_state);
 984
 985         state->smb1.mid = mid;
 986 }
 987
 988 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
 989 {
 990         struct smbXcli_req_state *state =
 991                 tevent_req_data(req,
 992                 struct smbXcli_req_state);
 993
 994         return state->smb1.seqnum;
 995 }
 996
 997 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
 998 {
 999         struct smbXcli_req_state *state =
1000                 tevent_req_data(req,
1001                 struct smbXcli_req_state);
1002
1003         state->smb1.seqnum = seqnum;
1004 }
1005
1006 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1007 {
1008         size_t result = 0;
1009         int i;
1010         for (i=0; i<count; i++) {
1011                 result += iov[i].iov_len;
1012         }
1013         return result;
1014 }
1015
1016 static uint8_t *smbXcli_iov_concat(TALLOC_CTX *mem_ctx,
1017                                    const struct iovec *iov,
1018                                    int count)
1019 {
1020         size_t len = smbXcli_iov_len(iov, count);
1021         size_t copied;
1022         uint8_t *buf;
1023         int i;
1024
1025         buf = talloc_array(mem_ctx, uint8_t, len);
1026         if (buf == NULL) {
1027                 return NULL;
1028         }
1029         copied = 0;
1030         for (i=0; i<count; i++) {
1031                 memcpy(buf+copied, iov[i].iov_base, iov[i].iov_len);
1032                 copied += iov[i].iov_len;
1033         }
1034         return buf;
1035 }
1036
1037 static void smb1cli_req_flags(enum protocol_types protocol,
1038                               uint32_t smb1_capabilities,
1039                               uint8_t smb_command,
1040                               uint8_t additional_flags,
1041                               uint8_t clear_flags,
1042                               uint8_t *_flags,
1043                               uint16_t additional_flags2,
1044                               uint16_t clear_flags2,
1045                               uint16_t *_flags2)
1046 {
1047         uint8_t flags = 0;
1048         uint16_t flags2 = 0;
1049
1050         if (protocol >= PROTOCOL_LANMAN1) {
1051                 flags |= FLAG_CASELESS_PATHNAMES;
1052                 flags |= FLAG_CANONICAL_PATHNAMES;
1053         }
1054
1055         if (protocol >= PROTOCOL_LANMAN2) {
1056                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1057                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1058         }
1059
1060         if (protocol >= PROTOCOL_NT1) {
1061                 flags2 |= FLAGS2_IS_LONG_NAME;
1062
1063                 if (smb1_capabilities & CAP_UNICODE) {
1064                         flags2 |= FLAGS2_UNICODE_STRINGS;
1065                 }
1066                 if (smb1_capabilities & CAP_STATUS32) {
1067                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1068                 }
1069                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1070                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1071                 }
1072         }
1073
1074         flags |= additional_flags;
1075         flags &= ~clear_flags;
1076         flags2 |= additional_flags2;
1077         flags2 &= ~clear_flags2;
1078
1079         *_flags = flags;
1080         *_flags2 = flags2;
1081 }
1082
1083 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1084
1085 static bool smb1cli_req_cancel(struct tevent_req *req)
1086 {
1087         struct smbXcli_req_state *state =
1088                 tevent_req_data(req,
1089                 struct smbXcli_req_state);
1090         uint8_t flags;
1091         uint16_t flags2;
1092         uint32_t pid;
1093         uint16_t tid;
1094         uint16_t uid;
1095         uint16_t mid;
1096         struct tevent_req *subreq;
1097         NTSTATUS status;
1098
1099         flags = CVAL(state->smb1.hdr, HDR_FLG);
1100         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1101         pid  = SVAL(state->smb1.hdr, HDR_PID);
1102         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1103         tid = SVAL(state->smb1.hdr, HDR_TID);
1104         uid = SVAL(state->smb1.hdr, HDR_UID);
1105         mid = SVAL(state->smb1.hdr, HDR_MID);
1106
1107         subreq = smb1cli_req_create(state, state->ev,
1108                                     state->conn,
1109                                     SMBntcancel,
1110                                     flags, 0,
1111                                     flags2, 0,
1112                                     0, /* timeout */
1113                                     pid, tid, uid,
1114                                     0, NULL, /* vwv */
1115                                     0, NULL); /* bytes */
1116         if (subreq == NULL) {
1117                 return false;
1118         }
1119         smb1cli_req_set_mid(subreq, mid);
1120
1121         status = smb1cli_req_chain_submit(&subreq, 1);
1122         if (!NT_STATUS_IS_OK(status)) {
1123                 TALLOC_FREE(subreq);
1124                 return false;
1125         }
1126         smb1cli_req_set_mid(subreq, 0);
1127
1128         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1129
1130         return true;
1131 }
1132
1133 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1134 {
1135         /* we do not care about the result */
1136         TALLOC_FREE(subreq);
1137 }
1138
1139 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1140                                       struct tevent_context *ev,
1141                                       struct smbXcli_conn *conn,
1142                                       uint8_t smb_command,
1143                                       uint8_t additional_flags,
1144                                       uint8_t clear_flags,
1145                                       uint16_t additional_flags2,
1146                                       uint16_t clear_flags2,
1147                                       uint32_t timeout_msec,
1148                                       uint32_t pid,
1149                                       uint16_t tid,
1150                                       uint16_t uid,
1151                                       uint8_t wct, uint16_t *vwv,
1152                                       int iov_count,
1153                                       struct iovec *bytes_iov)
1154 {
1155         struct tevent_req *req;
1156         struct smbXcli_req_state *state;
1157         uint8_t flags = 0;
1158         uint16_t flags2 = 0;
1159
1160         if (iov_count > MAX_SMB_IOV) {
1161                 /*
1162                  * Should not happen :-)
1163                  */
1164                 return NULL;
1165         }
1166
1167         req = tevent_req_create(mem_ctx, &state,
1168                                 struct smbXcli_req_state);
1169         if (req == NULL) {
1170                 return NULL;
1171         }
1172         state->ev = ev;
1173         state->conn = conn;
1174
1175         state->smb1.recv_cmd = 0xFF;
1176         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1177         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1178         if (state->smb1.recv_iov == NULL) {
1179                 TALLOC_FREE(req);
1180                 return NULL;
1181         }
1182
1183         smb1cli_req_flags(conn->protocol,
1184                           conn->smb1.capabilities,
1185                           smb_command,
1186                           additional_flags,
1187                           clear_flags,
1188                           &flags,
1189                           additional_flags2,
1190                           clear_flags2,
1191                           &flags2);
1192
1193         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1194         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1195         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1196         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1197         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1198         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1199         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1200         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1201         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1202         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1203         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1204
1205         state->smb1.vwv = vwv;
1206
1207         SSVAL(state->smb1.bytecount_buf, 0, smbXcli_iov_len(bytes_iov, iov_count));
1208
1209         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1210         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1211         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1212         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1213         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1214         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1215         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1216         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1217
1218         if (iov_count != 0) {
1219                 memcpy(&state->smb1.iov[4], bytes_iov,
1220                        iov_count * sizeof(*bytes_iov));
1221         }
1222         state->smb1.iov_count = iov_count + 4;
1223
1224         if (timeout_msec > 0) {
1225                 struct timeval endtime;
1226
1227                 endtime = timeval_current_ofs_msec(timeout_msec);
1228                 if (!tevent_req_set_endtime(req, ev, endtime)) {
1229                         return req;
1230                 }
1231         }
1232
1233         switch (smb_command) {
1234         case SMBtranss:
1235         case SMBtranss2:
1236         case SMBnttranss:
1237                 state->one_way = true;
1238                 break;
1239         case SMBntcancel:
1240                 state->one_way = true;
1241                 state->smb1.one_way_seqnum = true;
1242                 break;
1243         case SMBlockingX:
1244                 if ((wct == 8) &&
1245                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1246                         state->one_way = true;
1247                 }
1248                 break;
1249         }
1250
1251         return req;
1252 }
1253
1254 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1255                                    struct iovec *iov, int iov_count,
1256                                    uint32_t *seqnum,
1257                                    bool one_way_seqnum)
1258 {
1259         TALLOC_CTX *frame = NULL;
1260         uint8_t *buf;
1261
1262         /*
1263          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1264          * iovec directly. MD5Update would do that just fine.
1265          */
1266
1267         if (iov_count < 4) {
1268                 return NT_STATUS_INVALID_PARAMETER_MIX;
1269         }
1270         if (iov[0].iov_len != NBT_HDR_SIZE) {
1271                 return NT_STATUS_INVALID_PARAMETER_MIX;
1272         }
1273         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1274                 return NT_STATUS_INVALID_PARAMETER_MIX;
1275         }
1276         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1277                 return NT_STATUS_INVALID_PARAMETER_MIX;
1278         }
1279         if (iov[3].iov_len != sizeof(uint16_t)) {
1280                 return NT_STATUS_INVALID_PARAMETER_MIX;
1281         }
1282
1283         frame = talloc_stackframe();
1284
1285         buf = smbXcli_iov_concat(frame, iov, iov_count);
1286         if (buf == NULL) {
1287                 return NT_STATUS_NO_MEMORY;
1288         }
1289
1290         *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1291                                           one_way_seqnum);
1292         smb_signing_sign_pdu(conn->smb1.signing, buf, *seqnum);
1293         memcpy(iov[1].iov_base, buf+4, iov[1].iov_len);
1294
1295         TALLOC_FREE(frame);
1296         return NT_STATUS_OK;
1297 }
1298
1299 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1300 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1301                                                TALLOC_CTX *tmp_mem,
1302                                                uint8_t *inbuf);
1303
1304 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1305                                           struct smbXcli_req_state *state,
1306                                           struct iovec *iov, int iov_count)
1307 {
1308         struct tevent_req *subreq;
1309         NTSTATUS status;
1310         uint8_t cmd;
1311         uint16_t mid;
1312
1313         if (!smbXcli_conn_is_connected(state->conn)) {
1314                 return NT_STATUS_CONNECTION_DISCONNECTED;
1315         }
1316
1317         if (state->conn->protocol > PROTOCOL_NT1) {
1318                 return NT_STATUS_REVISION_MISMATCH;
1319         }
1320
1321         if (iov_count < 4) {
1322                 return NT_STATUS_INVALID_PARAMETER_MIX;
1323         }
1324         if (iov[0].iov_len != NBT_HDR_SIZE) {
1325                 return NT_STATUS_INVALID_PARAMETER_MIX;
1326         }
1327         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1328                 return NT_STATUS_INVALID_PARAMETER_MIX;
1329         }
1330         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1331                 return NT_STATUS_INVALID_PARAMETER_MIX;
1332         }
1333         if (iov[3].iov_len != sizeof(uint16_t)) {
1334                 return NT_STATUS_INVALID_PARAMETER_MIX;
1335         }
1336
1337         cmd = CVAL(iov[1].iov_base, HDR_COM);
1338         if (cmd == SMBreadBraw) {
1339                 if (smbXcli_conn_has_async_calls(state->conn)) {
1340                         return NT_STATUS_INVALID_PARAMETER_MIX;
1341                 }
1342                 state->conn->smb1.read_braw_req = req;
1343         }
1344
1345         if (state->smb1.mid != 0) {
1346                 mid = state->smb1.mid;
1347         } else {
1348                 mid = smb1cli_alloc_mid(state->conn);
1349         }
1350         SSVAL(iov[1].iov_base, HDR_MID, mid);
1351
1352         _smb_setlen_nbt(iov[0].iov_base, smbXcli_iov_len(&iov[1], iov_count-1));
1353
1354         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1355                                     &state->smb1.seqnum,
1356                                     state->smb1.one_way_seqnum);
1357
1358         if (!NT_STATUS_IS_OK(status)) {
1359                 return status;
1360         }
1361
1362         /*
1363          * If we supported multiple encrytion contexts
1364          * here we'd look up based on tid.
1365          */
1366         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1367                 char *buf, *enc_buf;
1368
1369                 buf = (char *)smbXcli_iov_concat(talloc_tos(), iov, iov_count);
1370                 if (buf == NULL) {
1371                         return NT_STATUS_NO_MEMORY;
1372                 }
1373                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1374                                                (char *)buf, &enc_buf);
1375                 TALLOC_FREE(buf);
1376                 if (!NT_STATUS_IS_OK(status)) {
1377                         DEBUG(0, ("Error in encrypting client message: %s\n",
1378                                   nt_errstr(status)));
1379                         return status;
1380                 }
1381                 buf = (char *)talloc_memdup(state, enc_buf,
1382                                             smb_len_nbt(enc_buf)+4);
1383                 SAFE_FREE(enc_buf);
1384                 if (buf == NULL) {
1385                         return NT_STATUS_NO_MEMORY;
1386                 }
1387                 iov[0].iov_base = (void *)buf;
1388                 iov[0].iov_len = talloc_get_size(buf);
1389                 iov_count = 1;
1390         }
1391
1392         if (state->conn->dispatch_incoming == NULL) {
1393                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1394         }
1395
1396         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1397
1398         subreq = writev_send(state, state->ev, state->conn->outgoing,
1399                              state->conn->write_fd, false, iov, iov_count);
1400         if (subreq == NULL) {
1401                 return NT_STATUS_NO_MEMORY;
1402         }
1403         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1404         return NT_STATUS_OK;
1405 }
1406
1407 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1408                                     struct tevent_context *ev,
1409                                     struct smbXcli_conn *conn,
1410                                     uint8_t smb_command,
1411                                     uint8_t additional_flags,
1412                                     uint8_t clear_flags,
1413                                     uint16_t additional_flags2,
1414                                     uint16_t clear_flags2,
1415                                     uint32_t timeout_msec,
1416                                     uint32_t pid,
1417                                     uint16_t tid,
1418                                     uint16_t uid,
1419                                     uint8_t wct, uint16_t *vwv,
1420                                     uint32_t num_bytes,
1421                                     const uint8_t *bytes)
1422 {
1423         struct tevent_req *req;
1424         struct iovec iov;
1425         NTSTATUS status;
1426
1427         iov.iov_base = discard_const_p(void, bytes);
1428         iov.iov_len = num_bytes;
1429
1430         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1431                                  additional_flags, clear_flags,
1432                                  additional_flags2, clear_flags2,
1433                                  timeout_msec,
1434                                  pid, tid, uid,
1435                                  wct, vwv, 1, &iov);
1436         if (req == NULL) {
1437                 return NULL;
1438         }
1439         if (!tevent_req_is_in_progress(req)) {
1440                 return tevent_req_post(req, ev);
1441         }
1442         status = smb1cli_req_chain_submit(&req, 1);
1443         if (tevent_req_nterror(req, status)) {
1444                 return tevent_req_post(req, ev);
1445         }
1446         return req;
1447 }
1448
1449 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1450 {
1451         struct tevent_req *req =
1452                 tevent_req_callback_data(subreq,
1453                 struct tevent_req);
1454         struct smbXcli_req_state *state =
1455                 tevent_req_data(req,
1456                 struct smbXcli_req_state);
1457         ssize_t nwritten;
1458         int err;
1459
1460         nwritten = writev_recv(subreq, &err);
1461         TALLOC_FREE(subreq);
1462         if (nwritten == -1) {
1463                 NTSTATUS status = map_nt_error_from_unix_common(err);
1464                 smbXcli_conn_disconnect(state->conn, status);
1465                 return;
1466         }
1467
1468         if (state->one_way) {
1469                 state->inbuf = NULL;
1470                 tevent_req_done(req);
1471                 return;
1472         }
1473
1474         if (!smbXcli_req_set_pending(req)) {
1475                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1476                 return;
1477         }
1478 }
1479
1480 static void smbXcli_conn_received(struct tevent_req *subreq)
1481 {
1482         struct smbXcli_conn *conn =
1483                 tevent_req_callback_data(subreq,
1484                 struct smbXcli_conn);
1485         TALLOC_CTX *frame = talloc_stackframe();
1486         NTSTATUS status;
1487         uint8_t *inbuf;
1488         ssize_t received;
1489         int err;
1490
1491         if (subreq != conn->read_smb_req) {
1492                 DEBUG(1, ("Internal error: cli_smb_received called with "
1493                           "unexpected subreq\n"));
1494                 status = NT_STATUS_INTERNAL_ERROR;
1495                 smbXcli_conn_disconnect(conn, status);
1496                 TALLOC_FREE(frame);
1497                 return;
1498         }
1499         conn->read_smb_req = NULL;
1500
1501         received = read_smb_recv(subreq, frame, &inbuf, &err);
1502         TALLOC_FREE(subreq);
1503         if (received == -1) {
1504                 status = map_nt_error_from_unix_common(err);
1505                 smbXcli_conn_disconnect(conn, status);
1506                 TALLOC_FREE(frame);
1507                 return;
1508         }
1509
1510         status = conn->dispatch_incoming(conn, frame, inbuf);
1511         TALLOC_FREE(frame);
1512         if (NT_STATUS_IS_OK(status)) {
1513                 /*
1514                  * We should not do any more processing
1515                  * as the dispatch function called
1516                  * tevent_req_done().
1517                  */
1518                 return;
1519         } else if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1520                 /*
1521                  * We got an error, so notify all pending requests
1522                  */
1523                 smbXcli_conn_disconnect(conn, status);
1524                 return;
1525         }
1526
1527         /*
1528          * We got NT_STATUS_RETRY, so we may ask for a
1529          * next incoming pdu.
1530          */
1531         if (!smbXcli_conn_receive_next(conn)) {
1532                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1533         }
1534 }
1535
1536 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1537                                           struct iovec **piov, int *pnum_iov)
1538 {
1539         struct iovec *iov;
1540         int num_iov;
1541         size_t buflen;
1542         size_t taken;
1543         size_t remaining;
1544         uint8_t *hdr;
1545         uint8_t cmd;
1546         uint32_t wct_ofs;
1547
1548         buflen = smb_len_nbt(buf);
1549         taken = 0;
1550
1551         hdr = buf + NBT_HDR_SIZE;
1552
1553         if (buflen < MIN_SMB_SIZE) {
1554                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1555         }
1556
1557         /*
1558          * This returns iovec elements in the following order:
1559          *
1560          * - SMB header
1561          *
1562          * - Parameter Block
1563          * - Data Block
1564          *
1565          * - Parameter Block
1566          * - Data Block
1567          *
1568          * - Parameter Block
1569          * - Data Block
1570          */
1571         num_iov = 1;
1572
1573         iov = talloc_array(mem_ctx, struct iovec, num_iov);
1574         if (iov == NULL) {
1575                 return NT_STATUS_NO_MEMORY;
1576         }
1577         iov[0].iov_base = hdr;
1578         iov[0].iov_len = HDR_WCT;
1579         taken += HDR_WCT;
1580
1581         cmd = CVAL(hdr, HDR_COM);
1582         wct_ofs = HDR_WCT;
1583
1584         while (true) {
1585                 size_t len = buflen - taken;
1586                 struct iovec *cur;
1587                 struct iovec *iov_tmp;
1588                 uint8_t wct;
1589                 uint32_t bcc_ofs;
1590                 uint16_t bcc;
1591                 size_t needed;
1592
1593                 /*
1594                  * we need at least WCT and BCC
1595                  */
1596                 needed = sizeof(uint8_t) + sizeof(uint16_t);
1597                 if (len < needed) {
1598                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1599                                    __location__, (int)len, (int)needed));
1600                         goto inval;
1601                 }
1602
1603                 /*
1604                  * Now we check if the specified words are there
1605                  */
1606                 wct = CVAL(hdr, wct_ofs);
1607                 needed += wct * sizeof(uint16_t);
1608                 if (len < needed) {
1609                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1610                                    __location__, (int)len, (int)needed));
1611                         goto inval;
1612                 }
1613
1614                 /*
1615                  * Now we check if the specified bytes are there
1616                  */
1617                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
1618                 bcc = SVAL(hdr, bcc_ofs);
1619                 needed += bcc * sizeof(uint8_t);
1620                 if (len < needed) {
1621                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1622                                    __location__, (int)len, (int)needed));
1623                         goto inval;
1624                 }
1625
1626                 /*
1627                  * we allocate 2 iovec structures for words and bytes
1628                  */
1629                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
1630                                          num_iov + 2);
1631                 if (iov_tmp == NULL) {
1632                         TALLOC_FREE(iov);
1633                         return NT_STATUS_NO_MEMORY;
1634                 }
1635                 iov = iov_tmp;
1636                 cur = &iov[num_iov];
1637                 num_iov += 2;
1638
1639                 cur[0].iov_len = wct * sizeof(uint16_t);
1640                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
1641                 cur[1].iov_len = bcc * sizeof(uint8_t);
1642                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
1643
1644                 taken += needed;
1645
1646                 if (!smb1cli_is_andx_req(cmd)) {
1647                         /*
1648                          * If the current command does not have AndX chanining
1649                          * we are done.
1650                          */
1651                         break;
1652                 }
1653
1654                 if (wct == 0 && bcc == 0) {
1655                         /*
1656                          * An empty response also ends the chain,
1657                          * most likely with an error.
1658                          */
1659                         break;
1660                 }
1661
1662                 if (wct < 2) {
1663                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
1664                                    __location__, (int)wct, (int)cmd));
1665                         goto inval;
1666                 }
1667                 cmd = CVAL(cur[0].iov_base, 0);
1668                 if (cmd == 0xFF) {
1669                         /*
1670                          * If it is the end of the chain we are also done.
1671                          */
1672                         break;
1673                 }
1674                 wct_ofs = SVAL(cur[0].iov_base, 2);
1675
1676                 if (wct_ofs < taken) {
1677                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1678                 }
1679                 if (wct_ofs > buflen) {
1680                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1681                 }
1682
1683                 /*
1684                  * we consumed everything up to the start of the next
1685                  * parameter block.
1686                  */
1687                 taken = wct_ofs;
1688         }
1689
1690         remaining = buflen - taken;
1691
1692         if (remaining > 0 && num_iov >= 3) {
1693                 /*
1694                  * The last DATA block gets the remaining
1695                  * bytes, this is needed to support
1696                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
1697                  */
1698                 iov[num_iov-1].iov_len += remaining;
1699         }
1700
1701         *piov = iov;
1702         *pnum_iov = num_iov;
1703         return NT_STATUS_OK;
1704
1705 inval:
1706         TALLOC_FREE(iov);
1707         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1708 }
1709
1710 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1711                                                TALLOC_CTX *tmp_mem,
1712                                                uint8_t *inbuf)
1713 {
1714         struct tevent_req *req;
1715         struct smbXcli_req_state *state;
1716         NTSTATUS status;
1717         size_t num_pending;
1718         size_t i;
1719         uint8_t cmd;
1720         uint16_t mid;
1721         bool oplock_break;
1722         const uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
1723         struct iovec *iov = NULL;
1724         int num_iov = 0;
1725         struct tevent_req **chain = NULL;
1726         size_t num_chained = 0;
1727         size_t num_responses = 0;
1728
1729         if (conn->smb1.read_braw_req != NULL) {
1730                 req = conn->smb1.read_braw_req;
1731                 conn->smb1.read_braw_req = NULL;
1732                 state = tevent_req_data(req, struct smbXcli_req_state);
1733
1734                 smbXcli_req_unset_pending(req);
1735
1736                 if (state->smb1.recv_iov == NULL) {
1737                         /*
1738                          * For requests with more than
1739                          * one response, we have to readd the
1740                          * recv_iov array.
1741                          */
1742                         state->smb1.recv_iov = talloc_zero_array(state,
1743                                                                  struct iovec,
1744                                                                  3);
1745                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
1746                                 return NT_STATUS_OK;
1747                         }
1748                 }
1749
1750                 state->smb1.recv_iov[0].iov_base = (void *)(inbuf + NBT_HDR_SIZE);
1751                 state->smb1.recv_iov[0].iov_len = smb_len_nbt(inbuf);
1752                 ZERO_STRUCT(state->smb1.recv_iov[1]);
1753                 ZERO_STRUCT(state->smb1.recv_iov[2]);
1754
1755                 state->smb1.recv_cmd = SMBreadBraw;
1756                 state->smb1.recv_status = NT_STATUS_OK;
1757                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
1758
1759                 tevent_req_done(req);
1760                 return NT_STATUS_OK;
1761         }
1762
1763         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
1764             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
1765                 DEBUG(10, ("Got non-SMB PDU\n"));
1766                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1767         }
1768
1769         /*
1770          * If we supported multiple encrytion contexts
1771          * here we'd look up based on tid.
1772          */
1773         if (common_encryption_on(conn->smb1.trans_enc)
1774             && (CVAL(inbuf, 0) == 0)) {
1775                 uint16_t enc_ctx_num;
1776
1777                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
1778                 if (!NT_STATUS_IS_OK(status)) {
1779                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
1780                                    nt_errstr(status)));
1781                         return status;
1782                 }
1783
1784                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
1785                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
1786                                    enc_ctx_num,
1787                                    conn->smb1.trans_enc->enc_ctx_num));
1788                         return NT_STATUS_INVALID_HANDLE;
1789                 }
1790
1791                 status = common_decrypt_buffer(conn->smb1.trans_enc,
1792                                                (char *)inbuf);
1793                 if (!NT_STATUS_IS_OK(status)) {
1794                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
1795                                    nt_errstr(status)));
1796                         return status;
1797                 }
1798         }
1799
1800         mid = SVAL(inhdr, HDR_MID);
1801         num_pending = talloc_array_length(conn->pending);
1802
1803         for (i=0; i<num_pending; i++) {
1804                 if (mid == smb1cli_req_mid(conn->pending[i])) {
1805                         break;
1806                 }
1807         }
1808         if (i == num_pending) {
1809                 /* Dump unexpected reply */
1810                 return NT_STATUS_RETRY;
1811         }
1812
1813         oplock_break = false;
1814
1815         if (mid == 0xffff) {
1816                 /*
1817                  * Paranoia checks that this is really an oplock break request.
1818                  */
1819                 oplock_break = (smb_len_nbt(inbuf) == 51); /* hdr + 8 words */
1820                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
1821                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
1822                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
1823                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
1824
1825                 if (!oplock_break) {
1826                         /* Dump unexpected reply */
1827                         return NT_STATUS_RETRY;
1828                 }
1829         }
1830
1831         req = conn->pending[i];
1832         state = tevent_req_data(req, struct smbXcli_req_state);
1833
1834         if (!oplock_break /* oplock breaks are not signed */
1835             && !smb_signing_check_pdu(conn->smb1.signing,
1836                                       inbuf, state->smb1.seqnum+1)) {
1837                 DEBUG(10, ("cli_check_sign_mac failed\n"));
1838                 return NT_STATUS_ACCESS_DENIED;
1839         }
1840
1841         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
1842                                            &iov, &num_iov);
1843         if (!NT_STATUS_IS_OK(status)) {
1844                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
1845                           nt_errstr(status)));
1846                 return status;
1847         }
1848
1849         cmd = CVAL(inhdr, HDR_COM);
1850         status = smb1cli_pull_raw_error(inhdr);
1851
1852         if (state->smb1.chained_requests == NULL) {
1853                 if (num_iov != 3) {
1854                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1855                 }
1856
1857                 smbXcli_req_unset_pending(req);
1858
1859                 if (state->smb1.recv_iov == NULL) {
1860                         /*
1861                          * For requests with more than
1862                          * one response, we have to readd the
1863                          * recv_iov array.
1864                          */
1865                         state->smb1.recv_iov = talloc_zero_array(state,
1866                                                                  struct iovec,
1867                                                                  3);
1868                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
1869                                 return NT_STATUS_OK;
1870                         }
1871                 }
1872
1873                 state->smb1.recv_cmd = cmd;
1874                 state->smb1.recv_status = status;
1875                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
1876
1877                 state->smb1.recv_iov[0] = iov[0];
1878                 state->smb1.recv_iov[1] = iov[1];
1879                 state->smb1.recv_iov[2] = iov[2];
1880
1881                 if (talloc_array_length(conn->pending) == 0) {
1882                         tevent_req_done(req);
1883                         return NT_STATUS_OK;
1884                 }
1885
1886                 tevent_req_defer_callback(req, state->ev);
1887                 tevent_req_done(req);
1888                 return NT_STATUS_RETRY;
1889         }
1890
1891         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
1892         num_chained = talloc_array_length(chain);
1893         num_responses = (num_iov - 1)/2;
1894
1895         if (num_responses > num_chained) {
1896                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1897         }
1898
1899         for (i=0; i<num_chained; i++) {
1900                 size_t iov_idx = 1 + (i*2);
1901                 struct iovec *cur = &iov[iov_idx];
1902                 uint8_t *inbuf_ref;
1903
1904                 req = chain[i];
1905                 state = tevent_req_data(req, struct smbXcli_req_state);
1906
1907                 smbXcli_req_unset_pending(req);
1908
1909                 /*
1910                  * as we finish multiple requests here
1911                  * we need to defer the callbacks as
1912                  * they could destroy our current stack state.
1913                  */
1914                 tevent_req_defer_callback(req, state->ev);
1915
1916                 if (i >= num_responses) {
1917                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
1918                         continue;
1919                 }
1920
1921                 if (state->smb1.recv_iov == NULL) {
1922                         /*
1923                          * For requests with more than
1924                          * one response, we have to readd the
1925                          * recv_iov array.
1926                          */
1927                         state->smb1.recv_iov = talloc_zero_array(state,
1928                                                                  struct iovec,
1929                                                                  3);
1930                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
1931                                 continue;
1932                         }
1933                 }
1934
1935                 state->smb1.recv_cmd = cmd;
1936
1937                 if (i == (num_responses - 1)) {
1938                         /*
1939                          * The last request in the chain gets the status
1940                          */
1941                         state->smb1.recv_status = status;
1942                 } else {
1943                         cmd = CVAL(cur[0].iov_base, 0);
1944                         state->smb1.recv_status = NT_STATUS_OK;
1945                 }
1946
1947                 state->inbuf = inbuf;
1948
1949                 /*
1950                  * Note: here we use talloc_reference() in a way
1951                  *       that does not expose it to the caller.
1952                  */
1953                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
1954                 if (tevent_req_nomem(inbuf_ref, req)) {
1955                         continue;
1956                 }
1957
1958                 /* copy the related buffers */
1959                 state->smb1.recv_iov[0] = iov[0];
1960                 state->smb1.recv_iov[1] = cur[0];
1961                 state->smb1.recv_iov[2] = cur[1];
1962
1963                 tevent_req_done(req);
1964         }
1965
1966         return NT_STATUS_RETRY;
1967 }
1968
1969 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
1970                           TALLOC_CTX *mem_ctx,
1971                           struct iovec **piov,
1972                           uint8_t **phdr,
1973                           uint8_t *pwct,
1974                           uint16_t **pvwv,
1975                           uint32_t *pvwv_offset,
1976                           uint32_t *pnum_bytes,
1977                           uint8_t **pbytes,
1978                           uint32_t *pbytes_offset,
1979                           uint8_t **pinbuf,
1980                           const struct smb1cli_req_expected_response *expected,
1981                           size_t num_expected)
1982 {
1983         struct smbXcli_req_state *state =
1984                 tevent_req_data(req,
1985                 struct smbXcli_req_state);
1986         NTSTATUS status = NT_STATUS_OK;
1987         struct iovec *recv_iov = NULL;
1988         uint8_t *hdr = NULL;
1989         uint8_t wct = 0;
1990         uint32_t vwv_offset = 0;
1991         uint16_t *vwv = NULL;
1992         uint32_t num_bytes = 0;
1993         uint32_t bytes_offset = 0;
1994         uint8_t *bytes = NULL;
1995         size_t i;
1996         bool found_status = false;
1997         bool found_size = false;
1998
1999         if (piov != NULL) {
2000                 *piov = NULL;
2001         }
2002         if (phdr != NULL) {
2003                 *phdr = 0;
2004         }
2005         if (pwct != NULL) {
2006                 *pwct = 0;
2007         }
2008         if (pvwv != NULL) {
2009                 *pvwv = NULL;
2010         }
2011         if (pvwv_offset != NULL) {
2012                 *pvwv_offset = 0;
2013         }
2014         if (pnum_bytes != NULL) {
2015                 *pnum_bytes = 0;
2016         }
2017         if (pbytes != NULL) {
2018                 *pbytes = NULL;
2019         }
2020         if (pbytes_offset != NULL) {
2021                 *pbytes_offset = 0;
2022         }
2023         if (pinbuf != NULL) {
2024                 *pinbuf = NULL;
2025         }
2026
2027         if (state->inbuf != NULL) {
2028                 recv_iov = state->smb1.recv_iov;
2029                 state->smb1.recv_iov = NULL;
2030                 if (state->smb1.recv_cmd != SMBreadBraw) {
2031                         hdr = (uint8_t *)recv_iov[0].iov_base;
2032                         wct = recv_iov[1].iov_len/2;
2033                         vwv = (uint16_t *)recv_iov[1].iov_base;
2034                         vwv_offset = PTR_DIFF(vwv, hdr);
2035                         num_bytes = recv_iov[2].iov_len;
2036                         bytes = (uint8_t *)recv_iov[2].iov_base;
2037                         bytes_offset = PTR_DIFF(bytes, hdr);
2038                 }
2039         }
2040
2041         if (tevent_req_is_nterror(req, &status)) {
2042                 for (i=0; i < num_expected; i++) {
2043                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2044                                 found_status = true;
2045                                 break;
2046                         }
2047                 }
2048
2049                 if (found_status) {
2050                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2051                 }
2052
2053                 return status;
2054         }
2055
2056         if (num_expected == 0) {
2057                 found_status = true;
2058                 found_size = true;
2059         }
2060
2061         status = state->smb1.recv_status;
2062
2063         for (i=0; i < num_expected; i++) {
2064                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2065                         continue;
2066                 }
2067
2068                 found_status = true;
2069                 if (expected[i].wct == 0) {
2070                         found_size = true;
2071                         break;
2072                 }
2073
2074                 if (expected[i].wct == wct) {
2075                         found_size = true;
2076                         break;
2077                 }
2078         }
2079
2080         if (!found_status) {
2081                 return status;
2082         }
2083
2084         if (!found_size) {
2085                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2086         }
2087
2088         if (piov != NULL) {
2089                 *piov = talloc_move(mem_ctx, &recv_iov);
2090         }
2091
2092         if (phdr != NULL) {
2093                 *phdr = hdr;
2094         }
2095         if (pwct != NULL) {
2096                 *pwct = wct;
2097         }
2098         if (pvwv != NULL) {
2099                 *pvwv = vwv;
2100         }
2101         if (pvwv_offset != NULL) {
2102                 *pvwv_offset = vwv_offset;
2103         }
2104         if (pnum_bytes != NULL) {
2105                 *pnum_bytes = num_bytes;
2106         }
2107         if (pbytes != NULL) {
2108                 *pbytes = bytes;
2109         }
2110         if (pbytes_offset != NULL) {
2111                 *pbytes_offset = bytes_offset;
2112         }
2113         if (pinbuf != NULL) {
2114                 *pinbuf = state->inbuf;
2115         }
2116
2117         return status;
2118 }
2119
2120 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2121 {
2122         size_t wct_ofs;
2123         int i;
2124
2125         wct_ofs = HDR_WCT;
2126
2127         for (i=0; i<num_reqs; i++) {
2128                 struct smbXcli_req_state *state;
2129                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2130                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2131                                            state->smb1.iov_count-2);
2132                 wct_ofs = (wct_ofs + 3) & ~3;
2133         }
2134         return wct_ofs;
2135 }
2136
2137 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2138 {
2139         struct smbXcli_req_state *first_state =
2140                 tevent_req_data(reqs[0],
2141                 struct smbXcli_req_state);
2142         struct smbXcli_req_state *state;
2143         size_t wct_offset;
2144         size_t chain_padding = 0;
2145         int i, iovlen;
2146         struct iovec *iov = NULL;
2147         struct iovec *this_iov;
2148         NTSTATUS status;
2149         size_t nbt_len;
2150
2151         if (num_reqs == 1) {
2152                 return smb1cli_req_writev_submit(reqs[0], first_state,
2153                                                  first_state->smb1.iov,
2154                                                  first_state->smb1.iov_count);
2155         }
2156
2157         iovlen = 0;
2158         for (i=0; i<num_reqs; i++) {
2159                 if (!tevent_req_is_in_progress(reqs[i])) {
2160                         return NT_STATUS_INTERNAL_ERROR;
2161                 }
2162
2163                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2164
2165                 if (state->smb1.iov_count < 4) {
2166                         return NT_STATUS_INVALID_PARAMETER_MIX;
2167                 }
2168
2169                 if (i == 0) {
2170                         /*
2171                          * The NBT and SMB header
2172                          */
2173                         iovlen += 2;
2174                 } else {
2175                         /*
2176                          * Chain padding
2177                          */
2178                         iovlen += 1;
2179                 }
2180
2181                 /*
2182                  * words and bytes
2183                  */
2184                 iovlen += state->smb1.iov_count - 2;
2185         }
2186
2187         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2188         if (iov == NULL) {
2189                 return NT_STATUS_NO_MEMORY;
2190         }
2191
2192         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2193                 first_state, reqs, sizeof(*reqs) * num_reqs);
2194         if (first_state->smb1.chained_requests == NULL) {
2195                 TALLOC_FREE(iov);
2196                 return NT_STATUS_NO_MEMORY;
2197         }
2198
2199         wct_offset = HDR_WCT;
2200         this_iov = iov;
2201
2202         for (i=0; i<num_reqs; i++) {
2203                 size_t next_padding = 0;
2204                 uint16_t *vwv;
2205
2206                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2207
2208                 if (i < num_reqs-1) {
2209                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2210                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2211                                 TALLOC_FREE(iov);
2212                                 TALLOC_FREE(first_state->smb1.chained_requests);
2213                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2214                         }
2215                 }
2216
2217                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2218                                               state->smb1.iov_count-2) + 1;
2219                 if ((wct_offset % 4) != 0) {
2220                         next_padding = 4 - (wct_offset % 4);
2221                 }
2222                 wct_offset += next_padding;
2223                 vwv = state->smb1.vwv;
2224
2225                 if (i < num_reqs-1) {
2226                         struct smbXcli_req_state *next_state =
2227                                 tevent_req_data(reqs[i+1],
2228                                 struct smbXcli_req_state);
2229                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2230                         SCVAL(vwv+0, 1, 0);
2231                         SSVAL(vwv+1, 0, wct_offset);
2232                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2233                         /* properly end the chain */
2234                         SCVAL(vwv+0, 0, 0xff);
2235                         SCVAL(vwv+0, 1, 0xff);
2236                         SSVAL(vwv+1, 0, 0);
2237                 }
2238
2239                 if (i == 0) {
2240                         /*
2241                          * The NBT and SMB header
2242                          */
2243                         this_iov[0] = state->smb1.iov[0];
2244                         this_iov[1] = state->smb1.iov[1];
2245                         this_iov += 2;
2246                 } else {
2247                         /*
2248                          * This one is a bit subtle. We have to add
2249                          * chain_padding bytes between the requests, and we
2250                          * have to also include the wct field of the
2251                          * subsequent requests. We use the subsequent header
2252                          * for the padding, it contains the wct field in its
2253                          * last byte.
2254                          */
2255                         this_iov[0].iov_len = chain_padding+1;
2256                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2257                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2258                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2259                         this_iov += 1;
2260                 }
2261
2262                 /*
2263                  * copy the words and bytes
2264                  */
2265                 memcpy(this_iov, state->smb1.iov+2,
2266                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2267                 this_iov += state->smb1.iov_count - 2;
2268                 chain_padding = next_padding;
2269         }
2270
2271         nbt_len = smbXcli_iov_len(&iov[1], iovlen-1);
2272         if (nbt_len > first_state->conn->smb1.max_xmit) {
2273                 TALLOC_FREE(iov);
2274                 TALLOC_FREE(first_state->smb1.chained_requests);
2275                 return NT_STATUS_INVALID_PARAMETER_MIX;
2276         }
2277
2278         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2279         if (!NT_STATUS_IS_OK(status)) {
2280                 TALLOC_FREE(iov);
2281                 TALLOC_FREE(first_state->smb1.chained_requests);
2282                 return status;
2283         }
2284
2285         return NT_STATUS_OK;
2286 }
2287
2288 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2289 {
2290         return ((tevent_queue_length(conn->outgoing) != 0)
2291                 || (talloc_array_length(conn->pending) != 0));
2292 }
2293
2294 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2295 {
2296         return conn->smb2.server.capabilities;
2297 }
2298
2299 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2300 {
2301         return conn->smb2.server.security_mode;
2302 }
2303
2304 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2305 {
2306         return conn->smb2.server.max_trans_size;
2307 }
2308
2309 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2310 {
2311         return conn->smb2.server.max_read_size;
2312 }
2313
2314 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2315 {
2316         return conn->smb2.server.max_write_size;
2317 }
2318
2319 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2320                                   uint16_t max_credits)
2321 {
2322         conn->smb2.max_credits = max_credits;
2323 }
2324
2325 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2326
2327 static bool smb2cli_req_cancel(struct tevent_req *req)
2328 {
2329         struct smbXcli_req_state *state =
2330                 tevent_req_data(req,
2331                 struct smbXcli_req_state);
2332         uint32_t flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
2333         uint32_t pid = IVAL(state->smb2.hdr, SMB2_HDR_PID);
2334         uint32_t tid = IVAL(state->smb2.hdr, SMB2_HDR_TID);
2335         uint64_t mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
2336         uint64_t aid = BVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID);
2337         struct smbXcli_session *session = state->session;
2338         uint8_t *fixed = state->smb2.pad;
2339         uint16_t fixed_len = 4;
2340         struct tevent_req *subreq;
2341         struct smbXcli_req_state *substate;
2342         NTSTATUS status;
2343
2344         SSVAL(fixed, 0, 0x04);
2345         SSVAL(fixed, 2, 0);
2346
2347         subreq = smb2cli_req_create(state, state->ev,
2348                                     state->conn,
2349                                     SMB2_OP_CANCEL,
2350                                     flags, 0,
2351                                     0, /* timeout */
2352                                     pid, tid, session,
2353                                     fixed, fixed_len,
2354                                     NULL, 0);
2355         if (subreq == NULL) {
2356                 return false;
2357         }
2358         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2359
2360         if (flags & SMB2_HDR_FLAG_ASYNC) {
2361                 mid = 0;
2362         }
2363
2364         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, flags);
2365         SIVAL(substate->smb2.hdr, SMB2_HDR_PID, pid);
2366         SIVAL(substate->smb2.hdr, SMB2_HDR_TID, tid);
2367         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2368         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, aid);
2369
2370         status = smb2cli_req_compound_submit(&subreq, 1);
2371         if (!NT_STATUS_IS_OK(status)) {
2372                 TALLOC_FREE(subreq);
2373                 return false;
2374         }
2375
2376         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2377
2378         return true;
2379 }
2380
2381 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2382 {
2383         /* we do not care about the result */
2384         TALLOC_FREE(subreq);
2385 }
2386
2387 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2388                                       struct tevent_context *ev,
2389                                       struct smbXcli_conn *conn,
2390                                       uint16_t cmd,
2391                                       uint32_t additional_flags,
2392                                       uint32_t clear_flags,
2393                                       uint32_t timeout_msec,
2394                                       uint32_t pid,
2395                                       uint32_t tid,
2396                                       struct smbXcli_session *session,
2397                                       const uint8_t *fixed,
2398                                       uint16_t fixed_len,
2399                                       const uint8_t *dyn,
2400                                       uint32_t dyn_len)
2401 {
2402         struct tevent_req *req;
2403         struct smbXcli_req_state *state;
2404         uint32_t flags = 0;
2405         uint64_t uid = 0;
2406
2407         req = tevent_req_create(mem_ctx, &state,
2408                                 struct smbXcli_req_state);
2409         if (req == NULL) {
2410                 return NULL;
2411         }
2412
2413         state->ev = ev;
2414         state->conn = conn;
2415         state->session = session;
2416
2417         if (session) {
2418                 uid = session->smb2.session_id;
2419
2420                 state->smb2.should_sign = session->smb2.should_sign;
2421                 state->smb2.should_encrypt = session->smb2.should_encrypt;
2422
2423                 /* TODO: turn on encryption based on the tree connect. */
2424
2425                 if (cmd == SMB2_OP_SESSSETUP &&
2426                     session->smb2.signing_key.length != 0) {
2427                         state->smb2.should_sign = true;
2428                 }
2429
2430                 if (cmd == SMB2_OP_SESSSETUP &&
2431                     session->smb2.channel_signing_key.length == 0) {
2432                         state->smb2.should_encrypt = false;
2433                 }
2434
2435                 if (state->smb2.should_encrypt) {
2436                         state->smb2.should_sign = false;
2437                 }
2438         }
2439
2440         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
2441         if (state->smb2.recv_iov == NULL) {
2442                 TALLOC_FREE(req);
2443                 return NULL;
2444         }
2445
2446         flags |= additional_flags;
2447         flags &= ~clear_flags;
2448
2449         state->smb2.fixed = fixed;
2450         state->smb2.fixed_len = fixed_len;
2451         state->smb2.dyn = dyn;
2452         state->smb2.dyn_len = dyn_len;
2453
2454         if (state->smb2.should_encrypt) {
2455                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2456                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
2457         }
2458
2459         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
2460         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
2461         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
2462         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
2463         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            pid);
2464         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
2465         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
2466
2467         switch (cmd) {
2468         case SMB2_OP_CANCEL:
2469                 state->one_way = true;
2470                 break;
2471         case SMB2_OP_BREAK:
2472                 /*
2473                  * If this is a dummy request, it will have
2474                  * UINT64_MAX as message id.
2475                  * If we send on break acknowledgement,
2476                  * this gets overwritten later.
2477                  */
2478                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2479                 break;
2480         }
2481
2482         if (timeout_msec > 0) {
2483                 struct timeval endtime;
2484
2485                 endtime = timeval_current_ofs_msec(timeout_msec);
2486                 if (!tevent_req_set_endtime(req, ev, endtime)) {
2487                         return req;
2488                 }
2489         }
2490
2491         return req;
2492 }
2493
2494 void smb2cli_req_set_notify_async(struct tevent_req *req)
2495 {
2496         struct smbXcli_req_state *state =
2497                 tevent_req_data(req,
2498                 struct smbXcli_req_state);
2499
2500         state->smb2.notify_async = true;
2501 }
2502
2503 static void smb2cli_req_writev_done(struct tevent_req *subreq);
2504 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2505                                                TALLOC_CTX *tmp_mem,
2506                                                uint8_t *inbuf);
2507
2508 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
2509                                      int num_reqs)
2510 {
2511         struct smbXcli_req_state *state;
2512         struct tevent_req *subreq;
2513         struct iovec *iov;
2514         int i, num_iov, nbt_len;
2515
2516         /*
2517          * 1 for the nbt length
2518          * per request: TRANSFORM, HDR, fixed, dyn, padding
2519          * -1 because the last one does not need padding
2520          */
2521
2522         iov = talloc_array(reqs[0], struct iovec, 1 + 5*num_reqs - 1);
2523         if (iov == NULL) {
2524                 return NT_STATUS_NO_MEMORY;
2525         }
2526
2527         num_iov = 1;
2528         nbt_len = 0;
2529
2530         for (i=0; i<num_reqs; i++) {
2531                 int tf_iov;
2532                 int hdr_iov;
2533                 size_t reqlen;
2534                 bool ret;
2535                 uint16_t opcode;
2536                 uint64_t avail;
2537                 uint16_t charge;
2538                 uint16_t credits;
2539                 uint64_t mid;
2540                 const DATA_BLOB *signing_key = NULL;
2541                 const DATA_BLOB *encryption_key = NULL;
2542
2543                 if (!tevent_req_is_in_progress(reqs[i])) {
2544                         return NT_STATUS_INTERNAL_ERROR;
2545                 }
2546
2547                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2548
2549                 if (!smbXcli_conn_is_connected(state->conn)) {
2550                         return NT_STATUS_CONNECTION_DISCONNECTED;
2551                 }
2552
2553                 if ((state->conn->protocol != PROTOCOL_NONE) &&
2554                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
2555                         return NT_STATUS_REVISION_MISMATCH;
2556                 }
2557
2558                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
2559                 if (opcode == SMB2_OP_CANCEL) {
2560                         goto skip_credits;
2561                 }
2562
2563                 avail = UINT64_MAX - state->conn->smb2.mid;
2564                 if (avail < 1) {
2565                         return NT_STATUS_CONNECTION_ABORTED;
2566                 }
2567
2568                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2569                         charge = (MAX(state->smb2.dyn_len, 1) - 1)/ 65536 + 1;
2570                 } else {
2571                         charge = 1;
2572                 }
2573
2574                 charge = MAX(state->smb2.credit_charge, charge);
2575
2576                 avail = MIN(avail, state->conn->smb2.cur_credits);
2577                 if (avail < charge) {
2578                         return NT_STATUS_INTERNAL_ERROR;
2579                 }
2580
2581                 credits = 0;
2582                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
2583                         credits = state->conn->smb2.max_credits -
2584                                   state->conn->smb2.cur_credits;
2585                 }
2586                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
2587                         credits += 1;
2588                 }
2589
2590                 mid = state->conn->smb2.mid;
2591                 state->conn->smb2.mid += charge;
2592                 state->conn->smb2.cur_credits -= charge;
2593
2594                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2595                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
2596                 }
2597                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
2598                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2599
2600 skip_credits:
2601                 if (state->session) {
2602                         /*
2603                          * We prefer the channel signing key if it is
2604                          * already there.
2605                          */
2606                         if (state->smb2.should_sign) {
2607                                 signing_key = &state->session->smb2.channel_signing_key;
2608                         }
2609
2610                         /*
2611                          * If it is a channel binding, we already have the main
2612                          * signing key and try that one.
2613                          */
2614                         if (signing_key && signing_key->length == 0) {
2615                                 signing_key = &state->session->smb2.signing_key;
2616                         }
2617
2618                         /*
2619                          * If we do not have any session key yet, we skip the
2620                          * signing of SMB2_OP_SESSSETUP requests.
2621                          */
2622                         if (signing_key && signing_key->length == 0) {
2623                                 signing_key = NULL;
2624                         }
2625
2626                         if (state->smb2.should_encrypt) {
2627                                 encryption_key = &state->session->smb2.encryption_key;
2628                         }
2629                 }
2630
2631                 if (encryption_key) {
2632                         tf_iov = num_iov;
2633                         iov[num_iov].iov_base = state->smb2.transform;
2634                         iov[num_iov].iov_len  = sizeof(state->smb2.transform);
2635                         num_iov += 1;
2636                 }
2637
2638                 hdr_iov = num_iov;
2639                 iov[num_iov].iov_base = state->smb2.hdr;
2640                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
2641                 num_iov += 1;
2642
2643                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
2644                 iov[num_iov].iov_len  = state->smb2.fixed_len;
2645                 num_iov += 1;
2646
2647                 if (state->smb2.dyn != NULL) {
2648                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
2649                         iov[num_iov].iov_len  = state->smb2.dyn_len;
2650                         num_iov += 1;
2651                 }
2652
2653                 reqlen  = sizeof(state->smb2.hdr);
2654                 reqlen += state->smb2.fixed_len;
2655                 reqlen += state->smb2.dyn_len;
2656
2657                 if (i < num_reqs-1) {
2658                         if ((reqlen % 8) > 0) {
2659                                 uint8_t pad = 8 - (reqlen % 8);
2660                                 iov[num_iov].iov_base = state->smb2.pad;
2661                                 iov[num_iov].iov_len = pad;
2662                                 num_iov += 1;
2663                                 reqlen += pad;
2664                         }
2665                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
2666                 }
2667
2668                 if (encryption_key) {
2669                         NTSTATUS status;
2670                         uint8_t *buf;
2671                         int vi;
2672
2673                         SBVAL(state->smb2.transform, SMB2_TF_NONCE, mid);
2674                         SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
2675                               state->session->smb2.channel_nonce);
2676                         SBVAL(state->smb2.transform, SMB2_TF_MSG_SIZE,
2677                               reqlen);
2678
2679                         buf = talloc_array(iov, uint8_t, reqlen);
2680                         if (buf == NULL) {
2681                                 return NT_STATUS_NO_MEMORY;
2682                         }
2683
2684                         reqlen += SMB2_TF_HDR_SIZE;
2685
2686                         /*
2687                          * We copy the buffers before encrypting them,
2688                          * this is at least currently needed for the
2689                          * to keep state->smb2.hdr.
2690                          *
2691                          * Also the callers may expect there buffers
2692                          * to be const.
2693                          */
2694                         for (vi = hdr_iov; vi < num_iov; vi++) {
2695                                 struct iovec *v = &iov[vi];
2696                                 const uint8_t *o = (const uint8_t *)v->iov_base;
2697
2698                                 memcpy(buf, o, v->iov_len);
2699                                 v->iov_base = (void *)buf;
2700                                 buf += v->iov_len;
2701                         }
2702
2703                         status = smb2_signing_encrypt_pdu(*encryption_key,
2704                                                 state->session->conn->protocol,
2705                                                 &iov[tf_iov], num_iov - tf_iov);
2706                         if (!NT_STATUS_IS_OK(status)) {
2707                                 return status;
2708                         }
2709                 } else if (signing_key) {
2710                         NTSTATUS status;
2711
2712                         status = smb2_signing_sign_pdu(*signing_key,
2713                                                        state->session->conn->protocol,
2714                                                        &iov[hdr_iov], num_iov - hdr_iov);
2715                         if (!NT_STATUS_IS_OK(status)) {
2716                                 return status;
2717                         }
2718                 }
2719
2720                 nbt_len += reqlen;
2721
2722                 ret = smbXcli_req_set_pending(reqs[i]);
2723                 if (!ret) {
2724                         return NT_STATUS_NO_MEMORY;
2725                 }
2726         }
2727
2728         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
2729         _smb_setlen_tcp(state->length_hdr, nbt_len);
2730         iov[0].iov_base = state->length_hdr;
2731         iov[0].iov_len  = sizeof(state->length_hdr);
2732
2733         if (state->conn->dispatch_incoming == NULL) {
2734                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
2735         }
2736
2737         subreq = writev_send(state, state->ev, state->conn->outgoing,
2738                              state->conn->write_fd, false, iov, num_iov);
2739         if (subreq == NULL) {
2740                 return NT_STATUS_NO_MEMORY;
2741         }
2742         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
2743         return NT_STATUS_OK;
2744 }
2745
2746 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
2747 {
2748         struct smbXcli_req_state *state =
2749                 tevent_req_data(req,
2750                 struct smbXcli_req_state);
2751
2752         state->smb2.credit_charge = charge;
2753 }
2754
2755 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
2756                                     struct tevent_context *ev,
2757                                     struct smbXcli_conn *conn,
2758                                     uint16_t cmd,
2759                                     uint32_t additional_flags,
2760                                     uint32_t clear_flags,
2761                                     uint32_t timeout_msec,
2762                                     uint32_t pid,
2763                                     uint32_t tid,
2764                                     struct smbXcli_session *session,
2765                                     const uint8_t *fixed,
2766                                     uint16_t fixed_len,
2767                                     const uint8_t *dyn,
2768                                     uint32_t dyn_len)
2769 {
2770         struct tevent_req *req;
2771         NTSTATUS status;
2772
2773         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
2774                                  additional_flags, clear_flags,
2775                                  timeout_msec,
2776                                  pid, tid, session,
2777                                  fixed, fixed_len, dyn, dyn_len);
2778         if (req == NULL) {
2779                 return NULL;
2780         }
2781         if (!tevent_req_is_in_progress(req)) {
2782                 return tevent_req_post(req, ev);
2783         }
2784         status = smb2cli_req_compound_submit(&req, 1);
2785         if (tevent_req_nterror(req, status)) {
2786                 return tevent_req_post(req, ev);
2787         }
2788         return req;
2789 }
2790
2791 static void smb2cli_req_writev_done(struct tevent_req *subreq)
2792 {
2793         struct tevent_req *req =
2794                 tevent_req_callback_data(subreq,
2795                 struct tevent_req);
2796         struct smbXcli_req_state *state =
2797                 tevent_req_data(req,
2798                 struct smbXcli_req_state);
2799         ssize_t nwritten;
2800         int err;
2801
2802         nwritten = writev_recv(subreq, &err);
2803         TALLOC_FREE(subreq);
2804         if (nwritten == -1) {
2805                 /* here, we need to notify all pending requests */
2806                 NTSTATUS status = map_nt_error_from_unix_common(err);
2807                 smbXcli_conn_disconnect(state->conn, status);
2808                 return;
2809         }
2810 }
2811
2812 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
2813                                              uint8_t *buf,
2814                                              size_t buflen,
2815                                              TALLOC_CTX *mem_ctx,
2816                                              struct iovec **piov, int *pnum_iov)
2817 {
2818         struct iovec *iov;
2819         int num_iov = 0;
2820         size_t taken = 0;
2821         uint8_t *first_hdr = buf;
2822
2823         iov = talloc_array(mem_ctx, struct iovec, num_iov);
2824         if (iov == NULL) {
2825                 return NT_STATUS_NO_MEMORY;
2826         }
2827
2828         while (taken < buflen) {
2829                 uint8_t *tf = NULL;
2830                 size_t tf_len = 0;
2831                 size_t len = buflen - taken;
2832                 uint8_t *hdr = first_hdr + taken;
2833                 struct iovec *cur;
2834                 size_t full_size;
2835                 size_t next_command_ofs;
2836                 uint16_t body_size;
2837                 struct iovec *iov_tmp;
2838
2839                 if (len < 4) {
2840                         DEBUG(10, ("%d bytes left, expected at least %d\n",
2841                                    (int)len, 4));
2842                         goto inval;
2843                 }
2844                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
2845                         struct smbXcli_session *s;
2846                         uint64_t uid;
2847                         struct iovec tf_iov[2];
2848                         NTSTATUS status;
2849
2850                         if (len < SMB2_TF_HDR_SIZE) {
2851                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
2852                                            (int)len, SMB2_TF_HDR_SIZE));
2853                                 goto inval;
2854                         }
2855                         tf = hdr;
2856                         tf_len = SMB2_TF_HDR_SIZE;
2857                         taken += tf_len;
2858
2859                         hdr = first_hdr + taken;
2860                         len = IVAL(tf, SMB2_TF_MSG_SIZE);
2861                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
2862
2863                         s = conn->sessions;
2864                         for (; s; s = s->next) {
2865                                 if (s->smb2.session_id != uid) {
2866                                         continue;
2867                                 }
2868                                 break;
2869                         }
2870
2871                         if (s == NULL) {
2872                                 DEBUG(10, ("unknown session_id %llu\n",
2873                                            (unsigned long long)uid));
2874                                 goto inval;
2875                         }
2876
2877                         tf_iov[0].iov_base = (void *)tf;
2878                         tf_iov[0].iov_len = tf_len;
2879                         tf_iov[1].iov_base = (void *)hdr;
2880                         tf_iov[1].iov_len = len;
2881
2882                         status = smb2_signing_decrypt_pdu(s->smb2.decryption_key,
2883                                                           conn->protocol,
2884                                                           tf_iov, 2);
2885                         if (!NT_STATUS_IS_OK(status)) {
2886                                 TALLOC_FREE(iov);
2887                                 return status;
2888                         }
2889                 }
2890
2891                 /*
2892                  * We need the header plus the body length field
2893                  */
2894
2895                 if (len < SMB2_HDR_BODY + 2) {
2896                         DEBUG(10, ("%d bytes left, expected at least %d\n",
2897                                    (int)len, SMB2_HDR_BODY));
2898                         goto inval;
2899                 }
2900                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
2901                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
2902                                    IVAL(hdr, 0)));
2903                         goto inval;
2904                 }
2905                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
2906                         DEBUG(10, ("Got HDR len %d, expected %d\n",
2907                                    SVAL(hdr, 4), SMB2_HDR_BODY));
2908                         goto inval;
2909                 }
2910
2911                 full_size = len;
2912                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
2913                 body_size = SVAL(hdr, SMB2_HDR_BODY);
2914
2915                 if (next_command_ofs != 0) {
2916                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
2917                                 goto inval;
2918                         }
2919                         if (next_command_ofs > full_size) {
2920                                 goto inval;
2921                         }
2922                         if (tf && next_command_ofs < len) {
2923                                 goto inval;
2924                         }
2925                         full_size = next_command_ofs;
2926                 }
2927                 if (body_size < 2) {
2928                         goto inval;
2929                 }
2930                 body_size &= 0xfffe;
2931
2932                 if (body_size > (full_size - SMB2_HDR_BODY)) {
2933                         goto inval;
2934                 }
2935
2936                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2937                                          num_iov + 4);
2938                 if (iov_tmp == NULL) {
2939                         TALLOC_FREE(iov);
2940                         return NT_STATUS_NO_MEMORY;
2941                 }
2942                 iov = iov_tmp;
2943                 cur = &iov[num_iov];
2944                 num_iov += 4;
2945
2946                 cur[0].iov_base = tf;
2947                 cur[0].iov_len  = tf_len;
2948                 cur[1].iov_base = hdr;
2949                 cur[1].iov_len  = SMB2_HDR_BODY;
2950                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
2951                 cur[2].iov_len  = body_size;
2952                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
2953                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
2954
2955                 taken += full_size;
2956         }
2957
2958         *piov = iov;
2959         *pnum_iov = num_iov;
2960         return NT_STATUS_OK;
2961
2962 inval:
2963         TALLOC_FREE(iov);
2964         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2965 }
2966
2967 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
2968                                                     uint64_t mid)
2969 {
2970         size_t num_pending = talloc_array_length(conn->pending);
2971         size_t i;
2972
2973         for (i=0; i<num_pending; i++) {
2974                 struct tevent_req *req = conn->pending[i];
2975                 struct smbXcli_req_state *state =
2976                         tevent_req_data(req,
2977                         struct smbXcli_req_state);
2978
2979                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
2980                         return req;
2981                 }
2982         }
2983         return NULL;
2984 }
2985
2986 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2987                                                TALLOC_CTX *tmp_mem,
2988                                                uint8_t *inbuf)
2989 {
2990         struct tevent_req *req;
2991         struct smbXcli_req_state *state = NULL;
2992         struct iovec *iov;
2993         int i, num_iov;
2994         NTSTATUS status;
2995         bool defer = true;
2996         struct smbXcli_session *last_session = NULL;
2997         size_t inbuf_len = smb_len_tcp(inbuf);
2998
2999         status = smb2cli_inbuf_parse_compound(conn,
3000                                               inbuf + NBT_HDR_SIZE,
3001                                               inbuf_len,
3002                                               tmp_mem,
3003                                               &iov, &num_iov);
3004         if (!NT_STATUS_IS_OK(status)) {
3005                 return status;
3006         }
3007
3008         for (i=0; i<num_iov; i+=4) {
3009                 uint8_t *inbuf_ref = NULL;
3010                 struct iovec *cur = &iov[i];
3011                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3012                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3013                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3014                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3015                 uint16_t req_opcode;
3016                 uint32_t req_flags;
3017                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3018                 uint32_t new_credits;
3019                 struct smbXcli_session *session = NULL;
3020                 const DATA_BLOB *signing_key = NULL;
3021
3022                 new_credits = conn->smb2.cur_credits;
3023                 new_credits += credits;
3024                 if (new_credits > UINT16_MAX) {
3025                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3026                 }
3027                 conn->smb2.cur_credits += credits;
3028
3029                 req = smb2cli_conn_find_pending(conn, mid);
3030                 if (req == NULL) {
3031                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3032                 }
3033                 state = tevent_req_data(req, struct smbXcli_req_state);
3034
3035                 state->smb2.got_async = false;
3036
3037                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3038                 if (opcode != req_opcode) {
3039                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3040                 }
3041                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3042
3043                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3044                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3045                 }
3046
3047                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3048                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3049                     NT_STATUS_EQUAL(status, STATUS_PENDING)) {
3050                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3051
3052                         /*
3053                          * async interim responses are not signed,
3054                          * even if the SMB2_HDR_FLAG_SIGNED flag
3055                          * is set.
3056                          */
3057                         req_flags |= SMB2_HDR_FLAG_ASYNC;
3058                         SBVAL(state->smb2.hdr, SMB2_HDR_FLAGS, req_flags);
3059                         SBVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID, async_id);
3060
3061                         if (state->smb2.notify_async) {
3062                                 state->smb2.got_async = true;
3063                                 tevent_req_defer_callback(req, state->ev);
3064                                 tevent_req_notify_callback(req);
3065                         }
3066                         continue;
3067                 }
3068
3069                 session = state->session;
3070                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3071                         session = last_session;
3072                 }
3073                 last_session = session;
3074
3075                 if (state->smb2.should_sign) {
3076                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3077                                 return NT_STATUS_ACCESS_DENIED;
3078                         }
3079                 }
3080
3081                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3082                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3083
3084                         if (session == NULL) {
3085                                 struct smbXcli_session *s;
3086
3087                                 s = state->conn->sessions;
3088                                 for (; s; s = s->next) {
3089                                         if (s->smb2.session_id != uid) {
3090                                                 continue;
3091                                         }
3092
3093                                         session = s;
3094                                         break;
3095                                 }
3096                         }
3097
3098                         if (session == NULL) {
3099                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3100                         }
3101
3102                         last_session = session;
3103                         signing_key = &session->smb2.channel_signing_key;
3104                 }
3105
3106                 if (opcode == SMB2_OP_SESSSETUP) {
3107                         /*
3108                          * We prefer the channel signing key, if it is
3109                          * already there.
3110                          *
3111                          * If we do not have a channel signing key yet,
3112                          * we try the main signing key, if it is not
3113                          * the final response.
3114                          */
3115                         if (signing_key && signing_key->length == 0 &&
3116                             !NT_STATUS_IS_OK(status)) {
3117                                 signing_key = &session->smb2.signing_key;
3118                         }
3119
3120                         if (signing_key && signing_key->length == 0) {
3121                                 /*
3122                                  * If we do not have a session key to
3123                                  * verify the signature, we defer the
3124                                  * signing check to the caller.
3125                                  *
3126                                  * The caller gets NT_STATUS_OK, it
3127                                  * has to call
3128                                  * smb2cli_session_set_session_key()
3129                                  * or
3130                                  * smb2cli_session_set_channel_key()
3131                                  * which will check the signature
3132                                  * with the channel signing key.
3133                                  */
3134                                 signing_key = NULL;
3135                         }
3136                 }
3137
3138                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3139                         /*
3140                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3141                          * the response is not signed and we should
3142                          * propagate the NT_STATUS_USER_SESSION_DELETED
3143                          * status to the caller.
3144                          */
3145                         signing_key = NULL;
3146                 } else if (state->smb2.should_encrypt) {
3147                         if (cur[0].iov_len != SMB2_TF_HDR_SIZE) {
3148                                 return NT_STATUS_ACCESS_DENIED;
3149                         }
3150                 }
3151
3152                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3153                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3154                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3155                         /*
3156                          * if the server returns
3157                          * NT_STATUS_NETWORK_NAME_DELETED
3158                          * NT_STATUS_FILE_CLOSED
3159                          * NT_STATUS_INVALID_PARAMETER
3160                          * the response might not be signed
3161                          * as this happens before the signing checks.
3162                          *
3163                          * If server echos the signature (or all zeros)
3164                          * we should report the status from the server
3165                          * to the caller.
3166                          */
3167                         if (signing_key) {
3168                                 int cmp;
3169
3170                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3171                                              state->smb2.hdr+SMB2_HDR_SIGNATURE,
3172                                              16);
3173                                 if (cmp == 0) {
3174                                         state->smb2.signing_skipped = true;
3175                                         signing_key = NULL;
3176                                 }
3177                         }
3178                         if (signing_key) {
3179                                 int cmp;
3180                                 static const uint8_t zeros[16];
3181
3182                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3183                                              zeros,
3184                                              16);
3185                                 if (cmp == 0) {
3186                                         state->smb2.signing_skipped = true;
3187                                         signing_key = NULL;
3188                                 }
3189                         }
3190                 }
3191
3192                 if (signing_key) {
3193                         status = smb2_signing_check_pdu(*signing_key,
3194                                                         state->conn->protocol,
3195                                                         &cur[1], 3);
3196                         if (!NT_STATUS_IS_OK(status)) {
3197                                 /*
3198                                  * If the signing check fails, we disconnect
3199                                  * the connection.
3200                                  */
3201                                 return status;
3202                         }
3203                 }
3204
3205                 smbXcli_req_unset_pending(req);
3206
3207                 /*
3208                  * There might be more than one response
3209                  * we need to defer the notifications
3210                  */
3211                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
3212                         defer = false;
3213                 }
3214
3215                 if (defer) {
3216                         tevent_req_defer_callback(req, state->ev);
3217                 }
3218
3219                 /*
3220                  * Note: here we use talloc_reference() in a way
3221                  *       that does not expose it to the caller.
3222                  */
3223                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
3224                 if (tevent_req_nomem(inbuf_ref, req)) {
3225                         continue;
3226                 }
3227
3228                 /* copy the related buffers */
3229                 state->smb2.recv_iov[0] = cur[1];
3230                 state->smb2.recv_iov[1] = cur[2];
3231                 state->smb2.recv_iov[2] = cur[3];
3232
3233                 tevent_req_done(req);
3234         }
3235
3236         if (defer) {
3237                 return NT_STATUS_RETRY;
3238         }
3239
3240         return NT_STATUS_OK;
3241 }
3242
3243 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3244                           struct iovec **piov,
3245                           const struct smb2cli_req_expected_response *expected,
3246                           size_t num_expected)
3247 {
3248         struct smbXcli_req_state *state =
3249                 tevent_req_data(req,
3250                 struct smbXcli_req_state);
3251         NTSTATUS status;
3252         size_t body_size;
3253         bool found_status = false;
3254         bool found_size = false;
3255         size_t i;
3256
3257         if (piov != NULL) {
3258                 *piov = NULL;
3259         }
3260
3261         if (state->smb2.got_async) {
3262                 return STATUS_PENDING;
3263         }
3264
3265         if (tevent_req_is_nterror(req, &status)) {
3266                 for (i=0; i < num_expected; i++) {
3267                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
3268                                 found_status = true;
3269                                 break;
3270                         }
3271                 }
3272
3273                 if (found_status) {
3274                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
3275                 }
3276
3277                 return status;
3278         }
3279
3280         if (num_expected == 0) {
3281                 found_status = true;
3282                 found_size = true;
3283         }
3284
3285         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
3286         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
3287
3288         for (i=0; i < num_expected; i++) {
3289                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
3290                         continue;
3291                 }
3292
3293                 found_status = true;
3294                 if (expected[i].body_size == 0) {
3295                         found_size = true;
3296                         break;
3297                 }
3298
3299                 if (expected[i].body_size == body_size) {
3300                         found_size = true;
3301                         break;
3302                 }
3303         }
3304
3305         if (!found_status) {
3306                 return status;
3307         }
3308
3309         if (state->smb2.signing_skipped) {
3310                 if (num_expected > 0) {
3311                         return NT_STATUS_ACCESS_DENIED;
3312                 }
3313                 if (!NT_STATUS_IS_ERR(status)) {
3314                         return NT_STATUS_ACCESS_DENIED;
3315                 }
3316         }
3317
3318         if (!found_size) {
3319                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3320         }
3321
3322         if (piov != NULL) {
3323                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
3324         }
3325
3326         return status;
3327 }
3328
3329 static const struct {
3330         enum protocol_types proto;
3331         const char *smb1_name;
3332 } smb1cli_prots[] = {
3333         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
3334         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
3335         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
3336         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
3337         {PROTOCOL_LANMAN2,      "LM1.2X002"},
3338         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
3339         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
3340         {PROTOCOL_LANMAN2,      "Samba"},
3341         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
3342         {PROTOCOL_NT1,          "NT LM 0.12"},
3343         {PROTOCOL_SMB2_02,      "SMB 2.002"},
3344         {PROTOCOL_SMB2_10,      "SMB 2.???"},
3345 };
3346
3347 static const struct {
3348         enum protocol_types proto;
3349         uint16_t smb2_dialect;
3350 } smb2cli_prots[] = {
3351         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
3352         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
3353         {PROTOCOL_SMB2_22,      SMB2_DIALECT_REVISION_222},
3354         {PROTOCOL_SMB2_24,      SMB2_DIALECT_REVISION_224},
3355         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
3356 };
3357
3358 struct smbXcli_negprot_state {
3359         struct smbXcli_conn *conn;
3360         struct tevent_context *ev;
3361         uint32_t timeout_msec;
3362         enum protocol_types min_protocol;
3363         enum protocol_types max_protocol;
3364
3365         struct {
3366                 uint8_t fixed[36];
3367                 uint8_t dyn[ARRAY_SIZE(smb2cli_prots)*2];
3368         } smb2;
3369 };
3370
3371 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
3372 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
3373 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
3374 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
3375 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
3376 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
3377                                                   TALLOC_CTX *frame,
3378                                                   uint8_t *inbuf);
3379
3380 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
3381                                         struct tevent_context *ev,
3382                                         struct smbXcli_conn *conn,
3383                                         uint32_t timeout_msec,
3384                                         enum protocol_types min_protocol,
3385                                         enum protocol_types max_protocol)
3386 {
3387         struct tevent_req *req, *subreq;
3388         struct smbXcli_negprot_state *state;
3389
3390         req = tevent_req_create(mem_ctx, &state,
3391                                 struct smbXcli_negprot_state);
3392         if (req == NULL) {
3393                 return NULL;
3394         }
3395         state->conn = conn;
3396         state->ev = ev;
3397         state->timeout_msec = timeout_msec;
3398         state->min_protocol = min_protocol;
3399         state->max_protocol = max_protocol;
3400
3401         if (min_protocol == PROTOCOL_NONE) {
3402                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3403                 return tevent_req_post(req, ev);
3404         }
3405
3406         if (max_protocol == PROTOCOL_NONE) {
3407                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3408                 return tevent_req_post(req, ev);
3409         }
3410
3411         if (min_protocol > max_protocol) {
3412                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3413                 return tevent_req_post(req, ev);
3414         }
3415
3416         if ((min_protocol < PROTOCOL_SMB2_02) &&
3417             (max_protocol < PROTOCOL_SMB2_02)) {
3418                 /*
3419                  * SMB1 only...
3420                  */
3421                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
3422
3423                 subreq = smbXcli_negprot_smb1_subreq(state);
3424                 if (tevent_req_nomem(subreq, req)) {
3425                         return tevent_req_post(req, ev);
3426                 }
3427                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
3428                 return req;
3429         }
3430
3431         if ((min_protocol >= PROTOCOL_SMB2_02) &&
3432             (max_protocol >= PROTOCOL_SMB2_02)) {
3433                 /*
3434                  * SMB2 only...
3435                  */
3436                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3437
3438                 subreq = smbXcli_negprot_smb2_subreq(state);
3439                 if (tevent_req_nomem(subreq, req)) {
3440                         return tevent_req_post(req, ev);
3441                 }
3442                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
3443                 return req;
3444         }
3445
3446         /*
3447          * We send an SMB1 negprot with the SMB2 dialects
3448          * and expect a SMB1 or a SMB2 response.
3449          *
3450          * smbXcli_negprot_dispatch_incoming() will fix the
3451          * callback to match protocol of the response.
3452          */
3453         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
3454
3455         subreq = smbXcli_negprot_smb1_subreq(state);
3456         if (tevent_req_nomem(subreq, req)) {
3457                 return tevent_req_post(req, ev);
3458         }
3459         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
3460         return req;
3461 }
3462
3463 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
3464 {
3465         struct tevent_req *req =
3466                 tevent_req_callback_data(subreq,
3467                 struct tevent_req);
3468         NTSTATUS status;
3469
3470         /*
3471          * we just want the low level error
3472          */
3473         status = tevent_req_simple_recv_ntstatus(subreq);
3474         TALLOC_FREE(subreq);
3475         if (tevent_req_nterror(req, status)) {
3476                 return;
3477         }
3478
3479         /* this should never happen */
3480         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
3481 }
3482
3483 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
3484 {
3485         size_t i;
3486         DATA_BLOB bytes = data_blob_null;
3487         uint8_t flags;
3488         uint16_t flags2;
3489
3490         /* setup the protocol strings */
3491         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
3492                 uint8_t c = 2;
3493                 bool ok;
3494
3495                 if (smb1cli_prots[i].proto < state->min_protocol) {
3496                         continue;
3497                 }
3498
3499                 if (smb1cli_prots[i].proto > state->max_protocol) {
3500                         continue;
3501                 }
3502
3503                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
3504                 if (!ok) {
3505                         return NULL;
3506                 }
3507
3508                 /*
3509                  * We now it is already ascii and
3510                  * we want NULL termination.
3511                  */
3512                 ok = data_blob_append(state, &bytes,
3513                                       smb1cli_prots[i].smb1_name,
3514                                       strlen(smb1cli_prots[i].smb1_name)+1);
3515                 if (!ok) {
3516                         return NULL;
3517                 }
3518         }
3519
3520         smb1cli_req_flags(state->max_protocol,
3521                           state->conn->smb1.client.capabilities,
3522                           SMBnegprot,
3523                           0, 0, &flags,
3524                           0, 0, &flags2);
3525
3526         return smb1cli_req_send(state, state->ev, state->conn,
3527                                 SMBnegprot,
3528                                 flags, ~flags,
3529                                 flags2, ~flags2,
3530                                 state->timeout_msec,
3531                                 0xFFFE, 0, 0, /* pid, tid, uid */
3532                                 0, NULL, /* wct, vwv */
3533                                 bytes.length, bytes.data);
3534 }
3535
3536 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
3537 {
3538         struct tevent_req *req =
3539                 tevent_req_callback_data(subreq,
3540                 struct tevent_req);
3541         struct smbXcli_negprot_state *state =
3542                 tevent_req_data(req,
3543                 struct smbXcli_negprot_state);
3544         struct smbXcli_conn *conn = state->conn;
3545         struct iovec *recv_iov = NULL;
3546         uint8_t *inhdr;
3547         uint8_t wct;
3548         uint16_t *vwv;
3549         uint32_t num_bytes;
3550         uint8_t *bytes;
3551         NTSTATUS status;
3552         uint16_t protnum;
3553         size_t i;
3554         size_t num_prots = 0;
3555         uint8_t flags;
3556         uint32_t client_capabilities = conn->smb1.client.capabilities;
3557         uint32_t both_capabilities;
3558         uint32_t server_capabilities = 0;
3559         uint32_t capabilities;
3560         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
3561         uint32_t server_max_xmit = 0;
3562         uint32_t max_xmit;
3563         uint32_t server_max_mux = 0;
3564         uint16_t server_security_mode = 0;
3565         uint32_t server_session_key = 0;
3566         bool server_readbraw = false;
3567         bool server_writebraw = false;
3568         bool server_lockread = false;
3569         bool server_writeunlock = false;
3570         struct GUID server_guid = GUID_zero();
3571         DATA_BLOB server_gss_blob = data_blob_null;
3572         uint8_t server_challenge[8];
3573         char *server_workgroup = NULL;
3574         char *server_name = NULL;
3575         int server_time_zone = 0;
3576         NTTIME server_system_time = 0;
3577         static const struct smb1cli_req_expected_response expected[] = {
3578         {
3579                 .status = NT_STATUS_OK,
3580                 .wct = 0x11, /* NT1 */
3581         },
3582         {
3583                 .status = NT_STATUS_OK,
3584                 .wct = 0x0D, /* LM */
3585         },
3586         {
3587                 .status = NT_STATUS_OK,
3588                 .wct = 0x01, /* CORE */
3589         }
3590         };
3591
3592         ZERO_STRUCT(server_challenge);
3593
3594         status = smb1cli_req_recv(subreq, state,
3595                                   &recv_iov,
3596                                   &inhdr,
3597                                   &wct,
3598                                   &vwv,
3599                                   NULL, /* pvwv_offset */
3600                                   &num_bytes,
3601                                   &bytes,
3602                                   NULL, /* pbytes_offset */
3603                                   NULL, /* pinbuf */
3604                                   expected, ARRAY_SIZE(expected));
3605         TALLOC_FREE(subreq);
3606         if (tevent_req_nterror(req, status)) {
3607                 return;
3608         }
3609
3610         flags = CVAL(inhdr, HDR_FLG);
3611
3612         protnum = SVAL(vwv, 0);
3613
3614         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
3615                 if (smb1cli_prots[i].proto < state->min_protocol) {
3616                         continue;
3617                 }
3618
3619                 if (smb1cli_prots[i].proto > state->max_protocol) {
3620                         continue;
3621                 }
3622
3623                 if (protnum != num_prots) {
3624                         num_prots++;
3625                         continue;
3626                 }
3627
3628                 conn->protocol = smb1cli_prots[i].proto;
3629                 break;
3630         }
3631
3632         if (conn->protocol == PROTOCOL_NONE) {
3633                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3634                 return;
3635         }
3636
3637         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
3638                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
3639                          "and the selected protocol level doesn't support it.\n"));
3640                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
3641                 return;
3642         }
3643
3644         if (flags & FLAG_SUPPORT_LOCKREAD) {
3645                 server_lockread = true;
3646                 server_writeunlock = true;
3647         }
3648
3649         if (conn->protocol >= PROTOCOL_NT1) {
3650                 const char *client_signing = NULL;
3651                 bool server_mandatory = false;
3652                 bool server_allowed = false;
3653                 const char *server_signing = NULL;
3654                 bool ok;
3655                 uint8_t key_len;
3656
3657                 if (wct != 0x11) {
3658                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3659                         return;
3660                 }
3661
3662                 /* NT protocol */
3663                 server_security_mode = CVAL(vwv + 1, 0);
3664                 server_max_mux = SVAL(vwv + 1, 1);
3665                 server_max_xmit = IVAL(vwv + 3, 1);
3666                 server_session_key = IVAL(vwv + 7, 1);
3667                 server_time_zone = SVALS(vwv + 15, 1);
3668                 server_time_zone *= 60;
3669                 /* this time arrives in real GMT */
3670                 server_system_time = BVAL(vwv + 11, 1);
3671                 server_capabilities = IVAL(vwv + 9, 1);
3672
3673                 key_len = CVAL(vwv + 16, 1);
3674
3675                 if (server_capabilities & CAP_RAW_MODE) {
3676                         server_readbraw = true;
3677                         server_writebraw = true;
3678                 }
3679                 if (server_capabilities & CAP_LOCK_AND_READ) {
3680                         server_lockread = true;
3681                 }
3682
3683                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
3684                         DATA_BLOB blob1, blob2;
3685
3686                         if (num_bytes < 16) {
3687                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3688                                 return;
3689                         }
3690
3691                         blob1 = data_blob_const(bytes, 16);
3692                         status = GUID_from_data_blob(&blob1, &server_guid);
3693                         if (tevent_req_nterror(req, status)) {
3694                                 return;
3695                         }
3696
3697                         blob1 = data_blob_const(bytes+16, num_bytes-16);
3698                         blob2 = data_blob_dup_talloc(state, blob1);
3699                         if (blob1.length > 0 &&
3700                             tevent_req_nomem(blob2.data, req)) {
3701                                 return;
3702                         }
3703                         server_gss_blob = blob2;
3704                 } else {
3705                         DATA_BLOB blob1, blob2;
3706
3707                         if (num_bytes < key_len) {
3708                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3709                                 return;
3710                         }
3711
3712                         if (key_len != 0 && key_len != 8) {
3713                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3714                                 return;
3715                         }
3716
3717                         if (key_len == 8) {
3718                                 memcpy(server_challenge, bytes, 8);
3719                         }
3720
3721                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
3722                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
3723                         if (blob1.length > 0) {
3724                                 size_t len;
3725
3726                                 len = utf16_len_n(blob1.data,
3727                                                   blob1.length);
3728                                 blob1.length = len;
3729
3730                                 ok = convert_string_talloc(state,
3731                                                            CH_UTF16LE,
3732                                                            CH_UNIX,
3733                                                            blob1.data,
3734                                                            blob1.length,
3735                                                            &server_workgroup,
3736                                                            &len);
3737                                 if (!ok) {
3738                                         status = map_nt_error_from_unix_common(errno);
3739                                         tevent_req_nterror(req, status);
3740                                         return;
3741                                 }
3742                         }
3743
3744                         blob2.data += blob1.length;
3745                         blob2.length -= blob1.length;
3746                         if (blob2.length > 0) {
3747                                 size_t len;
3748
3749                                 len = utf16_len_n(blob1.data,
3750                                                   blob1.length);
3751                                 blob1.length = len;
3752
3753                                 ok = convert_string_talloc(state,
3754                                                            CH_UTF16LE,
3755                                                            CH_UNIX,
3756                                                            blob2.data,
3757                                                            blob2.length,
3758                                                            &server_name,
3759                                                            &len);
3760                                 if (!ok) {
3761                                         status = map_nt_error_from_unix_common(errno);
3762                                         tevent_req_nterror(req, status);
3763                                         return;
3764                                 }
3765                         }
3766                 }
3767
3768                 client_signing = "disabled";
3769                 if (conn->allow_signing) {
3770                         client_signing = "allowed";
3771                 }
3772                 if (conn->mandatory_signing) {
3773                         client_signing = "required";
3774                 }
3775
3776                 server_signing = "not supported";
3777                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
3778                         server_signing = "supported";
3779                         server_allowed = true;
3780                 }
3781                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
3782                         server_signing = "required";
3783                         server_mandatory = true;
3784                 }
3785
3786                 ok = smb_signing_set_negotiated(conn->smb1.signing,
3787                                                 server_allowed,
3788                                                 server_mandatory);
3789                 if (!ok) {
3790                         DEBUG(1,("cli_negprot: SMB signing is required, "
3791                                  "but client[%s] and server[%s] mismatch\n",
3792                                  client_signing, server_signing));
3793                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
3794                         return;
3795                 }
3796
3797         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
3798                 DATA_BLOB blob1;
3799                 uint8_t key_len;
3800                 time_t t;
3801
3802                 if (wct != 0x0D) {
3803                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3804                         return;
3805                 }
3806
3807                 server_security_mode = SVAL(vwv + 1, 0);
3808                 server_max_xmit = SVAL(vwv + 2, 0);
3809                 server_max_mux = SVAL(vwv + 3, 0);
3810                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
3811                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
3812                 server_session_key = IVAL(vwv + 6, 0);
3813                 server_time_zone = SVALS(vwv + 10, 0);
3814                 server_time_zone *= 60;
3815                 /* this time is converted to GMT by make_unix_date */
3816                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
3817                 unix_to_nt_time(&server_system_time, t);
3818                 key_len = SVAL(vwv + 11, 0);
3819
3820                 if (num_bytes < key_len) {
3821                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3822                         return;
3823                 }
3824
3825                 if (key_len != 0 && key_len != 8) {
3826                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3827                         return;
3828                 }
3829
3830                 if (key_len == 8) {
3831                         memcpy(server_challenge, bytes, 8);
3832                 }
3833
3834                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
3835                 if (blob1.length > 0) {
3836                         size_t len;
3837                         bool ok;
3838
3839                         len = utf16_len_n(blob1.data,
3840                                           blob1.length);
3841                         blob1.length = len;
3842
3843                         ok = convert_string_talloc(state,
3844                                                    CH_DOS,
3845                                                    CH_UNIX,
3846                                                    blob1.data,
3847                                                    blob1.length,
3848                                                    &server_workgroup,
3849                                                    &len);
3850                         if (!ok) {
3851                                 status = map_nt_error_from_unix_common(errno);
3852                                 tevent_req_nterror(req, status);
3853                                 return;
3854                         }
3855                 }
3856
3857         } else {
3858                 /* the old core protocol */
3859                 server_time_zone = get_time_zone(time(NULL));
3860                 server_max_xmit = 1024;
3861                 server_max_mux = 1;
3862         }
3863
3864         if (server_max_xmit < 1024) {
3865                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3866                 return;
3867         }
3868
3869         if (server_max_mux < 1) {
3870                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3871                 return;
3872         }
3873
3874         /*
3875          * Now calculate the negotiated capabilities
3876          * based on the mask for:
3877          * - client only flags
3878          * - flags used in both directions
3879          * - server only flags
3880          */
3881         both_capabilities = client_capabilities & server_capabilities;
3882         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
3883         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
3884         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
3885
3886         max_xmit = MIN(client_max_xmit, server_max_xmit);
3887
3888         conn->smb1.server.capabilities = server_capabilities;
3889         conn->smb1.capabilities = capabilities;
3890
3891         conn->smb1.server.max_xmit = server_max_xmit;
3892         conn->smb1.max_xmit = max_xmit;
3893
3894         conn->smb1.server.max_mux = server_max_mux;
3895
3896         conn->smb1.server.security_mode = server_security_mode;
3897
3898         conn->smb1.server.readbraw = server_readbraw;
3899         conn->smb1.server.writebraw = server_writebraw;
3900         conn->smb1.server.lockread = server_lockread;
3901         conn->smb1.server.writeunlock = server_writeunlock;
3902
3903         conn->smb1.server.session_key = server_session_key;
3904
3905         talloc_steal(conn, server_gss_blob.data);
3906         conn->smb1.server.gss_blob = server_gss_blob;
3907         conn->smb1.server.guid = server_guid;
3908         memcpy(conn->smb1.server.challenge, server_challenge, 8);
3909         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
3910         conn->smb1.server.name = talloc_move(conn, &server_name);
3911
3912         conn->smb1.server.time_zone = server_time_zone;
3913         conn->smb1.server.system_time = server_system_time;
3914
3915         tevent_req_done(req);
3916 }
3917
3918 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
3919 {
3920         size_t i;
3921         uint8_t *buf;
3922         uint16_t dialect_count = 0;
3923
3924         buf = state->smb2.dyn;
3925         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
3926                 if (smb2cli_prots[i].proto < state->min_protocol) {
3927                         continue;
3928                 }
3929
3930                 if (smb2cli_prots[i].proto > state->max_protocol) {
3931                         continue;
3932                 }
3933
3934                 SSVAL(buf, dialect_count*2, smb2cli_prots[i].smb2_dialect);
3935                 dialect_count++;
3936         }
3937
3938         buf = state->smb2.fixed;
3939         SSVAL(buf, 0, 36);
3940         SSVAL(buf, 2, dialect_count);
3941         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
3942         SSVAL(buf, 6, 0);       /* Reserved */
3943         if (state->max_protocol >= PROTOCOL_SMB2_22) {
3944                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
3945         } else {
3946                 SIVAL(buf, 8, 0);       /* Capabilities */
3947         }
3948         if (state->max_protocol >= PROTOCOL_SMB2_10) {
3949                 NTSTATUS status;
3950                 DATA_BLOB blob;
3951
3952                 status = GUID_to_ndr_blob(&state->conn->smb2.client.guid,
3953                                           state, &blob);
3954                 if (!NT_STATUS_IS_OK(status)) {
3955                         return NULL;
3956                 }
3957                 memcpy(buf+12, blob.data, 16); /* ClientGuid */
3958         } else {
3959                 memset(buf+12, 0, 16);  /* ClientGuid */
3960         }
3961         SBVAL(buf, 28, 0);      /* ClientStartTime */
3962
3963         return smb2cli_req_send(state, state->ev,
3964                                 state->conn, SMB2_OP_NEGPROT,
3965                                 0, 0, /* flags */
3966                                 state->timeout_msec,
3967                                 0xFEFF, 0, NULL, /* pid, tid, session */
3968                                 state->smb2.fixed, sizeof(state->smb2.fixed),
3969                                 state->smb2.dyn, dialect_count*2);
3970 }
3971
3972 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
3973 {
3974         struct tevent_req *req =
3975                 tevent_req_callback_data(subreq,
3976                 struct tevent_req);
3977         struct smbXcli_negprot_state *state =
3978                 tevent_req_data(req,
3979                 struct smbXcli_negprot_state);
3980         struct smbXcli_conn *conn = state->conn;
3981         size_t security_offset, security_length;
3982         DATA_BLOB blob;
3983         NTSTATUS status;
3984         struct iovec *iov;
3985         uint8_t *body;
3986         size_t i;
3987         uint16_t dialect_revision;
3988         static const struct smb2cli_req_expected_response expected[] = {
3989         {
3990                 .status = NT_STATUS_OK,
3991                 .body_size = 0x41
3992         }
3993         };
3994
3995         status = smb2cli_req_recv(subreq, state, &iov,
3996                                   expected, ARRAY_SIZE(expected));
3997         TALLOC_FREE(subreq);
3998         if (tevent_req_nterror(req, status)) {
3999                 return;
4000         }
4001
4002         body = (uint8_t *)iov[1].iov_base;
4003
4004         dialect_revision = SVAL(body, 4);
4005
4006         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4007                 if (smb2cli_prots[i].proto < state->min_protocol) {
4008                         continue;
4009                 }
4010
4011                 if (smb2cli_prots[i].proto > state->max_protocol) {
4012                         continue;
4013                 }
4014
4015                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
4016                         continue;
4017                 }
4018
4019                 conn->protocol = smb2cli_prots[i].proto;
4020                 break;
4021         }
4022
4023         if (conn->protocol == PROTOCOL_NONE) {
4024                 if (state->min_protocol >= PROTOCOL_SMB2_02) {
4025                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4026                         return;
4027                 }
4028
4029                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
4030                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4031                         return;
4032                 }
4033
4034                 /* make sure we do not loop forever */
4035                 state->min_protocol = PROTOCOL_SMB2_02;
4036
4037                 /*
4038                  * send a SMB2 negprot, in order to negotiate
4039                  * the SMB2 dialect.
4040                  */
4041                 subreq = smbXcli_negprot_smb2_subreq(state);
4042                 if (tevent_req_nomem(subreq, req)) {
4043                         return;
4044                 }
4045                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4046                 return;
4047         }
4048
4049         conn->smb2.server.security_mode = SVAL(body, 2);
4050
4051         blob = data_blob_const(body + 8, 16);
4052         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
4053         if (tevent_req_nterror(req, status)) {
4054                 return;
4055         }
4056
4057         conn->smb2.server.capabilities  = IVAL(body, 24);
4058         conn->smb2.server.max_trans_size= IVAL(body, 28);
4059         conn->smb2.server.max_read_size = IVAL(body, 32);
4060         conn->smb2.server.max_write_size= IVAL(body, 36);
4061         conn->smb2.server.system_time   = BVAL(body, 40);
4062         conn->smb2.server.start_time    = BVAL(body, 48);
4063
4064         security_offset = SVAL(body, 56);
4065         security_length = SVAL(body, 58);
4066
4067         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
4068                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4069                 return;
4070         }
4071
4072         if (security_length > iov[2].iov_len) {
4073                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4074                 return;
4075         }
4076
4077         conn->smb2.server.gss_blob = data_blob_talloc(conn,
4078                                                 iov[2].iov_base,
4079                                                 security_length);
4080         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
4081                 return;
4082         }
4083
4084         tevent_req_done(req);
4085 }
4086
4087 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4088                                                   TALLOC_CTX *tmp_mem,
4089                                                   uint8_t *inbuf)
4090 {
4091         size_t num_pending = talloc_array_length(conn->pending);
4092         struct tevent_req *subreq;
4093         struct smbXcli_req_state *substate;
4094         struct tevent_req *req;
4095         uint32_t protocol_magic;
4096         size_t inbuf_len = smb_len_nbt(inbuf);
4097
4098         if (num_pending != 1) {
4099                 return NT_STATUS_INTERNAL_ERROR;
4100         }
4101
4102         if (inbuf_len < 4) {
4103                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4104         }
4105
4106         subreq = conn->pending[0];
4107         substate = tevent_req_data(subreq, struct smbXcli_req_state);
4108         req = tevent_req_callback_data(subreq, struct tevent_req);
4109
4110         protocol_magic = IVAL(inbuf, 4);
4111
4112         switch (protocol_magic) {
4113         case SMB_MAGIC:
4114                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4115                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4116                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4117
4118         case SMB2_MAGIC:
4119                 if (substate->smb2.recv_iov == NULL) {
4120                         /*
4121                          * For the SMB1 negprot we have move it.
4122                          */
4123                         substate->smb2.recv_iov = substate->smb1.recv_iov;
4124                         substate->smb1.recv_iov = NULL;
4125                 }
4126
4127                 /*
4128                  * we got an SMB2 answer, which consumed sequence number 0
4129                  * so we need to use 1 as the next one
4130                  */
4131                 conn->smb2.mid = 1;
4132                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4133                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4134                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4135         }
4136
4137         DEBUG(10, ("Got non-SMB PDU\n"));
4138         return NT_STATUS_INVALID_NETWORK_RESPONSE;
4139 }
4140
4141 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
4142 {
4143         return tevent_req_simple_recv_ntstatus(req);
4144 }
4145
4146 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
4147                          uint32_t timeout_msec,
4148                          enum protocol_types min_protocol,
4149                          enum protocol_types max_protocol)
4150 {
4151         TALLOC_CTX *frame = talloc_stackframe();
4152         struct tevent_context *ev;
4153         struct tevent_req *req;
4154         NTSTATUS status = NT_STATUS_NO_MEMORY;
4155         bool ok;
4156
4157         if (smbXcli_conn_has_async_calls(conn)) {
4158                 /*
4159                  * Can't use sync call while an async call is in flight
4160                  */
4161                 status = NT_STATUS_INVALID_PARAMETER_MIX;
4162                 goto fail;
4163         }
4164         ev = tevent_context_init(frame);
4165         if (ev == NULL) {
4166                 goto fail;
4167         }
4168         req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
4169                                    min_protocol, max_protocol);
4170         if (req == NULL) {
4171                 goto fail;
4172         }
4173         ok = tevent_req_poll(req, ev);
4174         if (!ok) {
4175                 status = map_nt_error_from_unix_common(errno);
4176                 goto fail;
4177         }
4178         status = smbXcli_negprot_recv(req);
4179  fail:
4180         TALLOC_FREE(frame);
4181         return status;
4182 }
4183
4184 static int smbXcli_session_destructor(struct smbXcli_session *session)
4185 {
4186         if (session->conn == NULL) {
4187                 return 0;
4188         }
4189
4190         DLIST_REMOVE(session->conn->sessions, session);
4191         return 0;
4192 }
4193
4194 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
4195                                                struct smbXcli_conn *conn)
4196 {
4197         struct smbXcli_session *session;
4198
4199         session = talloc_zero(mem_ctx, struct smbXcli_session);
4200         if (session == NULL) {
4201                 return NULL;
4202         }
4203         talloc_set_destructor(session, smbXcli_session_destructor);
4204
4205         DLIST_ADD_END(conn->sessions, session, struct smbXcli_session *);
4206         session->conn = conn;
4207
4208         return session;
4209 }
4210
4211 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
4212 {
4213         struct smbXcli_conn *conn = session->conn;
4214         uint8_t security_mode = 0;
4215
4216         if (conn == NULL) {
4217                 return security_mode;
4218         }
4219
4220         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
4221         if (conn->mandatory_signing) {
4222                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
4223         }
4224
4225         return security_mode;
4226 }
4227
4228 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
4229 {
4230         return session->smb2.session_id;
4231 }
4232
4233 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
4234 {
4235         return session->smb2.session_flags;
4236 }
4237
4238 NTSTATUS smb2cli_session_application_key(struct smbXcli_session *session,
4239                                          TALLOC_CTX *mem_ctx,
4240                                          DATA_BLOB *key)
4241 {
4242         *key = data_blob_null;
4243
4244         if (session->smb2.application_key.length == 0) {
4245                 return NT_STATUS_NO_USER_SESSION_KEY;
4246         }
4247
4248         *key = data_blob_dup_talloc(mem_ctx, session->smb2.application_key);
4249         if (key->data == NULL) {
4250                 return NT_STATUS_NO_MEMORY;
4251         }
4252
4253         return NT_STATUS_OK;
4254 }
4255
4256 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
4257                                       uint64_t session_id,
4258                                       uint16_t session_flags)
4259 {
4260         session->smb2.session_id = session_id;
4261         session->smb2.session_flags = session_flags;
4262 }
4263
4264 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
4265                                          const DATA_BLOB _session_key,
4266                                          const struct iovec *recv_iov)
4267 {
4268         struct smbXcli_conn *conn = session->conn;
4269         uint16_t no_sign_flags;
4270         uint8_t session_key[16];
4271         NTSTATUS status;
4272
4273         if (conn == NULL) {
4274                 return NT_STATUS_INVALID_PARAMETER_MIX;
4275         }
4276
4277         no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
4278
4279         if (session->smb2.session_flags & no_sign_flags) {
4280                 session->smb2.should_sign = false;
4281                 return NT_STATUS_OK;
4282         }
4283
4284         if (session->smb2.signing_key.length != 0) {
4285                 return NT_STATUS_INVALID_PARAMETER_MIX;
4286         }
4287
4288         ZERO_STRUCT(session_key);
4289         memcpy(session_key, _session_key.data,
4290                MIN(_session_key.length, sizeof(session_key)));
4291
4292         session->smb2.signing_key = data_blob_talloc(session,
4293                                                      session_key,
4294                                                      sizeof(session_key));
4295         if (session->smb2.signing_key.data == NULL) {
4296                 ZERO_STRUCT(session_key);
4297                 return NT_STATUS_NO_MEMORY;
4298         }
4299
4300         if (conn->protocol >= PROTOCOL_SMB2_24) {
4301                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
4302                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
4303
4304                 smb2_key_derivation(session_key, sizeof(session_key),
4305                                     label.data, label.length,
4306                                     context.data, context.length,
4307                                     session->smb2.signing_key.data);
4308         }
4309
4310         session->smb2.encryption_key = data_blob_dup_talloc(session,
4311                                                 session->smb2.signing_key);
4312         if (session->smb2.encryption_key.data == NULL) {
4313                 ZERO_STRUCT(session_key);
4314                 return NT_STATUS_NO_MEMORY;
4315         }
4316
4317         if (conn->protocol >= PROTOCOL_SMB2_24) {
4318                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
4319                 const DATA_BLOB context = data_blob_string_const_null("ServerIn ");
4320
4321                 smb2_key_derivation(session_key, sizeof(session_key),
4322                                     label.data, label.length,
4323                                     context.data, context.length,
4324                                     session->smb2.encryption_key.data);
4325         }
4326
4327         session->smb2.decryption_key = data_blob_dup_talloc(session,
4328                                                 session->smb2.signing_key);
4329         if (session->smb2.decryption_key.data == NULL) {
4330                 ZERO_STRUCT(session_key);
4331                 return NT_STATUS_NO_MEMORY;
4332         }
4333
4334         if (conn->protocol >= PROTOCOL_SMB2_24) {
4335                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
4336                 const DATA_BLOB context = data_blob_string_const_null("ServerOut");
4337
4338                 smb2_key_derivation(session_key, sizeof(session_key),
4339                                     label.data, label.length,
4340                                     context.data, context.length,
4341                                     session->smb2.decryption_key.data);
4342         }
4343
4344         session->smb2.application_key = data_blob_dup_talloc(session,
4345                                                 session->smb2.signing_key);
4346         if (session->smb2.application_key.data == NULL) {
4347                 ZERO_STRUCT(session_key);
4348                 return NT_STATUS_NO_MEMORY;
4349         }
4350
4351         if (conn->protocol >= PROTOCOL_SMB2_24) {
4352                 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
4353                 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
4354
4355                 smb2_key_derivation(session_key, sizeof(session_key),
4356                                     label.data, label.length,
4357                                     context.data, context.length,
4358                                     session->smb2.application_key.data);
4359         }
4360         ZERO_STRUCT(session_key);
4361
4362         session->smb2.channel_signing_key = data_blob_dup_talloc(session,
4363                                                 session->smb2.signing_key);
4364         if (session->smb2.channel_signing_key.data == NULL) {
4365                 return NT_STATUS_NO_MEMORY;
4366         }
4367
4368         status = smb2_signing_check_pdu(session->smb2.channel_signing_key,
4369                                         session->conn->protocol,
4370                                         recv_iov, 3);
4371         if (!NT_STATUS_IS_OK(status)) {
4372                 return status;
4373         }
4374
4375         session->smb2.should_sign = false;
4376         session->smb2.should_encrypt = false;
4377
4378         if (conn->desire_signing) {
4379                 session->smb2.should_sign = true;
4380         }
4381
4382         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
4383                 session->smb2.should_sign = true;
4384         }
4385
4386         if (session->smb2.session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
4387                 session->smb2.should_encrypt = true;
4388         }
4389
4390         if (conn->protocol < PROTOCOL_SMB2_24) {
4391                 session->smb2.should_encrypt = false;
4392         }
4393
4394         if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
4395                 session->smb2.should_encrypt = false;
4396         }
4397
4398         generate_random_buffer((uint8_t *)&session->smb2.channel_nonce,
4399                                sizeof(session->smb2.channel_nonce));
4400         session->smb2.channel_next = 1;
4401
4402         return NT_STATUS_OK;
4403 }
4404
4405 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
4406                                         struct smbXcli_session *session1,
4407                                         struct smbXcli_conn *conn,
4408                                         struct smbXcli_session **_session2)
4409 {
4410         struct smbXcli_session *session2;
4411
4412         if (session1->smb2.signing_key.length == 0) {
4413                 return NT_STATUS_INVALID_PARAMETER_MIX;
4414         }
4415
4416         if (session1->smb2.channel_next == 0) {
4417                 return NT_STATUS_INVALID_PARAMETER_MIX;
4418         }
4419
4420         if (conn == NULL) {
4421                 return NT_STATUS_INVALID_PARAMETER_MIX;
4422         }
4423
4424         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
4425         if (session2 == NULL) {
4426                 return NT_STATUS_NO_MEMORY;
4427         }
4428         session2->smb2.session_id = session1->smb2.session_id;
4429         session2->smb2.session_flags = session1->smb2.session_flags;
4430
4431         session2->smb2.signing_key = data_blob_dup_talloc(session2,
4432                                                 session1->smb2.signing_key);
4433         if (session2->smb2.signing_key.data == NULL) {
4434                 return NT_STATUS_NO_MEMORY;
4435         }
4436
4437         session2->smb2.application_key = data_blob_dup_talloc(session2,
4438                                                 session1->smb2.application_key);
4439         if (session2->smb2.application_key.data == NULL) {
4440                 return NT_STATUS_NO_MEMORY;
4441         }
4442
4443         session2->smb2.should_sign = session1->smb2.should_sign;
4444         session2->smb2.should_encrypt = session1->smb2.should_encrypt;
4445
4446         session2->smb2.channel_nonce = session1->smb2.channel_nonce;
4447         session2->smb2.channel_nonce += session1->smb2.channel_next;
4448         session1->smb2.channel_next++;
4449
4450         session2->smb2.encryption_key = data_blob_dup_talloc(session2,
4451                                                 session1->smb2.encryption_key);
4452         if (session2->smb2.encryption_key.data == NULL) {
4453                 return NT_STATUS_NO_MEMORY;
4454         }
4455
4456         session2->smb2.decryption_key = data_blob_dup_talloc(session2,
4457                                                 session1->smb2.decryption_key);
4458         if (session2->smb2.decryption_key.data == NULL) {
4459                 return NT_STATUS_NO_MEMORY;
4460         }
4461
4462         talloc_set_destructor(session2, smbXcli_session_destructor);
4463         DLIST_ADD_END(conn->sessions, session2, struct smbXcli_session *);
4464         session2->conn = conn;
4465
4466         *_session2 = session2;
4467         return NT_STATUS_OK;
4468 }
4469
4470 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
4471                                          const DATA_BLOB _channel_key,
4472                                          const struct iovec *recv_iov)
4473 {
4474         struct smbXcli_conn *conn = session->conn;
4475         uint8_t channel_key[16];
4476         NTSTATUS status;
4477
4478         if (conn == NULL) {
4479                 return NT_STATUS_INVALID_PARAMETER_MIX;
4480         }
4481
4482         if (session->smb2.channel_signing_key.length != 0) {
4483                 return NT_STATUS_INVALID_PARAMETER_MIX;
4484         }
4485
4486         ZERO_STRUCT(channel_key);
4487         memcpy(channel_key, _channel_key.data,
4488                MIN(_channel_key.length, sizeof(channel_key)));
4489
4490         session->smb2.channel_signing_key = data_blob_talloc(session,
4491                                                 channel_key,
4492                                                 sizeof(channel_key));
4493         if (session->smb2.channel_signing_key.data == NULL) {
4494                 ZERO_STRUCT(channel_key);
4495                 return NT_STATUS_NO_MEMORY;
4496         }
4497
4498         if (conn->protocol >= PROTOCOL_SMB2_24) {
4499                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
4500                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
4501
4502                 smb2_key_derivation(channel_key, sizeof(channel_key),
4503                                     label.data, label.length,
4504                                     context.data, context.length,
4505                                     session->smb2.channel_signing_key.data);
4506         }
4507         ZERO_STRUCT(channel_key);
4508
4509         status = smb2_signing_check_pdu(session->smb2.channel_signing_key,
4510                                         session->conn->protocol,
4511                                         recv_iov, 3);
4512         if (!NT_STATUS_IS_OK(status)) {
4513                 return status;
4514         }
4515
4516         return NT_STATUS_OK;
4517 }