libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "lib/util/iov_buf.h"
  29 #include "../libcli/smb/smb_common.h"
  30 #include "../libcli/smb/smb_seal.h"
  31 #include "../libcli/smb/smb_signing.h"
  32 #include "../libcli/smb/read_smb.h"
  33 #include "smbXcli_base.h"
  34 #include "librpc/ndr/libndr.h"
  35 #include "libcli/smb/smb2_negotiate_context.h"
  36 #include "libcli/smb/smb2_signing.h"
  37
  38 #include "lib/crypto/gnutls_helpers.h"
  39 #include <gnutls/gnutls.h>
  40 #include <gnutls/crypto.h>
  41
  42 struct smbXcli_conn;
  43 struct smbXcli_req;
  44 struct smbXcli_session;
  45 struct smbXcli_tcon;
  46
  47 struct smbXcli_conn {
  48         int sock_fd;
  49         struct sockaddr_storage local_ss;
  50         struct sockaddr_storage remote_ss;
  51         const char *remote_name;
  52
  53         struct tevent_queue *outgoing;
  54         struct tevent_req **pending;
  55         struct tevent_req *read_smb_req;
  56         struct tevent_req *suicide_req;
  57
  58         enum protocol_types min_protocol;
  59         enum protocol_types max_protocol;
  60         enum protocol_types protocol;
  61         bool allow_signing;
  62         bool desire_signing;
  63         bool mandatory_signing;
  64
  65         /*
  66          * The incoming dispatch function should return:
  67          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  68          * - NT_STATUS_OK, if no more processing is desired, e.g.
  69          *                 the dispatch function called
  70          *                 tevent_req_done().
  71          * - All other return values disconnect the connection.
  72          */
  73         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  74                                       TALLOC_CTX *tmp_mem,
  75                                       uint8_t *inbuf);
  76
  77         struct {
  78                 struct {
  79                         uint32_t capabilities;
  80                         uint32_t max_xmit;
  81                 } client;
  82
  83                 struct {
  84                         uint32_t capabilities;
  85                         uint32_t max_xmit;
  86                         uint16_t max_mux;
  87                         uint16_t security_mode;
  88                         bool readbraw;
  89                         bool writebraw;
  90                         bool lockread;
  91                         bool writeunlock;
  92                         uint32_t session_key;
  93                         struct GUID guid;
  94                         DATA_BLOB gss_blob;
  95                         uint8_t challenge[8];
  96                         const char *workgroup;
  97                         const char *name;
  98                         int time_zone;
  99                         NTTIME system_time;
 100                 } server;
 101
 102                 uint32_t capabilities;
 103                 uint32_t max_xmit;
 104
 105                 uint16_t mid;
 106
 107                 struct smb_signing_state *signing;
 108                 struct smb_trans_enc_state *trans_enc;
 109
 110                 struct tevent_req *read_braw_req;
 111         } smb1;
 112
 113         struct {
 114                 struct {
 115                         uint32_t capabilities;
 116                         uint16_t security_mode;
 117                         struct GUID guid;
 118                         struct smb311_capabilities smb3_capabilities;
 119                 } client;
 120
 121                 struct {
 122                         uint32_t capabilities;
 123                         uint16_t security_mode;
 124                         struct GUID guid;
 125                         uint32_t max_trans_size;
 126                         uint32_t max_read_size;
 127                         uint32_t max_write_size;
 128                         NTTIME system_time;
 129                         NTTIME start_time;
 130                         DATA_BLOB gss_blob;
 131                         uint16_t sign_algo;
 132                         uint16_t cipher;
 133                 } server;
 134
 135                 uint64_t mid;
 136                 uint16_t cur_credits;
 137                 uint16_t max_credits;
 138
 139                 uint32_t cc_chunk_len;
 140                 uint32_t cc_max_chunks;
 141
 142                 uint8_t io_priority;
 143
 144                 bool force_channel_sequence;
 145
 146                 uint8_t preauth_sha512[64];
 147         } smb2;
 148
 149         struct smbXcli_session *sessions;
 150 };
 151
 152 struct smb2cli_session {
 153         uint64_t session_id;
 154         uint16_t session_flags;
 155         struct smb2_signing_key *application_key;
 156         struct smb2_signing_key *signing_key;
 157         bool should_sign;
 158         bool should_encrypt;
 159         struct smb2_signing_key *encryption_key;
 160         struct smb2_signing_key *decryption_key;
 161         uint64_t nonce_high_random;
 162         uint64_t nonce_high_max;
 163         uint64_t nonce_high;
 164         uint64_t nonce_low;
 165         uint16_t channel_sequence;
 166         bool replay_active;
 167         bool require_signed_response;
 168 };
 169
 170 struct smbXcli_session {
 171         struct smbXcli_session *prev, *next;
 172         struct smbXcli_conn *conn;
 173
 174         struct {
 175                 uint16_t session_id;
 176                 uint16_t action;
 177                 DATA_BLOB application_key;
 178                 bool protected_key;
 179         } smb1;
 180
 181         struct smb2cli_session *smb2;
 182
 183         struct {
 184                 struct smb2_signing_key *signing_key;
 185                 uint8_t preauth_sha512[64];
 186         } smb2_channel;
 187
 188         /*
 189          * this should be a short term hack
 190          * until the upper layers have implemented
 191          * re-authentication.
 192          */
 193         bool disconnect_expired;
 194 };
 195
 196 struct smbXcli_tcon {
 197         bool is_smb1;
 198         uint32_t fs_attributes;
 199
 200         struct {
 201                 uint16_t tcon_id;
 202                 uint16_t optional_support;
 203                 uint32_t maximal_access;
 204                 uint32_t guest_maximal_access;
 205                 char *service;
 206                 char *fs_type;
 207         } smb1;
 208
 209         struct {
 210                 uint32_t tcon_id;
 211                 uint8_t type;
 212                 uint32_t flags;
 213                 uint32_t capabilities;
 214                 uint32_t maximal_access;
 215                 bool should_sign;
 216                 bool should_encrypt;
 217         } smb2;
 218 };
 219
 220 struct smbXcli_req_state {
 221         struct tevent_context *ev;
 222         struct smbXcli_conn *conn;
 223         struct smbXcli_session *session; /* maybe NULL */
 224         struct smbXcli_tcon *tcon; /* maybe NULL */
 225
 226         uint8_t length_hdr[4];
 227
 228         bool one_way;
 229
 230         uint8_t *inbuf;
 231
 232         struct tevent_req *write_req;
 233
 234         struct timeval endtime;
 235
 236         struct {
 237                 /* Space for the header including the wct */
 238                 uint8_t hdr[HDR_VWV];
 239
 240                 /*
 241                  * For normal requests, smb1cli_req_send chooses a mid.
 242                  * SecondaryV trans requests need to use the mid of the primary
 243                  * request, so we need a place to store it.
 244                  * Assume it is set if != 0.
 245                  */
 246                 uint16_t mid;
 247
 248                 uint16_t *vwv;
 249                 uint8_t bytecount_buf[2];
 250
 251 #define MAX_SMB_IOV 10
 252                 /* length_hdr, hdr, words, byte_count, buffers */
 253                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 254                 int iov_count;
 255
 256                 bool one_way_seqnum;
 257                 uint32_t seqnum;
 258                 struct tevent_req **chained_requests;
 259
 260                 uint8_t recv_cmd;
 261                 NTSTATUS recv_status;
 262                 /* always an array of 3 talloc elements */
 263                 struct iovec *recv_iov;
 264         } smb1;
 265
 266         struct {
 267                 const uint8_t *fixed;
 268                 uint16_t fixed_len;
 269                 const uint8_t *dyn;
 270                 uint32_t dyn_len;
 271
 272                 uint8_t transform[SMB2_TF_HDR_SIZE];
 273                 uint8_t hdr[SMB2_HDR_BODY];
 274                 uint8_t pad[7]; /* padding space for compounding */
 275
 276                 /*
 277                  * always an array of 3 talloc elements
 278                  * (without a SMB2_TRANSFORM header!)
 279                  *
 280                  * HDR, BODY, DYN
 281                  */
 282                 struct iovec *recv_iov;
 283
 284                 /*
 285                  * the expected max for the response dyn_len
 286                  */
 287                 uint32_t max_dyn_len;
 288
 289                 uint16_t credit_charge;
 290
 291                 bool should_sign;
 292                 bool should_encrypt;
 293                 uint64_t encryption_session_id;
 294
 295                 bool signing_skipped;
 296                 bool require_signed_response;
 297                 bool notify_async;
 298                 bool got_async;
 299                 uint16_t cancel_flags;
 300                 uint64_t cancel_mid;
 301                 uint64_t cancel_aid;
 302         } smb2;
 303 };
 304
 305 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 306 {
 307         /*
 308          * NT_STATUS_OK, means we do not notify the callers
 309          */
 310         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 311
 312         while (conn->sessions) {
 313                 conn->sessions->conn = NULL;
 314                 DLIST_REMOVE(conn->sessions, conn->sessions);
 315         }
 316
 317         if (conn->smb1.trans_enc) {
 318                 TALLOC_FREE(conn->smb1.trans_enc);
 319         }
 320
 321         return 0;
 322 }
 323
 324 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 325                                          int fd,
 326                                          const char *remote_name,
 327                                          enum smb_signing_setting signing_state,
 328                                          uint32_t smb1_capabilities,
 329                                          struct GUID *client_guid,
 330                                          uint32_t smb2_capabilities,
 331                                          const struct smb311_capabilities *smb3_capabilities)
 332 {
 333         struct smbXcli_conn *conn = NULL;
 334         void *ss = NULL;
 335         struct sockaddr *sa = NULL;
 336         socklen_t sa_length;
 337         int ret;
 338
 339         if (smb3_capabilities != NULL) {
 340                 const struct smb3_signing_capabilities *sign_algos =
 341                         &smb3_capabilities->signing;
 342                 const struct smb3_encryption_capabilities *ciphers =
 343                         &smb3_capabilities->encryption;
 344
 345                 SMB_ASSERT(sign_algos->num_algos <= SMB3_SIGNING_CAPABILITIES_MAX_ALGOS);
 346                 SMB_ASSERT(ciphers->num_algos <= SMB3_ENCRYTION_CAPABILITIES_MAX_ALGOS);
 347         }
 348
 349         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 350         if (!conn) {
 351                 return NULL;
 352         }
 353
 354         ret = set_blocking(fd, false);
 355         if (ret < 0) {
 356                 goto error;
 357         }
 358         conn->sock_fd = fd;
 359
 360         conn->remote_name = talloc_strdup(conn, remote_name);
 361         if (conn->remote_name == NULL) {
 362                 goto error;
 363         }
 364
 365         ss = (void *)&conn->local_ss;
 366         sa = (struct sockaddr *)ss;
 367         sa_length = sizeof(conn->local_ss);
 368         ret = getsockname(fd, sa, &sa_length);
 369         if (ret == -1) {
 370                 goto error;
 371         }
 372         ss = (void *)&conn->remote_ss;
 373         sa = (struct sockaddr *)ss;
 374         sa_length = sizeof(conn->remote_ss);
 375         ret = getpeername(fd, sa, &sa_length);
 376         if (ret == -1) {
 377                 goto error;
 378         }
 379
 380         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 381         if (conn->outgoing == NULL) {
 382                 goto error;
 383         }
 384         conn->pending = NULL;
 385
 386         conn->min_protocol = PROTOCOL_NONE;
 387         conn->max_protocol = PROTOCOL_NONE;
 388         conn->protocol = PROTOCOL_NONE;
 389
 390         switch (signing_state) {
 391         case SMB_SIGNING_OFF:
 392                 /* never */
 393                 conn->allow_signing = false;
 394                 conn->desire_signing = false;
 395                 conn->mandatory_signing = false;
 396                 break;
 397         case SMB_SIGNING_DEFAULT:
 398         case SMB_SIGNING_IF_REQUIRED:
 399                 /* if the server requires it */
 400                 conn->allow_signing = true;
 401                 conn->desire_signing = false;
 402                 conn->mandatory_signing = false;
 403                 break;
 404         case SMB_SIGNING_DESIRED:
 405                 /* if the server desires it */
 406                 conn->allow_signing = true;
 407                 conn->desire_signing = true;
 408                 conn->mandatory_signing = false;
 409                 break;
 410         case SMB_SIGNING_IPC_DEFAULT:
 411         case SMB_SIGNING_REQUIRED:
 412                 /* always */
 413                 conn->allow_signing = true;
 414                 conn->desire_signing = true;
 415                 conn->mandatory_signing = true;
 416                 break;
 417         }
 418
 419         conn->smb1.client.capabilities = smb1_capabilities;
 420         conn->smb1.client.max_xmit = UINT16_MAX;
 421
 422         conn->smb1.capabilities = conn->smb1.client.capabilities;
 423         conn->smb1.max_xmit = 1024;
 424
 425         conn->smb1.mid = 1;
 426
 427         /* initialise signing */
 428         conn->smb1.signing = smb_signing_init(conn,
 429                                               conn->allow_signing,
 430                                               conn->desire_signing,
 431                                               conn->mandatory_signing);
 432         if (!conn->smb1.signing) {
 433                 goto error;
 434         }
 435
 436         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 437         if (conn->mandatory_signing) {
 438                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 439         }
 440         if (client_guid) {
 441                 conn->smb2.client.guid = *client_guid;
 442         }
 443         conn->smb2.client.capabilities = smb2_capabilities;
 444         if (smb3_capabilities != NULL) {
 445                 conn->smb2.client.smb3_capabilities = *smb3_capabilities;
 446         }
 447
 448         conn->smb2.cur_credits = 1;
 449         conn->smb2.max_credits = 0;
 450         conn->smb2.io_priority = 1;
 451
 452         /*
 453          * Samba and Windows servers accept a maximum of 16 MiB with a maximum
 454          * chunk length of 1 MiB.
 455          */
 456         conn->smb2.cc_chunk_len = 1024 * 1024;
 457         conn->smb2.cc_max_chunks = 16;
 458
 459         talloc_set_destructor(conn, smbXcli_conn_destructor);
 460         return conn;
 461
 462  error:
 463         TALLOC_FREE(conn);
 464         return NULL;
 465 }
 466
 467 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 468 {
 469         if (conn == NULL) {
 470                 return false;
 471         }
 472
 473         if (conn->sock_fd == -1) {
 474                 return false;
 475         }
 476
 477         return true;
 478 }
 479
 480 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 481 {
 482         return conn->protocol;
 483 }
 484
 485 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 486 {
 487         if (conn->protocol >= PROTOCOL_SMB2_02) {
 488                 return true;
 489         }
 490
 491         if (conn->smb1.capabilities & CAP_UNICODE) {
 492                 return true;
 493         }
 494
 495         return false;
 496 }
 497
 498 bool smbXcli_conn_signing_mandatory(struct smbXcli_conn *conn)
 499 {
 500         return conn->mandatory_signing;
 501 }
 502
 503 /*
 504  * [MS-SMB] 2.2.2.3.5 - SMB1 support for passing through
 505  * query/set commands to the file system
 506  */
 507 bool smbXcli_conn_support_passthrough(struct smbXcli_conn *conn)
 508 {
 509         if (conn->protocol >= PROTOCOL_SMB2_02) {
 510                 return true;
 511         }
 512
 513         if (conn->smb1.capabilities & CAP_W2K_SMBS) {
 514                 return true;
 515         }
 516
 517         return false;
 518 }
 519
 520 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 521 {
 522         set_socket_options(conn->sock_fd, options);
 523 }
 524
 525 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 526 {
 527         return &conn->local_ss;
 528 }
 529
 530 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 531 {
 532         return &conn->remote_ss;
 533 }
 534
 535 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 536 {
 537         return conn->remote_name;
 538 }
 539
 540 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 541 {
 542         if (conn->protocol >= PROTOCOL_SMB2_02) {
 543                 /*
 544                  * TODO...
 545                  */
 546                 return 1;
 547         }
 548
 549         return conn->smb1.server.max_mux;
 550 }
 551
 552 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 553 {
 554         if (conn->protocol >= PROTOCOL_SMB2_02) {
 555                 return conn->smb2.server.system_time;
 556         }
 557
 558         return conn->smb1.server.system_time;
 559 }
 560
 561 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 562 {
 563         if (conn->protocol >= PROTOCOL_SMB2_02) {
 564                 return &conn->smb2.server.gss_blob;
 565         }
 566
 567         return &conn->smb1.server.gss_blob;
 568 }
 569
 570 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 571 {
 572         if (conn->protocol >= PROTOCOL_SMB2_02) {
 573                 return &conn->smb2.server.guid;
 574         }
 575
 576         return &conn->smb1.server.guid;
 577 }
 578
 579 bool smbXcli_conn_get_force_channel_sequence(struct smbXcli_conn *conn)
 580 {
 581         return conn->smb2.force_channel_sequence;
 582 }
 583
 584 void smbXcli_conn_set_force_channel_sequence(struct smbXcli_conn *conn,
 585                                              bool v)
 586 {
 587         conn->smb2.force_channel_sequence = v;
 588 }
 589
 590 struct smbXcli_conn_samba_suicide_state {
 591         struct smbXcli_conn *conn;
 592         struct iovec iov;
 593         uint8_t buf[9];
 594         struct tevent_req *write_req;
 595 };
 596
 597 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 598                                                enum tevent_req_state req_state);
 599 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 600
 601 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 602                                                    struct tevent_context *ev,
 603                                                    struct smbXcli_conn *conn,
 604                                                    uint8_t exitcode)
 605 {
 606         struct tevent_req *req, *subreq;
 607         struct smbXcli_conn_samba_suicide_state *state;
 608
 609         req = tevent_req_create(mem_ctx, &state,
 610                                 struct smbXcli_conn_samba_suicide_state);
 611         if (req == NULL) {
 612                 return NULL;
 613         }
 614         state->conn = conn;
 615         SIVAL(state->buf, 4, SMB_SUICIDE_PACKET);
 616         SCVAL(state->buf, 8, exitcode);
 617         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 618
 619         if (conn->suicide_req != NULL) {
 620                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 621                 return tevent_req_post(req, ev);
 622         }
 623
 624         state->iov.iov_base = state->buf;
 625         state->iov.iov_len = sizeof(state->buf);
 626
 627         subreq = writev_send(state, ev, conn->outgoing, conn->sock_fd,
 628                              false, &state->iov, 1);
 629         if (tevent_req_nomem(subreq, req)) {
 630                 return tevent_req_post(req, ev);
 631         }
 632         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 633         state->write_req = subreq;
 634
 635         tevent_req_set_cleanup_fn(req, smbXcli_conn_samba_suicide_cleanup);
 636
 637         /*
 638          * We need to use tevent_req_defer_callback()
 639          * in order to allow smbXcli_conn_disconnect()
 640          * to do a safe cleanup.
 641          */
 642         tevent_req_defer_callback(req, ev);
 643         conn->suicide_req = req;
 644
 645         return req;
 646 }
 647
 648 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 649                                                enum tevent_req_state req_state)
 650 {
 651         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 652                 req, struct smbXcli_conn_samba_suicide_state);
 653
 654         TALLOC_FREE(state->write_req);
 655
 656         if (state->conn == NULL) {
 657                 return;
 658         }
 659
 660         if (state->conn->suicide_req == req) {
 661                 state->conn->suicide_req = NULL;
 662         }
 663         state->conn = NULL;
 664 }
 665
 666 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 667 {
 668         struct tevent_req *req = tevent_req_callback_data(
 669                 subreq, struct tevent_req);
 670         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 671                 req, struct smbXcli_conn_samba_suicide_state);
 672         ssize_t nwritten;
 673         int err;
 674
 675         state->write_req = NULL;
 676
 677         nwritten = writev_recv(subreq, &err);
 678         TALLOC_FREE(subreq);
 679         if (nwritten == -1) {
 680                 /* here, we need to notify all pending requests */
 681                 NTSTATUS status = map_nt_error_from_unix_common(err);
 682                 smbXcli_conn_disconnect(state->conn, status);
 683                 return;
 684         }
 685         tevent_req_done(req);
 686 }
 687
 688 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 689 {
 690         return tevent_req_simple_recv_ntstatus(req);
 691 }
 692
 693 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 694                                     uint8_t exitcode)
 695 {
 696         TALLOC_CTX *frame = talloc_stackframe();
 697         struct tevent_context *ev;
 698         struct tevent_req *req;
 699         NTSTATUS status = NT_STATUS_NO_MEMORY;
 700         bool ok;
 701
 702         if (smbXcli_conn_has_async_calls(conn)) {
 703                 /*
 704                  * Can't use sync call while an async call is in flight
 705                  */
 706                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 707                 goto fail;
 708         }
 709         ev = samba_tevent_context_init(frame);
 710         if (ev == NULL) {
 711                 goto fail;
 712         }
 713         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 714         if (req == NULL) {
 715                 goto fail;
 716         }
 717         ok = tevent_req_poll_ntstatus(req, ev, &status);
 718         if (!ok) {
 719                 goto fail;
 720         }
 721         status = smbXcli_conn_samba_suicide_recv(req);
 722  fail:
 723         TALLOC_FREE(frame);
 724         return status;
 725 }
 726
 727 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 728 {
 729         return conn->smb1.capabilities;
 730 }
 731
 732 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 733 {
 734         return conn->smb1.max_xmit;
 735 }
 736
 737 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
 738 {
 739         size_t pending = talloc_array_length(conn->pending);
 740         uint16_t possible = conn->smb1.server.max_mux;
 741
 742         if (pending >= possible) {
 743                 return false;
 744         }
 745
 746         return true;
 747 }
 748
 749 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 750 {
 751         return conn->smb1.server.session_key;
 752 }
 753
 754 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 755 {
 756         return conn->smb1.server.challenge;
 757 }
 758
 759 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 760 {
 761         return conn->smb1.server.security_mode;
 762 }
 763
 764 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 765 {
 766         return conn->smb1.server.readbraw;
 767 }
 768
 769 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 770 {
 771         return conn->smb1.server.writebraw;
 772 }
 773
 774 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 775 {
 776         return conn->smb1.server.lockread;
 777 }
 778
 779 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 780 {
 781         return conn->smb1.server.writeunlock;
 782 }
 783
 784 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 785 {
 786         return conn->smb1.server.time_zone;
 787 }
 788
 789 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 790                                    const DATA_BLOB user_session_key,
 791                                    const DATA_BLOB response)
 792 {
 793         return smb_signing_activate(conn->smb1.signing,
 794                                     user_session_key,
 795                                     response);
 796 }
 797
 798 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 799                                 const uint8_t *buf, uint32_t seqnum)
 800 {
 801         const uint8_t *hdr = buf + NBT_HDR_SIZE;
 802         size_t len = smb_len_nbt(buf);
 803
 804         return smb_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
 805 }
 806
 807 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 808 {
 809         return smb_signing_is_active(conn->smb1.signing);
 810 }
 811
 812 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 813                                  struct smb_trans_enc_state *es)
 814 {
 815         /* Replace the old state, if any. */
 816         if (conn->smb1.trans_enc) {
 817                 TALLOC_FREE(conn->smb1.trans_enc);
 818         }
 819         conn->smb1.trans_enc = es;
 820 }
 821
 822 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 823 {
 824         return common_encryption_on(conn->smb1.trans_enc);
 825 }
 826
 827
 828 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 829 {
 830         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 831         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 832
 833         if (NT_STATUS_IS_OK(status)) {
 834                 return NT_STATUS_OK;
 835         }
 836
 837         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 838                 return status;
 839         }
 840
 841         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 842 }
 843
 844 /**
 845  * Is the SMB command able to hold an AND_X successor
 846  * @param[in] cmd       The SMB command in question
 847  * @retval Can we add a chained request after "cmd"?
 848  */
 849 bool smb1cli_is_andx_req(uint8_t cmd)
 850 {
 851         switch (cmd) {
 852         case SMBtconX:
 853         case SMBlockingX:
 854         case SMBopenX:
 855         case SMBreadX:
 856         case SMBwriteX:
 857         case SMBsesssetupX:
 858         case SMBulogoffX:
 859         case SMBntcreateX:
 860                 return true;
 861                 break;
 862         default:
 863                 break;
 864         }
 865
 866         return false;
 867 }
 868
 869 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 870 {
 871         size_t num_pending = talloc_array_length(conn->pending);
 872         uint16_t result;
 873
 874         if (conn->protocol == PROTOCOL_NONE) {
 875                 /*
 876                  * This is what windows sends on the SMB1 Negprot request
 877                  * and some vendors reuse the SMB1 MID as SMB2 sequence number.
 878                  */
 879                 return 0;
 880         }
 881
 882         while (true) {
 883                 size_t i;
 884
 885                 result = conn->smb1.mid++;
 886                 if ((result == 0) || (result == 0xffff)) {
 887                         continue;
 888                 }
 889
 890                 for (i=0; i<num_pending; i++) {
 891                         if (result == smb1cli_req_mid(conn->pending[i])) {
 892                                 break;
 893                         }
 894                 }
 895
 896                 if (i == num_pending) {
 897                         return result;
 898                 }
 899         }
 900 }
 901
 902 static NTSTATUS smbXcli_req_cancel_write_req(struct tevent_req *req)
 903 {
 904         struct smbXcli_req_state *state =
 905                 tevent_req_data(req,
 906                 struct smbXcli_req_state);
 907         struct smbXcli_conn *conn = state->conn;
 908         size_t num_pending = talloc_array_length(conn->pending);
 909         ssize_t ret;
 910         int err;
 911         bool ok;
 912
 913         if (state->write_req == NULL) {
 914                 return NT_STATUS_OK;
 915         }
 916
 917         /*
 918          * Check if it's possible to cancel the request.
 919          * If the result is true it's not too late.
 920          * See writev_cancel().
 921          */
 922         ok = tevent_req_cancel(state->write_req);
 923         if (ok) {
 924                 TALLOC_FREE(state->write_req);
 925
 926                 if (conn->protocol >= PROTOCOL_SMB2_02) {
 927                         /*
 928                          * SMB2 has a sane signing state.
 929                          */
 930                         return NT_STATUS_OK;
 931                 }
 932
 933                 if (num_pending > 1) {
 934                         /*
 935                          * We have more pending requests following us.  This
 936                          * means the signing state will be broken for them.
 937                          *
 938                          * As a solution we could add the requests directly to
 939                          * our outgoing queue and do the signing in the trigger
 940                          * function and then use writev_send() without passing a
 941                          * queue.  That way we'll only sign packets we're most
 942                          * likely send to the wire.
 943                          */
 944                         return NT_STATUS_REQUEST_OUT_OF_SEQUENCE;
 945                 }
 946
 947                 /*
 948                  * If we're the only request that's
 949                  * pending, we're able to recover the signing
 950                  * state.
 951                  */
 952                 smb_signing_cancel_reply(conn->smb1.signing,
 953                                          state->smb1.one_way_seqnum);
 954                 return NT_STATUS_OK;
 955         }
 956
 957         ret = writev_recv(state->write_req, &err);
 958         TALLOC_FREE(state->write_req);
 959         if (ret == -1) {
 960                 return map_nt_error_from_unix_common(err);
 961         }
 962
 963         return NT_STATUS_OK;
 964 }
 965
 966 void smbXcli_req_unset_pending(struct tevent_req *req)
 967 {
 968         struct smbXcli_req_state *state =
 969                 tevent_req_data(req,
 970                 struct smbXcli_req_state);
 971         struct smbXcli_conn *conn = state->conn;
 972         size_t num_pending = talloc_array_length(conn->pending);
 973         size_t i;
 974         NTSTATUS cancel_status;
 975
 976         cancel_status = smbXcli_req_cancel_write_req(req);
 977
 978         if (state->smb1.mid != 0) {
 979                 /*
 980                  * This is a [nt]trans[2] request which waits
 981                  * for more than one reply.
 982                  */
 983                 if (!NT_STATUS_IS_OK(cancel_status)) {
 984                         /*
 985                          * If the write_req cancel didn't work
 986                          * we can't use the connection anymore.
 987                          */
 988                         smbXcli_conn_disconnect(conn, cancel_status);
 989                         return;
 990                 }
 991                 return;
 992         }
 993
 994         tevent_req_set_cleanup_fn(req, NULL);
 995
 996         if (num_pending == 1) {
 997                 /*
 998                  * The pending read_smb tevent_req is a child of
 999                  * conn->pending. So if nothing is pending anymore, we need to
1000                  * delete the socket read fde.
1001                  */
1002                 /* TODO: smbXcli_conn_cancel_read_req */
1003                 TALLOC_FREE(conn->pending);
1004                 conn->read_smb_req = NULL;
1005
1006                 if (!NT_STATUS_IS_OK(cancel_status)) {
1007                         /*
1008                          * If the write_req cancel didn't work
1009                          * we can't use the connection anymore.
1010                          */
1011                         smbXcli_conn_disconnect(conn, cancel_status);
1012                         return;
1013                 }
1014                 return;
1015         }
1016
1017         for (i=0; i<num_pending; i++) {
1018                 if (req == conn->pending[i]) {
1019                         break;
1020                 }
1021         }
1022         if (i == num_pending) {
1023                 /*
1024                  * Something's seriously broken. Just returning here is the
1025                  * right thing nevertheless, the point of this routine is to
1026                  * remove ourselves from conn->pending.
1027                  */
1028
1029                 if (!NT_STATUS_IS_OK(cancel_status)) {
1030                         /*
1031                          * If the write_req cancel didn't work
1032                          * we can't use the connection anymore.
1033                          */
1034                         smbXcli_conn_disconnect(conn, cancel_status);
1035                         return;
1036                 }
1037                 return;
1038         }
1039
1040         /*
1041          * Remove ourselves from the conn->pending array
1042          */
1043         for (; i < (num_pending - 1); i++) {
1044                 conn->pending[i] = conn->pending[i+1];
1045         }
1046
1047         /*
1048          * No NULL check here, we're shrinking by sizeof(void *), and
1049          * talloc_realloc just adjusts the size for this.
1050          */
1051         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
1052                                        num_pending - 1);
1053
1054         if (!NT_STATUS_IS_OK(cancel_status)) {
1055                 /*
1056                  * If the write_req cancel didn't work
1057                  * we can't use the connection anymore.
1058                  */
1059                 smbXcli_conn_disconnect(conn, cancel_status);
1060                 return;
1061         }
1062         return;
1063 }
1064
1065 static void smbXcli_req_cleanup(struct tevent_req *req,
1066                                 enum tevent_req_state req_state)
1067 {
1068         struct smbXcli_req_state *state =
1069                 tevent_req_data(req,
1070                 struct smbXcli_req_state);
1071         struct smbXcli_conn *conn = state->conn;
1072         NTSTATUS cancel_status;
1073
1074         switch (req_state) {
1075         case TEVENT_REQ_RECEIVED:
1076                 /*
1077                  * Make sure we really remove it from
1078                  * the pending array on destruction.
1079                  *
1080                  * smbXcli_req_unset_pending() calls
1081                  * smbXcli_req_cancel_write_req() internal
1082                  */
1083                 state->smb1.mid = 0;
1084                 smbXcli_req_unset_pending(req);
1085                 return;
1086         default:
1087                 cancel_status = smbXcli_req_cancel_write_req(req);
1088                 if (!NT_STATUS_IS_OK(cancel_status)) {
1089                         /*
1090                          * If the write_req cancel didn't work
1091                          * we can't use the connection anymore.
1092                          */
1093                         smbXcli_conn_disconnect(conn, cancel_status);
1094                         return;
1095                 }
1096                 return;
1097         }
1098 }
1099
1100 static bool smb1cli_req_cancel(struct tevent_req *req);
1101 static bool smb2cli_req_cancel(struct tevent_req *req);
1102
1103 static bool smbXcli_req_cancel(struct tevent_req *req)
1104 {
1105         struct smbXcli_req_state *state =
1106                 tevent_req_data(req,
1107                 struct smbXcli_req_state);
1108
1109         if (!smbXcli_conn_is_connected(state->conn)) {
1110                 return false;
1111         }
1112
1113         if (state->conn->protocol == PROTOCOL_NONE) {
1114                 return false;
1115         }
1116
1117         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
1118                 return smb2cli_req_cancel(req);
1119         }
1120
1121         return smb1cli_req_cancel(req);
1122 }
1123
1124 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
1125
1126 bool smbXcli_req_set_pending(struct tevent_req *req)
1127 {
1128         struct smbXcli_req_state *state =
1129                 tevent_req_data(req,
1130                 struct smbXcli_req_state);
1131         struct smbXcli_conn *conn;
1132         struct tevent_req **pending;
1133         size_t num_pending;
1134
1135         conn = state->conn;
1136
1137         if (!smbXcli_conn_is_connected(conn)) {
1138                 return false;
1139         }
1140
1141         num_pending = talloc_array_length(conn->pending);
1142
1143         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
1144                                  num_pending+1);
1145         if (pending == NULL) {
1146                 return false;
1147         }
1148         pending[num_pending] = req;
1149         conn->pending = pending;
1150         tevent_req_set_cleanup_fn(req, smbXcli_req_cleanup);
1151         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1152
1153         if (!smbXcli_conn_receive_next(conn)) {
1154                 /*
1155                  * the caller should notify the current request
1156                  *
1157                  * And all other pending requests get notified
1158                  * by smbXcli_conn_disconnect().
1159                  */
1160                 smbXcli_req_unset_pending(req);
1161                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1162                 return false;
1163         }
1164
1165         return true;
1166 }
1167
1168 static void smbXcli_conn_received(struct tevent_req *subreq);
1169
1170 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
1171 {
1172         size_t num_pending = talloc_array_length(conn->pending);
1173         struct tevent_req *req;
1174         struct smbXcli_req_state *state;
1175
1176         if (conn->read_smb_req != NULL) {
1177                 return true;
1178         }
1179
1180         if (num_pending == 0) {
1181                 if (conn->smb2.mid < UINT64_MAX) {
1182                         /* no more pending requests, so we are done for now */
1183                         return true;
1184                 }
1185
1186                 /*
1187                  * If there are no more SMB2 requests possible,
1188                  * because we are out of message ids,
1189                  * we need to disconnect.
1190                  */
1191                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
1192                 return true;
1193         }
1194
1195         req = conn->pending[0];
1196         state = tevent_req_data(req, struct smbXcli_req_state);
1197
1198         /*
1199          * We're the first ones, add the read_smb request that waits for the
1200          * answer from the server
1201          */
1202         conn->read_smb_req = read_smb_send(conn->pending,
1203                                            state->ev,
1204                                            conn->sock_fd);
1205         if (conn->read_smb_req == NULL) {
1206                 return false;
1207         }
1208         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
1209         return true;
1210 }
1211
1212 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
1213 {
1214         struct smbXcli_session *session;
1215         int sock_fd = conn->sock_fd;
1216
1217         tevent_queue_stop(conn->outgoing);
1218
1219         conn->sock_fd = -1;
1220
1221         session = conn->sessions;
1222         if (talloc_array_length(conn->pending) == 0) {
1223                 /*
1224                  * if we do not have pending requests
1225                  * there is no need to update the channel_sequence
1226                  */
1227                 session = NULL;
1228         }
1229         for (; session; session = session->next) {
1230                 smb2cli_session_increment_channel_sequence(session);
1231         }
1232
1233         if (conn->suicide_req != NULL) {
1234                 /*
1235                  * smbXcli_conn_samba_suicide_send()
1236                  * used tevent_req_defer_callback() already.
1237                  */
1238                 if (!NT_STATUS_IS_OK(status)) {
1239                         tevent_req_nterror(conn->suicide_req, status);
1240                 }
1241                 conn->suicide_req = NULL;
1242         }
1243
1244         /*
1245          * Cancel all pending requests. We do not do a for-loop walking
1246          * conn->pending because that array changes in
1247          * smbXcli_req_unset_pending.
1248          */
1249         while (conn->pending != NULL &&
1250                talloc_array_length(conn->pending) > 0) {
1251                 struct tevent_req *req;
1252                 struct smbXcli_req_state *state;
1253                 struct tevent_req **chain;
1254                 size_t num_chained;
1255                 size_t i;
1256
1257                 req = conn->pending[0];
1258                 state = tevent_req_data(req, struct smbXcli_req_state);
1259
1260                 if (state->smb1.chained_requests == NULL) {
1261                         bool in_progress;
1262
1263                         /*
1264                          * We're dead. No point waiting for trans2
1265                          * replies.
1266                          */
1267                         state->smb1.mid = 0;
1268
1269                         smbXcli_req_unset_pending(req);
1270
1271                         if (NT_STATUS_IS_OK(status)) {
1272                                 /* do not notify the callers */
1273                                 continue;
1274                         }
1275
1276                         in_progress = tevent_req_is_in_progress(req);
1277                         if (!in_progress) {
1278                                 /*
1279                                  * already finished
1280                                  */
1281                                 continue;
1282                         }
1283
1284                         /*
1285                          * we need to defer the callback, because we may notify
1286                          * more then one caller.
1287                          */
1288                         tevent_req_defer_callback(req, state->ev);
1289                         tevent_req_nterror(req, status);
1290                         continue;
1291                 }
1292
1293                 chain = talloc_move(conn, &state->smb1.chained_requests);
1294                 num_chained = talloc_array_length(chain);
1295
1296                 for (i=0; i<num_chained; i++) {
1297                         bool in_progress;
1298
1299                         req = chain[i];
1300                         state = tevent_req_data(req, struct smbXcli_req_state);
1301
1302                         /*
1303                          * We're dead. No point waiting for trans2
1304                          * replies.
1305                          */
1306                         state->smb1.mid = 0;
1307
1308                         smbXcli_req_unset_pending(req);
1309
1310                         if (NT_STATUS_IS_OK(status)) {
1311                                 /* do not notify the callers */
1312                                 continue;
1313                         }
1314
1315                         in_progress = tevent_req_is_in_progress(req);
1316                         if (!in_progress) {
1317                                 /*
1318                                  * already finished
1319                                  */
1320                                 continue;
1321                         }
1322
1323                         /*
1324                          * we need to defer the callback, because we may notify
1325                          * more than one caller.
1326                          */
1327                         tevent_req_defer_callback(req, state->ev);
1328                         tevent_req_nterror(req, status);
1329                 }
1330                 TALLOC_FREE(chain);
1331         }
1332
1333         if (sock_fd != -1) {
1334                 close(sock_fd);
1335         }
1336 }
1337
1338 /*
1339  * Fetch a smb request's mid. Only valid after the request has been sent by
1340  * smb1cli_req_send().
1341  */
1342 uint16_t smb1cli_req_mid(struct tevent_req *req)
1343 {
1344         struct smbXcli_req_state *state =
1345                 tevent_req_data(req,
1346                 struct smbXcli_req_state);
1347
1348         if (state->smb1.mid != 0) {
1349                 return state->smb1.mid;
1350         }
1351
1352         return SVAL(state->smb1.hdr, HDR_MID);
1353 }
1354
1355 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1356 {
1357         struct smbXcli_req_state *state =
1358                 tevent_req_data(req,
1359                 struct smbXcli_req_state);
1360
1361         state->smb1.mid = mid;
1362 }
1363
1364 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1365 {
1366         struct smbXcli_req_state *state =
1367                 tevent_req_data(req,
1368                 struct smbXcli_req_state);
1369
1370         return state->smb1.seqnum;
1371 }
1372
1373 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1374 {
1375         struct smbXcli_req_state *state =
1376                 tevent_req_data(req,
1377                 struct smbXcli_req_state);
1378
1379         state->smb1.seqnum = seqnum;
1380 }
1381
1382 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1383 {
1384         ssize_t ret = iov_buflen(iov, count);
1385
1386         /* Ignore the overflow case for now ... */
1387         return ret;
1388 }
1389
1390 static void smb1cli_req_flags(enum protocol_types protocol,
1391                               uint32_t smb1_capabilities,
1392                               uint8_t smb_command,
1393                               uint8_t additional_flags,
1394                               uint8_t clear_flags,
1395                               uint8_t *_flags,
1396                               uint16_t additional_flags2,
1397                               uint16_t clear_flags2,
1398                               uint16_t *_flags2)
1399 {
1400         uint8_t flags = 0;
1401         uint16_t flags2 = 0;
1402
1403         if (protocol >= PROTOCOL_LANMAN1) {
1404                 flags |= FLAG_CASELESS_PATHNAMES;
1405                 flags |= FLAG_CANONICAL_PATHNAMES;
1406         }
1407
1408         if (protocol >= PROTOCOL_LANMAN2) {
1409                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1410                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1411         }
1412
1413         if (protocol >= PROTOCOL_NT1) {
1414                 flags2 |= FLAGS2_IS_LONG_NAME;
1415
1416                 if (smb1_capabilities & CAP_UNICODE) {
1417                         flags2 |= FLAGS2_UNICODE_STRINGS;
1418                 }
1419                 if (smb1_capabilities & CAP_STATUS32) {
1420                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1421                 }
1422                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1423                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1424                 }
1425         }
1426
1427         flags |= additional_flags;
1428         flags &= ~clear_flags;
1429         flags2 |= additional_flags2;
1430         flags2 &= ~clear_flags2;
1431
1432         *_flags = flags;
1433         *_flags2 = flags2;
1434 }
1435
1436 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1437
1438 static bool smb1cli_req_cancel(struct tevent_req *req)
1439 {
1440         struct smbXcli_req_state *state =
1441                 tevent_req_data(req,
1442                 struct smbXcli_req_state);
1443         uint8_t flags;
1444         uint16_t flags2;
1445         uint32_t pid;
1446         uint16_t mid;
1447         struct tevent_req *subreq;
1448         NTSTATUS status;
1449
1450         flags = CVAL(state->smb1.hdr, HDR_FLG);
1451         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1452         pid  = SVAL(state->smb1.hdr, HDR_PID);
1453         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1454         mid = SVAL(state->smb1.hdr, HDR_MID);
1455
1456         subreq = smb1cli_req_create(state, state->ev,
1457                                     state->conn,
1458                                     SMBntcancel,
1459                                     flags, 0,
1460                                     flags2, 0,
1461                                     0, /* timeout */
1462                                     pid,
1463                                     state->tcon,
1464                                     state->session,
1465                                     0, NULL, /* vwv */
1466                                     0, NULL); /* bytes */
1467         if (subreq == NULL) {
1468                 return false;
1469         }
1470         smb1cli_req_set_mid(subreq, mid);
1471
1472         status = smb1cli_req_chain_submit(&subreq, 1);
1473         if (!NT_STATUS_IS_OK(status)) {
1474                 TALLOC_FREE(subreq);
1475                 return false;
1476         }
1477         smb1cli_req_set_mid(subreq, 0);
1478
1479         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1480
1481         return true;
1482 }
1483
1484 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1485 {
1486         /* we do not care about the result */
1487         TALLOC_FREE(subreq);
1488 }
1489
1490 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1491                                       struct tevent_context *ev,
1492                                       struct smbXcli_conn *conn,
1493                                       uint8_t smb_command,
1494                                       uint8_t additional_flags,
1495                                       uint8_t clear_flags,
1496                                       uint16_t additional_flags2,
1497                                       uint16_t clear_flags2,
1498                                       uint32_t timeout_msec,
1499                                       uint32_t pid,
1500                                       struct smbXcli_tcon *tcon,
1501                                       struct smbXcli_session *session,
1502                                       uint8_t wct, uint16_t *vwv,
1503                                       int iov_count,
1504                                       struct iovec *bytes_iov)
1505 {
1506         struct tevent_req *req;
1507         struct smbXcli_req_state *state;
1508         uint8_t flags = 0;
1509         uint16_t flags2 = 0;
1510         uint16_t uid = 0;
1511         uint16_t tid = 0;
1512         ssize_t num_bytes;
1513
1514         if (iov_count > MAX_SMB_IOV) {
1515                 /*
1516                  * Should not happen :-)
1517                  */
1518                 return NULL;
1519         }
1520
1521         req = tevent_req_create(mem_ctx, &state,
1522                                 struct smbXcli_req_state);
1523         if (req == NULL) {
1524                 return NULL;
1525         }
1526         state->ev = ev;
1527         state->conn = conn;
1528         state->session = session;
1529         state->tcon = tcon;
1530
1531         if (session) {
1532                 uid = session->smb1.session_id;
1533         }
1534
1535         if (tcon) {
1536                 tid = tcon->smb1.tcon_id;
1537
1538                 if (tcon->fs_attributes & FILE_CASE_SENSITIVE_SEARCH) {
1539                         clear_flags |= FLAG_CASELESS_PATHNAMES;
1540                 } else {
1541                         /* Default setting, case insensitive. */
1542                         additional_flags |= FLAG_CASELESS_PATHNAMES;
1543                 }
1544
1545                 if (smbXcli_conn_dfs_supported(conn) &&
1546                     smbXcli_tcon_is_dfs_share(tcon))
1547                 {
1548                         additional_flags2 |= FLAGS2_DFS_PATHNAMES;
1549                 }
1550         }
1551
1552         state->smb1.recv_cmd = 0xFF;
1553         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1554         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1555         if (state->smb1.recv_iov == NULL) {
1556                 TALLOC_FREE(req);
1557                 return NULL;
1558         }
1559
1560         smb1cli_req_flags(conn->protocol,
1561                           conn->smb1.capabilities,
1562                           smb_command,
1563                           additional_flags,
1564                           clear_flags,
1565                           &flags,
1566                           additional_flags2,
1567                           clear_flags2,
1568                           &flags2);
1569
1570         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1571         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1572         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1573         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1574         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1575         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1576         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1577         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1578         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1579         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1580         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1581
1582         state->smb1.vwv = vwv;
1583
1584         num_bytes = iov_buflen(bytes_iov, iov_count);
1585         if (num_bytes == -1) {
1586                 /*
1587                  * I'd love to add a check for num_bytes<=UINT16_MAX here, but
1588                  * the smbclient->samba connections can lie and transfer more.
1589                  */
1590                 TALLOC_FREE(req);
1591                 return NULL;
1592         }
1593
1594         SSVAL(state->smb1.bytecount_buf, 0, num_bytes);
1595
1596         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1597         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1598         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1599         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1600         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1601         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1602         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1603         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1604
1605         if (iov_count != 0) {
1606                 memcpy(&state->smb1.iov[4], bytes_iov,
1607                        iov_count * sizeof(*bytes_iov));
1608         }
1609         state->smb1.iov_count = iov_count + 4;
1610
1611         if (timeout_msec > 0) {
1612                 state->endtime = timeval_current_ofs_msec(timeout_msec);
1613                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
1614                         return req;
1615                 }
1616         }
1617
1618         switch (smb_command) {
1619         case SMBtranss:
1620         case SMBtranss2:
1621         case SMBnttranss:
1622                 state->one_way = true;
1623                 break;
1624         case SMBntcancel:
1625                 state->one_way = true;
1626                 state->smb1.one_way_seqnum = true;
1627                 break;
1628         case SMBlockingX:
1629                 if ((wct == 8) &&
1630                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1631                         state->one_way = true;
1632                 }
1633                 break;
1634         }
1635
1636         return req;
1637 }
1638
1639 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1640                                    struct iovec *iov, int iov_count,
1641                                    uint32_t *seqnum,
1642                                    bool one_way_seqnum)
1643 {
1644         TALLOC_CTX *frame = NULL;
1645         NTSTATUS status;
1646         uint8_t *buf;
1647
1648         /*
1649          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1650          * iovec directly. MD5Update would do that just fine.
1651          */
1652
1653         if (iov_count < 4) {
1654                 return NT_STATUS_INVALID_PARAMETER_MIX;
1655         }
1656         if (iov[0].iov_len != NBT_HDR_SIZE) {
1657                 return NT_STATUS_INVALID_PARAMETER_MIX;
1658         }
1659         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1660                 return NT_STATUS_INVALID_PARAMETER_MIX;
1661         }
1662         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1663                 return NT_STATUS_INVALID_PARAMETER_MIX;
1664         }
1665         if (iov[3].iov_len != sizeof(uint16_t)) {
1666                 return NT_STATUS_INVALID_PARAMETER_MIX;
1667         }
1668
1669         frame = talloc_stackframe();
1670
1671         buf = iov_concat(frame, &iov[1], iov_count - 1);
1672         if (buf == NULL) {
1673                 return NT_STATUS_NO_MEMORY;
1674         }
1675
1676         *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1677                                           one_way_seqnum);
1678         status = smb_signing_sign_pdu(conn->smb1.signing,
1679                                       buf,
1680                                       talloc_get_size(buf),
1681                                       *seqnum);
1682         if (!NT_STATUS_IS_OK(status)) {
1683                 return status;
1684         }
1685         memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1686
1687         TALLOC_FREE(frame);
1688         return NT_STATUS_OK;
1689 }
1690
1691 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1692 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1693                                                TALLOC_CTX *tmp_mem,
1694                                                uint8_t *inbuf);
1695
1696 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1697                                           struct smbXcli_req_state *state,
1698                                           struct iovec *iov, int iov_count)
1699 {
1700         struct tevent_req *subreq;
1701         NTSTATUS status;
1702         uint8_t cmd;
1703         uint16_t mid;
1704         ssize_t nbtlen;
1705
1706         if (!smbXcli_conn_is_connected(state->conn)) {
1707                 return NT_STATUS_CONNECTION_DISCONNECTED;
1708         }
1709
1710         if (state->conn->protocol > PROTOCOL_NT1) {
1711                 DBG_ERR("called for dialect[%s] server[%s]\n",
1712                         smb_protocol_types_string(state->conn->protocol),
1713                         smbXcli_conn_remote_name(state->conn));
1714                 return NT_STATUS_REVISION_MISMATCH;
1715         }
1716
1717         if (iov_count < 4) {
1718                 return NT_STATUS_INVALID_PARAMETER_MIX;
1719         }
1720         if (iov[0].iov_len != NBT_HDR_SIZE) {
1721                 return NT_STATUS_INVALID_PARAMETER_MIX;
1722         }
1723         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1724                 return NT_STATUS_INVALID_PARAMETER_MIX;
1725         }
1726         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1727                 return NT_STATUS_INVALID_PARAMETER_MIX;
1728         }
1729         if (iov[3].iov_len != sizeof(uint16_t)) {
1730                 return NT_STATUS_INVALID_PARAMETER_MIX;
1731         }
1732
1733         cmd = CVAL(iov[1].iov_base, HDR_COM);
1734         if (cmd == SMBreadBraw) {
1735                 if (smbXcli_conn_has_async_calls(state->conn)) {
1736                         return NT_STATUS_INVALID_PARAMETER_MIX;
1737                 }
1738                 state->conn->smb1.read_braw_req = req;
1739         }
1740
1741         if (state->smb1.mid != 0) {
1742                 mid = state->smb1.mid;
1743         } else {
1744                 mid = smb1cli_alloc_mid(state->conn);
1745         }
1746         SSVAL(iov[1].iov_base, HDR_MID, mid);
1747
1748         nbtlen = iov_buflen(&iov[1], iov_count-1);
1749         if ((nbtlen == -1) || (nbtlen > 0x1FFFF)) {
1750                 return NT_STATUS_INVALID_PARAMETER_MIX;
1751         }
1752
1753         _smb_setlen_nbt(iov[0].iov_base, nbtlen);
1754
1755         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1756                                     &state->smb1.seqnum,
1757                                     state->smb1.one_way_seqnum);
1758
1759         if (!NT_STATUS_IS_OK(status)) {
1760                 return status;
1761         }
1762
1763         /*
1764          * If we supported multiple encrytion contexts
1765          * here we'd look up based on tid.
1766          */
1767         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1768                 char *buf, *enc_buf;
1769
1770                 buf = (char *)iov_concat(talloc_tos(), iov, iov_count);
1771                 if (buf == NULL) {
1772                         return NT_STATUS_NO_MEMORY;
1773                 }
1774                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1775                                                (char *)buf, &enc_buf);
1776                 TALLOC_FREE(buf);
1777                 if (!NT_STATUS_IS_OK(status)) {
1778                         DEBUG(0, ("Error in encrypting client message: %s\n",
1779                                   nt_errstr(status)));
1780                         return status;
1781                 }
1782                 buf = (char *)talloc_memdup(state, enc_buf,
1783                                             smb_len_nbt(enc_buf)+4);
1784                 SAFE_FREE(enc_buf);
1785                 if (buf == NULL) {
1786                         return NT_STATUS_NO_MEMORY;
1787                 }
1788                 iov[0].iov_base = (void *)buf;
1789                 iov[0].iov_len = talloc_get_size(buf);
1790                 iov_count = 1;
1791         }
1792
1793         if (state->conn->dispatch_incoming == NULL) {
1794                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1795         }
1796
1797         if (!smbXcli_req_set_pending(req)) {
1798                 return NT_STATUS_NO_MEMORY;
1799         }
1800
1801         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1802
1803         subreq = writev_send(state, state->ev, state->conn->outgoing,
1804                              state->conn->sock_fd, false, iov, iov_count);
1805         if (subreq == NULL) {
1806                 return NT_STATUS_NO_MEMORY;
1807         }
1808         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1809         state->write_req = subreq;
1810
1811         return NT_STATUS_OK;
1812 }
1813
1814 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1815                                     struct tevent_context *ev,
1816                                     struct smbXcli_conn *conn,
1817                                     uint8_t smb_command,
1818                                     uint8_t additional_flags,
1819                                     uint8_t clear_flags,
1820                                     uint16_t additional_flags2,
1821                                     uint16_t clear_flags2,
1822                                     uint32_t timeout_msec,
1823                                     uint32_t pid,
1824                                     struct smbXcli_tcon *tcon,
1825                                     struct smbXcli_session *session,
1826                                     uint8_t wct, uint16_t *vwv,
1827                                     uint32_t num_bytes,
1828                                     const uint8_t *bytes)
1829 {
1830         struct tevent_req *req;
1831         struct iovec iov;
1832         NTSTATUS status;
1833
1834         iov.iov_base = discard_const_p(void, bytes);
1835         iov.iov_len = num_bytes;
1836
1837         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1838                                  additional_flags, clear_flags,
1839                                  additional_flags2, clear_flags2,
1840                                  timeout_msec,
1841                                  pid, tcon, session,
1842                                  wct, vwv, 1, &iov);
1843         if (req == NULL) {
1844                 return NULL;
1845         }
1846         if (!tevent_req_is_in_progress(req)) {
1847                 return tevent_req_post(req, ev);
1848         }
1849         status = smb1cli_req_chain_submit(&req, 1);
1850         if (tevent_req_nterror(req, status)) {
1851                 return tevent_req_post(req, ev);
1852         }
1853         return req;
1854 }
1855
1856 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1857 {
1858         struct tevent_req *req =
1859                 tevent_req_callback_data(subreq,
1860                 struct tevent_req);
1861         struct smbXcli_req_state *state =
1862                 tevent_req_data(req,
1863                 struct smbXcli_req_state);
1864         ssize_t nwritten;
1865         int err;
1866
1867         state->write_req = NULL;
1868
1869         nwritten = writev_recv(subreq, &err);
1870         TALLOC_FREE(subreq);
1871         if (nwritten == -1) {
1872                 /* here, we need to notify all pending requests */
1873                 NTSTATUS status = map_nt_error_from_unix_common(err);
1874                 smbXcli_conn_disconnect(state->conn, status);
1875                 return;
1876         }
1877
1878         if (state->one_way) {
1879                 state->inbuf = NULL;
1880                 tevent_req_done(req);
1881                 return;
1882         }
1883 }
1884
1885 static void smbXcli_conn_received(struct tevent_req *subreq)
1886 {
1887         struct smbXcli_conn *conn =
1888                 tevent_req_callback_data(subreq,
1889                 struct smbXcli_conn);
1890         TALLOC_CTX *frame = talloc_stackframe();
1891         NTSTATUS status;
1892         uint8_t *inbuf;
1893         ssize_t received;
1894         int err;
1895
1896         if (subreq != conn->read_smb_req) {
1897                 DEBUG(1, ("Internal error: cli_smb_received called with "
1898                           "unexpected subreq\n"));
1899                 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1900                 TALLOC_FREE(frame);
1901                 return;
1902         }
1903         conn->read_smb_req = NULL;
1904
1905         received = read_smb_recv(subreq, frame, &inbuf, &err);
1906         TALLOC_FREE(subreq);
1907         if (received == -1) {
1908                 status = map_nt_error_from_unix_common(err);
1909                 smbXcli_conn_disconnect(conn, status);
1910                 TALLOC_FREE(frame);
1911                 return;
1912         }
1913
1914         status = conn->dispatch_incoming(conn, frame, inbuf);
1915         TALLOC_FREE(frame);
1916         if (NT_STATUS_IS_OK(status)) {
1917                 /*
1918                  * We should not do any more processing
1919                  * as the dispatch function called
1920                  * tevent_req_done().
1921                  */
1922                 return;
1923         }
1924
1925         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1926                 /*
1927                  * We got an error, so notify all pending requests
1928                  */
1929                 smbXcli_conn_disconnect(conn, status);
1930                 return;
1931         }
1932
1933         /*
1934          * We got NT_STATUS_RETRY, so we may ask for a
1935          * next incoming pdu.
1936          */
1937         if (!smbXcli_conn_receive_next(conn)) {
1938                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1939         }
1940 }
1941
1942 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1943                                           struct iovec **piov, int *pnum_iov)
1944 {
1945         struct iovec *iov;
1946         size_t num_iov;
1947         size_t buflen;
1948         size_t taken;
1949         size_t remaining;
1950         uint8_t *hdr;
1951         uint8_t cmd;
1952         uint32_t wct_ofs;
1953         NTSTATUS status;
1954         size_t min_size = MIN_SMB_SIZE;
1955
1956         buflen = smb_len_tcp(buf);
1957         taken = 0;
1958
1959         hdr = buf + NBT_HDR_SIZE;
1960
1961         status = smb1cli_pull_raw_error(hdr);
1962         if (NT_STATUS_IS_ERR(status)) {
1963                 /*
1964                  * This is an ugly hack to support OS/2
1965                  * which skips the byte_count in the DATA block
1966                  * on some error responses.
1967                  *
1968                  * See bug #9096
1969                  */
1970                 min_size -= sizeof(uint16_t);
1971         }
1972
1973         if (buflen < min_size) {
1974                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1975         }
1976
1977         /*
1978          * This returns iovec elements in the following order:
1979          *
1980          * - SMB header
1981          *
1982          * - Parameter Block
1983          * - Data Block
1984          *
1985          * - Parameter Block
1986          * - Data Block
1987          *
1988          * - Parameter Block
1989          * - Data Block
1990          */
1991         num_iov = 1;
1992
1993         iov = talloc_array(mem_ctx, struct iovec, num_iov);
1994         if (iov == NULL) {
1995                 return NT_STATUS_NO_MEMORY;
1996         }
1997         iov[0].iov_base = hdr;
1998         iov[0].iov_len = HDR_WCT;
1999         taken += HDR_WCT;
2000
2001         cmd = CVAL(hdr, HDR_COM);
2002         wct_ofs = HDR_WCT;
2003
2004         while (true) {
2005                 size_t len = buflen - taken;
2006                 struct iovec *cur;
2007                 struct iovec *iov_tmp;
2008                 uint8_t wct;
2009                 uint32_t bcc_ofs;
2010                 uint16_t bcc;
2011                 size_t needed;
2012
2013                 /*
2014                  * we need at least WCT
2015                  */
2016                 needed = sizeof(uint8_t);
2017                 if (len < needed) {
2018                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2019                                    __location__, (int)len, (int)needed));
2020                         goto inval;
2021                 }
2022
2023                 /*
2024                  * Now we check if the specified words are there
2025                  */
2026                 wct = CVAL(hdr, wct_ofs);
2027                 needed += wct * sizeof(uint16_t);
2028                 if (len < needed) {
2029                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2030                                    __location__, (int)len, (int)needed));
2031                         goto inval;
2032                 }
2033
2034                 if ((num_iov == 1) &&
2035                     (len == needed) &&
2036                     NT_STATUS_IS_ERR(status))
2037                 {
2038                         /*
2039                          * This is an ugly hack to support OS/2
2040                          * which skips the byte_count in the DATA block
2041                          * on some error responses.
2042                          *
2043                          * See bug #9096
2044                          */
2045                         iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2046                                                  num_iov + 2);
2047                         if (iov_tmp == NULL) {
2048                                 TALLOC_FREE(iov);
2049                                 return NT_STATUS_NO_MEMORY;
2050                         }
2051                         iov = iov_tmp;
2052                         cur = &iov[num_iov];
2053                         num_iov += 2;
2054
2055                         cur[0].iov_len = 0;
2056                         cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2057                         cur[1].iov_len = 0;
2058                         cur[1].iov_base = cur[0].iov_base;
2059
2060                         taken += needed;
2061                         break;
2062                 }
2063
2064                 /*
2065                  * we need at least BCC
2066                  */
2067                 needed += sizeof(uint16_t);
2068                 if (len < needed) {
2069                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2070                                    __location__, (int)len, (int)needed));
2071                         goto inval;
2072                 }
2073
2074                 /*
2075                  * Now we check if the specified bytes are there
2076                  */
2077                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
2078                 bcc = SVAL(hdr, bcc_ofs);
2079                 needed += bcc * sizeof(uint8_t);
2080                 if (len < needed) {
2081                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2082                                    __location__, (int)len, (int)needed));
2083                         goto inval;
2084                 }
2085
2086                 /*
2087                  * we allocate 2 iovec structures for words and bytes
2088                  */
2089                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2090                                          num_iov + 2);
2091                 if (iov_tmp == NULL) {
2092                         TALLOC_FREE(iov);
2093                         return NT_STATUS_NO_MEMORY;
2094                 }
2095                 iov = iov_tmp;
2096                 cur = &iov[num_iov];
2097                 num_iov += 2;
2098
2099                 cur[0].iov_len = wct * sizeof(uint16_t);
2100                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2101                 cur[1].iov_len = bcc * sizeof(uint8_t);
2102                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
2103
2104                 taken += needed;
2105
2106                 if (!smb1cli_is_andx_req(cmd)) {
2107                         /*
2108                          * If the current command does not have AndX chanining
2109                          * we are done.
2110                          */
2111                         break;
2112                 }
2113
2114                 if (wct == 0 && bcc == 0) {
2115                         /*
2116                          * An empty response also ends the chain,
2117                          * most likely with an error.
2118                          */
2119                         break;
2120                 }
2121
2122                 if (wct < 2) {
2123                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
2124                                    __location__, (int)wct, (int)cmd));
2125                         goto inval;
2126                 }
2127                 cmd = CVAL(cur[0].iov_base, 0);
2128                 if (cmd == 0xFF) {
2129                         /*
2130                          * If it is the end of the chain we are also done.
2131                          */
2132                         break;
2133                 }
2134                 wct_ofs = SVAL(cur[0].iov_base, 2);
2135
2136                 if (wct_ofs < taken) {
2137                         goto inval;
2138                 }
2139                 if (wct_ofs > buflen) {
2140                         goto inval;
2141                 }
2142
2143                 /*
2144                  * we consumed everything up to the start of the next
2145                  * parameter block.
2146                  */
2147                 taken = wct_ofs;
2148         }
2149
2150         remaining = buflen - taken;
2151
2152         if (remaining > 0 && num_iov >= 3) {
2153                 /*
2154                  * The last DATA block gets the remaining
2155                  * bytes, this is needed to support
2156                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
2157                  */
2158                 iov[num_iov-1].iov_len += remaining;
2159         }
2160
2161         *piov = iov;
2162         *pnum_iov = num_iov;
2163         return NT_STATUS_OK;
2164
2165 inval:
2166         TALLOC_FREE(iov);
2167         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2168 }
2169
2170 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2171                                                TALLOC_CTX *tmp_mem,
2172                                                uint8_t *inbuf)
2173 {
2174         struct tevent_req *req;
2175         struct smbXcli_req_state *state;
2176         NTSTATUS status;
2177         size_t num_pending;
2178         size_t i;
2179         uint8_t cmd;
2180         uint16_t mid;
2181         bool oplock_break;
2182         uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
2183         size_t len = smb_len_tcp(inbuf);
2184         struct iovec *iov = NULL;
2185         int num_iov = 0;
2186         struct tevent_req **chain = NULL;
2187         size_t num_chained = 0;
2188         size_t num_responses = 0;
2189
2190         if (conn->smb1.read_braw_req != NULL) {
2191                 req = conn->smb1.read_braw_req;
2192                 conn->smb1.read_braw_req = NULL;
2193                 state = tevent_req_data(req, struct smbXcli_req_state);
2194
2195                 smbXcli_req_unset_pending(req);
2196
2197                 if (state->smb1.recv_iov == NULL) {
2198                         /*
2199                          * For requests with more than
2200                          * one response, we have to readd the
2201                          * recv_iov array.
2202                          */
2203                         state->smb1.recv_iov = talloc_zero_array(state,
2204                                                                  struct iovec,
2205                                                                  3);
2206                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2207                                 return NT_STATUS_OK;
2208                         }
2209                 }
2210
2211                 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
2212                 state->smb1.recv_iov[0].iov_len = len;
2213                 ZERO_STRUCT(state->smb1.recv_iov[1]);
2214                 ZERO_STRUCT(state->smb1.recv_iov[2]);
2215
2216                 state->smb1.recv_cmd = SMBreadBraw;
2217                 state->smb1.recv_status = NT_STATUS_OK;
2218                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2219
2220                 tevent_req_done(req);
2221                 return NT_STATUS_OK;
2222         }
2223
2224         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
2225             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
2226                 DEBUG(10, ("Got non-SMB PDU\n"));
2227                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2228         }
2229
2230         /*
2231          * If we supported multiple encrytion contexts
2232          * here we'd look up based on tid.
2233          */
2234         if (common_encryption_on(conn->smb1.trans_enc)
2235             && (CVAL(inbuf, 0) == 0)) {
2236                 uint16_t enc_ctx_num;
2237
2238                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
2239                 if (!NT_STATUS_IS_OK(status)) {
2240                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
2241                                    nt_errstr(status)));
2242                         return status;
2243                 }
2244
2245                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
2246                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
2247                                    enc_ctx_num,
2248                                    conn->smb1.trans_enc->enc_ctx_num));
2249                         return NT_STATUS_INVALID_HANDLE;
2250                 }
2251
2252                 status = common_decrypt_buffer(conn->smb1.trans_enc,
2253                                                (char *)inbuf);
2254                 if (!NT_STATUS_IS_OK(status)) {
2255                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
2256                                    nt_errstr(status)));
2257                         return status;
2258                 }
2259                 inhdr = inbuf + NBT_HDR_SIZE;
2260                 len = smb_len_nbt(inbuf);
2261         }
2262
2263         mid = SVAL(inhdr, HDR_MID);
2264         num_pending = talloc_array_length(conn->pending);
2265
2266         for (i=0; i<num_pending; i++) {
2267                 if (mid == smb1cli_req_mid(conn->pending[i])) {
2268                         break;
2269                 }
2270         }
2271         if (i == num_pending) {
2272                 /* Dump unexpected reply */
2273                 return NT_STATUS_RETRY;
2274         }
2275
2276         oplock_break = false;
2277
2278         if (mid == 0xffff) {
2279                 /*
2280                  * Paranoia checks that this is really an oplock break request.
2281                  */
2282                 oplock_break = (len == 51); /* hdr + 8 words */
2283                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
2284                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
2285                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
2286                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
2287
2288                 if (!oplock_break) {
2289                         /* Dump unexpected reply */
2290                         return NT_STATUS_RETRY;
2291                 }
2292         }
2293
2294         req = conn->pending[i];
2295         state = tevent_req_data(req, struct smbXcli_req_state);
2296
2297         if (!oplock_break /* oplock breaks are not signed */
2298             && !smb_signing_check_pdu(conn->smb1.signing,
2299                                       inhdr, len, state->smb1.seqnum+1)) {
2300                 DEBUG(10, ("cli_check_sign_mac failed\n"));
2301                 return NT_STATUS_ACCESS_DENIED;
2302         }
2303
2304         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
2305                                            &iov, &num_iov);
2306         if (!NT_STATUS_IS_OK(status)) {
2307                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
2308                           nt_errstr(status)));
2309                 return status;
2310         }
2311
2312         cmd = CVAL(inhdr, HDR_COM);
2313         status = smb1cli_pull_raw_error(inhdr);
2314
2315         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2316             (state->session != NULL) && state->session->disconnect_expired)
2317         {
2318                 /*
2319                  * this should be a short term hack
2320                  * until the upper layers have implemented
2321                  * re-authentication.
2322                  */
2323                 return status;
2324         }
2325
2326         if (state->smb1.chained_requests == NULL) {
2327                 if (num_iov != 3) {
2328                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2329                 }
2330
2331                 smbXcli_req_unset_pending(req);
2332
2333                 if (state->smb1.recv_iov == NULL) {
2334                         /*
2335                          * For requests with more than
2336                          * one response, we have to readd the
2337                          * recv_iov array.
2338                          */
2339                         state->smb1.recv_iov = talloc_zero_array(state,
2340                                                                  struct iovec,
2341                                                                  3);
2342                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2343                                 return NT_STATUS_OK;
2344                         }
2345                 }
2346
2347                 state->smb1.recv_cmd = cmd;
2348                 state->smb1.recv_status = status;
2349                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2350
2351                 state->smb1.recv_iov[0] = iov[0];
2352                 state->smb1.recv_iov[1] = iov[1];
2353                 state->smb1.recv_iov[2] = iov[2];
2354
2355                 if (talloc_array_length(conn->pending) == 0) {
2356                         tevent_req_done(req);
2357                         return NT_STATUS_OK;
2358                 }
2359
2360                 tevent_req_defer_callback(req, state->ev);
2361                 tevent_req_done(req);
2362                 return NT_STATUS_RETRY;
2363         }
2364
2365         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2366         num_chained = talloc_array_length(chain);
2367         num_responses = (num_iov - 1)/2;
2368
2369         if (num_responses > num_chained) {
2370                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2371         }
2372
2373         for (i=0; i<num_chained; i++) {
2374                 size_t iov_idx = 1 + (i*2);
2375                 struct iovec *cur = &iov[iov_idx];
2376                 uint8_t *inbuf_ref;
2377
2378                 req = chain[i];
2379                 state = tevent_req_data(req, struct smbXcli_req_state);
2380
2381                 smbXcli_req_unset_pending(req);
2382
2383                 /*
2384                  * as we finish multiple requests here
2385                  * we need to defer the callbacks as
2386                  * they could destroy our current stack state.
2387                  */
2388                 tevent_req_defer_callback(req, state->ev);
2389
2390                 if (i >= num_responses) {
2391                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2392                         continue;
2393                 }
2394
2395                 if (state->smb1.recv_iov == NULL) {
2396                         /*
2397                          * For requests with more than
2398                          * one response, we have to readd the
2399                          * recv_iov array.
2400                          */
2401                         state->smb1.recv_iov = talloc_zero_array(state,
2402                                                                  struct iovec,
2403                                                                  3);
2404                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2405                                 continue;
2406                         }
2407                 }
2408
2409                 state->smb1.recv_cmd = cmd;
2410
2411                 if (i == (num_responses - 1)) {
2412                         /*
2413                          * The last request in the chain gets the status
2414                          */
2415                         state->smb1.recv_status = status;
2416                 } else {
2417                         cmd = CVAL(cur[0].iov_base, 0);
2418                         state->smb1.recv_status = NT_STATUS_OK;
2419                 }
2420
2421                 state->inbuf = inbuf;
2422
2423                 /*
2424                  * Note: here we use talloc_reference() in a way
2425                  *       that does not expose it to the caller.
2426                  */
2427                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2428                 if (tevent_req_nomem(inbuf_ref, req)) {
2429                         continue;
2430                 }
2431
2432                 /* copy the related buffers */
2433                 state->smb1.recv_iov[0] = iov[0];
2434                 state->smb1.recv_iov[1] = cur[0];
2435                 state->smb1.recv_iov[2] = cur[1];
2436
2437                 tevent_req_done(req);
2438         }
2439
2440         return NT_STATUS_RETRY;
2441 }
2442
2443 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2444                           TALLOC_CTX *mem_ctx,
2445                           struct iovec **piov,
2446                           uint8_t **phdr,
2447                           uint8_t *pwct,
2448                           uint16_t **pvwv,
2449                           uint32_t *pvwv_offset,
2450                           uint32_t *pnum_bytes,
2451                           uint8_t **pbytes,
2452                           uint32_t *pbytes_offset,
2453                           uint8_t **pinbuf,
2454                           const struct smb1cli_req_expected_response *expected,
2455                           size_t num_expected)
2456 {
2457         struct smbXcli_req_state *state =
2458                 tevent_req_data(req,
2459                 struct smbXcli_req_state);
2460         NTSTATUS status = NT_STATUS_OK;
2461         struct iovec *recv_iov = NULL;
2462         uint8_t *hdr = NULL;
2463         uint8_t wct = 0;
2464         uint32_t vwv_offset = 0;
2465         uint16_t *vwv = NULL;
2466         uint32_t num_bytes = 0;
2467         uint32_t bytes_offset = 0;
2468         uint8_t *bytes = NULL;
2469         size_t i;
2470         bool found_status = false;
2471         bool found_size = false;
2472
2473         if (piov != NULL) {
2474                 *piov = NULL;
2475         }
2476         if (phdr != NULL) {
2477                 *phdr = 0;
2478         }
2479         if (pwct != NULL) {
2480                 *pwct = 0;
2481         }
2482         if (pvwv != NULL) {
2483                 *pvwv = NULL;
2484         }
2485         if (pvwv_offset != NULL) {
2486                 *pvwv_offset = 0;
2487         }
2488         if (pnum_bytes != NULL) {
2489                 *pnum_bytes = 0;
2490         }
2491         if (pbytes != NULL) {
2492                 *pbytes = NULL;
2493         }
2494         if (pbytes_offset != NULL) {
2495                 *pbytes_offset = 0;
2496         }
2497         if (pinbuf != NULL) {
2498                 *pinbuf = NULL;
2499         }
2500
2501         if (state->inbuf != NULL) {
2502                 recv_iov = state->smb1.recv_iov;
2503                 state->smb1.recv_iov = NULL;
2504                 if (state->smb1.recv_cmd != SMBreadBraw) {
2505                         hdr = (uint8_t *)recv_iov[0].iov_base;
2506                         wct = recv_iov[1].iov_len/2;
2507                         vwv = (uint16_t *)recv_iov[1].iov_base;
2508                         vwv_offset = PTR_DIFF(vwv, hdr);
2509                         num_bytes = recv_iov[2].iov_len;
2510                         bytes = (uint8_t *)recv_iov[2].iov_base;
2511                         bytes_offset = PTR_DIFF(bytes, hdr);
2512                 }
2513         }
2514
2515         if (tevent_req_is_nterror(req, &status)) {
2516                 for (i=0; i < num_expected; i++) {
2517                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2518                                 found_status = true;
2519                                 break;
2520                         }
2521                 }
2522
2523                 if (found_status) {
2524                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2525                 }
2526
2527                 return status;
2528         }
2529
2530         if (num_expected == 0) {
2531                 found_status = true;
2532                 found_size = true;
2533         }
2534
2535         status = state->smb1.recv_status;
2536
2537         for (i=0; i < num_expected; i++) {
2538                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2539                         continue;
2540                 }
2541
2542                 found_status = true;
2543                 if (expected[i].wct == 0) {
2544                         found_size = true;
2545                         break;
2546                 }
2547
2548                 if (expected[i].wct == wct) {
2549                         found_size = true;
2550                         break;
2551                 }
2552         }
2553
2554         if (!found_status) {
2555                 return status;
2556         }
2557
2558         if (!found_size) {
2559                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2560         }
2561
2562         if (piov != NULL) {
2563                 *piov = talloc_move(mem_ctx, &recv_iov);
2564         }
2565
2566         if (phdr != NULL) {
2567                 *phdr = hdr;
2568         }
2569         if (pwct != NULL) {
2570                 *pwct = wct;
2571         }
2572         if (pvwv != NULL) {
2573                 *pvwv = vwv;
2574         }
2575         if (pvwv_offset != NULL) {
2576                 *pvwv_offset = vwv_offset;
2577         }
2578         if (pnum_bytes != NULL) {
2579                 *pnum_bytes = num_bytes;
2580         }
2581         if (pbytes != NULL) {
2582                 *pbytes = bytes;
2583         }
2584         if (pbytes_offset != NULL) {
2585                 *pbytes_offset = bytes_offset;
2586         }
2587         if (pinbuf != NULL) {
2588                 *pinbuf = state->inbuf;
2589         }
2590
2591         return status;
2592 }
2593
2594 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2595 {
2596         size_t wct_ofs;
2597         int i;
2598
2599         wct_ofs = HDR_WCT;
2600
2601         for (i=0; i<num_reqs; i++) {
2602                 struct smbXcli_req_state *state;
2603                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2604                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2605                                            state->smb1.iov_count-2);
2606                 wct_ofs = (wct_ofs + 3) & ~3;
2607         }
2608         return wct_ofs;
2609 }
2610
2611 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2612 {
2613         struct smbXcli_req_state *first_state =
2614                 tevent_req_data(reqs[0],
2615                 struct smbXcli_req_state);
2616         struct smbXcli_req_state *state;
2617         size_t wct_offset;
2618         size_t chain_padding = 0;
2619         int i, iovlen;
2620         struct iovec *iov = NULL;
2621         struct iovec *this_iov;
2622         NTSTATUS status;
2623         ssize_t nbt_len;
2624
2625         if (num_reqs == 1) {
2626                 return smb1cli_req_writev_submit(reqs[0], first_state,
2627                                                  first_state->smb1.iov,
2628                                                  first_state->smb1.iov_count);
2629         }
2630
2631         iovlen = 0;
2632         for (i=0; i<num_reqs; i++) {
2633                 if (!tevent_req_is_in_progress(reqs[i])) {
2634                         return NT_STATUS_INTERNAL_ERROR;
2635                 }
2636
2637                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2638
2639                 if (state->smb1.iov_count < 4) {
2640                         return NT_STATUS_INVALID_PARAMETER_MIX;
2641                 }
2642
2643                 if (i == 0) {
2644                         /*
2645                          * The NBT and SMB header
2646                          */
2647                         iovlen += 2;
2648                 } else {
2649                         /*
2650                          * Chain padding
2651                          */
2652                         iovlen += 1;
2653                 }
2654
2655                 /*
2656                  * words and bytes
2657                  */
2658                 iovlen += state->smb1.iov_count - 2;
2659         }
2660
2661         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2662         if (iov == NULL) {
2663                 return NT_STATUS_NO_MEMORY;
2664         }
2665
2666         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2667                 first_state, reqs, sizeof(*reqs) * num_reqs);
2668         if (first_state->smb1.chained_requests == NULL) {
2669                 TALLOC_FREE(iov);
2670                 return NT_STATUS_NO_MEMORY;
2671         }
2672
2673         wct_offset = HDR_WCT;
2674         this_iov = iov;
2675
2676         for (i=0; i<num_reqs; i++) {
2677                 size_t next_padding = 0;
2678                 uint16_t *vwv;
2679
2680                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2681
2682                 if (i < num_reqs-1) {
2683                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2684                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2685                                 TALLOC_FREE(iov);
2686                                 TALLOC_FREE(first_state->smb1.chained_requests);
2687                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2688                         }
2689                 }
2690
2691                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2692                                               state->smb1.iov_count-2) + 1;
2693                 if ((wct_offset % 4) != 0) {
2694                         next_padding = 4 - (wct_offset % 4);
2695                 }
2696                 wct_offset += next_padding;
2697                 vwv = state->smb1.vwv;
2698
2699                 if (i < num_reqs-1) {
2700                         struct smbXcli_req_state *next_state =
2701                                 tevent_req_data(reqs[i+1],
2702                                 struct smbXcli_req_state);
2703                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2704                         SCVAL(vwv+0, 1, 0);
2705                         SSVAL(vwv+1, 0, wct_offset);
2706                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2707                         /* properly end the chain */
2708                         SCVAL(vwv+0, 0, 0xff);
2709                         SCVAL(vwv+0, 1, 0xff);
2710                         SSVAL(vwv+1, 0, 0);
2711                 }
2712
2713                 if (i == 0) {
2714                         /*
2715                          * The NBT and SMB header
2716                          */
2717                         this_iov[0] = state->smb1.iov[0];
2718                         this_iov[1] = state->smb1.iov[1];
2719                         this_iov += 2;
2720                 } else {
2721                         /*
2722                          * This one is a bit subtle. We have to add
2723                          * chain_padding bytes between the requests, and we
2724                          * have to also include the wct field of the
2725                          * subsequent requests. We use the subsequent header
2726                          * for the padding, it contains the wct field in its
2727                          * last byte.
2728                          */
2729                         this_iov[0].iov_len = chain_padding+1;
2730                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2731                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2732                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2733                         this_iov += 1;
2734                 }
2735
2736                 /*
2737                  * copy the words and bytes
2738                  */
2739                 memcpy(this_iov, state->smb1.iov+2,
2740                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2741                 this_iov += state->smb1.iov_count - 2;
2742                 chain_padding = next_padding;
2743         }
2744
2745         nbt_len = iov_buflen(&iov[1], iovlen-1);
2746         if ((nbt_len == -1) || (nbt_len > first_state->conn->smb1.max_xmit)) {
2747                 TALLOC_FREE(iov);
2748                 TALLOC_FREE(first_state->smb1.chained_requests);
2749                 return NT_STATUS_INVALID_PARAMETER_MIX;
2750         }
2751
2752         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2753         if (!NT_STATUS_IS_OK(status)) {
2754                 TALLOC_FREE(iov);
2755                 TALLOC_FREE(first_state->smb1.chained_requests);
2756                 return status;
2757         }
2758
2759         return NT_STATUS_OK;
2760 }
2761
2762 struct tevent_queue *smbXcli_conn_send_queue(struct smbXcli_conn *conn)
2763 {
2764         return conn->outgoing;
2765 }
2766
2767 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2768 {
2769         return ((tevent_queue_length(conn->outgoing) != 0)
2770                 || (talloc_array_length(conn->pending) != 0));
2771 }
2772
2773 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn)
2774 {
2775         if (conn->protocol >= PROTOCOL_SMB2_02) {
2776                 return (smb2cli_conn_server_capabilities(conn) & SMB2_CAP_DFS);
2777         }
2778
2779         return (smb1cli_conn_capabilities(conn) & CAP_DFS);
2780 }
2781
2782 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2783 {
2784         uint16_t credits = 1;
2785
2786         if (conn->smb2.cur_credits == 0) {
2787                 if (max_dyn_len != NULL) {
2788                         *max_dyn_len = 0;
2789                 }
2790                 return false;
2791         }
2792
2793         if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2794                 credits = conn->smb2.cur_credits;
2795         }
2796
2797         if (max_dyn_len != NULL) {
2798                 *max_dyn_len = credits * 65536;
2799         }
2800
2801         return true;
2802 }
2803
2804 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2805 {
2806         return conn->smb2.server.capabilities;
2807 }
2808
2809 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2810 {
2811         return conn->smb2.server.security_mode;
2812 }
2813
2814 uint16_t smb2cli_conn_server_signing_algo(struct smbXcli_conn *conn)
2815 {
2816         return conn->smb2.server.sign_algo;
2817 }
2818
2819 uint16_t smb2cli_conn_server_encryption_algo(struct smbXcli_conn *conn)
2820 {
2821         return conn->smb2.server.cipher;
2822 }
2823
2824 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2825 {
2826         return conn->smb2.server.max_trans_size;
2827 }
2828
2829 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2830 {
2831         return conn->smb2.server.max_read_size;
2832 }
2833
2834 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2835 {
2836         return conn->smb2.server.max_write_size;
2837 }
2838
2839 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2840                                   uint16_t max_credits)
2841 {
2842         conn->smb2.max_credits = max_credits;
2843 }
2844
2845 uint16_t smb2cli_conn_get_cur_credits(struct smbXcli_conn *conn)
2846 {
2847         return conn->smb2.cur_credits;
2848 }
2849
2850 uint8_t smb2cli_conn_get_io_priority(struct smbXcli_conn *conn)
2851 {
2852         if (conn->protocol < PROTOCOL_SMB3_11) {
2853                 return 0;
2854         }
2855
2856         return conn->smb2.io_priority;
2857 }
2858
2859 void smb2cli_conn_set_io_priority(struct smbXcli_conn *conn,
2860                                   uint8_t io_priority)
2861 {
2862         conn->smb2.io_priority = io_priority;
2863 }
2864
2865 uint32_t smb2cli_conn_cc_chunk_len(struct smbXcli_conn *conn)
2866 {
2867         return conn->smb2.cc_chunk_len;
2868 }
2869
2870 void smb2cli_conn_set_cc_chunk_len(struct smbXcli_conn *conn,
2871                                     uint32_t chunk_len)
2872 {
2873         conn->smb2.cc_chunk_len = chunk_len;
2874 }
2875
2876 uint32_t smb2cli_conn_cc_max_chunks(struct smbXcli_conn *conn)
2877 {
2878         return conn->smb2.cc_max_chunks;
2879 }
2880
2881 void smb2cli_conn_set_cc_max_chunks(struct smbXcli_conn *conn,
2882                                     uint32_t max_chunks)
2883 {
2884         conn->smb2.cc_max_chunks = max_chunks;
2885 }
2886
2887 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2888
2889 static bool smb2cli_req_cancel(struct tevent_req *req)
2890 {
2891         struct smbXcli_req_state *state =
2892                 tevent_req_data(req,
2893                 struct smbXcli_req_state);
2894         struct smbXcli_tcon *tcon = state->tcon;
2895         struct smbXcli_session *session = state->session;
2896         uint8_t *fixed = state->smb2.pad;
2897         uint16_t fixed_len = 4;
2898         struct tevent_req *subreq;
2899         struct smbXcli_req_state *substate;
2900         NTSTATUS status;
2901
2902         if (state->smb2.cancel_mid == UINT64_MAX) {
2903                 /*
2904                  * We already send a cancel,
2905                  * make sure we don't do it
2906                  * twice, otherwise we may
2907                  * expose the same NONCE for
2908                  * AES-128-GMAC signing
2909                  */
2910                 return true;
2911         }
2912
2913         SSVAL(fixed, 0, 0x04);
2914         SSVAL(fixed, 2, 0);
2915
2916         subreq = smb2cli_req_create(state, state->ev,
2917                                     state->conn,
2918                                     SMB2_OP_CANCEL,
2919                                     0, 0, /* flags */
2920                                     0, /* timeout */
2921                                     tcon, session,
2922                                     fixed, fixed_len,
2923                                     NULL, 0, 0);
2924         if (subreq == NULL) {
2925                 return false;
2926         }
2927         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2928
2929         substate->smb2.cancel_mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
2930
2931         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, state->smb2.cancel_flags);
2932         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, state->smb2.cancel_mid);
2933         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, state->smb2.cancel_aid);
2934
2935         /*
2936          * remember that we don't send a cancel again
2937          */
2938         state->smb2.cancel_mid = UINT64_MAX;
2939
2940         status = smb2cli_req_compound_submit(&subreq, 1);
2941         if (!NT_STATUS_IS_OK(status)) {
2942                 TALLOC_FREE(subreq);
2943                 return false;
2944         }
2945
2946         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2947
2948         return true;
2949 }
2950
2951 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2952 {
2953         /* we do not care about the result */
2954         TALLOC_FREE(subreq);
2955 }
2956
2957 struct timeval smbXcli_req_endtime(struct tevent_req *req)
2958 {
2959         struct smbXcli_req_state *state = tevent_req_data(
2960                 req, struct smbXcli_req_state);
2961
2962         return state->endtime;
2963 }
2964
2965 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2966                                       struct tevent_context *ev,
2967                                       struct smbXcli_conn *conn,
2968                                       uint16_t cmd,
2969                                       uint32_t additional_flags,
2970                                       uint32_t clear_flags,
2971                                       uint32_t timeout_msec,
2972                                       struct smbXcli_tcon *tcon,
2973                                       struct smbXcli_session *session,
2974                                       const uint8_t *fixed,
2975                                       uint16_t fixed_len,
2976                                       const uint8_t *dyn,
2977                                       uint32_t dyn_len,
2978                                       uint32_t max_dyn_len)
2979 {
2980         struct tevent_req *req;
2981         struct smbXcli_req_state *state;
2982         uint32_t flags = 0;
2983         uint32_t tid = 0;
2984         uint64_t uid = 0;
2985         bool use_channel_sequence = conn->smb2.force_channel_sequence;
2986         uint16_t channel_sequence = 0;
2987         bool use_replay_flag = false;
2988
2989         req = tevent_req_create(mem_ctx, &state,
2990                                 struct smbXcli_req_state);
2991         if (req == NULL) {
2992                 return NULL;
2993         }
2994
2995         state->ev = ev;
2996         state->conn = conn;
2997         state->session = session;
2998         state->tcon = tcon;
2999
3000         if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
3001                 use_channel_sequence = true;
3002         } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
3003                 use_channel_sequence = true;
3004         }
3005
3006         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_00) {
3007                 use_replay_flag = true;
3008         }
3009
3010         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_11) {
3011                 flags |= SMB2_PRIORITY_VALUE_TO_MASK(conn->smb2.io_priority);
3012         }
3013
3014         if (session) {
3015                 uid = session->smb2->session_id;
3016
3017                 if (use_channel_sequence) {
3018                         channel_sequence = session->smb2->channel_sequence;
3019                 }
3020
3021                 if (use_replay_flag && session->smb2->replay_active) {
3022                         additional_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
3023                 }
3024
3025                 state->smb2.should_sign = session->smb2->should_sign;
3026                 state->smb2.should_encrypt = session->smb2->should_encrypt;
3027                 state->smb2.require_signed_response =
3028                         session->smb2->require_signed_response;
3029
3030                 if (cmd == SMB2_OP_SESSSETUP &&
3031                     !smb2_signing_key_valid(session->smb2_channel.signing_key) &&
3032                     smb2_signing_key_valid(session->smb2->signing_key))
3033                 {
3034                         /*
3035                          * a session bind needs to be signed
3036                          */
3037                         state->smb2.should_sign = true;
3038                 }
3039
3040                 if (cmd == SMB2_OP_SESSSETUP &&
3041                     !smb2_signing_key_valid(session->smb2_channel.signing_key)) {
3042                         state->smb2.should_encrypt = false;
3043                 }
3044
3045                 if (additional_flags & SMB2_HDR_FLAG_SIGNED) {
3046                         if (!smb2_signing_key_valid(session->smb2_channel.signing_key)) {
3047                                 tevent_req_nterror(req, NT_STATUS_NO_USER_SESSION_KEY);
3048                                 return req;
3049                         }
3050
3051                         additional_flags &= ~SMB2_HDR_FLAG_SIGNED;
3052                         state->smb2.should_sign = true;
3053                 }
3054         }
3055
3056         if (tcon) {
3057                 tid = tcon->smb2.tcon_id;
3058
3059                 if (tcon->smb2.should_sign) {
3060                         state->smb2.should_sign = true;
3061                 }
3062                 if (tcon->smb2.should_encrypt) {
3063                         state->smb2.should_encrypt = true;
3064                 }
3065         }
3066
3067         if (state->smb2.should_encrypt) {
3068                 state->smb2.should_sign = false;
3069         }
3070
3071         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
3072         if (state->smb2.recv_iov == NULL) {
3073                 TALLOC_FREE(req);
3074                 return NULL;
3075         }
3076
3077         flags |= additional_flags;
3078         flags &= ~clear_flags;
3079
3080         state->smb2.fixed = fixed;
3081         state->smb2.fixed_len = fixed_len;
3082         state->smb2.dyn = dyn;
3083         state->smb2.dyn_len = dyn_len;
3084         state->smb2.max_dyn_len = max_dyn_len;
3085
3086         if (state->smb2.should_encrypt) {
3087                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3088                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
3089         }
3090
3091         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
3092         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
3093         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
3094         SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
3095         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
3096         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            0); /* reserved */
3097         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
3098         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
3099
3100         switch (cmd) {
3101         case SMB2_OP_CANCEL:
3102                 state->one_way = true;
3103                 break;
3104         case SMB2_OP_BREAK:
3105                 /*
3106                  * If this is a dummy request, it will have
3107                  * UINT64_MAX as message id.
3108                  * If we send on break acknowledgement,
3109                  * this gets overwritten later.
3110                  */
3111                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
3112                 break;
3113         }
3114
3115         if (timeout_msec > 0) {
3116                 state->endtime = timeval_current_ofs_msec(timeout_msec);
3117                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
3118                         return req;
3119                 }
3120         }
3121
3122         return req;
3123 }
3124
3125 void smb2cli_req_set_notify_async(struct tevent_req *req)
3126 {
3127         struct smbXcli_req_state *state =
3128                 tevent_req_data(req,
3129                 struct smbXcli_req_state);
3130
3131         state->smb2.notify_async = true;
3132 }
3133
3134 static void smb2cli_req_writev_done(struct tevent_req *subreq);
3135 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3136                                                TALLOC_CTX *tmp_mem,
3137                                                uint8_t *inbuf);
3138
3139 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
3140                                      int num_reqs)
3141 {
3142         struct smbXcli_req_state *state;
3143         struct tevent_req *subreq;
3144         struct iovec *iov;
3145         int i, num_iov, nbt_len;
3146         int tf_iov = -1;
3147         struct smb2_signing_key *encryption_key = NULL;
3148         uint64_t encryption_session_id = 0;
3149         uint64_t nonce_high = UINT64_MAX;
3150         uint64_t nonce_low = UINT64_MAX;
3151
3152         /*
3153          * 1 for the nbt length, optional TRANSFORM
3154          * per request: HDR, fixed, dyn, padding
3155          * -1 because the last one does not need padding
3156          */
3157
3158         iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
3159         if (iov == NULL) {
3160                 return NT_STATUS_NO_MEMORY;
3161         }
3162
3163         num_iov = 1;
3164         nbt_len = 0;
3165
3166         /*
3167          * the session of the first request that requires encryption
3168          * specifies the encryption key.
3169          */
3170         for (i=0; i<num_reqs; i++) {
3171                 if (!tevent_req_is_in_progress(reqs[i])) {
3172                         return NT_STATUS_INTERNAL_ERROR;
3173                 }
3174
3175                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3176
3177                 if (!smbXcli_conn_is_connected(state->conn)) {
3178                         return NT_STATUS_CONNECTION_DISCONNECTED;
3179                 }
3180
3181                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3182                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3183                         return NT_STATUS_REVISION_MISMATCH;
3184                 }
3185
3186                 if (state->session == NULL) {
3187                         continue;
3188                 }
3189
3190                 if (!state->smb2.should_encrypt) {
3191                         continue;
3192                 }
3193
3194                 encryption_key = state->session->smb2->encryption_key;
3195                 if (!smb2_signing_key_valid(encryption_key)) {
3196                         return NT_STATUS_INVALID_PARAMETER_MIX;
3197                 }
3198
3199                 encryption_session_id = state->session->smb2->session_id;
3200
3201                 state->session->smb2->nonce_low += 1;
3202                 if (state->session->smb2->nonce_low == 0) {
3203                         state->session->smb2->nonce_high += 1;
3204                         state->session->smb2->nonce_low += 1;
3205                 }
3206
3207                 /*
3208                  * CCM and GCM algorithms must never have their
3209                  * nonce wrap, or the security of the whole
3210                  * communication and the keys is destroyed.
3211                  * We must drop the connection once we have
3212                  * transfered too much data.
3213                  *
3214                  * NOTE: We assume nonces greater than 8 bytes.
3215                  */
3216                 if (state->session->smb2->nonce_high >=
3217                     state->session->smb2->nonce_high_max)
3218                 {
3219                         return NT_STATUS_ENCRYPTION_FAILED;
3220                 }
3221
3222                 nonce_high = state->session->smb2->nonce_high_random;
3223                 nonce_high += state->session->smb2->nonce_high;
3224                 nonce_low = state->session->smb2->nonce_low;
3225
3226                 tf_iov = num_iov;
3227                 iov[num_iov].iov_base = state->smb2.transform;
3228                 iov[num_iov].iov_len  = sizeof(state->smb2.transform);
3229                 num_iov += 1;
3230
3231                 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3232                 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
3233                       nonce_low);
3234                 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
3235                       nonce_high);
3236                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
3237                       encryption_session_id);
3238
3239                 nbt_len += SMB2_TF_HDR_SIZE;
3240                 break;
3241         }
3242
3243         for (i=0; i<num_reqs; i++) {
3244                 int hdr_iov;
3245                 size_t reqlen;
3246                 bool ret;
3247                 uint16_t opcode;
3248                 uint64_t avail;
3249                 uint16_t charge;
3250                 uint16_t credits;
3251                 uint64_t mid;
3252                 struct smb2_signing_key *signing_key = NULL;
3253
3254                 if (!tevent_req_is_in_progress(reqs[i])) {
3255                         return NT_STATUS_INTERNAL_ERROR;
3256                 }
3257
3258                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3259
3260                 if (!smbXcli_conn_is_connected(state->conn)) {
3261                         return NT_STATUS_CONNECTION_DISCONNECTED;
3262                 }
3263
3264                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3265                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3266                         return NT_STATUS_REVISION_MISMATCH;
3267                 }
3268
3269                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3270                 if (opcode == SMB2_OP_CANCEL) {
3271                         goto skip_credits;
3272                 }
3273
3274                 avail = UINT64_MAX - state->conn->smb2.mid;
3275                 if (avail < 1) {
3276                         return NT_STATUS_CONNECTION_ABORTED;
3277                 }
3278
3279                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3280                         uint32_t max_dyn_len = 1;
3281
3282                         max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
3283                         max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
3284
3285                         charge = (max_dyn_len - 1)/ 65536 + 1;
3286                 } else {
3287                         charge = 1;
3288                 }
3289
3290                 charge = MAX(state->smb2.credit_charge, charge);
3291
3292                 avail = MIN(avail, state->conn->smb2.cur_credits);
3293                 if (avail < charge) {
3294                         DBG_ERR("Insufficient credits. "
3295                                 "%"PRIu64" available, %"PRIu16" needed\n",
3296                                 avail, charge);
3297                         return NT_STATUS_INTERNAL_ERROR;
3298                 }
3299
3300                 credits = 0;
3301                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
3302                         credits = state->conn->smb2.max_credits -
3303                                   state->conn->smb2.cur_credits;
3304                 }
3305                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
3306                         credits += 1;
3307                 }
3308
3309                 mid = state->conn->smb2.mid;
3310                 state->conn->smb2.mid += charge;
3311                 state->conn->smb2.cur_credits -= charge;
3312
3313                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3314                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
3315                 }
3316                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
3317                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
3318
3319                 state->smb2.cancel_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3320                 state->smb2.cancel_flags &= ~SMB2_HDR_FLAG_CHAINED;
3321                 state->smb2.cancel_mid = mid;
3322                 state->smb2.cancel_aid = 0;
3323
3324 skip_credits:
3325                 if (state->session && encryption_key == NULL) {
3326                         /*
3327                          * We prefer the channel signing key if it is
3328                          * already there.
3329                          */
3330                         if (state->smb2.should_sign) {
3331                                 signing_key = state->session->smb2_channel.signing_key;
3332                         }
3333
3334                         /*
3335                          * If it is a channel binding, we already have the main
3336                          * signing key and try that one.
3337                          */
3338                         if (signing_key != NULL &&
3339                             !smb2_signing_key_valid(signing_key)) {
3340                                 signing_key = state->session->smb2->signing_key;
3341                         }
3342
3343                         /*
3344                          * If we do not have any session key yet, we skip the
3345                          * signing of SMB2_OP_SESSSETUP requests.
3346                          */
3347                         if (signing_key != NULL &&
3348                             !smb2_signing_key_valid(signing_key)) {
3349                                 signing_key = NULL;
3350                         }
3351                 }
3352
3353                 hdr_iov = num_iov;
3354                 iov[num_iov].iov_base = state->smb2.hdr;
3355                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
3356                 num_iov += 1;
3357
3358                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
3359                 iov[num_iov].iov_len  = state->smb2.fixed_len;
3360                 num_iov += 1;
3361
3362                 if (state->smb2.dyn != NULL) {
3363                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
3364                         iov[num_iov].iov_len  = state->smb2.dyn_len;
3365                         num_iov += 1;
3366                 }
3367
3368                 reqlen  = sizeof(state->smb2.hdr);
3369                 reqlen += state->smb2.fixed_len;
3370                 reqlen += state->smb2.dyn_len;
3371
3372                 if (i < num_reqs-1) {
3373                         if ((reqlen % 8) > 0) {
3374                                 uint8_t pad = 8 - (reqlen % 8);
3375                                 iov[num_iov].iov_base = state->smb2.pad;
3376                                 iov[num_iov].iov_len = pad;
3377                                 num_iov += 1;
3378                                 reqlen += pad;
3379                         }
3380                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
3381                 }
3382
3383                 state->smb2.encryption_session_id = encryption_session_id;
3384
3385                 if (signing_key != NULL) {
3386                         NTSTATUS status;
3387
3388                         status = smb2_signing_sign_pdu(signing_key,
3389                                                        &iov[hdr_iov], num_iov - hdr_iov);
3390                         if (!NT_STATUS_IS_OK(status)) {
3391                                 return status;
3392                         }
3393                 }
3394
3395                 nbt_len += reqlen;
3396
3397                 ret = smbXcli_req_set_pending(reqs[i]);
3398                 if (!ret) {
3399                         return NT_STATUS_NO_MEMORY;
3400                 }
3401         }
3402
3403         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
3404         _smb_setlen_tcp(state->length_hdr, nbt_len);
3405         iov[0].iov_base = state->length_hdr;
3406         iov[0].iov_len  = sizeof(state->length_hdr);
3407
3408         if (encryption_key != NULL) {
3409                 NTSTATUS status;
3410                 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
3411                 uint8_t *buf;
3412                 int vi;
3413
3414                 buf = talloc_array(iov, uint8_t, buflen);
3415                 if (buf == NULL) {
3416                         return NT_STATUS_NO_MEMORY;
3417                 }
3418
3419                 /*
3420                  * We copy the buffers before encrypting them,
3421                  * this is at least currently needed for the
3422                  * to keep state->smb2.hdr.
3423                  *
3424                  * Also the callers may expect there buffers
3425                  * to be const.
3426                  */
3427                 for (vi = tf_iov + 1; vi < num_iov; vi++) {
3428                         struct iovec *v = &iov[vi];
3429                         const uint8_t *o = (const uint8_t *)v->iov_base;
3430
3431                         memcpy(buf, o, v->iov_len);
3432                         v->iov_base = (void *)buf;
3433                         buf += v->iov_len;
3434                 }
3435
3436                 status = smb2_signing_encrypt_pdu(encryption_key,
3437                                         &iov[tf_iov], num_iov - tf_iov);
3438                 if (!NT_STATUS_IS_OK(status)) {
3439                         return status;
3440                 }
3441         }
3442
3443         if (state->conn->dispatch_incoming == NULL) {
3444                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3445         }
3446
3447         subreq = writev_send(state, state->ev, state->conn->outgoing,
3448                              state->conn->sock_fd, false, iov, num_iov);
3449         if (subreq == NULL) {
3450                 return NT_STATUS_NO_MEMORY;
3451         }
3452         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3453         state->write_req = subreq;
3454
3455         return NT_STATUS_OK;
3456 }
3457
3458 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3459 {
3460         struct smbXcli_req_state *state =
3461                 tevent_req_data(req,
3462                 struct smbXcli_req_state);
3463
3464         state->smb2.credit_charge = charge;
3465 }
3466
3467 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3468                                     struct tevent_context *ev,
3469                                     struct smbXcli_conn *conn,
3470                                     uint16_t cmd,
3471                                     uint32_t additional_flags,
3472                                     uint32_t clear_flags,
3473                                     uint32_t timeout_msec,
3474                                     struct smbXcli_tcon *tcon,
3475                                     struct smbXcli_session *session,
3476                                     const uint8_t *fixed,
3477                                     uint16_t fixed_len,
3478                                     const uint8_t *dyn,
3479                                     uint32_t dyn_len,
3480                                     uint32_t max_dyn_len)
3481 {
3482         struct tevent_req *req;
3483         NTSTATUS status;
3484
3485         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3486                                  additional_flags, clear_flags,
3487                                  timeout_msec,
3488                                  tcon, session,
3489                                  fixed, fixed_len,
3490                                  dyn, dyn_len,
3491                                  max_dyn_len);
3492         if (req == NULL) {
3493                 return NULL;
3494         }
3495         if (!tevent_req_is_in_progress(req)) {
3496                 return tevent_req_post(req, ev);
3497         }
3498         status = smb2cli_req_compound_submit(&req, 1);
3499         if (tevent_req_nterror(req, status)) {
3500                 return tevent_req_post(req, ev);
3501         }
3502         return req;
3503 }
3504
3505 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3506 {
3507         struct tevent_req *req =
3508                 tevent_req_callback_data(subreq,
3509                 struct tevent_req);
3510         struct smbXcli_req_state *state =
3511                 tevent_req_data(req,
3512                 struct smbXcli_req_state);
3513         ssize_t nwritten;
3514         int err;
3515
3516         state->write_req = NULL;
3517
3518         nwritten = writev_recv(subreq, &err);
3519         TALLOC_FREE(subreq);
3520         if (nwritten == -1) {
3521                 /* here, we need to notify all pending requests */
3522                 NTSTATUS status = map_nt_error_from_unix_common(err);
3523                 smbXcli_conn_disconnect(state->conn, status);
3524                 return;
3525         }
3526 }
3527
3528 static struct smbXcli_session* smbXcli_session_by_uid(struct smbXcli_conn *conn,
3529                                                      uint64_t uid)
3530 {
3531         struct smbXcli_session *s = conn->sessions;
3532
3533         for (; s; s = s->next) {
3534                 if (s->smb2->session_id != uid) {
3535                         continue;
3536                 }
3537                 break;
3538         }
3539
3540         return s;
3541 }
3542
3543 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3544                                              uint8_t *buf,
3545                                              size_t buflen,
3546                                              TALLOC_CTX *mem_ctx,
3547                                              struct iovec **piov,
3548                                              size_t *pnum_iov)
3549 {
3550         struct iovec *iov;
3551         int num_iov = 0;
3552         size_t taken = 0;
3553         uint8_t *first_hdr = buf;
3554         size_t verified_buflen = 0;
3555         uint8_t *tf = NULL;
3556         size_t tf_len = 0;
3557
3558         iov = talloc_array(mem_ctx, struct iovec, num_iov);
3559         if (iov == NULL) {
3560                 return NT_STATUS_NO_MEMORY;
3561         }
3562
3563         while (taken < buflen) {
3564                 size_t len = buflen - taken;
3565                 uint8_t *hdr = first_hdr + taken;
3566                 struct iovec *cur;
3567                 size_t full_size;
3568                 size_t next_command_ofs;
3569                 uint16_t body_size;
3570                 struct iovec *iov_tmp;
3571
3572                 if (verified_buflen > taken) {
3573                         len = verified_buflen - taken;
3574                 } else {
3575                         tf = NULL;
3576                         tf_len = 0;
3577                 }
3578
3579                 if (len < 4) {
3580                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3581                                    (int)len, 4));
3582                         goto inval;
3583                 }
3584                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3585                         struct smbXcli_session *s;
3586                         uint64_t uid;
3587                         struct iovec tf_iov[2];
3588                         size_t enc_len;
3589                         NTSTATUS status;
3590
3591                         if (len < SMB2_TF_HDR_SIZE) {
3592                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3593                                            (int)len, SMB2_TF_HDR_SIZE));
3594                                 goto inval;
3595                         }
3596                         tf = hdr;
3597                         tf_len = SMB2_TF_HDR_SIZE;
3598                         taken += tf_len;
3599
3600                         hdr = first_hdr + taken;
3601                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3602                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
3603
3604                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
3605                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3606                                            (int)len,
3607                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
3608                                 goto inval;
3609                         }
3610
3611                         s = smbXcli_session_by_uid(conn, uid);
3612                         if (s == NULL) {
3613                                 DEBUG(10, ("unknown session_id %llu\n",
3614                                            (unsigned long long)uid));
3615                                 goto inval;
3616                         }
3617
3618                         tf_iov[0].iov_base = (void *)tf;
3619                         tf_iov[0].iov_len = tf_len;
3620                         tf_iov[1].iov_base = (void *)hdr;
3621                         tf_iov[1].iov_len = enc_len;
3622
3623                         status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3624                                                           tf_iov, 2);
3625                         if (!NT_STATUS_IS_OK(status)) {
3626                                 TALLOC_FREE(iov);
3627                                 return status;
3628                         }
3629
3630                         verified_buflen = taken + enc_len;
3631                         len = enc_len;
3632                 }
3633
3634                 /*
3635                  * We need the header plus the body length field
3636                  */
3637
3638                 if (len < SMB2_HDR_BODY + 2) {
3639                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3640                                    (int)len, SMB2_HDR_BODY));
3641                         goto inval;
3642                 }
3643                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3644                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3645                                    IVAL(hdr, 0)));
3646                         goto inval;
3647                 }
3648                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3649                         DEBUG(10, ("Got HDR len %d, expected %d\n",
3650                                    SVAL(hdr, 4), SMB2_HDR_BODY));
3651                         goto inval;
3652                 }
3653
3654                 full_size = len;
3655                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3656                 body_size = SVAL(hdr, SMB2_HDR_BODY);
3657
3658                 if (next_command_ofs != 0) {
3659                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3660                                 goto inval;
3661                         }
3662                         if (next_command_ofs > full_size) {
3663                                 goto inval;
3664                         }
3665                         full_size = next_command_ofs;
3666                 }
3667                 if (body_size < 2) {
3668                         goto inval;
3669                 }
3670                 body_size &= 0xfffe;
3671
3672                 if (body_size > (full_size - SMB2_HDR_BODY)) {
3673                         goto inval;
3674                 }
3675
3676                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3677                                          num_iov + 4);
3678                 if (iov_tmp == NULL) {
3679                         TALLOC_FREE(iov);
3680                         return NT_STATUS_NO_MEMORY;
3681                 }
3682                 iov = iov_tmp;
3683                 cur = &iov[num_iov];
3684                 num_iov += 4;
3685
3686                 cur[0].iov_base = tf;
3687                 cur[0].iov_len  = tf_len;
3688                 cur[1].iov_base = hdr;
3689                 cur[1].iov_len  = SMB2_HDR_BODY;
3690                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3691                 cur[2].iov_len  = body_size;
3692                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3693                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
3694
3695                 taken += full_size;
3696         }
3697
3698         *piov = iov;
3699         *pnum_iov = num_iov;
3700         return NT_STATUS_OK;
3701
3702 inval:
3703         TALLOC_FREE(iov);
3704         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3705 }
3706
3707 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3708                                                     uint64_t mid)
3709 {
3710         size_t num_pending = talloc_array_length(conn->pending);
3711         size_t i;
3712
3713         for (i=0; i<num_pending; i++) {
3714                 struct tevent_req *req = conn->pending[i];
3715                 struct smbXcli_req_state *state =
3716                         tevent_req_data(req,
3717                         struct smbXcli_req_state);
3718
3719                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3720                         return req;
3721                 }
3722         }
3723         return NULL;
3724 }
3725
3726 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3727                                                TALLOC_CTX *tmp_mem,
3728                                                uint8_t *inbuf)
3729 {
3730         struct tevent_req *req;
3731         struct smbXcli_req_state *state = NULL;
3732         struct iovec *iov = NULL;
3733         size_t i, num_iov = 0;
3734         NTSTATUS status;
3735         bool defer = true;
3736         struct smbXcli_session *last_session = NULL;
3737         size_t inbuf_len = smb_len_tcp(inbuf);
3738
3739         status = smb2cli_inbuf_parse_compound(conn,
3740                                               inbuf + NBT_HDR_SIZE,
3741                                               inbuf_len,
3742                                               tmp_mem,
3743                                               &iov, &num_iov);
3744         if (!NT_STATUS_IS_OK(status)) {
3745                 return status;
3746         }
3747
3748         for (i=0; i<num_iov; i+=4) {
3749                 uint8_t *inbuf_ref = NULL;
3750                 struct iovec *cur = &iov[i];
3751                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3752                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3753                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3754                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3755                 uint16_t req_opcode;
3756                 uint32_t req_flags;
3757                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3758                 uint32_t new_credits;
3759                 struct smbXcli_session *session = NULL;
3760                 struct smb2_signing_key *signing_key = NULL;
3761                 bool was_encrypted = false;
3762
3763                 new_credits = conn->smb2.cur_credits;
3764                 new_credits += credits;
3765                 if (new_credits > UINT16_MAX) {
3766                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3767                 }
3768                 conn->smb2.cur_credits += credits;
3769
3770                 req = smb2cli_conn_find_pending(conn, mid);
3771                 if (req == NULL) {
3772                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3773                 }
3774                 state = tevent_req_data(req, struct smbXcli_req_state);
3775
3776                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3777                 if (opcode != req_opcode) {
3778                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3779                 }
3780                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3781
3782                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3783                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3784                 }
3785
3786                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3787                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3788                     NT_STATUS_EQUAL(status, NT_STATUS_PENDING)) {
3789                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3790
3791                         if (state->smb2.got_async) {
3792                                 /* We only expect one STATUS_PENDING response */
3793                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3794                         }
3795                         state->smb2.got_async = true;
3796
3797                         /*
3798                          * async interim responses are not signed,
3799                          * even if the SMB2_HDR_FLAG_SIGNED flag
3800                          * is set.
3801                          */
3802                         state->smb2.cancel_flags |= SMB2_HDR_FLAG_ASYNC;
3803                         state->smb2.cancel_aid = async_id;
3804
3805                         if (state->smb2.notify_async) {
3806                                 tevent_req_defer_callback(req, state->ev);
3807                                 tevent_req_notify_callback(req);
3808                         }
3809                         continue;
3810                 }
3811
3812                 session = state->session;
3813                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3814                         session = last_session;
3815                 }
3816                 last_session = session;
3817
3818                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3819                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3820
3821                         if (session == NULL) {
3822                                 session = smbXcli_session_by_uid(state->conn,
3823                                                                  uid);
3824                         }
3825
3826                         if (session == NULL) {
3827                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3828                         }
3829
3830                         last_session = session;
3831                         signing_key = session->smb2_channel.signing_key;
3832                 }
3833
3834                 if (opcode == SMB2_OP_SESSSETUP) {
3835                         /*
3836                          * We prefer the channel signing key, if it is
3837                          * already there.
3838                          *
3839                          * If we do not have a channel signing key yet,
3840                          * we try the main signing key, if it is not
3841                          * the final response.
3842                          */
3843                         if (signing_key != NULL &&
3844                             !smb2_signing_key_valid(signing_key) &&
3845                             !NT_STATUS_IS_OK(status)) {
3846                                 signing_key = session->smb2->signing_key;
3847                         }
3848
3849                         if (signing_key != NULL &&
3850                             !smb2_signing_key_valid(signing_key)) {
3851                                 /*
3852                                  * If we do not have a session key to
3853                                  * verify the signature, we defer the
3854                                  * signing check to the caller.
3855                                  *
3856                                  * The caller gets NT_STATUS_OK, it
3857                                  * has to call
3858                                  * smb2cli_session_set_session_key()
3859                                  * or
3860                                  * smb2cli_session_set_channel_key()
3861                                  * which will check the signature
3862                                  * with the channel signing key.
3863                                  */
3864                                 signing_key = NULL;
3865                         }
3866
3867                         if (!NT_STATUS_IS_OK(status)) {
3868                                 /*
3869                                  * Only check the signature of the last response
3870                                  * of a successfull session auth. This matches
3871                                  * Windows behaviour for NTLM auth and reauth.
3872                                  */
3873                                 state->smb2.require_signed_response = false;
3874                         }
3875                 }
3876
3877                 if (state->smb2.should_sign ||
3878                     state->smb2.require_signed_response)
3879                 {
3880                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3881                                 return NT_STATUS_ACCESS_DENIED;
3882                         }
3883                 }
3884
3885                 if (!smb2_signing_key_valid(signing_key) &&
3886                     state->smb2.require_signed_response) {
3887                         signing_key = session->smb2_channel.signing_key;
3888                 }
3889
3890                 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3891                         const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3892                         uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3893
3894                         /*
3895                          * If the response was encrypted in a SMB2_TRANSFORM
3896                          * pdu, which belongs to the correct session,
3897                          * we do not need to do signing checks
3898                          *
3899                          * It could be the session the response belongs to
3900                          * or the session that was used to encrypt the
3901                          * SMB2_TRANSFORM request.
3902                          */
3903                         if ((session && session->smb2->session_id == uid) ||
3904                             (state->smb2.encryption_session_id == uid)) {
3905                                 signing_key = NULL;
3906                                 was_encrypted = true;
3907                         }
3908                 }
3909
3910                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3911                         /*
3912                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3913                          * the response is not signed and we should
3914                          * propagate the NT_STATUS_USER_SESSION_DELETED
3915                          * status to the caller.
3916                          */
3917                         state->smb2.signing_skipped = true;
3918                         signing_key = NULL;
3919                 }
3920                 if (NT_STATUS_EQUAL(status, NT_STATUS_REQUEST_OUT_OF_SEQUENCE)) {
3921                         /*
3922                          * if the server returns
3923                          * NT_STATUS_REQUEST_OUT_OF_SEQUENCE for a session setup
3924                          * request, the response is not signed and we should
3925                          * propagate the NT_STATUS_REQUEST_OUT_OF_SEQUENCE
3926                          * status to the caller
3927                          */
3928                         if (opcode == SMB2_OP_SESSSETUP) {
3929                                 state->smb2.signing_skipped = true;
3930                                 signing_key = NULL;
3931                         }
3932                 }
3933                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
3934                         /*
3935                          * if the server returns NT_STATUS_NOT_SUPPORTED
3936                          * for a session setup request, the response is not
3937                          * signed and we should propagate the NT_STATUS_NOT_SUPPORTED
3938                          * status to the caller.
3939                          */
3940                         if (opcode == SMB2_OP_SESSSETUP) {
3941                                 state->smb2.signing_skipped = true;
3942                                 signing_key = NULL;
3943                         }
3944                 }
3945                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3946                         /*
3947                          * if the server returns
3948                          * NT_STATUS_ACCESS_DENIED for a session setup
3949                          * request, the response is not signed and we should
3950                          * propagate the NT_STATUS_ACCESS_DENIED
3951                          * status to the caller without disconnecting
3952                          * the connection because we where not able to
3953                          * verify the response signature.
3954                          */
3955                         if (opcode == SMB2_OP_SESSSETUP) {
3956                                 state->smb2.signing_skipped = true;
3957                                 signing_key = NULL;
3958                         }
3959                 }
3960
3961                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3962                         /*
3963                          * if the server returns
3964                          * NT_STATUS_INVALID_PARAMETER
3965                          * the response might not be encrypted.
3966                          */
3967                         if (state->smb2.should_encrypt && !was_encrypted) {
3968                                 state->smb2.signing_skipped = true;
3969                                 signing_key = NULL;
3970                         }
3971                 }
3972
3973                 if (state->smb2.should_encrypt && !was_encrypted) {
3974                         if (!state->smb2.signing_skipped) {
3975                                 return NT_STATUS_ACCESS_DENIED;
3976                         }
3977                 }
3978
3979                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3980                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3981                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3982                         /*
3983                          * if the server returns
3984                          * NT_STATUS_NETWORK_NAME_DELETED
3985                          * NT_STATUS_FILE_CLOSED
3986                          * NT_STATUS_INVALID_PARAMETER
3987                          * the response might not be signed
3988                          * as this happens before the signing checks.
3989                          *
3990                          * If server echos the signature (or all zeros)
3991                          * we should report the status from the server
3992                          * to the caller.
3993                          */
3994                         if (signing_key) {
3995                                 int cmp;
3996
3997                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3998                                              state->smb2.hdr+SMB2_HDR_SIGNATURE,
3999                                              16);
4000                                 if (cmp == 0) {
4001                                         state->smb2.signing_skipped = true;
4002                                         signing_key = NULL;
4003                                 }
4004                         }
4005                         if (signing_key) {
4006                                 bool zero;
4007                                 zero = all_zero(inhdr+SMB2_HDR_SIGNATURE, 16);
4008                                 if (zero) {
4009                                         state->smb2.signing_skipped = true;
4010                                         signing_key = NULL;
4011                                 }
4012                         }
4013                 }
4014
4015                 if (signing_key) {
4016                         NTSTATUS signing_status;
4017
4018                         signing_status = smb2_signing_check_pdu(signing_key,
4019                                                                 &cur[1], 3);
4020                         if (!NT_STATUS_IS_OK(signing_status)) {
4021                                 /*
4022                                  * If the signing check fails, we disconnect
4023                                  * the connection.
4024                                  */
4025                                 return signing_status;
4026                         }
4027                 }
4028
4029                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
4030                     (session != NULL) && session->disconnect_expired)
4031                 {
4032                         /*
4033                          * this should be a short term hack
4034                          * until the upper layers have implemented
4035                          * re-authentication.
4036                          */
4037                         return status;
4038                 }
4039
4040                 smbXcli_req_unset_pending(req);
4041
4042                 /*
4043                  * There might be more than one response
4044                  * we need to defer the notifications
4045                  */
4046                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
4047                         defer = false;
4048                 }
4049
4050                 if (defer) {
4051                         tevent_req_defer_callback(req, state->ev);
4052                 }
4053
4054                 /*
4055                  * Note: here we use talloc_reference() in a way
4056                  *       that does not expose it to the caller.
4057                  */
4058                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
4059                 if (tevent_req_nomem(inbuf_ref, req)) {
4060                         continue;
4061                 }
4062
4063                 /* copy the related buffers */
4064                 state->smb2.recv_iov[0] = cur[1];
4065                 state->smb2.recv_iov[1] = cur[2];
4066                 state->smb2.recv_iov[2] = cur[3];
4067
4068                 tevent_req_done(req);
4069         }
4070
4071         if (defer) {
4072                 return NT_STATUS_RETRY;
4073         }
4074
4075         return NT_STATUS_OK;
4076 }
4077
4078 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
4079                           struct iovec **piov,
4080                           const struct smb2cli_req_expected_response *expected,
4081                           size_t num_expected)
4082 {
4083         struct smbXcli_req_state *state =
4084                 tevent_req_data(req,
4085                 struct smbXcli_req_state);
4086         NTSTATUS status;
4087         size_t body_size;
4088         bool found_status = false;
4089         bool found_size = false;
4090         size_t i;
4091
4092         if (piov != NULL) {
4093                 *piov = NULL;
4094         }
4095
4096         if (tevent_req_is_in_progress(req) && state->smb2.got_async) {
4097                 return NT_STATUS_PENDING;
4098         }
4099
4100         if (tevent_req_is_nterror(req, &status)) {
4101                 for (i=0; i < num_expected; i++) {
4102                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
4103                                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
4104                         }
4105                 }
4106
4107                 return status;
4108         }
4109
4110         if (num_expected == 0) {
4111                 found_status = true;
4112                 found_size = true;
4113         }
4114
4115         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
4116         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
4117
4118         for (i=0; i < num_expected; i++) {
4119                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
4120                         continue;
4121                 }
4122
4123                 found_status = true;
4124                 if (expected[i].body_size == 0) {
4125                         found_size = true;
4126                         break;
4127                 }
4128
4129                 if (expected[i].body_size == body_size) {
4130                         found_size = true;
4131                         break;
4132                 }
4133         }
4134
4135         if (!found_status) {
4136                 return status;
4137         }
4138
4139         if (state->smb2.signing_skipped) {
4140                 if (num_expected > 0) {
4141                         return NT_STATUS_ACCESS_DENIED;
4142                 }
4143                 if (!NT_STATUS_IS_ERR(status)) {
4144                         return NT_STATUS_ACCESS_DENIED;
4145                 }
4146         }
4147
4148         if (!found_size) {
4149                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4150         }
4151
4152         if (piov != NULL) {
4153                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
4154         }
4155
4156         return status;
4157 }
4158
4159 NTSTATUS smb2cli_req_get_sent_iov(struct tevent_req *req,
4160                                   struct iovec *sent_iov)
4161 {
4162         struct smbXcli_req_state *state =
4163                 tevent_req_data(req,
4164                 struct smbXcli_req_state);
4165
4166         if (tevent_req_is_in_progress(req)) {
4167                 return NT_STATUS_PENDING;
4168         }
4169
4170         sent_iov[0].iov_base = state->smb2.hdr;
4171         sent_iov[0].iov_len  = sizeof(state->smb2.hdr);
4172
4173         sent_iov[1].iov_base = discard_const(state->smb2.fixed);
4174         sent_iov[1].iov_len  = state->smb2.fixed_len;
4175
4176         if (state->smb2.dyn != NULL) {
4177                 sent_iov[2].iov_base = discard_const(state->smb2.dyn);
4178                 sent_iov[2].iov_len  = state->smb2.dyn_len;
4179         } else {
4180                 sent_iov[2].iov_base = NULL;
4181                 sent_iov[2].iov_len  = 0;
4182         }
4183
4184         return NT_STATUS_OK;
4185 }
4186
4187 static const struct {
4188         enum protocol_types proto;
4189         const char *smb1_name;
4190 } smb1cli_prots[] = {
4191         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
4192         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
4193         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
4194         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
4195         {PROTOCOL_LANMAN2,      "LM1.2X002"},
4196         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
4197         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
4198         {PROTOCOL_LANMAN2,      "Samba"},
4199         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
4200         {PROTOCOL_NT1,          "NT LM 0.12"},
4201         {PROTOCOL_SMB2_02,      "SMB 2.002"},
4202         {PROTOCOL_SMB2_10,      "SMB 2.???"},
4203 };
4204
4205 static const struct {
4206         enum protocol_types proto;
4207         uint16_t smb2_dialect;
4208 } smb2cli_prots[] = {
4209         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
4210         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
4211         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
4212         {PROTOCOL_SMB3_02,      SMB3_DIALECT_REVISION_302},
4213         {PROTOCOL_SMB3_11,      SMB3_DIALECT_REVISION_311},
4214 };
4215
4216 struct smbXcli_negprot_state {
4217         struct smbXcli_conn *conn;
4218         struct tevent_context *ev;
4219         uint32_t timeout_msec;
4220
4221         struct {
4222                 uint8_t fixed[36];
4223         } smb2;
4224 };
4225
4226 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
4227 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
4228 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
4229 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
4230 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
4231 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4232                                                   TALLOC_CTX *frame,
4233                                                   uint8_t *inbuf);
4234
4235 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
4236                                         struct tevent_context *ev,
4237                                         struct smbXcli_conn *conn,
4238                                         uint32_t timeout_msec,
4239                                         enum protocol_types min_protocol,
4240                                         enum protocol_types max_protocol,
4241                                         uint16_t max_credits)
4242 {
4243         struct tevent_req *req, *subreq;
4244         struct smbXcli_negprot_state *state;
4245
4246         req = tevent_req_create(mem_ctx, &state,
4247                                 struct smbXcli_negprot_state);
4248         if (req == NULL) {
4249                 return NULL;
4250         }
4251         state->conn = conn;
4252         state->ev = ev;
4253         state->timeout_msec = timeout_msec;
4254
4255         if (min_protocol == PROTOCOL_NONE) {
4256                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4257                 return tevent_req_post(req, ev);
4258         }
4259
4260         if (max_protocol == PROTOCOL_NONE) {
4261                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4262                 return tevent_req_post(req, ev);
4263         }
4264
4265         if (min_protocol > max_protocol) {
4266                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4267                 return tevent_req_post(req, ev);
4268         }
4269
4270         conn->min_protocol = min_protocol;
4271         conn->max_protocol = max_protocol;
4272         conn->protocol = PROTOCOL_NONE;
4273
4274         if (max_protocol >= PROTOCOL_SMB2_02) {
4275                 conn->smb2.max_credits = max_credits;
4276         }
4277
4278         if ((min_protocol < PROTOCOL_SMB2_02) &&
4279             (max_protocol < PROTOCOL_SMB2_02)) {
4280                 /*
4281                  * SMB1 only...
4282                  */
4283                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4284
4285                 subreq = smbXcli_negprot_smb1_subreq(state);
4286                 if (tevent_req_nomem(subreq, req)) {
4287                         return tevent_req_post(req, ev);
4288                 }
4289                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4290                 return req;
4291         }
4292
4293         if ((min_protocol >= PROTOCOL_SMB2_02) &&
4294             (max_protocol >= PROTOCOL_SMB2_02)) {
4295                 /*
4296                  * SMB2 only...
4297                  */
4298                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4299
4300                 subreq = smbXcli_negprot_smb2_subreq(state);
4301                 if (tevent_req_nomem(subreq, req)) {
4302                         return tevent_req_post(req, ev);
4303                 }
4304                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4305                 return req;
4306         }
4307
4308         /*
4309          * We send an SMB1 negprot with the SMB2 dialects
4310          * and expect a SMB1 or a SMB2 response.
4311          *
4312          * smbXcli_negprot_dispatch_incoming() will fix the
4313          * callback to match protocol of the response.
4314          */
4315         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
4316
4317         subreq = smbXcli_negprot_smb1_subreq(state);
4318         if (tevent_req_nomem(subreq, req)) {
4319                 return tevent_req_post(req, ev);
4320         }
4321         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
4322         return req;
4323 }
4324
4325 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
4326 {
4327         struct tevent_req *req =
4328                 tevent_req_callback_data(subreq,
4329                 struct tevent_req);
4330         NTSTATUS status;
4331
4332         /*
4333          * we just want the low level error
4334          */
4335         status = tevent_req_simple_recv_ntstatus(subreq);
4336         TALLOC_FREE(subreq);
4337         if (tevent_req_nterror(req, status)) {
4338                 return;
4339         }
4340
4341         /* this should never happen */
4342         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
4343 }
4344
4345 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
4346 {
4347         size_t i;
4348         DATA_BLOB bytes = data_blob_null;
4349         uint8_t flags;
4350         uint16_t flags2;
4351
4352         /* setup the protocol strings */
4353         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4354                 uint8_t c = 2;
4355                 bool ok;
4356
4357                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4358                         continue;
4359                 }
4360
4361                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4362                         continue;
4363                 }
4364
4365                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
4366                 if (!ok) {
4367                         return NULL;
4368                 }
4369
4370                 /*
4371                  * We now it is already ascii and
4372                  * we want NULL termination.
4373                  */
4374                 ok = data_blob_append(state, &bytes,
4375                                       smb1cli_prots[i].smb1_name,
4376                                       strlen(smb1cli_prots[i].smb1_name)+1);
4377                 if (!ok) {
4378                         return NULL;
4379                 }
4380         }
4381
4382         smb1cli_req_flags(state->conn->max_protocol,
4383                           state->conn->smb1.client.capabilities,
4384                           SMBnegprot,
4385                           0, 0, &flags,
4386                           0, 0, &flags2);
4387
4388         return smb1cli_req_send(state, state->ev, state->conn,
4389                                 SMBnegprot,
4390                                 flags, ~flags,
4391                                 flags2, ~flags2,
4392                                 state->timeout_msec,
4393                                 0xFFFE, 0, NULL, /* pid, tid, session */
4394                                 0, NULL, /* wct, vwv */
4395                                 bytes.length, bytes.data);
4396 }
4397
4398 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
4399 {
4400         struct tevent_req *req =
4401                 tevent_req_callback_data(subreq,
4402                 struct tevent_req);
4403         struct smbXcli_negprot_state *state =
4404                 tevent_req_data(req,
4405                 struct smbXcli_negprot_state);
4406         struct smbXcli_conn *conn = state->conn;
4407         struct iovec *recv_iov = NULL;
4408         uint8_t *inhdr = NULL;
4409         uint8_t wct;
4410         uint16_t *vwv;
4411         uint32_t num_bytes;
4412         uint8_t *bytes;
4413         NTSTATUS status;
4414         uint16_t protnum;
4415         size_t i;
4416         size_t num_prots = 0;
4417         uint8_t flags;
4418         uint32_t client_capabilities = conn->smb1.client.capabilities;
4419         uint32_t both_capabilities;
4420         uint32_t server_capabilities = 0;
4421         uint32_t capabilities;
4422         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
4423         uint32_t server_max_xmit = 0;
4424         uint32_t max_xmit;
4425         uint32_t server_max_mux = 0;
4426         uint16_t server_security_mode = 0;
4427         uint32_t server_session_key = 0;
4428         bool server_readbraw = false;
4429         bool server_writebraw = false;
4430         bool server_lockread = false;
4431         bool server_writeunlock = false;
4432         struct GUID server_guid = GUID_zero();
4433         DATA_BLOB server_gss_blob = data_blob_null;
4434         uint8_t server_challenge[8];
4435         char *server_workgroup = NULL;
4436         char *server_name = NULL;
4437         int server_time_zone = 0;
4438         NTTIME server_system_time = 0;
4439         static const struct smb1cli_req_expected_response expected[] = {
4440         {
4441                 .status = NT_STATUS_OK,
4442                 .wct = 0x11, /* NT1 */
4443         },
4444         {
4445                 .status = NT_STATUS_OK,
4446                 .wct = 0x0D, /* LM */
4447         },
4448         {
4449                 .status = NT_STATUS_OK,
4450                 .wct = 0x01, /* CORE */
4451         }
4452         };
4453
4454         ZERO_STRUCT(server_challenge);
4455
4456         status = smb1cli_req_recv(subreq, state,
4457                                   &recv_iov,
4458                                   &inhdr,
4459                                   &wct,
4460                                   &vwv,
4461                                   NULL, /* pvwv_offset */
4462                                   &num_bytes,
4463                                   &bytes,
4464                                   NULL, /* pbytes_offset */
4465                                   NULL, /* pinbuf */
4466                                   expected, ARRAY_SIZE(expected));
4467         TALLOC_FREE(subreq);
4468         if (inhdr == NULL || tevent_req_nterror(req, status)) {
4469                 return;
4470         }
4471
4472         flags = CVAL(inhdr, HDR_FLG);
4473
4474         protnum = SVAL(vwv, 0);
4475
4476         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4477                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4478                         continue;
4479                 }
4480
4481                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4482                         continue;
4483                 }
4484
4485                 if (protnum != num_prots) {
4486                         num_prots++;
4487                         continue;
4488                 }
4489
4490                 conn->protocol = smb1cli_prots[i].proto;
4491                 break;
4492         }
4493
4494         if (conn->protocol == PROTOCOL_NONE) {
4495                 DBG_ERR("No compatible protocol selected by server.\n");
4496                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4497                 return;
4498         }
4499
4500         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
4501                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
4502                          "and the selected protocol level doesn't support it.\n"));
4503                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4504                 return;
4505         }
4506
4507         if (flags & FLAG_SUPPORT_LOCKREAD) {
4508                 server_lockread = true;
4509                 server_writeunlock = true;
4510         }
4511
4512         if (conn->protocol >= PROTOCOL_NT1) {
4513                 const char *client_signing = NULL;
4514                 bool server_mandatory = false;
4515                 bool server_allowed = false;
4516                 const char *server_signing = NULL;
4517                 bool ok;
4518                 uint8_t key_len;
4519
4520                 if (wct != 0x11) {
4521                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4522                         return;
4523                 }
4524
4525                 /* NT protocol */
4526                 server_security_mode = CVAL(vwv + 1, 0);
4527                 server_max_mux = SVAL(vwv + 1, 1);
4528                 server_max_xmit = IVAL(vwv + 3, 1);
4529                 server_session_key = IVAL(vwv + 7, 1);
4530                 server_time_zone = SVALS(vwv + 15, 1);
4531                 server_time_zone *= 60;
4532                 /* this time arrives in real GMT */
4533                 server_system_time = BVAL(vwv + 11, 1);
4534                 server_capabilities = IVAL(vwv + 9, 1);
4535
4536                 key_len = CVAL(vwv + 16, 1);
4537
4538                 if (server_capabilities & CAP_RAW_MODE) {
4539                         server_readbraw = true;
4540                         server_writebraw = true;
4541                 }
4542                 if (server_capabilities & CAP_LOCK_AND_READ) {
4543                         server_lockread = true;
4544                 }
4545
4546                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4547                         DATA_BLOB blob1, blob2;
4548
4549                         if (num_bytes < 16) {
4550                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4551                                 return;
4552                         }
4553
4554                         blob1 = data_blob_const(bytes, 16);
4555                         status = GUID_from_data_blob(&blob1, &server_guid);
4556                         if (tevent_req_nterror(req, status)) {
4557                                 return;
4558                         }
4559
4560                         blob1 = data_blob_const(bytes+16, num_bytes-16);
4561                         blob2 = data_blob_dup_talloc(state, blob1);
4562                         if (blob1.length > 0 &&
4563                             tevent_req_nomem(blob2.data, req)) {
4564                                 return;
4565                         }
4566                         server_gss_blob = blob2;
4567                 } else {
4568                         DATA_BLOB blob1, blob2;
4569
4570                         if (num_bytes < key_len) {
4571                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4572                                 return;
4573                         }
4574
4575                         if (key_len != 0 && key_len != 8) {
4576                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4577                                 return;
4578                         }
4579
4580                         if (key_len == 8) {
4581                                 memcpy(server_challenge, bytes, 8);
4582                         }
4583
4584                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4585                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4586                         if (blob1.length > 0) {
4587                                 size_t len;
4588
4589                                 len = utf16_len_n(blob1.data,
4590                                                   blob1.length);
4591                                 blob1.length = len;
4592
4593                                 ok = convert_string_talloc(state,
4594                                                            CH_UTF16LE,
4595                                                            CH_UNIX,
4596                                                            blob1.data,
4597                                                            blob1.length,
4598                                                            &server_workgroup,
4599                                                            &len);
4600                                 if (!ok) {
4601                                         status = map_nt_error_from_unix_common(errno);
4602                                         tevent_req_nterror(req, status);
4603                                         return;
4604                                 }
4605                         }
4606
4607                         blob2.data += blob1.length;
4608                         blob2.length -= blob1.length;
4609                         if (blob2.length > 0) {
4610                                 size_t len;
4611
4612                                 len = utf16_len_n(blob1.data,
4613                                                   blob1.length);
4614                                 blob1.length = len;
4615
4616                                 ok = convert_string_talloc(state,
4617                                                            CH_UTF16LE,
4618                                                            CH_UNIX,
4619                                                            blob2.data,
4620                                                            blob2.length,
4621                                                            &server_name,
4622                                                            &len);
4623                                 if (!ok) {
4624                                         status = map_nt_error_from_unix_common(errno);
4625                                         tevent_req_nterror(req, status);
4626                                         return;
4627                                 }
4628                         }
4629                 }
4630
4631                 client_signing = "disabled";
4632                 if (conn->allow_signing) {
4633                         client_signing = "allowed";
4634                 }
4635                 if (conn->mandatory_signing) {
4636                         client_signing = "required";
4637                 }
4638
4639                 server_signing = "not supported";
4640                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4641                         server_signing = "supported";
4642                         server_allowed = true;
4643                 } else if (conn->mandatory_signing) {
4644                         /*
4645                          * We have mandatory signing as client
4646                          * lets assume the server will look at our
4647                          * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4648                          * flag in the session setup
4649                          */
4650                         server_signing = "not announced";
4651                         server_allowed = true;
4652                 }
4653                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4654                         server_signing = "required";
4655                         server_mandatory = true;
4656                 }
4657
4658                 ok = smb_signing_set_negotiated(conn->smb1.signing,
4659                                                 server_allowed,
4660                                                 server_mandatory);
4661                 if (!ok) {
4662                         DEBUG(1,("cli_negprot: SMB signing is required, "
4663                                  "but client[%s] and server[%s] mismatch\n",
4664                                  client_signing, server_signing));
4665                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4666                         return;
4667                 }
4668
4669         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4670                 DATA_BLOB blob1;
4671                 uint8_t key_len;
4672                 time_t t;
4673
4674                 if (wct != 0x0D) {
4675                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4676                         return;
4677                 }
4678
4679                 server_security_mode = SVAL(vwv + 1, 0);
4680                 server_max_xmit = SVAL(vwv + 2, 0);
4681                 server_max_mux = SVAL(vwv + 3, 0);
4682                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4683                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4684                 server_session_key = IVAL(vwv + 6, 0);
4685                 server_time_zone = SVALS(vwv + 10, 0);
4686                 server_time_zone *= 60;
4687                 /* this time is converted to GMT by make_unix_date */
4688                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4689                 unix_to_nt_time(&server_system_time, t);
4690                 key_len = SVAL(vwv + 11, 0);
4691
4692                 if (num_bytes < key_len) {
4693                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4694                         return;
4695                 }
4696
4697                 if (key_len != 0 && key_len != 8) {
4698                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4699                         return;
4700                 }
4701
4702                 if (key_len == 8) {
4703                         memcpy(server_challenge, bytes, 8);
4704                 }
4705
4706                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4707                 if (blob1.length > 0) {
4708                         size_t len;
4709                         bool ok;
4710
4711                         len = utf16_len_n(blob1.data,
4712                                           blob1.length);
4713                         blob1.length = len;
4714
4715                         ok = convert_string_talloc(state,
4716                                                    CH_DOS,
4717                                                    CH_UNIX,
4718                                                    blob1.data,
4719                                                    blob1.length,
4720                                                    &server_workgroup,
4721                                                    &len);
4722                         if (!ok) {
4723                                 status = map_nt_error_from_unix_common(errno);
4724                                 tevent_req_nterror(req, status);
4725                                 return;
4726                         }
4727                 }
4728
4729         } else {
4730                 /* the old core protocol */
4731                 server_time_zone = get_time_zone(time(NULL));
4732                 server_max_xmit = 1024;
4733                 server_max_mux = 1;
4734         }
4735
4736         if (server_max_xmit < 1024) {
4737                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4738                 return;
4739         }
4740
4741         if (server_max_mux < 1) {
4742                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4743                 return;
4744         }
4745
4746         /*
4747          * Now calculate the negotiated capabilities
4748          * based on the mask for:
4749          * - client only flags
4750          * - flags used in both directions
4751          * - server only flags
4752          */
4753         both_capabilities = client_capabilities & server_capabilities;
4754         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4755         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4756         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4757
4758         max_xmit = MIN(client_max_xmit, server_max_xmit);
4759
4760         conn->smb1.server.capabilities = server_capabilities;
4761         conn->smb1.capabilities = capabilities;
4762
4763         conn->smb1.server.max_xmit = server_max_xmit;
4764         conn->smb1.max_xmit = max_xmit;
4765
4766         conn->smb1.server.max_mux = server_max_mux;
4767
4768         conn->smb1.server.security_mode = server_security_mode;
4769
4770         conn->smb1.server.readbraw = server_readbraw;
4771         conn->smb1.server.writebraw = server_writebraw;
4772         conn->smb1.server.lockread = server_lockread;
4773         conn->smb1.server.writeunlock = server_writeunlock;
4774
4775         conn->smb1.server.session_key = server_session_key;
4776
4777         talloc_steal(conn, server_gss_blob.data);
4778         conn->smb1.server.gss_blob = server_gss_blob;
4779         conn->smb1.server.guid = server_guid;
4780         memcpy(conn->smb1.server.challenge, server_challenge, 8);
4781         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4782         conn->smb1.server.name = talloc_move(conn, &server_name);
4783
4784         conn->smb1.server.time_zone = server_time_zone;
4785         conn->smb1.server.system_time = server_system_time;
4786
4787         tevent_req_done(req);
4788 }
4789
4790 static size_t smbXcli_padding_helper(uint32_t offset, size_t n)
4791 {
4792         if ((offset & (n-1)) == 0) return 0;
4793         return n - (offset & (n-1));
4794 }
4795
4796 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4797 {
4798         size_t i;
4799         uint8_t *buf;
4800         uint16_t dialect_count = 0;
4801         DATA_BLOB dyn = data_blob_null;
4802
4803         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4804                 bool ok;
4805                 uint8_t val[2];
4806
4807                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4808                         continue;
4809                 }
4810
4811                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4812                         continue;
4813                 }
4814
4815                 SSVAL(val, 0, smb2cli_prots[i].smb2_dialect);
4816
4817                 ok = data_blob_append(state, &dyn, val, sizeof(val));
4818                 if (!ok) {
4819                         return NULL;
4820                 }
4821
4822                 dialect_count++;
4823         }
4824
4825         buf = state->smb2.fixed;
4826         SSVAL(buf, 0, 36);
4827         SSVAL(buf, 2, dialect_count);
4828         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4829         SSVAL(buf, 6, 0);       /* Reserved */
4830         if (state->conn->max_protocol >= PROTOCOL_SMB3_00) {
4831                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4832         } else {
4833                 SIVAL(buf, 8, 0);       /* Capabilities */
4834         }
4835         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4836                 NTSTATUS status;
4837                 struct GUID_ndr_buf guid_buf = { .buf = {0}, };
4838
4839                 status = GUID_to_ndr_buf(&state->conn->smb2.client.guid,
4840                                          &guid_buf);
4841                 if (!NT_STATUS_IS_OK(status)) {
4842                         return NULL;
4843                 }
4844                 memcpy(buf+12, guid_buf.buf, 16); /* ClientGuid */
4845         } else {
4846                 memset(buf+12, 0, 16);  /* ClientGuid */
4847         }
4848
4849         if (state->conn->max_protocol >= PROTOCOL_SMB3_11) {
4850                 const struct smb3_signing_capabilities *client_sign_algos =
4851                         &state->conn->smb2.client.smb3_capabilities.signing;
4852                 const struct smb3_encryption_capabilities *client_ciphers =
4853                         &state->conn->smb2.client.smb3_capabilities.encryption;
4854                 NTSTATUS status;
4855                 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4856                 uint8_t *netname_utf16 = NULL;
4857                 size_t netname_utf16_len = 0;
4858                 uint32_t offset;
4859                 DATA_BLOB b;
4860                 uint8_t p[38];
4861                 const uint8_t zeros[8] = {0, };
4862                 size_t pad;
4863                 bool ok;
4864
4865                 SSVAL(p, 0,  1); /* HashAlgorithmCount */
4866                 SSVAL(p, 2, 32); /* SaltLength */
4867                 SSVAL(p, 4, SMB2_PREAUTH_INTEGRITY_SHA512);
4868                 generate_random_buffer(p + 6, 32);
4869
4870                 status = smb2_negotiate_context_add(
4871                         state, &c, SMB2_PREAUTH_INTEGRITY_CAPABILITIES, p, 38);
4872                 if (!NT_STATUS_IS_OK(status)) {
4873                         return NULL;
4874                 }
4875
4876                 if (client_ciphers->num_algos > 0) {
4877                         size_t ofs = 0;
4878                         SSVAL(p, ofs, client_ciphers->num_algos);
4879                         ofs += 2;
4880
4881                         for (i = 0; i < client_ciphers->num_algos; i++) {
4882                                 size_t next_ofs = ofs + 2;
4883                                 SMB_ASSERT(next_ofs < ARRAY_SIZE(p));
4884                                 SSVAL(p, ofs, client_ciphers->algos[i]);
4885                                 ofs = next_ofs;
4886                         }
4887
4888                         status = smb2_negotiate_context_add(
4889                                 state, &c, SMB2_ENCRYPTION_CAPABILITIES, p, ofs);
4890                         if (!NT_STATUS_IS_OK(status)) {
4891                                 return NULL;
4892                         }
4893                 }
4894
4895                 if (client_sign_algos->num_algos > 0) {
4896                         size_t ofs = 0;
4897                         SSVAL(p, ofs, client_sign_algos->num_algos);
4898                         ofs += 2;
4899
4900                         for (i = 0; i < client_sign_algos->num_algos; i++) {
4901                                 size_t next_ofs = ofs + 2;
4902                                 SMB_ASSERT(next_ofs < ARRAY_SIZE(p));
4903                                 SSVAL(p, ofs, client_sign_algos->algos[i]);
4904                                 ofs = next_ofs;
4905                         }
4906
4907                         status = smb2_negotiate_context_add(
4908                                 state, &c, SMB2_SIGNING_CAPABILITIES, p, ofs);
4909                         if (!NT_STATUS_IS_OK(status)) {
4910                                 return NULL;
4911                         }
4912                 }
4913
4914                 ok = convert_string_talloc(state, CH_UNIX, CH_UTF16,
4915                                            state->conn->remote_name,
4916                                            strlen(state->conn->remote_name),
4917                                            &netname_utf16, &netname_utf16_len);
4918                 if (!ok) {
4919                         return NULL;
4920                 }
4921
4922                 status = smb2_negotiate_context_add(state, &c,
4923                                         SMB2_NETNAME_NEGOTIATE_CONTEXT_ID,
4924                                         netname_utf16, netname_utf16_len);
4925                 if (!NT_STATUS_IS_OK(status)) {
4926                         return NULL;
4927                 }
4928
4929                 status = smb2_negotiate_context_push(state, &b, c);
4930                 if (!NT_STATUS_IS_OK(status)) {
4931                         return NULL;
4932                 }
4933
4934                 offset = SMB2_HDR_BODY + sizeof(state->smb2.fixed) + dyn.length;
4935                 pad = smbXcli_padding_helper(offset, 8);
4936
4937                 ok = data_blob_append(state, &dyn, zeros, pad);
4938                 if (!ok) {
4939                         return NULL;
4940                 }
4941                 offset += pad;
4942
4943                 ok = data_blob_append(state, &dyn, b.data, b.length);
4944                 if (!ok) {
4945                         return NULL;
4946                 }
4947
4948                 SIVAL(buf, 28, offset);   /* NegotiateContextOffset */
4949                 SSVAL(buf, 32, c.num_contexts); /* NegotiateContextCount */
4950                 SSVAL(buf, 34, 0);        /* Reserved */
4951         } else {
4952                 SBVAL(buf, 28, 0);      /* Reserved/ClientStartTime */
4953         }
4954
4955         return smb2cli_req_send(state, state->ev,
4956                                 state->conn, SMB2_OP_NEGPROT,
4957                                 0, 0, /* flags */
4958                                 state->timeout_msec,
4959                                 NULL, NULL, /* tcon, session */
4960                                 state->smb2.fixed, sizeof(state->smb2.fixed),
4961                                 dyn.data, dyn.length,
4962                                 UINT16_MAX); /* max_dyn_len */
4963 }
4964
4965 static NTSTATUS smbXcli_negprot_smb3_check_capabilities(struct tevent_req *req);
4966
4967 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
4968 {
4969         struct tevent_req *req =
4970                 tevent_req_callback_data(subreq,
4971                 struct tevent_req);
4972         struct smbXcli_negprot_state *state =
4973                 tevent_req_data(req,
4974                 struct smbXcli_negprot_state);
4975         struct smbXcli_conn *conn = state->conn;
4976         size_t security_offset, security_length;
4977         DATA_BLOB blob;
4978         NTSTATUS status;
4979         struct iovec *iov = NULL;
4980         uint8_t *body;
4981         size_t i;
4982         uint16_t dialect_revision;
4983         struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4984         uint32_t negotiate_context_offset = 0;
4985         uint16_t negotiate_context_count = 0;
4986         DATA_BLOB negotiate_context_blob = data_blob_null;
4987         size_t avail;
4988         size_t ctx_ofs;
4989         size_t needed;
4990         struct smb2_negotiate_context *preauth = NULL;
4991         uint16_t hash_count;
4992         uint16_t salt_length;
4993         uint16_t hash_selected;
4994         gnutls_hash_hd_t hash_hnd = NULL;
4995         struct smb2_negotiate_context *sign_algo = NULL;
4996         struct smb2_negotiate_context *cipher = NULL;
4997         struct iovec sent_iov[3] = {{0}, {0}, {0}};
4998         static const struct smb2cli_req_expected_response expected[] = {
4999         {
5000                 .status = NT_STATUS_OK,
5001                 .body_size = 0x41
5002         }
5003         };
5004         int rc;
5005
5006         status = smb2cli_req_recv(subreq, state, &iov,
5007                                   expected, ARRAY_SIZE(expected));
5008         if (tevent_req_nterror(req, status) || iov == NULL) {
5009                 return;
5010         }
5011
5012         body = (uint8_t *)iov[1].iov_base;
5013
5014         dialect_revision = SVAL(body, 4);
5015
5016         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5017                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5018                         continue;
5019                 }
5020
5021                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5022                         continue;
5023                 }
5024
5025                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
5026                         continue;
5027                 }
5028
5029                 conn->protocol = smb2cli_prots[i].proto;
5030                 break;
5031         }
5032
5033         if (conn->protocol == PROTOCOL_NONE) {
5034                 TALLOC_FREE(subreq);
5035
5036                 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5037                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5038                         return;
5039                 }
5040
5041                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
5042                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5043                         return;
5044                 }
5045
5046                 /* make sure we do not loop forever */
5047                 state->conn->min_protocol = PROTOCOL_SMB2_02;
5048
5049                 /*
5050                  * send a SMB2 negprot, in order to negotiate
5051                  * the SMB2 dialect.
5052                  */
5053                 subreq = smbXcli_negprot_smb2_subreq(state);
5054                 if (tevent_req_nomem(subreq, req)) {
5055                         return;
5056                 }
5057                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5058                 return;
5059         }
5060
5061         conn->smb2.server.security_mode = SVAL(body, 2);
5062         if (conn->protocol >= PROTOCOL_SMB3_11) {
5063                 negotiate_context_count = SVAL(body, 6);
5064         }
5065
5066         blob = data_blob_const(body + 8, 16);
5067         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
5068         if (tevent_req_nterror(req, status)) {
5069                 return;
5070         }
5071
5072         conn->smb2.server.capabilities  = IVAL(body, 24);
5073         conn->smb2.server.max_trans_size= IVAL(body, 28);
5074         conn->smb2.server.max_read_size = IVAL(body, 32);
5075         conn->smb2.server.max_write_size= IVAL(body, 36);
5076         conn->smb2.server.system_time   = BVAL(body, 40);
5077         conn->smb2.server.start_time    = BVAL(body, 48);
5078
5079         security_offset = SVAL(body, 56);
5080         security_length = SVAL(body, 58);
5081
5082         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
5083                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5084                 return;
5085         }
5086
5087         if (security_length > iov[2].iov_len) {
5088                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5089                 return;
5090         }
5091
5092         conn->smb2.server.gss_blob = data_blob_talloc(conn,
5093                                                 iov[2].iov_base,
5094                                                 security_length);
5095         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
5096                 return;
5097         }
5098
5099         if (conn->protocol >= PROTOCOL_SMB3_00) {
5100                 conn->smb2.server.sign_algo = SMB2_SIGNING_AES128_CMAC;
5101         } else {
5102                 conn->smb2.server.sign_algo = SMB2_SIGNING_HMAC_SHA256;
5103         }
5104
5105         if (conn->protocol < PROTOCOL_SMB3_11) {
5106                 TALLOC_FREE(subreq);
5107
5108                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
5109                         conn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
5110                 }
5111
5112                 status = smbXcli_negprot_smb3_check_capabilities(req);
5113                 if (tevent_req_nterror(req, status)) {
5114                         return;
5115                 }
5116
5117                 tevent_req_done(req);
5118                 return;
5119         }
5120
5121         /*
5122          * Here we are now at SMB3_11, so encryption should be
5123          * negotiated via context, not capabilities.
5124          */
5125
5126         if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
5127                 /*
5128                  * Server set SMB2_CAP_ENCRYPTION capability,
5129                  * but *SHOULD* not, not *MUST* not. Just mask it off.
5130                  * NetApp seems to do this:
5131                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009
5132                  */
5133                 conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION;
5134         }
5135
5136         negotiate_context_offset = IVAL(body, 60);
5137         if (negotiate_context_offset < security_offset) {
5138                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5139                 return;
5140         }
5141
5142         ctx_ofs = negotiate_context_offset - security_offset;
5143         if (ctx_ofs > iov[2].iov_len) {
5144                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5145                 return;
5146         }
5147         avail = iov[2].iov_len - security_length;
5148         needed = iov[2].iov_len - ctx_ofs;
5149         if (needed > avail) {
5150                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5151                 return;
5152         }
5153
5154         negotiate_context_blob.data = (uint8_t *)iov[2].iov_base;
5155         negotiate_context_blob.length = iov[2].iov_len;
5156
5157         negotiate_context_blob.data += ctx_ofs;
5158         negotiate_context_blob.length -= ctx_ofs;
5159
5160         status = smb2_negotiate_context_parse(state,
5161                                               negotiate_context_blob,
5162                                               negotiate_context_count,
5163                                               &c);
5164         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5165                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
5166         }
5167         if (tevent_req_nterror(req, status)) {
5168                 return;
5169         }
5170
5171         preauth = smb2_negotiate_context_find(&c,
5172                                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
5173         if (preauth == NULL) {
5174                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5175                 return;
5176         }
5177
5178         if (preauth->data.length < 6) {
5179                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5180                 return;
5181         }
5182
5183         hash_count = SVAL(preauth->data.data, 0);
5184         salt_length = SVAL(preauth->data.data, 2);
5185         hash_selected = SVAL(preauth->data.data, 4);
5186
5187         if (hash_count != 1) {
5188                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5189                 return;
5190         }
5191
5192         if (preauth->data.length != (6 + salt_length)) {
5193                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5194                 return;
5195         }
5196
5197         if (hash_selected != SMB2_PREAUTH_INTEGRITY_SHA512) {
5198                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5199                 return;
5200         }
5201
5202         sign_algo = smb2_negotiate_context_find(&c, SMB2_SIGNING_CAPABILITIES);
5203         if (sign_algo != NULL) {
5204                 const struct smb3_signing_capabilities *client_sign_algos =
5205                         &state->conn->smb2.client.smb3_capabilities.signing;
5206                 bool found_selected = false;
5207                 uint16_t sign_algo_count;
5208                 uint16_t sign_algo_selected;
5209
5210                 if (client_sign_algos->num_algos == 0) {
5211                         /*
5212                          * We didn't ask for SMB2_ENCRYPTION_CAPABILITIES
5213                          */
5214                         tevent_req_nterror(req,
5215                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5216                         return;
5217                 }
5218
5219                 if (sign_algo->data.length < 2) {
5220                         tevent_req_nterror(req,
5221                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5222                         return;
5223                 }
5224
5225                 sign_algo_count = SVAL(sign_algo->data.data, 0);
5226                 if (sign_algo_count != 1) {
5227                         tevent_req_nterror(req,
5228                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5229                         return;
5230                 }
5231
5232                 if (sign_algo->data.length < (2 + 2 * sign_algo_count)) {
5233                         tevent_req_nterror(req,
5234                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5235                         return;
5236                 }
5237                 sign_algo_selected = SVAL(sign_algo->data.data, 2);
5238
5239                 for (i = 0; i < client_sign_algos->num_algos; i++) {
5240                         if (client_sign_algos->algos[i] == sign_algo_selected) {
5241                                 /*
5242                                  * We found a match
5243                                  */
5244                                 found_selected = true;
5245                                 break;
5246                         }
5247                 }
5248
5249                 if (!found_selected) {
5250                         /*
5251                          * The server send a sign_algo we didn't offer.
5252                          */
5253                         tevent_req_nterror(req,
5254                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5255                         return;
5256                 }
5257
5258                 conn->smb2.server.sign_algo = sign_algo_selected;
5259         }
5260
5261         cipher = smb2_negotiate_context_find(&c, SMB2_ENCRYPTION_CAPABILITIES);
5262         if (cipher != NULL) {
5263                 const struct smb3_encryption_capabilities *client_ciphers =
5264                         &state->conn->smb2.client.smb3_capabilities.encryption;
5265                 bool found_selected = false;
5266                 uint16_t cipher_count;
5267                 uint16_t cipher_selected;
5268
5269                 if (client_ciphers->num_algos == 0) {
5270                         /*
5271                          * We didn't ask for SMB2_ENCRYPTION_CAPABILITIES
5272                          */
5273                         tevent_req_nterror(req,
5274                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5275                         return;
5276                 }
5277
5278                 if (cipher->data.length < 2) {
5279                         tevent_req_nterror(req,
5280                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5281                         return;
5282                 }
5283
5284                 cipher_count = SVAL(cipher->data.data, 0);
5285                 if (cipher_count != 1) {
5286                         tevent_req_nterror(req,
5287                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5288                         return;
5289                 }
5290
5291                 if (cipher->data.length < (2 + 2 * cipher_count)) {
5292                         tevent_req_nterror(req,
5293                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5294                         return;
5295                 }
5296                 cipher_selected = SVAL(cipher->data.data, 2);
5297
5298                 for (i = 0; i < client_ciphers->num_algos; i++) {
5299                         if (cipher_selected == SMB2_ENCRYPTION_NONE) {
5300                                 /*
5301                                  * encryption not supported
5302                                  */
5303                                 found_selected = true;
5304                                 break;
5305                         }
5306                         if (client_ciphers->algos[i] == cipher_selected) {
5307                                 /*
5308                                  * We found a match
5309                                  */
5310                                 found_selected = true;
5311                                 break;
5312                         }
5313                 }
5314
5315                 if (!found_selected) {
5316                         /*
5317                          * The server send a cipher we didn't offer.
5318                          */
5319                         tevent_req_nterror(req,
5320                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5321                         return;
5322                 }
5323
5324                 conn->smb2.server.cipher = cipher_selected;
5325         }
5326
5327         /* First we hash the request */
5328         smb2cli_req_get_sent_iov(subreq, sent_iov);
5329
5330         rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
5331         if (rc < 0) {
5332                 tevent_req_nterror(req,
5333                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5334                 return;
5335         }
5336
5337         rc = gnutls_hash(hash_hnd,
5338                          conn->smb2.preauth_sha512,
5339                          sizeof(conn->smb2.preauth_sha512));
5340         if (rc < 0) {
5341                 gnutls_hash_deinit(hash_hnd, NULL);
5342                 tevent_req_nterror(req,
5343                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5344                 return;
5345         }
5346         for (i = 0; i < 3; i++) {
5347                 rc = gnutls_hash(hash_hnd,
5348                                  sent_iov[i].iov_base,
5349                                  sent_iov[i].iov_len);
5350                 if (rc < 0) {
5351                         gnutls_hash_deinit(hash_hnd, NULL);
5352                         tevent_req_nterror(req,
5353                                            gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5354                         return;
5355                 }
5356         }
5357
5358         if (rc < 0) {
5359                 gnutls_hash_deinit(hash_hnd, NULL);
5360                 tevent_req_nterror(req,
5361                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5362                 return;
5363         }
5364
5365         /* This resets the hash state */
5366         gnutls_hash_output(hash_hnd, conn->smb2.preauth_sha512);
5367         TALLOC_FREE(subreq);
5368
5369         /* And now we hash the response */
5370         rc = gnutls_hash(hash_hnd,
5371                          conn->smb2.preauth_sha512,
5372                          sizeof(conn->smb2.preauth_sha512));
5373         if (rc < 0) {
5374                 gnutls_hash_deinit(hash_hnd, NULL);
5375                 tevent_req_nterror(req,
5376                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5377                 return;
5378         }
5379         for (i = 0; i < 3; i++) {
5380                 rc = gnutls_hash(hash_hnd,
5381                                  iov[i].iov_base,
5382                                  iov[i].iov_len);
5383                 if (rc < 0) {
5384                         gnutls_hash_deinit(hash_hnd, NULL);
5385                         tevent_req_nterror(req,
5386                                            gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5387                         return;
5388                 }
5389         }
5390         gnutls_hash_deinit(hash_hnd, conn->smb2.preauth_sha512);
5391         if (rc < 0) {
5392                 tevent_req_nterror(req,
5393                                    NT_STATUS_UNSUCCESSFUL);
5394                 return;
5395         }
5396
5397         status = smbXcli_negprot_smb3_check_capabilities(req);
5398         if (tevent_req_nterror(req, status)) {
5399                 return;
5400         }
5401
5402         tevent_req_done(req);
5403 }
5404
5405 static NTSTATUS smbXcli_negprot_smb3_check_capabilities(struct tevent_req *req)
5406 {
5407         struct smbXcli_negprot_state *state =
5408                 tevent_req_data(req,
5409                 struct smbXcli_negprot_state);
5410         struct smbXcli_conn *conn = state->conn;
5411
5412         return smb311_capabilities_check(&conn->smb2.client.smb3_capabilities,
5413                                          "smbXcli_negprot",
5414                                          DBGLVL_ERR,
5415                                          NT_STATUS_ACCESS_DENIED,
5416                                          "client",
5417                                          conn->protocol,
5418                                          conn->smb2.server.sign_algo,
5419                                          conn->smb2.server.cipher);
5420 }
5421
5422 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
5423                                                   TALLOC_CTX *tmp_mem,
5424                                                   uint8_t *inbuf)
5425 {
5426         size_t num_pending = talloc_array_length(conn->pending);
5427         struct tevent_req *subreq;
5428         struct smbXcli_req_state *substate;
5429         struct tevent_req *req;
5430         uint32_t protocol_magic;
5431         size_t inbuf_len = smb_len_nbt(inbuf);
5432
5433         if (num_pending != 1) {
5434                 return NT_STATUS_INTERNAL_ERROR;
5435         }
5436
5437         if (inbuf_len < 4) {
5438                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
5439         }
5440
5441         subreq = conn->pending[0];
5442         substate = tevent_req_data(subreq, struct smbXcli_req_state);
5443         req = tevent_req_callback_data(subreq, struct tevent_req);
5444
5445         protocol_magic = IVAL(inbuf, 4);
5446
5447         switch (protocol_magic) {
5448         case SMB_MAGIC:
5449                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
5450                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
5451                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5452
5453         case SMB2_MAGIC:
5454                 if (substate->smb2.recv_iov == NULL) {
5455                         /*
5456                          * For the SMB1 negprot we have move it.
5457                          */
5458                         substate->smb2.recv_iov = substate->smb1.recv_iov;
5459                         substate->smb1.recv_iov = NULL;
5460                 }
5461
5462                 /*
5463                  * we got an SMB2 answer, which consumed sequence number 0
5464                  * so we need to use 1 as the next one.
5465                  *
5466                  * we also need to set the current credits to 0
5467                  * as we consumed the initial one. The SMB2 answer
5468                  * hopefully grant us a new credit.
5469                  */
5470                 conn->smb2.mid = 1;
5471                 conn->smb2.cur_credits = 0;
5472                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5473                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
5474                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5475         }
5476
5477         DEBUG(10, ("Got non-SMB PDU\n"));
5478         return NT_STATUS_INVALID_NETWORK_RESPONSE;
5479 }
5480
5481 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
5482 {
5483         return tevent_req_simple_recv_ntstatus(req);
5484 }
5485
5486 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
5487                          uint32_t timeout_msec,
5488                          enum protocol_types min_protocol,
5489                          enum protocol_types max_protocol)
5490 {
5491         TALLOC_CTX *frame = talloc_stackframe();
5492         struct tevent_context *ev;
5493         struct tevent_req *req;
5494         NTSTATUS status = NT_STATUS_NO_MEMORY;
5495         bool ok;
5496
5497         if (smbXcli_conn_has_async_calls(conn)) {
5498                 /*
5499                  * Can't use sync call while an async call is in flight
5500                  */
5501                 status = NT_STATUS_INVALID_PARAMETER_MIX;
5502                 goto fail;
5503         }
5504         ev = samba_tevent_context_init(frame);
5505         if (ev == NULL) {
5506                 goto fail;
5507         }
5508         req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
5509                                    min_protocol, max_protocol,
5510                                    WINDOWS_CLIENT_PURE_SMB2_NEGPROT_INITIAL_CREDIT_ASK);
5511         if (req == NULL) {
5512                 goto fail;
5513         }
5514         ok = tevent_req_poll_ntstatus(req, ev, &status);
5515         if (!ok) {
5516                 goto fail;
5517         }
5518         status = smbXcli_negprot_recv(req);
5519  fail:
5520         TALLOC_FREE(frame);
5521         return status;
5522 }
5523
5524 struct smb2cli_validate_negotiate_info_state {
5525         struct smbXcli_conn *conn;
5526         DATA_BLOB in_input_buffer;
5527         DATA_BLOB in_output_buffer;
5528         DATA_BLOB out_input_buffer;
5529         DATA_BLOB out_output_buffer;
5530         uint16_t dialect;
5531 };
5532
5533 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq);
5534
5535 struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx,
5536                                                 struct tevent_context *ev,
5537                                                 struct smbXcli_conn *conn,
5538                                                 uint32_t timeout_msec,
5539                                                 struct smbXcli_session *session,
5540                                                 struct smbXcli_tcon *tcon)
5541 {
5542         struct tevent_req *req;
5543         struct smb2cli_validate_negotiate_info_state *state;
5544         uint8_t *buf;
5545         uint16_t dialect_count = 0;
5546         struct tevent_req *subreq;
5547         bool _save_should_sign;
5548         size_t i;
5549
5550         req = tevent_req_create(mem_ctx, &state,
5551                                 struct smb2cli_validate_negotiate_info_state);
5552         if (req == NULL) {
5553                 return NULL;
5554         }
5555         state->conn = conn;
5556
5557         state->in_input_buffer = data_blob_talloc_zero(state,
5558                                         4 + 16 + 1 + 1 + 2);
5559         if (tevent_req_nomem(state->in_input_buffer.data, req)) {
5560                 return tevent_req_post(req, ev);
5561         }
5562         buf = state->in_input_buffer.data;
5563
5564         if (state->conn->max_protocol >= PROTOCOL_SMB3_00) {
5565                 SIVAL(buf, 0, conn->smb2.client.capabilities);
5566         } else {
5567                 SIVAL(buf, 0, 0); /* Capabilities */
5568         }
5569         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
5570                 NTSTATUS status;
5571                 struct GUID_ndr_buf guid_buf = { .buf = {0}, };
5572
5573                 status = GUID_to_ndr_buf(&conn->smb2.client.guid,
5574                                          &guid_buf);
5575                 if (!NT_STATUS_IS_OK(status)) {
5576                         return NULL;
5577                 }
5578                 memcpy(buf+4, guid_buf.buf, 16); /* ClientGuid */
5579         } else {
5580                 memset(buf+4, 0, 16);   /* ClientGuid */
5581         }
5582         if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5583                 SCVAL(buf, 20, conn->smb2.client.security_mode);
5584         } else {
5585                 SCVAL(buf, 20, 0);
5586         }
5587         SCVAL(buf, 21, 0); /* reserved */
5588
5589         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5590                 bool ok;
5591                 size_t ofs;
5592
5593                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5594                         continue;
5595                 }
5596
5597                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5598                         continue;
5599                 }
5600
5601                 if (smb2cli_prots[i].proto == state->conn->protocol) {
5602                         state->dialect = smb2cli_prots[i].smb2_dialect;
5603                 }
5604
5605                 ofs = state->in_input_buffer.length;
5606                 ok = data_blob_realloc(state, &state->in_input_buffer,
5607                                        ofs + 2);
5608                 if (!ok) {
5609                         tevent_req_oom(req);
5610                         return tevent_req_post(req, ev);
5611                 }
5612
5613                 buf = state->in_input_buffer.data;
5614                 SSVAL(buf, ofs, smb2cli_prots[i].smb2_dialect);
5615
5616                 dialect_count++;
5617         }
5618         buf = state->in_input_buffer.data;
5619         SSVAL(buf, 22, dialect_count);
5620
5621         _save_should_sign = smb2cli_tcon_is_signing_on(tcon);
5622         smb2cli_tcon_should_sign(tcon, true);
5623         subreq = smb2cli_ioctl_send(state, ev, conn,
5624                                     timeout_msec, session, tcon,
5625                                     UINT64_MAX, /* in_fid_persistent */
5626                                     UINT64_MAX, /* in_fid_volatile */
5627                                     FSCTL_VALIDATE_NEGOTIATE_INFO,
5628                                     0, /* in_max_input_length */
5629                                     &state->in_input_buffer,
5630                                     24, /* in_max_output_length */
5631                                     &state->in_output_buffer,
5632                                     SMB2_IOCTL_FLAG_IS_FSCTL);
5633         smb2cli_tcon_should_sign(tcon, _save_should_sign);
5634         if (tevent_req_nomem(subreq, req)) {
5635                 return tevent_req_post(req, ev);
5636         }
5637         tevent_req_set_callback(subreq,
5638                                 smb2cli_validate_negotiate_info_done,
5639                                 req);
5640
5641         return req;
5642 }
5643
5644 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq)
5645 {
5646         struct tevent_req *req =
5647                 tevent_req_callback_data(subreq,
5648                 struct tevent_req);
5649         struct smb2cli_validate_negotiate_info_state *state =
5650                 tevent_req_data(req,
5651                 struct smb2cli_validate_negotiate_info_state);
5652         NTSTATUS status;
5653         const uint8_t *buf;
5654         uint32_t capabilities;
5655         DATA_BLOB guid_blob;
5656         struct GUID server_guid;
5657         uint16_t security_mode;
5658         uint16_t dialect;
5659
5660         status = smb2cli_ioctl_recv(subreq, state,
5661                                     &state->out_input_buffer,
5662                                     &state->out_output_buffer);
5663         TALLOC_FREE(subreq);
5664
5665         /*
5666          * This response must be signed correctly for
5667          * these "normal" error codes to be processed.
5668          * If the packet wasn't signed correctly we will get
5669          * NT_STATUS_ACCESS_DENIED or NT_STATUS_HMAC_NOT_SUPPORTED,
5670          * or NT_STATUS_INVALID_NETWORK_RESPONSE
5671          * from smb2_signing_check_pdu().
5672          *
5673          * We must never ignore the above errors here.
5674          */
5675
5676         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED)) {
5677                 /*
5678                  * The response was signed, but not supported
5679                  *
5680                  * Older Windows and Samba releases return
5681                  * NT_STATUS_FILE_CLOSED.
5682                  */
5683                 tevent_req_done(req);
5684                 return;
5685         }
5686         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST)) {
5687                 /*
5688                  * The response was signed, but not supported
5689                  *
5690                  * This is returned by the NTVFS based Samba 4.x file server
5691                  * for file shares.
5692                  */
5693                 tevent_req_done(req);
5694                 return;
5695         }
5696         if (NT_STATUS_EQUAL(status, NT_STATUS_FS_DRIVER_REQUIRED)) {
5697                 /*
5698                  * The response was signed, but not supported
5699                  *
5700                  * This is returned by the NTVFS based Samba 4.x file server
5701                  * for ipc shares.
5702                  */
5703                 tevent_req_done(req);
5704                 return;
5705         }
5706         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
5707                 /*
5708                  * The response was signed, but not supported
5709                  *
5710                  * This might be returned by older Windows versions or by
5711                  * NetApp SMB server implementations.
5712                  *
5713                  * See
5714                  *
5715                  * https://blogs.msdn.microsoft.com/openspecification/2012/06/28/smb3-secure-dialect-negotiation/
5716                  *
5717                  */
5718                 tevent_req_done(req);
5719                 return;
5720         }
5721         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5722                 /*
5723                  * The response was signed, but not supported
5724                  *
5725                  * This might be returned by NetApp Ontap 7.3.7 SMB server
5726                  * implementations.
5727                  *
5728                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=14607
5729                  *
5730                  */
5731                 tevent_req_done(req);
5732                 return;
5733         }
5734         if (tevent_req_nterror(req, status)) {
5735                 return;
5736         }
5737
5738         if (state->out_output_buffer.length != 24) {
5739                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5740                 return;
5741         }
5742
5743         buf = state->out_output_buffer.data;
5744
5745         capabilities = IVAL(buf, 0);
5746         guid_blob = data_blob_const(buf + 4, 16);
5747         status = GUID_from_data_blob(&guid_blob, &server_guid);
5748         if (tevent_req_nterror(req, status)) {
5749                 return;
5750         }
5751         security_mode = CVAL(buf, 20);
5752         dialect = SVAL(buf, 22);
5753
5754         if (capabilities != state->conn->smb2.server.capabilities) {
5755                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5756                 return;
5757         }
5758
5759         if (!GUID_equal(&server_guid, &state->conn->smb2.server.guid)) {
5760                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5761                 return;
5762         }
5763
5764         if (security_mode != state->conn->smb2.server.security_mode) {
5765                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5766                 return;
5767         }
5768
5769         if (dialect != state->dialect) {
5770                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5771                 return;
5772         }
5773
5774         tevent_req_done(req);
5775 }
5776
5777 NTSTATUS smb2cli_validate_negotiate_info_recv(struct tevent_req *req)
5778 {
5779         return tevent_req_simple_recv_ntstatus(req);
5780 }
5781
5782 static int smbXcli_session_destructor(struct smbXcli_session *session)
5783 {
5784         if (session->conn == NULL) {
5785                 return 0;
5786         }
5787
5788         DLIST_REMOVE(session->conn->sessions, session);
5789         return 0;
5790 }
5791
5792 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
5793                                                struct smbXcli_conn *conn)
5794 {
5795         struct smbXcli_session *session;
5796         NTSTATUS status;
5797
5798         session = talloc_zero(mem_ctx, struct smbXcli_session);
5799         if (session == NULL) {
5800                 return NULL;
5801         }
5802         session->smb2 = talloc_zero(session, struct smb2cli_session);
5803         if (session->smb2 == NULL) {
5804                 talloc_free(session);
5805                 return NULL;
5806         }
5807         talloc_set_destructor(session, smbXcli_session_destructor);
5808
5809         status = smb2_signing_key_sign_create(session->smb2,
5810                                               conn->smb2.server.sign_algo,
5811                                               NULL, /* no master key */
5812                                               NULL, /* derivations */
5813                                               &session->smb2->signing_key);
5814         if (!NT_STATUS_IS_OK(status)) {
5815                 talloc_free(session);
5816                 return NULL;
5817         }
5818
5819         DLIST_ADD_END(conn->sessions, session);
5820         session->conn = conn;
5821
5822         status = smb2_signing_key_sign_create(session,
5823                                               conn->smb2.server.sign_algo,
5824                                               NULL, /* no master key */
5825                                               NULL, /* derivations */
5826                                               &session->smb2_channel.signing_key);
5827         if (!NT_STATUS_IS_OK(status)) {
5828                 talloc_free(session);
5829                 return NULL;
5830         }
5831
5832         memcpy(session->smb2_channel.preauth_sha512,
5833                conn->smb2.preauth_sha512,
5834                sizeof(session->smb2_channel.preauth_sha512));
5835
5836         return session;
5837 }
5838
5839 struct smbXcli_session *smbXcli_session_shallow_copy(TALLOC_CTX *mem_ctx,
5840                                                 struct smbXcli_session *src)
5841 {
5842         struct smbXcli_session *session;
5843         struct timespec ts;
5844         NTTIME nt;
5845
5846         session = talloc_zero(mem_ctx, struct smbXcli_session);
5847         if (session == NULL) {
5848                 return NULL;
5849         }
5850         session->smb2 = talloc_zero(session, struct smb2cli_session);
5851         if (session->smb2 == NULL) {
5852                 talloc_free(session);
5853                 return NULL;
5854         }
5855
5856         /*
5857          * Note we keep a pointer to the session keys of the
5858          * main session and rely on the caller to free the
5859          * shallow copy first!
5860          */
5861         session->conn = src->conn;
5862         *session->smb2 = *src->smb2;
5863         session->smb2_channel = src->smb2_channel;
5864         session->disconnect_expired = src->disconnect_expired;
5865
5866         /*
5867          * This is only supposed to be called in test code
5868          * but we should not reuse nonces!
5869          *
5870          * Add the current timestamp as NTTIME to nonce_high
5871          * and set nonce_low to a value we can recognize in captures.
5872          */
5873         clock_gettime_mono(&ts);
5874         nt = unix_timespec_to_nt_time(ts);
5875         nt &= session->smb2->nonce_high_max;
5876         if (nt == session->smb2->nonce_high_max || nt < UINT8_MAX) {
5877                 talloc_free(session);
5878                 return NULL;
5879         }
5880         session->smb2->nonce_high += nt;
5881         session->smb2->nonce_low = UINT32_MAX;
5882
5883         DLIST_ADD_END(src->conn->sessions, session);
5884         talloc_set_destructor(session, smbXcli_session_destructor);
5885
5886         return session;
5887 }
5888
5889 bool smbXcli_session_is_guest(struct smbXcli_session *session)
5890 {
5891         if (session == NULL) {
5892                 return false;
5893         }
5894
5895         if (session->conn == NULL) {
5896                 return false;
5897         }
5898
5899         if (session->conn->mandatory_signing) {
5900                 return false;
5901         }
5902
5903         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5904                 if (session->smb2->session_flags & SMB2_SESSION_FLAG_IS_GUEST) {
5905                         return true;
5906                 }
5907                 return false;
5908         }
5909
5910         if (session->smb1.action & SMB_SETUP_GUEST) {
5911                 return true;
5912         }
5913
5914         return false;
5915 }
5916
5917 bool smbXcli_session_is_authenticated(struct smbXcli_session *session)
5918 {
5919         const DATA_BLOB *application_key;
5920
5921         if (session == NULL) {
5922                 return false;
5923         }
5924
5925         if (session->conn == NULL) {
5926                 return false;
5927         }
5928
5929         /*
5930          * If we have an application key we had a session key negotiated
5931          * at auth time.
5932          */
5933         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5934                 if (!smb2_signing_key_valid(session->smb2->application_key)) {
5935                         return false;
5936                 }
5937                 application_key = &session->smb2->application_key->blob;
5938         } else {
5939                 application_key = &session->smb1.application_key;
5940         }
5941
5942         if (application_key->length == 0) {
5943                 return false;
5944         }
5945
5946         return true;
5947 }
5948
5949 NTSTATUS smb2cli_session_signing_key(struct smbXcli_session *session,
5950                                      TALLOC_CTX *mem_ctx,
5951                                      DATA_BLOB *key)
5952 {
5953         const struct smb2_signing_key *sig = NULL;
5954
5955         if (session->conn == NULL) {
5956                 return NT_STATUS_NO_USER_SESSION_KEY;
5957         }
5958
5959         /*
5960          * Use channel signing key if there is one, otherwise fallback
5961          * to session.
5962          */
5963
5964         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
5965                 sig = session->smb2_channel.signing_key;
5966         } else if (smb2_signing_key_valid(session->smb2->signing_key)) {
5967                 sig = session->smb2->signing_key;
5968         } else {
5969                 return NT_STATUS_NO_USER_SESSION_KEY;
5970         }
5971
5972         *key = data_blob_dup_talloc(mem_ctx, sig->blob);
5973         if (key->data == NULL) {
5974                 return NT_STATUS_NO_MEMORY;
5975         }
5976
5977         return NT_STATUS_OK;
5978 }
5979
5980 NTSTATUS smb2cli_session_encryption_key(struct smbXcli_session *session,
5981                                         TALLOC_CTX *mem_ctx,
5982                                         DATA_BLOB *key)
5983 {
5984         if (session->conn == NULL) {
5985                 return NT_STATUS_NO_USER_SESSION_KEY;
5986         }
5987
5988         if (session->conn->protocol < PROTOCOL_SMB3_00) {
5989                 return NT_STATUS_NO_USER_SESSION_KEY;
5990         }
5991
5992         if (!smb2_signing_key_valid(session->smb2->encryption_key)) {
5993                 return NT_STATUS_NO_USER_SESSION_KEY;
5994         }
5995
5996         *key = data_blob_dup_talloc(mem_ctx, session->smb2->encryption_key->blob);
5997         if (key->data == NULL) {
5998                 return NT_STATUS_NO_MEMORY;
5999         }
6000
6001         return NT_STATUS_OK;
6002 }
6003
6004 NTSTATUS smb2cli_session_decryption_key(struct smbXcli_session *session,
6005                                         TALLOC_CTX *mem_ctx,
6006                                         DATA_BLOB *key)
6007 {
6008         if (session->conn == NULL) {
6009                 return NT_STATUS_NO_USER_SESSION_KEY;
6010         }
6011
6012         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6013                 return NT_STATUS_NO_USER_SESSION_KEY;
6014         }
6015
6016         if (!smb2_signing_key_valid(session->smb2->decryption_key)) {
6017                 return NT_STATUS_NO_USER_SESSION_KEY;
6018         }
6019
6020         *key = data_blob_dup_talloc(mem_ctx, session->smb2->decryption_key->blob);
6021         if (key->data == NULL) {
6022                 return NT_STATUS_NO_MEMORY;
6023         }
6024
6025         return NT_STATUS_OK;
6026 }
6027
6028 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
6029                                          TALLOC_CTX *mem_ctx,
6030                                          DATA_BLOB *key)
6031 {
6032         const DATA_BLOB *application_key;
6033
6034         *key = data_blob_null;
6035
6036         if (session->conn == NULL) {
6037                 return NT_STATUS_NO_USER_SESSION_KEY;
6038         }
6039
6040         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
6041                 if (!smb2_signing_key_valid(session->smb2->application_key)) {
6042                         return NT_STATUS_NO_USER_SESSION_KEY;
6043                 }
6044                 application_key = &session->smb2->application_key->blob;
6045         } else {
6046                 application_key = &session->smb1.application_key;
6047         }
6048
6049         if (application_key->length == 0) {
6050                 return NT_STATUS_NO_USER_SESSION_KEY;
6051         }
6052
6053         *key = data_blob_dup_talloc(mem_ctx, *application_key);
6054         if (key->data == NULL) {
6055                 return NT_STATUS_NO_MEMORY;
6056         }
6057
6058         return NT_STATUS_OK;
6059 }
6060
6061 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
6062 {
6063         session->disconnect_expired = true;
6064 }
6065
6066 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
6067 {
6068         return session->smb1.session_id;
6069 }
6070
6071 void smb1cli_session_set_id(struct smbXcli_session *session,
6072                             uint16_t session_id)
6073 {
6074         session->smb1.session_id = session_id;
6075 }
6076
6077 void smb1cli_session_set_action(struct smbXcli_session *session,
6078                                 uint16_t action)
6079 {
6080         session->smb1.action = action;
6081 }
6082
6083 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
6084                                          const DATA_BLOB _session_key)
6085 {
6086         struct smbXcli_conn *conn = session->conn;
6087         uint8_t session_key[16];
6088
6089         if (conn == NULL) {
6090                 return NT_STATUS_INVALID_PARAMETER_MIX;
6091         }
6092
6093         if (session->smb1.application_key.length != 0) {
6094                 /*
6095                  * TODO: do not allow this...
6096                  *
6097                  * return NT_STATUS_INVALID_PARAMETER_MIX;
6098                  */
6099                 data_blob_clear_free(&session->smb1.application_key);
6100                 session->smb1.protected_key = false;
6101         }
6102
6103         if (_session_key.length == 0) {
6104                 return NT_STATUS_OK;
6105         }
6106
6107         ZERO_STRUCT(session_key);
6108         memcpy(session_key, _session_key.data,
6109                MIN(_session_key.length, sizeof(session_key)));
6110
6111         session->smb1.application_key = data_blob_talloc(session,
6112                                                          session_key,
6113                                                          sizeof(session_key));
6114         ZERO_STRUCT(session_key);
6115         if (session->smb1.application_key.data == NULL) {
6116                 return NT_STATUS_NO_MEMORY;
6117         }
6118
6119         session->smb1.protected_key = false;
6120
6121         return NT_STATUS_OK;
6122 }
6123
6124 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
6125 {
6126         NTSTATUS status;
6127
6128         if (session->smb1.protected_key) {
6129                 /* already protected */
6130                 return NT_STATUS_OK;
6131         }
6132
6133         if (session->smb1.application_key.length != 16) {
6134                 return NT_STATUS_INVALID_PARAMETER_MIX;
6135         }
6136
6137         status = smb_key_derivation(session->smb1.application_key.data,
6138                                     session->smb1.application_key.length,
6139                                     session->smb1.application_key.data);
6140         if (!NT_STATUS_IS_OK(status)) {
6141                 return status;
6142         }
6143
6144         session->smb1.protected_key = true;
6145
6146         return NT_STATUS_OK;
6147 }
6148
6149 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
6150 {
6151         struct smbXcli_conn *conn = session->conn;
6152         uint8_t security_mode = 0;
6153
6154         if (conn == NULL) {
6155                 return security_mode;
6156         }
6157
6158         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
6159         if (conn->mandatory_signing) {
6160                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
6161         }
6162         if (session->smb2->should_sign) {
6163                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
6164         }
6165
6166         return security_mode;
6167 }
6168
6169 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
6170 {
6171         return session->smb2->session_id;
6172 }
6173
6174 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
6175 {
6176         return session->smb2->session_flags;
6177 }
6178
6179 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
6180                                       uint64_t session_id,
6181                                       uint16_t session_flags)
6182 {
6183         session->smb2->session_id = session_id;
6184         session->smb2->session_flags = session_flags;
6185 }
6186
6187 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
6188 {
6189         session->smb2->channel_sequence += 1;
6190 }
6191
6192 uint16_t smb2cli_session_reset_channel_sequence(struct smbXcli_session *session,
6193                                                 uint16_t channel_sequence)
6194 {
6195         uint16_t prev_cs;
6196
6197         prev_cs = session->smb2->channel_sequence;
6198         session->smb2->channel_sequence = channel_sequence;
6199
6200         return prev_cs;
6201 }
6202
6203 uint16_t smb2cli_session_current_channel_sequence(struct smbXcli_session *session)
6204 {
6205         return session->smb2->channel_sequence;
6206 }
6207
6208 void smb2cli_session_start_replay(struct smbXcli_session *session)
6209 {
6210         session->smb2->replay_active = true;
6211 }
6212
6213 void smb2cli_session_stop_replay(struct smbXcli_session *session)
6214 {
6215         session->smb2->replay_active = false;
6216 }
6217
6218 void smb2cli_session_require_signed_response(struct smbXcli_session *session,
6219                                              bool require_signed_response)
6220 {
6221         session->smb2->require_signed_response = require_signed_response;
6222 }
6223
6224 NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
6225                                         const struct iovec *iov)
6226 {
6227         gnutls_hash_hd_t hash_hnd = NULL;
6228         size_t i;
6229         int rc;
6230
6231         if (session->conn == NULL) {
6232                 return NT_STATUS_INTERNAL_ERROR;
6233         }
6234
6235         if (session->conn->protocol < PROTOCOL_SMB3_11) {
6236                 return NT_STATUS_OK;
6237         }
6238
6239         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6240                 return NT_STATUS_OK;
6241         }
6242
6243         rc = gnutls_hash_init(&hash_hnd,
6244                               GNUTLS_DIG_SHA512);
6245         if (rc < 0) {
6246                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6247         }
6248
6249         rc = gnutls_hash(hash_hnd,
6250                          session->smb2_channel.preauth_sha512,
6251                          sizeof(session->smb2_channel.preauth_sha512));
6252         if (rc < 0) {
6253                 gnutls_hash_deinit(hash_hnd, NULL);
6254                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6255         }
6256         for (i = 0; i < 3; i++) {
6257                 rc = gnutls_hash(hash_hnd,
6258                                  iov[i].iov_base,
6259                                  iov[i].iov_len);
6260                 if (rc < 0) {
6261                         gnutls_hash_deinit(hash_hnd, NULL);
6262                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6263                 }
6264         }
6265         gnutls_hash_deinit(hash_hnd, session->smb2_channel.preauth_sha512);
6266
6267         return NT_STATUS_OK;
6268 }
6269
6270 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
6271                                          const DATA_BLOB _session_key,
6272                                          const struct iovec *recv_iov)
6273 {
6274         struct smbXcli_conn *conn = session->conn;
6275         uint16_t no_sign_flags = 0;
6276         bool check_signature = true;
6277         uint32_t hdr_flags;
6278         NTSTATUS status;
6279         struct smb2_signing_derivations derivations = {
6280                 .signing = NULL,
6281         };
6282         DATA_BLOB preauth_hash = data_blob_null;
6283         size_t nonce_size = 0;
6284
6285         if (conn == NULL) {
6286                 return NT_STATUS_INVALID_PARAMETER_MIX;
6287         }
6288
6289         if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
6290                 return NT_STATUS_INVALID_PARAMETER_MIX;
6291         }
6292
6293         if (!conn->mandatory_signing) {
6294                 /*
6295                  * only allow guest sessions without
6296                  * mandatory signing.
6297                  *
6298                  * If we try an authentication with username != ""
6299                  * and the server let us in without verifying the
6300                  * password we don't have a negotiated session key
6301                  * for signing.
6302                  */
6303                 no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST;
6304         }
6305
6306         if (session->smb2->session_flags & no_sign_flags) {
6307                 session->smb2->should_sign = false;
6308                 return NT_STATUS_OK;
6309         }
6310
6311         if (smb2_signing_key_valid(session->smb2->signing_key)) {
6312                 return NT_STATUS_INVALID_PARAMETER_MIX;
6313         }
6314
6315         if (conn->protocol >= PROTOCOL_SMB3_11) {
6316                 preauth_hash = data_blob_const(session->smb2_channel.preauth_sha512,
6317                                 sizeof(session->smb2_channel.preauth_sha512));
6318         }
6319
6320         smb2_signing_derivations_fill_const_stack(&derivations,
6321                                                   conn->protocol,
6322                                                   preauth_hash);
6323
6324         status = smb2_signing_key_sign_create(session->smb2,
6325                                               conn->smb2.server.sign_algo,
6326                                               &_session_key,
6327                                               derivations.signing,
6328                                               &session->smb2->signing_key);
6329         if (!NT_STATUS_IS_OK(status)) {
6330                 return status;
6331         }
6332
6333         status = smb2_signing_key_cipher_create(session->smb2,
6334                                                 conn->smb2.server.cipher,
6335                                                 &_session_key,
6336                                                 derivations.cipher_c2s,
6337                                                 &session->smb2->encryption_key);
6338         if (!NT_STATUS_IS_OK(status)) {
6339                 return status;
6340         }
6341
6342         status = smb2_signing_key_cipher_create(session->smb2,
6343                                                 conn->smb2.server.cipher,
6344                                                 &_session_key,
6345                                                 derivations.cipher_s2c,
6346                                                 &session->smb2->decryption_key);
6347         if (!NT_STATUS_IS_OK(status)) {
6348                 return status;
6349         }
6350
6351         status = smb2_signing_key_sign_create(session->smb2,
6352                                               conn->smb2.server.sign_algo,
6353                                               &_session_key,
6354                                               derivations.application,
6355                                               &session->smb2->application_key);
6356         if (!NT_STATUS_IS_OK(status)) {
6357                 return status;
6358         }
6359
6360         status = smb2_signing_key_copy(session,
6361                                        session->smb2->signing_key,
6362                                        &session->smb2_channel.signing_key);
6363         if (!NT_STATUS_IS_OK(status)) {
6364                 return status;
6365         }
6366
6367         check_signature = conn->mandatory_signing;
6368
6369         hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
6370         if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
6371                 /*
6372                  * Sadly some vendors don't sign the
6373                  * final SMB2 session setup response
6374                  *
6375                  * At least Windows and Samba are always doing this
6376                  * if there's a session key available.
6377                  *
6378                  * We only check the signature if it's mandatory
6379                  * or SMB2_HDR_FLAG_SIGNED is provided.
6380                  */
6381                 check_signature = true;
6382         }
6383
6384         if (conn->protocol >= PROTOCOL_SMB3_11) {
6385                 check_signature = true;
6386         }
6387
6388         if (check_signature) {
6389                 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6390                                                 recv_iov, 3);
6391                 if (!NT_STATUS_IS_OK(status)) {
6392                         return status;
6393                 }
6394         }
6395
6396         session->smb2->should_sign = false;
6397         session->smb2->should_encrypt = false;
6398
6399         if (conn->desire_signing) {
6400                 session->smb2->should_sign = true;
6401         }
6402
6403         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
6404                 session->smb2->should_sign = true;
6405         }
6406
6407         if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
6408                 session->smb2->should_encrypt = true;
6409         }
6410
6411         if (conn->protocol < PROTOCOL_SMB3_00) {
6412                 session->smb2->should_encrypt = false;
6413         }
6414
6415         if (conn->smb2.server.cipher == 0) {
6416                 session->smb2->should_encrypt = false;
6417         }
6418
6419         /*
6420          * CCM and GCM algorithms must never have their
6421          * nonce wrap, or the security of the whole
6422          * communication and the keys is destroyed.
6423          * We must drop the connection once we have
6424          * transfered too much data.
6425          *
6426          * NOTE: We assume nonces greater than 8 bytes.
6427          */
6428         generate_nonce_buffer((uint8_t *)&session->smb2->nonce_high_random,
6429                               sizeof(session->smb2->nonce_high_random));
6430         switch (conn->smb2.server.cipher) {
6431         case SMB2_ENCRYPTION_AES128_CCM:
6432                 nonce_size = SMB2_AES_128_CCM_NONCE_SIZE;
6433                 break;
6434         case SMB2_ENCRYPTION_AES128_GCM:
6435                 nonce_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_128_GCM);
6436                 break;
6437         case SMB2_ENCRYPTION_AES256_CCM:
6438                 nonce_size = SMB2_AES_128_CCM_NONCE_SIZE;
6439                 break;
6440         case SMB2_ENCRYPTION_AES256_GCM:
6441                 nonce_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_GCM);
6442                 break;
6443         default:
6444                 nonce_size = 0;
6445                 break;
6446         }
6447         session->smb2->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
6448         session->smb2->nonce_high = 0;
6449         session->smb2->nonce_low = 0;
6450
6451         return NT_STATUS_OK;
6452 }
6453
6454 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
6455                                         struct smbXcli_session *session1,
6456                                         struct smbXcli_conn *conn,
6457                                         struct smbXcli_session **_session2)
6458 {
6459         struct smbXcli_session *session2;
6460         NTSTATUS status;
6461
6462         if (!smb2_signing_key_valid(session1->smb2->signing_key)) {
6463                 return NT_STATUS_INVALID_PARAMETER_MIX;
6464         }
6465
6466         if (conn == NULL) {
6467                 return NT_STATUS_INVALID_PARAMETER_MIX;
6468         }
6469
6470         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
6471         if (session2 == NULL) {
6472                 return NT_STATUS_NO_MEMORY;
6473         }
6474         session2->smb2 = talloc_reference(session2, session1->smb2);
6475         if (session2->smb2 == NULL) {
6476                 talloc_free(session2);
6477                 return NT_STATUS_NO_MEMORY;
6478         }
6479
6480         talloc_set_destructor(session2, smbXcli_session_destructor);
6481         DLIST_ADD_END(conn->sessions, session2);
6482         session2->conn = conn;
6483
6484         status = smb2_signing_key_sign_create(session2,
6485                                               conn->smb2.server.sign_algo,
6486                                               NULL, /* no master key */
6487                                               NULL, /* derivations */
6488                                               &session2->smb2_channel.signing_key);
6489         if (!NT_STATUS_IS_OK(status)) {
6490                 talloc_free(session2);
6491                 return NT_STATUS_NO_MEMORY;
6492         }
6493
6494         memcpy(session2->smb2_channel.preauth_sha512,
6495                conn->smb2.preauth_sha512,
6496                sizeof(session2->smb2_channel.preauth_sha512));
6497
6498         *_session2 = session2;
6499         return NT_STATUS_OK;
6500 }
6501
6502 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
6503                                          const DATA_BLOB _channel_key,
6504                                          const struct iovec *recv_iov)
6505 {
6506         struct smbXcli_conn *conn = session->conn;
6507         uint8_t channel_key[16];
6508         NTSTATUS status;
6509         struct _derivation {
6510                 DATA_BLOB label;
6511                 DATA_BLOB context;
6512         };
6513         struct {
6514                 struct _derivation signing;
6515         } derivation = {
6516                 .signing.label.length = 0,
6517         };
6518
6519         if (conn == NULL) {
6520                 return NT_STATUS_INVALID_PARAMETER_MIX;
6521         }
6522
6523         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6524                 return NT_STATUS_INVALID_PARAMETER_MIX;
6525         }
6526
6527         if (conn->protocol >= PROTOCOL_SMB3_11) {
6528                 struct _derivation *d;
6529                 DATA_BLOB p;
6530
6531                 p = data_blob_const(session->smb2_channel.preauth_sha512,
6532                                 sizeof(session->smb2_channel.preauth_sha512));
6533
6534                 d = &derivation.signing;
6535                 d->label = data_blob_string_const_null("SMBSigningKey");
6536                 d->context = p;
6537         } else if (conn->protocol >= PROTOCOL_SMB3_00) {
6538                 struct _derivation *d;
6539
6540                 d = &derivation.signing;
6541                 d->label = data_blob_string_const_null("SMB2AESCMAC");
6542                 d->context = data_blob_string_const_null("SmbSign");
6543         }
6544
6545         ZERO_STRUCT(channel_key);
6546         memcpy(channel_key, _channel_key.data,
6547                MIN(_channel_key.length, sizeof(channel_key)));
6548
6549         session->smb2_channel.signing_key->blob =
6550                 data_blob_talloc(session->smb2_channel.signing_key,
6551                                  channel_key,
6552                                  sizeof(channel_key));
6553         if (!smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6554                 ZERO_STRUCT(channel_key);
6555                 return NT_STATUS_NO_MEMORY;
6556         }
6557
6558         if (conn->protocol >= PROTOCOL_SMB3_00) {
6559                 struct _derivation *d = &derivation.signing;
6560
6561                 status = smb2_key_derivation(channel_key, sizeof(channel_key),
6562                                              d->label.data, d->label.length,
6563                                              d->context.data, d->context.length,
6564                                              session->smb2_channel.signing_key->blob.data,
6565                                              session->smb2_channel.signing_key->blob.length);
6566                 if (!NT_STATUS_IS_OK(status)) {
6567                         return status;
6568                 }
6569         }
6570         ZERO_STRUCT(channel_key);
6571
6572         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6573                                         recv_iov, 3);
6574         if (!NT_STATUS_IS_OK(status)) {
6575                 return status;
6576         }
6577
6578         return NT_STATUS_OK;
6579 }
6580
6581 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
6582 {
6583         if (!session->smb2->should_sign) {
6584                 /*
6585                  * We need required signing on the session
6586                  * in order to prevent man in the middle attacks.
6587                  */
6588                 return NT_STATUS_INVALID_PARAMETER_MIX;
6589         }
6590
6591         if (session->smb2->should_encrypt) {
6592                 return NT_STATUS_OK;
6593         }
6594
6595         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6596                 return NT_STATUS_NOT_SUPPORTED;
6597         }
6598
6599         if (session->conn->smb2.server.cipher == 0) {
6600                 return NT_STATUS_NOT_SUPPORTED;
6601         }
6602
6603         if (!smb2_signing_key_valid(session->smb2->signing_key)) {
6604                 return NT_STATUS_NOT_SUPPORTED;
6605         }
6606         session->smb2->should_encrypt = true;
6607         return NT_STATUS_OK;
6608 }
6609
6610 uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session)
6611 {
6612         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6613                 return 0;
6614         }
6615
6616         if (!session->smb2->should_encrypt) {
6617                 return 0;
6618         }
6619
6620         return session->conn->smb2.server.cipher;
6621 }
6622
6623 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
6624 {
6625         struct smbXcli_tcon *tcon;
6626
6627         tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
6628         if (tcon == NULL) {
6629                 return NULL;
6630         }
6631
6632         return tcon;
6633 }
6634
6635 /*
6636  * Return a deep structure copy of a struct smbXcli_tcon *
6637  */
6638
6639 struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx,
6640                                 const struct smbXcli_tcon *tcon_in)
6641 {
6642         struct smbXcli_tcon *tcon;
6643
6644         tcon = talloc_memdup(mem_ctx, tcon_in, sizeof(struct smbXcli_tcon));
6645         if (tcon == NULL) {
6646                 return NULL;
6647         }
6648
6649         /* Deal with the SMB1 strings. */
6650         if (tcon_in->smb1.service != NULL) {
6651                 tcon->smb1.service = talloc_strdup(tcon, tcon_in->smb1.service);
6652                 if (tcon->smb1.service == NULL) {
6653                         TALLOC_FREE(tcon);
6654                         return NULL;
6655                 }
6656         }
6657         if (tcon->smb1.fs_type != NULL) {
6658                 tcon->smb1.fs_type = talloc_strdup(tcon, tcon_in->smb1.fs_type);
6659                 if (tcon->smb1.fs_type == NULL) {
6660                         TALLOC_FREE(tcon);
6661                         return NULL;
6662                 }
6663         }
6664         return tcon;
6665 }
6666
6667 void smbXcli_tcon_set_fs_attributes(struct smbXcli_tcon *tcon,
6668                                     uint32_t fs_attributes)
6669 {
6670         tcon->fs_attributes = fs_attributes;
6671 }
6672
6673 uint32_t smbXcli_tcon_get_fs_attributes(struct smbXcli_tcon *tcon)
6674 {
6675         return tcon->fs_attributes;
6676 }
6677
6678 bool smbXcli_tcon_is_dfs_share(struct smbXcli_tcon *tcon)
6679 {
6680         if (tcon == NULL) {
6681                 return false;
6682         }
6683
6684         if (tcon->is_smb1) {
6685                 if (tcon->smb1.optional_support & SMB_SHARE_IN_DFS) {
6686                         return true;
6687                 }
6688
6689                 return false;
6690         }
6691
6692         if (tcon->smb2.capabilities & SMB2_SHARE_CAP_DFS) {
6693                 return true;
6694         }
6695
6696         return false;
6697 }
6698
6699 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
6700 {
6701         return tcon->smb1.tcon_id;
6702 }
6703
6704 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
6705 {
6706         tcon->is_smb1 = true;
6707         tcon->smb1.tcon_id = tcon_id;
6708 }
6709
6710 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
6711                              uint16_t tcon_id,
6712                              uint16_t optional_support,
6713                              uint32_t maximal_access,
6714                              uint32_t guest_maximal_access,
6715                              const char *service,
6716                              const char *fs_type)
6717 {
6718         tcon->is_smb1 = true;
6719         tcon->fs_attributes = 0;
6720         tcon->smb1.tcon_id = tcon_id;
6721         tcon->smb1.optional_support = optional_support;
6722         tcon->smb1.maximal_access = maximal_access;
6723         tcon->smb1.guest_maximal_access = guest_maximal_access;
6724
6725         TALLOC_FREE(tcon->smb1.service);
6726         tcon->smb1.service = talloc_strdup(tcon, service);
6727         if (service != NULL && tcon->smb1.service == NULL) {
6728                 return false;
6729         }
6730
6731         TALLOC_FREE(tcon->smb1.fs_type);
6732         tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
6733         if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
6734                 return false;
6735         }
6736
6737         return true;
6738 }
6739
6740 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
6741 {
6742         return tcon->smb2.tcon_id;
6743 }
6744
6745 void smb2cli_tcon_set_id(struct smbXcli_tcon *tcon, uint32_t tcon_id)
6746 {
6747         tcon->smb2.tcon_id = tcon_id;
6748 }
6749
6750 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
6751 {
6752         return tcon->smb2.capabilities;
6753 }
6754
6755 uint32_t smb2cli_tcon_flags(struct smbXcli_tcon *tcon)
6756 {
6757         return tcon->smb2.flags;
6758 }
6759
6760 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
6761                              struct smbXcli_session *session,
6762                              uint32_t tcon_id,
6763                              uint8_t type,
6764                              uint32_t flags,
6765                              uint32_t capabilities,
6766                              uint32_t maximal_access)
6767 {
6768         tcon->is_smb1 = false;
6769         tcon->fs_attributes = 0;
6770         tcon->smb2.tcon_id = tcon_id;
6771         tcon->smb2.type = type;
6772         tcon->smb2.flags = flags;
6773         tcon->smb2.capabilities = capabilities;
6774         tcon->smb2.maximal_access = maximal_access;
6775
6776         tcon->smb2.should_sign = false;
6777         tcon->smb2.should_encrypt = false;
6778
6779         if (session == NULL) {
6780                 return;
6781         }
6782
6783         tcon->smb2.should_sign = session->smb2->should_sign;
6784         tcon->smb2.should_encrypt = session->smb2->should_encrypt;
6785
6786         if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
6787                 tcon->smb2.should_encrypt = true;
6788         }
6789 }
6790
6791 void smb2cli_tcon_should_sign(struct smbXcli_tcon *tcon,
6792                               bool should_sign)
6793 {
6794         tcon->smb2.should_sign = should_sign;
6795 }
6796
6797 bool smb2cli_tcon_is_signing_on(struct smbXcli_tcon *tcon)
6798 {
6799         if (tcon->smb2.should_encrypt) {
6800                 return true;
6801         }
6802
6803         return tcon->smb2.should_sign;
6804 }
6805
6806 void smb2cli_tcon_should_encrypt(struct smbXcli_tcon *tcon,
6807                                  bool should_encrypt)
6808 {
6809         tcon->smb2.should_encrypt = should_encrypt;
6810 }
6811
6812 bool smb2cli_tcon_is_encryption_on(struct smbXcli_tcon *tcon)
6813 {
6814         return tcon->smb2.should_encrypt;
6815 }
6816
6817 void smb2cli_conn_set_mid(struct smbXcli_conn *conn, uint64_t mid)
6818 {
6819         conn->smb2.mid = mid;
6820 }
6821
6822 uint64_t smb2cli_conn_get_mid(struct smbXcli_conn *conn)
6823 {
6824         return conn->smb2.mid;
6825 }