libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "../libcli/smb/smb_common.h"
  29 #include "../libcli/smb/smb_seal.h"
  30 #include "../libcli/smb/smb_signing.h"
  31 #include "../libcli/smb/read_smb.h"
  32 #include "smbXcli_base.h"
  33 #include "librpc/ndr/libndr.h"
  34
  35 struct smbXcli_conn;
  36 struct smbXcli_req;
  37 struct smbXcli_session;
  38 struct smbXcli_tcon;
  39
  40 struct smbXcli_conn {
  41         int read_fd;
  42         int write_fd;
  43         struct sockaddr_storage local_ss;
  44         struct sockaddr_storage remote_ss;
  45         const char *remote_name;
  46
  47         struct tevent_queue *outgoing;
  48         struct tevent_req **pending;
  49         struct tevent_req *read_smb_req;
  50
  51         enum protocol_types protocol;
  52         bool allow_signing;
  53         bool desire_signing;
  54         bool mandatory_signing;
  55
  56         /*
  57          * The incoming dispatch function should return:
  58          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  59          * - NT_STATUS_OK, if no more processing is desired, e.g.
  60          *                 the dispatch function called
  61          *                 tevent_req_done().
  62          * - All other return values disconnect the connection.
  63          */
  64         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  65                                       TALLOC_CTX *tmp_mem,
  66                                       uint8_t *inbuf);
  67
  68         struct {
  69                 struct {
  70                         uint32_t capabilities;
  71                         uint32_t max_xmit;
  72                 } client;
  73
  74                 struct {
  75                         uint32_t capabilities;
  76                         uint32_t max_xmit;
  77                         uint16_t max_mux;
  78                         uint16_t security_mode;
  79                         bool readbraw;
  80                         bool writebraw;
  81                         bool lockread;
  82                         bool writeunlock;
  83                         uint32_t session_key;
  84                         struct GUID guid;
  85                         DATA_BLOB gss_blob;
  86                         uint8_t challenge[8];
  87                         const char *workgroup;
  88                         const char *name;
  89                         int time_zone;
  90                         NTTIME system_time;
  91                 } server;
  92
  93                 uint32_t capabilities;
  94                 uint32_t max_xmit;
  95
  96                 uint16_t mid;
  97
  98                 struct smb_signing_state *signing;
  99                 struct smb_trans_enc_state *trans_enc;
 100
 101                 struct tevent_req *read_braw_req;
 102         } smb1;
 103
 104         struct {
 105                 struct {
 106                         uint32_t capabilities;
 107                         uint16_t security_mode;
 108                         struct GUID guid;
 109                 } client;
 110
 111                 struct {
 112                         uint32_t capabilities;
 113                         uint16_t security_mode;
 114                         struct GUID guid;
 115                         uint32_t max_trans_size;
 116                         uint32_t max_read_size;
 117                         uint32_t max_write_size;
 118                         NTTIME system_time;
 119                         NTTIME start_time;
 120                         DATA_BLOB gss_blob;
 121                 } server;
 122
 123                 uint64_t mid;
 124                 uint16_t cur_credits;
 125                 uint16_t max_credits;
 126         } smb2;
 127
 128         struct smbXcli_session *sessions;
 129 };
 130
 131 struct smb2cli_session {
 132         uint64_t session_id;
 133         uint16_t session_flags;
 134         DATA_BLOB application_key;
 135         DATA_BLOB signing_key;
 136         bool should_sign;
 137         bool should_encrypt;
 138         DATA_BLOB encryption_key;
 139         DATA_BLOB decryption_key;
 140         uint64_t nonce_high;
 141         uint64_t nonce_low;
 142         uint16_t channel_sequence;
 143 };
 144
 145 struct smbXcli_session {
 146         struct smbXcli_session *prev, *next;
 147         struct smbXcli_conn *conn;
 148
 149         struct {
 150                 uint16_t session_id;
 151                 DATA_BLOB application_key;
 152                 bool protected_key;
 153         } smb1;
 154
 155         struct smb2cli_session *smb2;
 156
 157         struct {
 158                 DATA_BLOB signing_key;
 159         } smb2_channel;
 160
 161         /*
 162          * this should be a short term hack
 163          * until the upper layers have implemented
 164          * re-authentication.
 165          */
 166         bool disconnect_expired;
 167 };
 168
 169 struct smbXcli_tcon {
 170         struct {
 171                 uint16_t tcon_id;
 172                 uint16_t optional_support;
 173                 uint32_t maximal_access;
 174                 uint32_t guest_maximal_access;
 175                 char *service;
 176                 char *fs_type;
 177         } smb1;
 178
 179         struct {
 180                 uint32_t tcon_id;
 181                 uint8_t type;
 182                 uint32_t flags;
 183                 uint32_t capabilities;
 184                 uint32_t maximal_access;
 185                 bool should_encrypt;
 186         } smb2;
 187 };
 188
 189 struct smbXcli_req_state {
 190         struct tevent_context *ev;
 191         struct smbXcli_conn *conn;
 192         struct smbXcli_session *session; /* maybe NULL */
 193         struct smbXcli_tcon *tcon; /* maybe NULL */
 194
 195         uint8_t length_hdr[4];
 196
 197         bool one_way;
 198
 199         uint8_t *inbuf;
 200
 201         struct {
 202                 /* Space for the header including the wct */
 203                 uint8_t hdr[HDR_VWV];
 204
 205                 /*
 206                  * For normal requests, smb1cli_req_send chooses a mid.
 207                  * SecondaryV trans requests need to use the mid of the primary
 208                  * request, so we need a place to store it.
 209                  * Assume it is set if != 0.
 210                  */
 211                 uint16_t mid;
 212
 213                 uint16_t *vwv;
 214                 uint8_t bytecount_buf[2];
 215
 216 #define MAX_SMB_IOV 10
 217                 /* length_hdr, hdr, words, byte_count, buffers */
 218                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 219                 int iov_count;
 220
 221                 bool one_way_seqnum;
 222                 uint32_t seqnum;
 223                 struct tevent_req **chained_requests;
 224
 225                 uint8_t recv_cmd;
 226                 NTSTATUS recv_status;
 227                 /* always an array of 3 talloc elements */
 228                 struct iovec *recv_iov;
 229         } smb1;
 230
 231         struct {
 232                 const uint8_t *fixed;
 233                 uint16_t fixed_len;
 234                 const uint8_t *dyn;
 235                 uint32_t dyn_len;
 236
 237                 uint8_t transform[SMB2_TF_HDR_SIZE];
 238                 uint8_t hdr[SMB2_HDR_BODY];
 239                 uint8_t pad[7]; /* padding space for compounding */
 240
 241                 /*
 242                  * always an array of 3 talloc elements
 243                  * (without a SMB2_TRANSFORM header!)
 244                  *
 245                  * HDR, BODY, DYN
 246                  */
 247                 struct iovec *recv_iov;
 248
 249                 /*
 250                  * the expected max for the response dyn_len
 251                  */
 252                 uint32_t max_dyn_len;
 253
 254                 uint16_t credit_charge;
 255
 256                 bool should_sign;
 257                 bool should_encrypt;
 258                 uint64_t encryption_session_id;
 259
 260                 bool signing_skipped;
 261                 bool notify_async;
 262                 bool got_async;
 263         } smb2;
 264 };
 265
 266 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 267 {
 268         /*
 269          * NT_STATUS_OK, means we do not notify the callers
 270          */
 271         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 272
 273         while (conn->sessions) {
 274                 conn->sessions->conn = NULL;
 275                 DLIST_REMOVE(conn->sessions, conn->sessions);
 276         }
 277
 278         if (conn->smb1.trans_enc) {
 279                 TALLOC_FREE(conn->smb1.trans_enc);
 280         }
 281
 282         return 0;
 283 }
 284
 285 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 286                                          int fd,
 287                                          const char *remote_name,
 288                                          enum smb_signing_setting signing_state,
 289                                          uint32_t smb1_capabilities,
 290                                          struct GUID *client_guid,
 291                                          uint32_t smb2_capabilities)
 292 {
 293         struct smbXcli_conn *conn = NULL;
 294         void *ss = NULL;
 295         struct sockaddr *sa = NULL;
 296         socklen_t sa_length;
 297         int ret;
 298
 299         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 300         if (!conn) {
 301                 return NULL;
 302         }
 303
 304         conn->read_fd = fd;
 305         conn->write_fd = dup(fd);
 306         if (conn->write_fd == -1) {
 307                 goto error;
 308         }
 309
 310         conn->remote_name = talloc_strdup(conn, remote_name);
 311         if (conn->remote_name == NULL) {
 312                 goto error;
 313         }
 314
 315
 316         ss = (void *)&conn->local_ss;
 317         sa = (struct sockaddr *)ss;
 318         sa_length = sizeof(conn->local_ss);
 319         ret = getsockname(fd, sa, &sa_length);
 320         if (ret == -1) {
 321                 goto error;
 322         }
 323         ss = (void *)&conn->remote_ss;
 324         sa = (struct sockaddr *)ss;
 325         sa_length = sizeof(conn->remote_ss);
 326         ret = getpeername(fd, sa, &sa_length);
 327         if (ret == -1) {
 328                 goto error;
 329         }
 330
 331         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 332         if (conn->outgoing == NULL) {
 333                 goto error;
 334         }
 335         conn->pending = NULL;
 336
 337         conn->protocol = PROTOCOL_NONE;
 338
 339         switch (signing_state) {
 340         case SMB_SIGNING_OFF:
 341                 /* never */
 342                 conn->allow_signing = false;
 343                 conn->desire_signing = false;
 344                 conn->mandatory_signing = false;
 345                 break;
 346         case SMB_SIGNING_DEFAULT:
 347         case SMB_SIGNING_IF_REQUIRED:
 348                 /* if the server requires it */
 349                 conn->allow_signing = true;
 350                 conn->desire_signing = false;
 351                 conn->mandatory_signing = false;
 352                 break;
 353         case SMB_SIGNING_REQUIRED:
 354                 /* always */
 355                 conn->allow_signing = true;
 356                 conn->desire_signing = true;
 357                 conn->mandatory_signing = true;
 358                 break;
 359         }
 360
 361         conn->smb1.client.capabilities = smb1_capabilities;
 362         conn->smb1.client.max_xmit = UINT16_MAX;
 363
 364         conn->smb1.capabilities = conn->smb1.client.capabilities;
 365         conn->smb1.max_xmit = 1024;
 366
 367         conn->smb1.mid = 1;
 368
 369         /* initialise signing */
 370         conn->smb1.signing = smb_signing_init(conn,
 371                                               conn->allow_signing,
 372                                               conn->desire_signing,
 373                                               conn->mandatory_signing);
 374         if (!conn->smb1.signing) {
 375                 goto error;
 376         }
 377
 378         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 379         if (conn->mandatory_signing) {
 380                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 381         }
 382         if (client_guid) {
 383                 conn->smb2.client.guid = *client_guid;
 384         }
 385         conn->smb2.client.capabilities = smb2_capabilities;
 386
 387         conn->smb2.cur_credits = 1;
 388         conn->smb2.max_credits = 0;
 389
 390         talloc_set_destructor(conn, smbXcli_conn_destructor);
 391         return conn;
 392
 393  error:
 394         if (conn->write_fd != -1) {
 395                 close(conn->write_fd);
 396         }
 397         TALLOC_FREE(conn);
 398         return NULL;
 399 }
 400
 401 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 402 {
 403         if (conn == NULL) {
 404                 return false;
 405         }
 406
 407         if (conn->read_fd == -1) {
 408                 return false;
 409         }
 410
 411         return true;
 412 }
 413
 414 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 415 {
 416         return conn->protocol;
 417 }
 418
 419 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 420 {
 421         if (conn->protocol >= PROTOCOL_SMB2_02) {
 422                 return true;
 423         }
 424
 425         if (conn->smb1.capabilities & CAP_UNICODE) {
 426                 return true;
 427         }
 428
 429         return false;
 430 }
 431
 432 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 433 {
 434         set_socket_options(conn->read_fd, options);
 435 }
 436
 437 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 438 {
 439         return &conn->local_ss;
 440 }
 441
 442 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 443 {
 444         return &conn->remote_ss;
 445 }
 446
 447 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 448 {
 449         return conn->remote_name;
 450 }
 451
 452 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 453 {
 454         if (conn->protocol >= PROTOCOL_SMB2_02) {
 455                 /*
 456                  * TODO...
 457                  */
 458                 return 1;
 459         }
 460
 461         return conn->smb1.server.max_mux;
 462 }
 463
 464 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 465 {
 466         if (conn->protocol >= PROTOCOL_SMB2_02) {
 467                 return conn->smb2.server.system_time;
 468         }
 469
 470         return conn->smb1.server.system_time;
 471 }
 472
 473 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 474 {
 475         if (conn->protocol >= PROTOCOL_SMB2_02) {
 476                 return &conn->smb2.server.gss_blob;
 477         }
 478
 479         return &conn->smb1.server.gss_blob;
 480 }
 481
 482 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 483 {
 484         if (conn->protocol >= PROTOCOL_SMB2_02) {
 485                 return &conn->smb2.server.guid;
 486         }
 487
 488         return &conn->smb1.server.guid;
 489 }
 490
 491 struct smbXcli_conn_samba_suicide_state {
 492         struct smbXcli_conn *conn;
 493         struct iovec iov;
 494         uint8_t buf[9];
 495 };
 496
 497 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 498
 499 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 500                                                    struct tevent_context *ev,
 501                                                    struct smbXcli_conn *conn,
 502                                                    uint8_t exitcode)
 503 {
 504         struct tevent_req *req, *subreq;
 505         struct smbXcli_conn_samba_suicide_state *state;
 506
 507         req = tevent_req_create(mem_ctx, &state,
 508                                 struct smbXcli_conn_samba_suicide_state);
 509         if (req == NULL) {
 510                 return NULL;
 511         }
 512         state->conn = conn;
 513         SIVAL(state->buf, 4, 0x74697865);
 514         SCVAL(state->buf, 8, exitcode);
 515         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 516
 517         state->iov.iov_base = state->buf;
 518         state->iov.iov_len = sizeof(state->buf);
 519
 520         subreq = writev_send(state, ev, conn->outgoing, conn->write_fd,
 521                              false, &state->iov, 1);
 522         if (tevent_req_nomem(subreq, req)) {
 523                 return tevent_req_post(req, ev);
 524         }
 525         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 526         return req;
 527 }
 528
 529 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 530 {
 531         struct tevent_req *req = tevent_req_callback_data(
 532                 subreq, struct tevent_req);
 533         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 534                 req, struct smbXcli_conn_samba_suicide_state);
 535         ssize_t nwritten;
 536         int err;
 537
 538         nwritten = writev_recv(subreq, &err);
 539         TALLOC_FREE(subreq);
 540         if (nwritten == -1) {
 541                 NTSTATUS status = map_nt_error_from_unix_common(err);
 542                 smbXcli_conn_disconnect(state->conn, status);
 543                 return;
 544         }
 545         tevent_req_done(req);
 546 }
 547
 548 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 549 {
 550         return tevent_req_simple_recv_ntstatus(req);
 551 }
 552
 553 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 554                                     uint8_t exitcode)
 555 {
 556         TALLOC_CTX *frame = talloc_stackframe();
 557         struct tevent_context *ev;
 558         struct tevent_req *req;
 559         NTSTATUS status = NT_STATUS_NO_MEMORY;
 560         bool ok;
 561
 562         if (smbXcli_conn_has_async_calls(conn)) {
 563                 /*
 564                  * Can't use sync call while an async call is in flight
 565                  */
 566                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 567                 goto fail;
 568         }
 569         ev = samba_tevent_context_init(frame);
 570         if (ev == NULL) {
 571                 goto fail;
 572         }
 573         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 574         if (req == NULL) {
 575                 goto fail;
 576         }
 577         ok = tevent_req_poll(req, ev);
 578         if (!ok) {
 579                 status = map_nt_error_from_unix_common(errno);
 580                 goto fail;
 581         }
 582         status = smbXcli_conn_samba_suicide_recv(req);
 583  fail:
 584         TALLOC_FREE(frame);
 585         return status;
 586 }
 587
 588 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 589 {
 590         return conn->smb1.capabilities;
 591 }
 592
 593 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 594 {
 595         return conn->smb1.max_xmit;
 596 }
 597
 598 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
 599 {
 600         size_t pending;
 601         uint16_t possible = conn->smb1.server.max_mux;
 602
 603         pending = tevent_queue_length(conn->outgoing);
 604         if (pending >= possible) {
 605                 return false;
 606         }
 607         pending += talloc_array_length(conn->pending);
 608         if (pending >= possible) {
 609                 return false;
 610         }
 611
 612         return true;
 613 }
 614
 615 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 616 {
 617         return conn->smb1.server.session_key;
 618 }
 619
 620 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 621 {
 622         return conn->smb1.server.challenge;
 623 }
 624
 625 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 626 {
 627         return conn->smb1.server.security_mode;
 628 }
 629
 630 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 631 {
 632         return conn->smb1.server.readbraw;
 633 }
 634
 635 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 636 {
 637         return conn->smb1.server.writebraw;
 638 }
 639
 640 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 641 {
 642         return conn->smb1.server.lockread;
 643 }
 644
 645 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 646 {
 647         return conn->smb1.server.writeunlock;
 648 }
 649
 650 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 651 {
 652         return conn->smb1.server.time_zone;
 653 }
 654
 655 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 656                                    const DATA_BLOB user_session_key,
 657                                    const DATA_BLOB response)
 658 {
 659         return smb_signing_activate(conn->smb1.signing,
 660                                     user_session_key,
 661                                     response);
 662 }
 663
 664 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 665                                 const uint8_t *buf, uint32_t seqnum)
 666 {
 667         const uint8_t *hdr = buf + NBT_HDR_SIZE;
 668         size_t len = smb_len_nbt(buf);
 669
 670         return smb_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
 671 }
 672
 673 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 674 {
 675         return smb_signing_is_active(conn->smb1.signing);
 676 }
 677
 678 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 679                                  struct smb_trans_enc_state *es)
 680 {
 681         /* Replace the old state, if any. */
 682         if (conn->smb1.trans_enc) {
 683                 TALLOC_FREE(conn->smb1.trans_enc);
 684         }
 685         conn->smb1.trans_enc = es;
 686 }
 687
 688 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 689 {
 690         return common_encryption_on(conn->smb1.trans_enc);
 691 }
 692
 693
 694 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 695 {
 696         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 697         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 698
 699         if (NT_STATUS_IS_OK(status)) {
 700                 return NT_STATUS_OK;
 701         }
 702
 703         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 704                 return status;
 705         }
 706
 707         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 708 }
 709
 710 /**
 711  * Is the SMB command able to hold an AND_X successor
 712  * @param[in] cmd       The SMB command in question
 713  * @retval Can we add a chained request after "cmd"?
 714  */
 715 bool smb1cli_is_andx_req(uint8_t cmd)
 716 {
 717         switch (cmd) {
 718         case SMBtconX:
 719         case SMBlockingX:
 720         case SMBopenX:
 721         case SMBreadX:
 722         case SMBwriteX:
 723         case SMBsesssetupX:
 724         case SMBulogoffX:
 725         case SMBntcreateX:
 726                 return true;
 727                 break;
 728         default:
 729                 break;
 730         }
 731
 732         return false;
 733 }
 734
 735 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 736 {
 737         size_t num_pending = talloc_array_length(conn->pending);
 738         uint16_t result;
 739
 740         while (true) {
 741                 size_t i;
 742
 743                 result = conn->smb1.mid++;
 744                 if ((result == 0) || (result == 0xffff)) {
 745                         continue;
 746                 }
 747
 748                 for (i=0; i<num_pending; i++) {
 749                         if (result == smb1cli_req_mid(conn->pending[i])) {
 750                                 break;
 751                         }
 752                 }
 753
 754                 if (i == num_pending) {
 755                         return result;
 756                 }
 757         }
 758 }
 759
 760 void smbXcli_req_unset_pending(struct tevent_req *req)
 761 {
 762         struct smbXcli_req_state *state =
 763                 tevent_req_data(req,
 764                 struct smbXcli_req_state);
 765         struct smbXcli_conn *conn = state->conn;
 766         size_t num_pending = talloc_array_length(conn->pending);
 767         size_t i;
 768
 769         if (state->smb1.mid != 0) {
 770                 /*
 771                  * This is a [nt]trans[2] request which waits
 772                  * for more than one reply.
 773                  */
 774                 return;
 775         }
 776
 777         talloc_set_destructor(req, NULL);
 778
 779         if (num_pending == 1) {
 780                 /*
 781                  * The pending read_smb tevent_req is a child of
 782                  * conn->pending. So if nothing is pending anymore, we need to
 783                  * delete the socket read fde.
 784                  */
 785                 TALLOC_FREE(conn->pending);
 786                 conn->read_smb_req = NULL;
 787                 return;
 788         }
 789
 790         for (i=0; i<num_pending; i++) {
 791                 if (req == conn->pending[i]) {
 792                         break;
 793                 }
 794         }
 795         if (i == num_pending) {
 796                 /*
 797                  * Something's seriously broken. Just returning here is the
 798                  * right thing nevertheless, the point of this routine is to
 799                  * remove ourselves from conn->pending.
 800                  */
 801                 return;
 802         }
 803
 804         /*
 805          * Remove ourselves from the conn->pending array
 806          */
 807         for (; i < (num_pending - 1); i++) {
 808                 conn->pending[i] = conn->pending[i+1];
 809         }
 810
 811         /*
 812          * No NULL check here, we're shrinking by sizeof(void *), and
 813          * talloc_realloc just adjusts the size for this.
 814          */
 815         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
 816                                        num_pending - 1);
 817         return;
 818 }
 819
 820 static int smbXcli_req_destructor(struct tevent_req *req)
 821 {
 822         struct smbXcli_req_state *state =
 823                 tevent_req_data(req,
 824                 struct smbXcli_req_state);
 825
 826         /*
 827          * Make sure we really remove it from
 828          * the pending array on destruction.
 829          */
 830         state->smb1.mid = 0;
 831         smbXcli_req_unset_pending(req);
 832         return 0;
 833 }
 834
 835 static bool smb1cli_req_cancel(struct tevent_req *req);
 836 static bool smb2cli_req_cancel(struct tevent_req *req);
 837
 838 static bool smbXcli_req_cancel(struct tevent_req *req)
 839 {
 840         struct smbXcli_req_state *state =
 841                 tevent_req_data(req,
 842                 struct smbXcli_req_state);
 843
 844         if (!smbXcli_conn_is_connected(state->conn)) {
 845                 return false;
 846         }
 847
 848         if (state->conn->protocol == PROTOCOL_NONE) {
 849                 return false;
 850         }
 851
 852         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
 853                 return smb2cli_req_cancel(req);
 854         }
 855
 856         return smb1cli_req_cancel(req);
 857 }
 858
 859 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
 860
 861 bool smbXcli_req_set_pending(struct tevent_req *req)
 862 {
 863         struct smbXcli_req_state *state =
 864                 tevent_req_data(req,
 865                 struct smbXcli_req_state);
 866         struct smbXcli_conn *conn;
 867         struct tevent_req **pending;
 868         size_t num_pending;
 869
 870         conn = state->conn;
 871
 872         if (!smbXcli_conn_is_connected(conn)) {
 873                 return false;
 874         }
 875
 876         num_pending = talloc_array_length(conn->pending);
 877
 878         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
 879                                  num_pending+1);
 880         if (pending == NULL) {
 881                 return false;
 882         }
 883         pending[num_pending] = req;
 884         conn->pending = pending;
 885         talloc_set_destructor(req, smbXcli_req_destructor);
 886         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
 887
 888         if (!smbXcli_conn_receive_next(conn)) {
 889                 /*
 890                  * the caller should notify the current request
 891                  *
 892                  * And all other pending requests get notified
 893                  * by smbXcli_conn_disconnect().
 894                  */
 895                 smbXcli_req_unset_pending(req);
 896                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
 897                 return false;
 898         }
 899
 900         return true;
 901 }
 902
 903 static void smbXcli_conn_received(struct tevent_req *subreq);
 904
 905 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
 906 {
 907         size_t num_pending = talloc_array_length(conn->pending);
 908         struct tevent_req *req;
 909         struct smbXcli_req_state *state;
 910
 911         if (conn->read_smb_req != NULL) {
 912                 return true;
 913         }
 914
 915         if (num_pending == 0) {
 916                 if (conn->smb2.mid < UINT64_MAX) {
 917                         /* no more pending requests, so we are done for now */
 918                         return true;
 919                 }
 920
 921                 /*
 922                  * If there are no more SMB2 requests possible,
 923                  * because we are out of message ids,
 924                  * we need to disconnect.
 925                  */
 926                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
 927                 return true;
 928         }
 929
 930         req = conn->pending[0];
 931         state = tevent_req_data(req, struct smbXcli_req_state);
 932
 933         /*
 934          * We're the first ones, add the read_smb request that waits for the
 935          * answer from the server
 936          */
 937         conn->read_smb_req = read_smb_send(conn->pending,
 938                                            state->ev,
 939                                            conn->read_fd);
 940         if (conn->read_smb_req == NULL) {
 941                 return false;
 942         }
 943         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
 944         return true;
 945 }
 946
 947 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
 948 {
 949         struct smbXcli_session *session;
 950
 951         tevent_queue_stop(conn->outgoing);
 952
 953         if (conn->read_fd != -1) {
 954                 close(conn->read_fd);
 955         }
 956         if (conn->write_fd != -1) {
 957                 close(conn->write_fd);
 958         }
 959         conn->read_fd = -1;
 960         conn->write_fd = -1;
 961
 962         session = conn->sessions;
 963         if (talloc_array_length(conn->pending) == 0) {
 964                 /*
 965                  * if we do not have pending requests
 966                  * there is no need to update the channel_sequence
 967                  */
 968                 session = NULL;
 969         }
 970         for (; session; session = session->next) {
 971                 smb2cli_session_increment_channel_sequence(session);
 972         }
 973
 974         /*
 975          * Cancel all pending requests. We do not do a for-loop walking
 976          * conn->pending because that array changes in
 977          * smbXcli_req_unset_pending.
 978          */
 979         while (talloc_array_length(conn->pending) > 0) {
 980                 struct tevent_req *req;
 981                 struct smbXcli_req_state *state;
 982                 struct tevent_req **chain;
 983                 size_t num_chained;
 984                 size_t i;
 985
 986                 req = conn->pending[0];
 987                 state = tevent_req_data(req, struct smbXcli_req_state);
 988
 989                 if (state->smb1.chained_requests == NULL) {
 990                         /*
 991                          * We're dead. No point waiting for trans2
 992                          * replies.
 993                          */
 994                         state->smb1.mid = 0;
 995
 996                         smbXcli_req_unset_pending(req);
 997
 998                         if (NT_STATUS_IS_OK(status)) {
 999                                 /* do not notify the callers */
1000                                 continue;
1001                         }
1002
1003                         /*
1004                          * we need to defer the callback, because we may notify
1005                          * more then one caller.
1006                          */
1007                         tevent_req_defer_callback(req, state->ev);
1008                         tevent_req_nterror(req, status);
1009                         continue;
1010                 }
1011
1012                 chain = talloc_move(conn, &state->smb1.chained_requests);
1013                 num_chained = talloc_array_length(chain);
1014
1015                 for (i=0; i<num_chained; i++) {
1016                         req = chain[i];
1017                         state = tevent_req_data(req, struct smbXcli_req_state);
1018
1019                         /*
1020                          * We're dead. No point waiting for trans2
1021                          * replies.
1022                          */
1023                         state->smb1.mid = 0;
1024
1025                         smbXcli_req_unset_pending(req);
1026
1027                         if (NT_STATUS_IS_OK(status)) {
1028                                 /* do not notify the callers */
1029                                 continue;
1030                         }
1031
1032                         /*
1033                          * we need to defer the callback, because we may notify
1034                          * more than one caller.
1035                          */
1036                         tevent_req_defer_callback(req, state->ev);
1037                         tevent_req_nterror(req, status);
1038                 }
1039                 TALLOC_FREE(chain);
1040         }
1041 }
1042
1043 /*
1044  * Fetch a smb request's mid. Only valid after the request has been sent by
1045  * smb1cli_req_send().
1046  */
1047 uint16_t smb1cli_req_mid(struct tevent_req *req)
1048 {
1049         struct smbXcli_req_state *state =
1050                 tevent_req_data(req,
1051                 struct smbXcli_req_state);
1052
1053         if (state->smb1.mid != 0) {
1054                 return state->smb1.mid;
1055         }
1056
1057         return SVAL(state->smb1.hdr, HDR_MID);
1058 }
1059
1060 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1061 {
1062         struct smbXcli_req_state *state =
1063                 tevent_req_data(req,
1064                 struct smbXcli_req_state);
1065
1066         state->smb1.mid = mid;
1067 }
1068
1069 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1070 {
1071         struct smbXcli_req_state *state =
1072                 tevent_req_data(req,
1073                 struct smbXcli_req_state);
1074
1075         return state->smb1.seqnum;
1076 }
1077
1078 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1079 {
1080         struct smbXcli_req_state *state =
1081                 tevent_req_data(req,
1082                 struct smbXcli_req_state);
1083
1084         state->smb1.seqnum = seqnum;
1085 }
1086
1087 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1088 {
1089         size_t result = 0;
1090         int i;
1091         for (i=0; i<count; i++) {
1092                 result += iov[i].iov_len;
1093         }
1094         return result;
1095 }
1096
1097 static uint8_t *smbXcli_iov_concat(TALLOC_CTX *mem_ctx,
1098                                    const struct iovec *iov,
1099                                    int count)
1100 {
1101         size_t len = smbXcli_iov_len(iov, count);
1102         size_t copied;
1103         uint8_t *buf;
1104         int i;
1105
1106         buf = talloc_array(mem_ctx, uint8_t, len);
1107         if (buf == NULL) {
1108                 return NULL;
1109         }
1110         copied = 0;
1111         for (i=0; i<count; i++) {
1112                 memcpy(buf+copied, iov[i].iov_base, iov[i].iov_len);
1113                 copied += iov[i].iov_len;
1114         }
1115         return buf;
1116 }
1117
1118 static void smb1cli_req_flags(enum protocol_types protocol,
1119                               uint32_t smb1_capabilities,
1120                               uint8_t smb_command,
1121                               uint8_t additional_flags,
1122                               uint8_t clear_flags,
1123                               uint8_t *_flags,
1124                               uint16_t additional_flags2,
1125                               uint16_t clear_flags2,
1126                               uint16_t *_flags2)
1127 {
1128         uint8_t flags = 0;
1129         uint16_t flags2 = 0;
1130
1131         if (protocol >= PROTOCOL_LANMAN1) {
1132                 flags |= FLAG_CASELESS_PATHNAMES;
1133                 flags |= FLAG_CANONICAL_PATHNAMES;
1134         }
1135
1136         if (protocol >= PROTOCOL_LANMAN2) {
1137                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1138                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1139         }
1140
1141         if (protocol >= PROTOCOL_NT1) {
1142                 flags2 |= FLAGS2_IS_LONG_NAME;
1143
1144                 if (smb1_capabilities & CAP_UNICODE) {
1145                         flags2 |= FLAGS2_UNICODE_STRINGS;
1146                 }
1147                 if (smb1_capabilities & CAP_STATUS32) {
1148                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1149                 }
1150                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1151                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1152                 }
1153         }
1154
1155         flags |= additional_flags;
1156         flags &= ~clear_flags;
1157         flags2 |= additional_flags2;
1158         flags2 &= ~clear_flags2;
1159
1160         *_flags = flags;
1161         *_flags2 = flags2;
1162 }
1163
1164 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1165
1166 static bool smb1cli_req_cancel(struct tevent_req *req)
1167 {
1168         struct smbXcli_req_state *state =
1169                 tevent_req_data(req,
1170                 struct smbXcli_req_state);
1171         uint8_t flags;
1172         uint16_t flags2;
1173         uint32_t pid;
1174         uint16_t mid;
1175         struct tevent_req *subreq;
1176         NTSTATUS status;
1177
1178         flags = CVAL(state->smb1.hdr, HDR_FLG);
1179         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1180         pid  = SVAL(state->smb1.hdr, HDR_PID);
1181         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1182         mid = SVAL(state->smb1.hdr, HDR_MID);
1183
1184         subreq = smb1cli_req_create(state, state->ev,
1185                                     state->conn,
1186                                     SMBntcancel,
1187                                     flags, 0,
1188                                     flags2, 0,
1189                                     0, /* timeout */
1190                                     pid,
1191                                     state->tcon,
1192                                     state->session,
1193                                     0, NULL, /* vwv */
1194                                     0, NULL); /* bytes */
1195         if (subreq == NULL) {
1196                 return false;
1197         }
1198         smb1cli_req_set_mid(subreq, mid);
1199
1200         status = smb1cli_req_chain_submit(&subreq, 1);
1201         if (!NT_STATUS_IS_OK(status)) {
1202                 TALLOC_FREE(subreq);
1203                 return false;
1204         }
1205         smb1cli_req_set_mid(subreq, 0);
1206
1207         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1208
1209         return true;
1210 }
1211
1212 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1213 {
1214         /* we do not care about the result */
1215         TALLOC_FREE(subreq);
1216 }
1217
1218 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1219                                       struct tevent_context *ev,
1220                                       struct smbXcli_conn *conn,
1221                                       uint8_t smb_command,
1222                                       uint8_t additional_flags,
1223                                       uint8_t clear_flags,
1224                                       uint16_t additional_flags2,
1225                                       uint16_t clear_flags2,
1226                                       uint32_t timeout_msec,
1227                                       uint32_t pid,
1228                                       struct smbXcli_tcon *tcon,
1229                                       struct smbXcli_session *session,
1230                                       uint8_t wct, uint16_t *vwv,
1231                                       int iov_count,
1232                                       struct iovec *bytes_iov)
1233 {
1234         struct tevent_req *req;
1235         struct smbXcli_req_state *state;
1236         uint8_t flags = 0;
1237         uint16_t flags2 = 0;
1238         uint16_t uid = 0;
1239         uint16_t tid = 0;
1240
1241         if (iov_count > MAX_SMB_IOV) {
1242                 /*
1243                  * Should not happen :-)
1244                  */
1245                 return NULL;
1246         }
1247
1248         req = tevent_req_create(mem_ctx, &state,
1249                                 struct smbXcli_req_state);
1250         if (req == NULL) {
1251                 return NULL;
1252         }
1253         state->ev = ev;
1254         state->conn = conn;
1255         state->session = session;
1256         state->tcon = tcon;
1257
1258         if (session) {
1259                 uid = session->smb1.session_id;
1260         }
1261
1262         if (tcon) {
1263                 tid = tcon->smb1.tcon_id;
1264         }
1265
1266         state->smb1.recv_cmd = 0xFF;
1267         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1268         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1269         if (state->smb1.recv_iov == NULL) {
1270                 TALLOC_FREE(req);
1271                 return NULL;
1272         }
1273
1274         smb1cli_req_flags(conn->protocol,
1275                           conn->smb1.capabilities,
1276                           smb_command,
1277                           additional_flags,
1278                           clear_flags,
1279                           &flags,
1280                           additional_flags2,
1281                           clear_flags2,
1282                           &flags2);
1283
1284         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1285         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1286         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1287         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1288         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1289         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1290         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1291         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1292         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1293         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1294         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1295
1296         state->smb1.vwv = vwv;
1297
1298         SSVAL(state->smb1.bytecount_buf, 0, smbXcli_iov_len(bytes_iov, iov_count));
1299
1300         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1301         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1302         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1303         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1304         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1305         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1306         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1307         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1308
1309         if (iov_count != 0) {
1310                 memcpy(&state->smb1.iov[4], bytes_iov,
1311                        iov_count * sizeof(*bytes_iov));
1312         }
1313         state->smb1.iov_count = iov_count + 4;
1314
1315         if (timeout_msec > 0) {
1316                 struct timeval endtime;
1317
1318                 endtime = timeval_current_ofs_msec(timeout_msec);
1319                 if (!tevent_req_set_endtime(req, ev, endtime)) {
1320                         return req;
1321                 }
1322         }
1323
1324         switch (smb_command) {
1325         case SMBtranss:
1326         case SMBtranss2:
1327         case SMBnttranss:
1328                 state->one_way = true;
1329                 break;
1330         case SMBntcancel:
1331                 state->one_way = true;
1332                 state->smb1.one_way_seqnum = true;
1333                 break;
1334         case SMBlockingX:
1335                 if ((wct == 8) &&
1336                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1337                         state->one_way = true;
1338                 }
1339                 break;
1340         }
1341
1342         return req;
1343 }
1344
1345 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1346                                    struct iovec *iov, int iov_count,
1347                                    uint32_t *seqnum,
1348                                    bool one_way_seqnum)
1349 {
1350         TALLOC_CTX *frame = NULL;
1351         uint8_t *buf;
1352
1353         /*
1354          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1355          * iovec directly. MD5Update would do that just fine.
1356          */
1357
1358         if (iov_count < 4) {
1359                 return NT_STATUS_INVALID_PARAMETER_MIX;
1360         }
1361         if (iov[0].iov_len != NBT_HDR_SIZE) {
1362                 return NT_STATUS_INVALID_PARAMETER_MIX;
1363         }
1364         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1365                 return NT_STATUS_INVALID_PARAMETER_MIX;
1366         }
1367         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1368                 return NT_STATUS_INVALID_PARAMETER_MIX;
1369         }
1370         if (iov[3].iov_len != sizeof(uint16_t)) {
1371                 return NT_STATUS_INVALID_PARAMETER_MIX;
1372         }
1373
1374         frame = talloc_stackframe();
1375
1376         buf = smbXcli_iov_concat(frame, &iov[1], iov_count - 1);
1377         if (buf == NULL) {
1378                 return NT_STATUS_NO_MEMORY;
1379         }
1380
1381         *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1382                                           one_way_seqnum);
1383         smb_signing_sign_pdu(conn->smb1.signing,
1384                              buf, talloc_get_size(buf),
1385                              *seqnum);
1386         memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1387
1388         TALLOC_FREE(frame);
1389         return NT_STATUS_OK;
1390 }
1391
1392 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1393 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1394                                                TALLOC_CTX *tmp_mem,
1395                                                uint8_t *inbuf);
1396
1397 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1398                                           struct smbXcli_req_state *state,
1399                                           struct iovec *iov, int iov_count)
1400 {
1401         struct tevent_req *subreq;
1402         NTSTATUS status;
1403         uint8_t cmd;
1404         uint16_t mid;
1405
1406         if (!smbXcli_conn_is_connected(state->conn)) {
1407                 return NT_STATUS_CONNECTION_DISCONNECTED;
1408         }
1409
1410         if (state->conn->protocol > PROTOCOL_NT1) {
1411                 return NT_STATUS_REVISION_MISMATCH;
1412         }
1413
1414         if (iov_count < 4) {
1415                 return NT_STATUS_INVALID_PARAMETER_MIX;
1416         }
1417         if (iov[0].iov_len != NBT_HDR_SIZE) {
1418                 return NT_STATUS_INVALID_PARAMETER_MIX;
1419         }
1420         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1421                 return NT_STATUS_INVALID_PARAMETER_MIX;
1422         }
1423         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1424                 return NT_STATUS_INVALID_PARAMETER_MIX;
1425         }
1426         if (iov[3].iov_len != sizeof(uint16_t)) {
1427                 return NT_STATUS_INVALID_PARAMETER_MIX;
1428         }
1429
1430         cmd = CVAL(iov[1].iov_base, HDR_COM);
1431         if (cmd == SMBreadBraw) {
1432                 if (smbXcli_conn_has_async_calls(state->conn)) {
1433                         return NT_STATUS_INVALID_PARAMETER_MIX;
1434                 }
1435                 state->conn->smb1.read_braw_req = req;
1436         }
1437
1438         if (state->smb1.mid != 0) {
1439                 mid = state->smb1.mid;
1440         } else {
1441                 mid = smb1cli_alloc_mid(state->conn);
1442         }
1443         SSVAL(iov[1].iov_base, HDR_MID, mid);
1444
1445         _smb_setlen_nbt(iov[0].iov_base, smbXcli_iov_len(&iov[1], iov_count-1));
1446
1447         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1448                                     &state->smb1.seqnum,
1449                                     state->smb1.one_way_seqnum);
1450
1451         if (!NT_STATUS_IS_OK(status)) {
1452                 return status;
1453         }
1454
1455         /*
1456          * If we supported multiple encrytion contexts
1457          * here we'd look up based on tid.
1458          */
1459         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1460                 char *buf, *enc_buf;
1461
1462                 buf = (char *)smbXcli_iov_concat(talloc_tos(), iov, iov_count);
1463                 if (buf == NULL) {
1464                         return NT_STATUS_NO_MEMORY;
1465                 }
1466                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1467                                                (char *)buf, &enc_buf);
1468                 TALLOC_FREE(buf);
1469                 if (!NT_STATUS_IS_OK(status)) {
1470                         DEBUG(0, ("Error in encrypting client message: %s\n",
1471                                   nt_errstr(status)));
1472                         return status;
1473                 }
1474                 buf = (char *)talloc_memdup(state, enc_buf,
1475                                             smb_len_nbt(enc_buf)+4);
1476                 SAFE_FREE(enc_buf);
1477                 if (buf == NULL) {
1478                         return NT_STATUS_NO_MEMORY;
1479                 }
1480                 iov[0].iov_base = (void *)buf;
1481                 iov[0].iov_len = talloc_get_size(buf);
1482                 iov_count = 1;
1483         }
1484
1485         if (state->conn->dispatch_incoming == NULL) {
1486                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1487         }
1488
1489         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1490
1491         subreq = writev_send(state, state->ev, state->conn->outgoing,
1492                              state->conn->write_fd, false, iov, iov_count);
1493         if (subreq == NULL) {
1494                 return NT_STATUS_NO_MEMORY;
1495         }
1496         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1497         return NT_STATUS_OK;
1498 }
1499
1500 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1501                                     struct tevent_context *ev,
1502                                     struct smbXcli_conn *conn,
1503                                     uint8_t smb_command,
1504                                     uint8_t additional_flags,
1505                                     uint8_t clear_flags,
1506                                     uint16_t additional_flags2,
1507                                     uint16_t clear_flags2,
1508                                     uint32_t timeout_msec,
1509                                     uint32_t pid,
1510                                     struct smbXcli_tcon *tcon,
1511                                     struct smbXcli_session *session,
1512                                     uint8_t wct, uint16_t *vwv,
1513                                     uint32_t num_bytes,
1514                                     const uint8_t *bytes)
1515 {
1516         struct tevent_req *req;
1517         struct iovec iov;
1518         NTSTATUS status;
1519
1520         iov.iov_base = discard_const_p(void, bytes);
1521         iov.iov_len = num_bytes;
1522
1523         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1524                                  additional_flags, clear_flags,
1525                                  additional_flags2, clear_flags2,
1526                                  timeout_msec,
1527                                  pid, tcon, session,
1528                                  wct, vwv, 1, &iov);
1529         if (req == NULL) {
1530                 return NULL;
1531         }
1532         if (!tevent_req_is_in_progress(req)) {
1533                 return tevent_req_post(req, ev);
1534         }
1535         status = smb1cli_req_chain_submit(&req, 1);
1536         if (tevent_req_nterror(req, status)) {
1537                 return tevent_req_post(req, ev);
1538         }
1539         return req;
1540 }
1541
1542 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1543 {
1544         struct tevent_req *req =
1545                 tevent_req_callback_data(subreq,
1546                 struct tevent_req);
1547         struct smbXcli_req_state *state =
1548                 tevent_req_data(req,
1549                 struct smbXcli_req_state);
1550         ssize_t nwritten;
1551         int err;
1552
1553         nwritten = writev_recv(subreq, &err);
1554         TALLOC_FREE(subreq);
1555         if (nwritten == -1) {
1556                 NTSTATUS status = map_nt_error_from_unix_common(err);
1557                 smbXcli_conn_disconnect(state->conn, status);
1558                 return;
1559         }
1560
1561         if (state->one_way) {
1562                 state->inbuf = NULL;
1563                 tevent_req_done(req);
1564                 return;
1565         }
1566
1567         if (!smbXcli_req_set_pending(req)) {
1568                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1569                 return;
1570         }
1571 }
1572
1573 static void smbXcli_conn_received(struct tevent_req *subreq)
1574 {
1575         struct smbXcli_conn *conn =
1576                 tevent_req_callback_data(subreq,
1577                 struct smbXcli_conn);
1578         TALLOC_CTX *frame = talloc_stackframe();
1579         NTSTATUS status;
1580         uint8_t *inbuf;
1581         ssize_t received;
1582         int err;
1583
1584         if (subreq != conn->read_smb_req) {
1585                 DEBUG(1, ("Internal error: cli_smb_received called with "
1586                           "unexpected subreq\n"));
1587                 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1588                 TALLOC_FREE(frame);
1589                 return;
1590         }
1591         conn->read_smb_req = NULL;
1592
1593         received = read_smb_recv(subreq, frame, &inbuf, &err);
1594         TALLOC_FREE(subreq);
1595         if (received == -1) {
1596                 status = map_nt_error_from_unix_common(err);
1597                 smbXcli_conn_disconnect(conn, status);
1598                 TALLOC_FREE(frame);
1599                 return;
1600         }
1601
1602         status = conn->dispatch_incoming(conn, frame, inbuf);
1603         TALLOC_FREE(frame);
1604         if (NT_STATUS_IS_OK(status)) {
1605                 /*
1606                  * We should not do any more processing
1607                  * as the dispatch function called
1608                  * tevent_req_done().
1609                  */
1610                 return;
1611         }
1612
1613         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1614                 /*
1615                  * We got an error, so notify all pending requests
1616                  */
1617                 smbXcli_conn_disconnect(conn, status);
1618                 return;
1619         }
1620
1621         /*
1622          * We got NT_STATUS_RETRY, so we may ask for a
1623          * next incoming pdu.
1624          */
1625         if (!smbXcli_conn_receive_next(conn)) {
1626                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1627         }
1628 }
1629
1630 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1631                                           struct iovec **piov, int *pnum_iov)
1632 {
1633         struct iovec *iov;
1634         int num_iov;
1635         size_t buflen;
1636         size_t taken;
1637         size_t remaining;
1638         uint8_t *hdr;
1639         uint8_t cmd;
1640         uint32_t wct_ofs;
1641         NTSTATUS status;
1642         size_t min_size = MIN_SMB_SIZE;
1643
1644         buflen = smb_len_tcp(buf);
1645         taken = 0;
1646
1647         hdr = buf + NBT_HDR_SIZE;
1648
1649         status = smb1cli_pull_raw_error(hdr);
1650         if (NT_STATUS_IS_ERR(status)) {
1651                 /*
1652                  * This is an ugly hack to support OS/2
1653                  * which skips the byte_count in the DATA block
1654                  * on some error responses.
1655                  *
1656                  * See bug #9096
1657                  */
1658                 min_size -= sizeof(uint16_t);
1659         }
1660
1661         if (buflen < min_size) {
1662                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1663         }
1664
1665         /*
1666          * This returns iovec elements in the following order:
1667          *
1668          * - SMB header
1669          *
1670          * - Parameter Block
1671          * - Data Block
1672          *
1673          * - Parameter Block
1674          * - Data Block
1675          *
1676          * - Parameter Block
1677          * - Data Block
1678          */
1679         num_iov = 1;
1680
1681         iov = talloc_array(mem_ctx, struct iovec, num_iov);
1682         if (iov == NULL) {
1683                 return NT_STATUS_NO_MEMORY;
1684         }
1685         iov[0].iov_base = hdr;
1686         iov[0].iov_len = HDR_WCT;
1687         taken += HDR_WCT;
1688
1689         cmd = CVAL(hdr, HDR_COM);
1690         wct_ofs = HDR_WCT;
1691
1692         while (true) {
1693                 size_t len = buflen - taken;
1694                 struct iovec *cur;
1695                 struct iovec *iov_tmp;
1696                 uint8_t wct;
1697                 uint32_t bcc_ofs;
1698                 uint16_t bcc;
1699                 size_t needed;
1700
1701                 /*
1702                  * we need at least WCT
1703                  */
1704                 needed = sizeof(uint8_t);
1705                 if (len < needed) {
1706                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1707                                    __location__, (int)len, (int)needed));
1708                         goto inval;
1709                 }
1710
1711                 /*
1712                  * Now we check if the specified words are there
1713                  */
1714                 wct = CVAL(hdr, wct_ofs);
1715                 needed += wct * sizeof(uint16_t);
1716                 if (len < needed) {
1717                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1718                                    __location__, (int)len, (int)needed));
1719                         goto inval;
1720                 }
1721
1722                 if ((num_iov == 1) &&
1723                     (len == needed) &&
1724                     NT_STATUS_IS_ERR(status))
1725                 {
1726                         /*
1727                          * This is an ugly hack to support OS/2
1728                          * which skips the byte_count in the DATA block
1729                          * on some error responses.
1730                          *
1731                          * See bug #9096
1732                          */
1733                         iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
1734                                                  num_iov + 2);
1735                         if (iov_tmp == NULL) {
1736                                 TALLOC_FREE(iov);
1737                                 return NT_STATUS_NO_MEMORY;
1738                         }
1739                         iov = iov_tmp;
1740                         cur = &iov[num_iov];
1741                         num_iov += 2;
1742
1743                         cur[0].iov_len = 0;
1744                         cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
1745                         cur[1].iov_len = 0;
1746                         cur[1].iov_base = cur[0].iov_base;
1747
1748                         taken += needed;
1749                         break;
1750                 }
1751
1752                 /*
1753                  * we need at least BCC
1754                  */
1755                 needed += sizeof(uint16_t);
1756                 if (len < needed) {
1757                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1758                                    __location__, (int)len, (int)needed));
1759                         goto inval;
1760                 }
1761
1762                 /*
1763                  * Now we check if the specified bytes are there
1764                  */
1765                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
1766                 bcc = SVAL(hdr, bcc_ofs);
1767                 needed += bcc * sizeof(uint8_t);
1768                 if (len < needed) {
1769                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1770                                    __location__, (int)len, (int)needed));
1771                         goto inval;
1772                 }
1773
1774                 /*
1775                  * we allocate 2 iovec structures for words and bytes
1776                  */
1777                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
1778                                          num_iov + 2);
1779                 if (iov_tmp == NULL) {
1780                         TALLOC_FREE(iov);
1781                         return NT_STATUS_NO_MEMORY;
1782                 }
1783                 iov = iov_tmp;
1784                 cur = &iov[num_iov];
1785                 num_iov += 2;
1786
1787                 cur[0].iov_len = wct * sizeof(uint16_t);
1788                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
1789                 cur[1].iov_len = bcc * sizeof(uint8_t);
1790                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
1791
1792                 taken += needed;
1793
1794                 if (!smb1cli_is_andx_req(cmd)) {
1795                         /*
1796                          * If the current command does not have AndX chanining
1797                          * we are done.
1798                          */
1799                         break;
1800                 }
1801
1802                 if (wct == 0 && bcc == 0) {
1803                         /*
1804                          * An empty response also ends the chain,
1805                          * most likely with an error.
1806                          */
1807                         break;
1808                 }
1809
1810                 if (wct < 2) {
1811                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
1812                                    __location__, (int)wct, (int)cmd));
1813                         goto inval;
1814                 }
1815                 cmd = CVAL(cur[0].iov_base, 0);
1816                 if (cmd == 0xFF) {
1817                         /*
1818                          * If it is the end of the chain we are also done.
1819                          */
1820                         break;
1821                 }
1822                 wct_ofs = SVAL(cur[0].iov_base, 2);
1823
1824                 if (wct_ofs < taken) {
1825                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1826                 }
1827                 if (wct_ofs > buflen) {
1828                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1829                 }
1830
1831                 /*
1832                  * we consumed everything up to the start of the next
1833                  * parameter block.
1834                  */
1835                 taken = wct_ofs;
1836         }
1837
1838         remaining = buflen - taken;
1839
1840         if (remaining > 0 && num_iov >= 3) {
1841                 /*
1842                  * The last DATA block gets the remaining
1843                  * bytes, this is needed to support
1844                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
1845                  */
1846                 iov[num_iov-1].iov_len += remaining;
1847         }
1848
1849         *piov = iov;
1850         *pnum_iov = num_iov;
1851         return NT_STATUS_OK;
1852
1853 inval:
1854         TALLOC_FREE(iov);
1855         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1856 }
1857
1858 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1859                                                TALLOC_CTX *tmp_mem,
1860                                                uint8_t *inbuf)
1861 {
1862         struct tevent_req *req;
1863         struct smbXcli_req_state *state;
1864         NTSTATUS status;
1865         size_t num_pending;
1866         size_t i;
1867         uint8_t cmd;
1868         uint16_t mid;
1869         bool oplock_break;
1870         uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
1871         size_t len = smb_len_tcp(inbuf);
1872         struct iovec *iov = NULL;
1873         int num_iov = 0;
1874         struct tevent_req **chain = NULL;
1875         size_t num_chained = 0;
1876         size_t num_responses = 0;
1877
1878         if (conn->smb1.read_braw_req != NULL) {
1879                 req = conn->smb1.read_braw_req;
1880                 conn->smb1.read_braw_req = NULL;
1881                 state = tevent_req_data(req, struct smbXcli_req_state);
1882
1883                 smbXcli_req_unset_pending(req);
1884
1885                 if (state->smb1.recv_iov == NULL) {
1886                         /*
1887                          * For requests with more than
1888                          * one response, we have to readd the
1889                          * recv_iov array.
1890                          */
1891                         state->smb1.recv_iov = talloc_zero_array(state,
1892                                                                  struct iovec,
1893                                                                  3);
1894                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
1895                                 return NT_STATUS_OK;
1896                         }
1897                 }
1898
1899                 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
1900                 state->smb1.recv_iov[0].iov_len = len;
1901                 ZERO_STRUCT(state->smb1.recv_iov[1]);
1902                 ZERO_STRUCT(state->smb1.recv_iov[2]);
1903
1904                 state->smb1.recv_cmd = SMBreadBraw;
1905                 state->smb1.recv_status = NT_STATUS_OK;
1906                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
1907
1908                 tevent_req_done(req);
1909                 return NT_STATUS_OK;
1910         }
1911
1912         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
1913             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
1914                 DEBUG(10, ("Got non-SMB PDU\n"));
1915                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1916         }
1917
1918         /*
1919          * If we supported multiple encrytion contexts
1920          * here we'd look up based on tid.
1921          */
1922         if (common_encryption_on(conn->smb1.trans_enc)
1923             && (CVAL(inbuf, 0) == 0)) {
1924                 uint16_t enc_ctx_num;
1925
1926                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
1927                 if (!NT_STATUS_IS_OK(status)) {
1928                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
1929                                    nt_errstr(status)));
1930                         return status;
1931                 }
1932
1933                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
1934                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
1935                                    enc_ctx_num,
1936                                    conn->smb1.trans_enc->enc_ctx_num));
1937                         return NT_STATUS_INVALID_HANDLE;
1938                 }
1939
1940                 status = common_decrypt_buffer(conn->smb1.trans_enc,
1941                                                (char *)inbuf);
1942                 if (!NT_STATUS_IS_OK(status)) {
1943                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
1944                                    nt_errstr(status)));
1945                         return status;
1946                 }
1947                 inhdr = inbuf + NBT_HDR_SIZE;
1948                 len = smb_len_nbt(inbuf);
1949         }
1950
1951         mid = SVAL(inhdr, HDR_MID);
1952         num_pending = talloc_array_length(conn->pending);
1953
1954         for (i=0; i<num_pending; i++) {
1955                 if (mid == smb1cli_req_mid(conn->pending[i])) {
1956                         break;
1957                 }
1958         }
1959         if (i == num_pending) {
1960                 /* Dump unexpected reply */
1961                 return NT_STATUS_RETRY;
1962         }
1963
1964         oplock_break = false;
1965
1966         if (mid == 0xffff) {
1967                 /*
1968                  * Paranoia checks that this is really an oplock break request.
1969                  */
1970                 oplock_break = (len == 51); /* hdr + 8 words */
1971                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
1972                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
1973                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
1974                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
1975
1976                 if (!oplock_break) {
1977                         /* Dump unexpected reply */
1978                         return NT_STATUS_RETRY;
1979                 }
1980         }
1981
1982         req = conn->pending[i];
1983         state = tevent_req_data(req, struct smbXcli_req_state);
1984
1985         if (!oplock_break /* oplock breaks are not signed */
1986             && !smb_signing_check_pdu(conn->smb1.signing,
1987                                       inhdr, len, state->smb1.seqnum+1)) {
1988                 DEBUG(10, ("cli_check_sign_mac failed\n"));
1989                 return NT_STATUS_ACCESS_DENIED;
1990         }
1991
1992         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
1993                                            &iov, &num_iov);
1994         if (!NT_STATUS_IS_OK(status)) {
1995                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
1996                           nt_errstr(status)));
1997                 return status;
1998         }
1999
2000         cmd = CVAL(inhdr, HDR_COM);
2001         status = smb1cli_pull_raw_error(inhdr);
2002
2003         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2004             (state->session != NULL) && state->session->disconnect_expired)
2005         {
2006                 /*
2007                  * this should be a short term hack
2008                  * until the upper layers have implemented
2009                  * re-authentication.
2010                  */
2011                 return status;
2012         }
2013
2014         if (state->smb1.chained_requests == NULL) {
2015                 if (num_iov != 3) {
2016                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2017                 }
2018
2019                 smbXcli_req_unset_pending(req);
2020
2021                 if (state->smb1.recv_iov == NULL) {
2022                         /*
2023                          * For requests with more than
2024                          * one response, we have to readd the
2025                          * recv_iov array.
2026                          */
2027                         state->smb1.recv_iov = talloc_zero_array(state,
2028                                                                  struct iovec,
2029                                                                  3);
2030                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2031                                 return NT_STATUS_OK;
2032                         }
2033                 }
2034
2035                 state->smb1.recv_cmd = cmd;
2036                 state->smb1.recv_status = status;
2037                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2038
2039                 state->smb1.recv_iov[0] = iov[0];
2040                 state->smb1.recv_iov[1] = iov[1];
2041                 state->smb1.recv_iov[2] = iov[2];
2042
2043                 if (talloc_array_length(conn->pending) == 0) {
2044                         tevent_req_done(req);
2045                         return NT_STATUS_OK;
2046                 }
2047
2048                 tevent_req_defer_callback(req, state->ev);
2049                 tevent_req_done(req);
2050                 return NT_STATUS_RETRY;
2051         }
2052
2053         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2054         num_chained = talloc_array_length(chain);
2055         num_responses = (num_iov - 1)/2;
2056
2057         if (num_responses > num_chained) {
2058                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2059         }
2060
2061         for (i=0; i<num_chained; i++) {
2062                 size_t iov_idx = 1 + (i*2);
2063                 struct iovec *cur = &iov[iov_idx];
2064                 uint8_t *inbuf_ref;
2065
2066                 req = chain[i];
2067                 state = tevent_req_data(req, struct smbXcli_req_state);
2068
2069                 smbXcli_req_unset_pending(req);
2070
2071                 /*
2072                  * as we finish multiple requests here
2073                  * we need to defer the callbacks as
2074                  * they could destroy our current stack state.
2075                  */
2076                 tevent_req_defer_callback(req, state->ev);
2077
2078                 if (i >= num_responses) {
2079                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2080                         continue;
2081                 }
2082
2083                 if (state->smb1.recv_iov == NULL) {
2084                         /*
2085                          * For requests with more than
2086                          * one response, we have to readd the
2087                          * recv_iov array.
2088                          */
2089                         state->smb1.recv_iov = talloc_zero_array(state,
2090                                                                  struct iovec,
2091                                                                  3);
2092                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2093                                 continue;
2094                         }
2095                 }
2096
2097                 state->smb1.recv_cmd = cmd;
2098
2099                 if (i == (num_responses - 1)) {
2100                         /*
2101                          * The last request in the chain gets the status
2102                          */
2103                         state->smb1.recv_status = status;
2104                 } else {
2105                         cmd = CVAL(cur[0].iov_base, 0);
2106                         state->smb1.recv_status = NT_STATUS_OK;
2107                 }
2108
2109                 state->inbuf = inbuf;
2110
2111                 /*
2112                  * Note: here we use talloc_reference() in a way
2113                  *       that does not expose it to the caller.
2114                  */
2115                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2116                 if (tevent_req_nomem(inbuf_ref, req)) {
2117                         continue;
2118                 }
2119
2120                 /* copy the related buffers */
2121                 state->smb1.recv_iov[0] = iov[0];
2122                 state->smb1.recv_iov[1] = cur[0];
2123                 state->smb1.recv_iov[2] = cur[1];
2124
2125                 tevent_req_done(req);
2126         }
2127
2128         return NT_STATUS_RETRY;
2129 }
2130
2131 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2132                           TALLOC_CTX *mem_ctx,
2133                           struct iovec **piov,
2134                           uint8_t **phdr,
2135                           uint8_t *pwct,
2136                           uint16_t **pvwv,
2137                           uint32_t *pvwv_offset,
2138                           uint32_t *pnum_bytes,
2139                           uint8_t **pbytes,
2140                           uint32_t *pbytes_offset,
2141                           uint8_t **pinbuf,
2142                           const struct smb1cli_req_expected_response *expected,
2143                           size_t num_expected)
2144 {
2145         struct smbXcli_req_state *state =
2146                 tevent_req_data(req,
2147                 struct smbXcli_req_state);
2148         NTSTATUS status = NT_STATUS_OK;
2149         struct iovec *recv_iov = NULL;
2150         uint8_t *hdr = NULL;
2151         uint8_t wct = 0;
2152         uint32_t vwv_offset = 0;
2153         uint16_t *vwv = NULL;
2154         uint32_t num_bytes = 0;
2155         uint32_t bytes_offset = 0;
2156         uint8_t *bytes = NULL;
2157         size_t i;
2158         bool found_status = false;
2159         bool found_size = false;
2160
2161         if (piov != NULL) {
2162                 *piov = NULL;
2163         }
2164         if (phdr != NULL) {
2165                 *phdr = 0;
2166         }
2167         if (pwct != NULL) {
2168                 *pwct = 0;
2169         }
2170         if (pvwv != NULL) {
2171                 *pvwv = NULL;
2172         }
2173         if (pvwv_offset != NULL) {
2174                 *pvwv_offset = 0;
2175         }
2176         if (pnum_bytes != NULL) {
2177                 *pnum_bytes = 0;
2178         }
2179         if (pbytes != NULL) {
2180                 *pbytes = NULL;
2181         }
2182         if (pbytes_offset != NULL) {
2183                 *pbytes_offset = 0;
2184         }
2185         if (pinbuf != NULL) {
2186                 *pinbuf = NULL;
2187         }
2188
2189         if (state->inbuf != NULL) {
2190                 recv_iov = state->smb1.recv_iov;
2191                 state->smb1.recv_iov = NULL;
2192                 if (state->smb1.recv_cmd != SMBreadBraw) {
2193                         hdr = (uint8_t *)recv_iov[0].iov_base;
2194                         wct = recv_iov[1].iov_len/2;
2195                         vwv = (uint16_t *)recv_iov[1].iov_base;
2196                         vwv_offset = PTR_DIFF(vwv, hdr);
2197                         num_bytes = recv_iov[2].iov_len;
2198                         bytes = (uint8_t *)recv_iov[2].iov_base;
2199                         bytes_offset = PTR_DIFF(bytes, hdr);
2200                 }
2201         }
2202
2203         if (tevent_req_is_nterror(req, &status)) {
2204                 for (i=0; i < num_expected; i++) {
2205                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2206                                 found_status = true;
2207                                 break;
2208                         }
2209                 }
2210
2211                 if (found_status) {
2212                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2213                 }
2214
2215                 return status;
2216         }
2217
2218         if (num_expected == 0) {
2219                 found_status = true;
2220                 found_size = true;
2221         }
2222
2223         status = state->smb1.recv_status;
2224
2225         for (i=0; i < num_expected; i++) {
2226                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2227                         continue;
2228                 }
2229
2230                 found_status = true;
2231                 if (expected[i].wct == 0) {
2232                         found_size = true;
2233                         break;
2234                 }
2235
2236                 if (expected[i].wct == wct) {
2237                         found_size = true;
2238                         break;
2239                 }
2240         }
2241
2242         if (!found_status) {
2243                 return status;
2244         }
2245
2246         if (!found_size) {
2247                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2248         }
2249
2250         if (piov != NULL) {
2251                 *piov = talloc_move(mem_ctx, &recv_iov);
2252         }
2253
2254         if (phdr != NULL) {
2255                 *phdr = hdr;
2256         }
2257         if (pwct != NULL) {
2258                 *pwct = wct;
2259         }
2260         if (pvwv != NULL) {
2261                 *pvwv = vwv;
2262         }
2263         if (pvwv_offset != NULL) {
2264                 *pvwv_offset = vwv_offset;
2265         }
2266         if (pnum_bytes != NULL) {
2267                 *pnum_bytes = num_bytes;
2268         }
2269         if (pbytes != NULL) {
2270                 *pbytes = bytes;
2271         }
2272         if (pbytes_offset != NULL) {
2273                 *pbytes_offset = bytes_offset;
2274         }
2275         if (pinbuf != NULL) {
2276                 *pinbuf = state->inbuf;
2277         }
2278
2279         return status;
2280 }
2281
2282 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2283 {
2284         size_t wct_ofs;
2285         int i;
2286
2287         wct_ofs = HDR_WCT;
2288
2289         for (i=0; i<num_reqs; i++) {
2290                 struct smbXcli_req_state *state;
2291                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2292                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2293                                            state->smb1.iov_count-2);
2294                 wct_ofs = (wct_ofs + 3) & ~3;
2295         }
2296         return wct_ofs;
2297 }
2298
2299 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2300 {
2301         struct smbXcli_req_state *first_state =
2302                 tevent_req_data(reqs[0],
2303                 struct smbXcli_req_state);
2304         struct smbXcli_req_state *state;
2305         size_t wct_offset;
2306         size_t chain_padding = 0;
2307         int i, iovlen;
2308         struct iovec *iov = NULL;
2309         struct iovec *this_iov;
2310         NTSTATUS status;
2311         size_t nbt_len;
2312
2313         if (num_reqs == 1) {
2314                 return smb1cli_req_writev_submit(reqs[0], first_state,
2315                                                  first_state->smb1.iov,
2316                                                  first_state->smb1.iov_count);
2317         }
2318
2319         iovlen = 0;
2320         for (i=0; i<num_reqs; i++) {
2321                 if (!tevent_req_is_in_progress(reqs[i])) {
2322                         return NT_STATUS_INTERNAL_ERROR;
2323                 }
2324
2325                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2326
2327                 if (state->smb1.iov_count < 4) {
2328                         return NT_STATUS_INVALID_PARAMETER_MIX;
2329                 }
2330
2331                 if (i == 0) {
2332                         /*
2333                          * The NBT and SMB header
2334                          */
2335                         iovlen += 2;
2336                 } else {
2337                         /*
2338                          * Chain padding
2339                          */
2340                         iovlen += 1;
2341                 }
2342
2343                 /*
2344                  * words and bytes
2345                  */
2346                 iovlen += state->smb1.iov_count - 2;
2347         }
2348
2349         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2350         if (iov == NULL) {
2351                 return NT_STATUS_NO_MEMORY;
2352         }
2353
2354         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2355                 first_state, reqs, sizeof(*reqs) * num_reqs);
2356         if (first_state->smb1.chained_requests == NULL) {
2357                 TALLOC_FREE(iov);
2358                 return NT_STATUS_NO_MEMORY;
2359         }
2360
2361         wct_offset = HDR_WCT;
2362         this_iov = iov;
2363
2364         for (i=0; i<num_reqs; i++) {
2365                 size_t next_padding = 0;
2366                 uint16_t *vwv;
2367
2368                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2369
2370                 if (i < num_reqs-1) {
2371                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2372                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2373                                 TALLOC_FREE(iov);
2374                                 TALLOC_FREE(first_state->smb1.chained_requests);
2375                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2376                         }
2377                 }
2378
2379                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2380                                               state->smb1.iov_count-2) + 1;
2381                 if ((wct_offset % 4) != 0) {
2382                         next_padding = 4 - (wct_offset % 4);
2383                 }
2384                 wct_offset += next_padding;
2385                 vwv = state->smb1.vwv;
2386
2387                 if (i < num_reqs-1) {
2388                         struct smbXcli_req_state *next_state =
2389                                 tevent_req_data(reqs[i+1],
2390                                 struct smbXcli_req_state);
2391                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2392                         SCVAL(vwv+0, 1, 0);
2393                         SSVAL(vwv+1, 0, wct_offset);
2394                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2395                         /* properly end the chain */
2396                         SCVAL(vwv+0, 0, 0xff);
2397                         SCVAL(vwv+0, 1, 0xff);
2398                         SSVAL(vwv+1, 0, 0);
2399                 }
2400
2401                 if (i == 0) {
2402                         /*
2403                          * The NBT and SMB header
2404                          */
2405                         this_iov[0] = state->smb1.iov[0];
2406                         this_iov[1] = state->smb1.iov[1];
2407                         this_iov += 2;
2408                 } else {
2409                         /*
2410                          * This one is a bit subtle. We have to add
2411                          * chain_padding bytes between the requests, and we
2412                          * have to also include the wct field of the
2413                          * subsequent requests. We use the subsequent header
2414                          * for the padding, it contains the wct field in its
2415                          * last byte.
2416                          */
2417                         this_iov[0].iov_len = chain_padding+1;
2418                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2419                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2420                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2421                         this_iov += 1;
2422                 }
2423
2424                 /*
2425                  * copy the words and bytes
2426                  */
2427                 memcpy(this_iov, state->smb1.iov+2,
2428                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2429                 this_iov += state->smb1.iov_count - 2;
2430                 chain_padding = next_padding;
2431         }
2432
2433         nbt_len = smbXcli_iov_len(&iov[1], iovlen-1);
2434         if (nbt_len > first_state->conn->smb1.max_xmit) {
2435                 TALLOC_FREE(iov);
2436                 TALLOC_FREE(first_state->smb1.chained_requests);
2437                 return NT_STATUS_INVALID_PARAMETER_MIX;
2438         }
2439
2440         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2441         if (!NT_STATUS_IS_OK(status)) {
2442                 TALLOC_FREE(iov);
2443                 TALLOC_FREE(first_state->smb1.chained_requests);
2444                 return status;
2445         }
2446
2447         return NT_STATUS_OK;
2448 }
2449
2450 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2451 {
2452         return ((tevent_queue_length(conn->outgoing) != 0)
2453                 || (talloc_array_length(conn->pending) != 0));
2454 }
2455
2456 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2457 {
2458         uint16_t credits = 1;
2459
2460         if (conn->smb2.cur_credits == 0) {
2461                 if (max_dyn_len != NULL) {
2462                         *max_dyn_len = 0;
2463                 }
2464                 return false;
2465         }
2466
2467         if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2468                 credits = conn->smb2.cur_credits;
2469         }
2470
2471         if (max_dyn_len != NULL) {
2472                 *max_dyn_len = credits * 65536;
2473         }
2474
2475         return true;
2476 }
2477
2478 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2479 {
2480         return conn->smb2.server.capabilities;
2481 }
2482
2483 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2484 {
2485         return conn->smb2.server.security_mode;
2486 }
2487
2488 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2489 {
2490         return conn->smb2.server.max_trans_size;
2491 }
2492
2493 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2494 {
2495         return conn->smb2.server.max_read_size;
2496 }
2497
2498 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2499 {
2500         return conn->smb2.server.max_write_size;
2501 }
2502
2503 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2504                                   uint16_t max_credits)
2505 {
2506         conn->smb2.max_credits = max_credits;
2507 }
2508
2509 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2510
2511 static bool smb2cli_req_cancel(struct tevent_req *req)
2512 {
2513         struct smbXcli_req_state *state =
2514                 tevent_req_data(req,
2515                 struct smbXcli_req_state);
2516         uint32_t flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
2517         uint64_t mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
2518         uint64_t aid = BVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID);
2519         struct smbXcli_tcon *tcon = state->tcon;
2520         struct smbXcli_session *session = state->session;
2521         uint8_t *fixed = state->smb2.pad;
2522         uint16_t fixed_len = 4;
2523         struct tevent_req *subreq;
2524         struct smbXcli_req_state *substate;
2525         NTSTATUS status;
2526
2527         SSVAL(fixed, 0, 0x04);
2528         SSVAL(fixed, 2, 0);
2529
2530         subreq = smb2cli_req_create(state, state->ev,
2531                                     state->conn,
2532                                     SMB2_OP_CANCEL,
2533                                     flags, 0,
2534                                     0, /* timeout */
2535                                     tcon, session,
2536                                     fixed, fixed_len,
2537                                     NULL, 0, 0);
2538         if (subreq == NULL) {
2539                 return false;
2540         }
2541         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2542
2543         /*
2544          * clear everything but the SMB2_HDR_FLAG_ASYNC flag
2545          * e.g. if SMB2_HDR_FLAG_CHAINED is set we get INVALID_PARAMETER back
2546          */
2547         flags &= SMB2_HDR_FLAG_ASYNC;
2548
2549         if (flags & SMB2_HDR_FLAG_ASYNC) {
2550                 mid = 0;
2551         }
2552
2553         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, flags);
2554         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2555         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, aid);
2556
2557         status = smb2cli_req_compound_submit(&subreq, 1);
2558         if (!NT_STATUS_IS_OK(status)) {
2559                 TALLOC_FREE(subreq);
2560                 return false;
2561         }
2562
2563         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2564
2565         return true;
2566 }
2567
2568 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2569 {
2570         /* we do not care about the result */
2571         TALLOC_FREE(subreq);
2572 }
2573
2574 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2575                                       struct tevent_context *ev,
2576                                       struct smbXcli_conn *conn,
2577                                       uint16_t cmd,
2578                                       uint32_t additional_flags,
2579                                       uint32_t clear_flags,
2580                                       uint32_t timeout_msec,
2581                                       struct smbXcli_tcon *tcon,
2582                                       struct smbXcli_session *session,
2583                                       const uint8_t *fixed,
2584                                       uint16_t fixed_len,
2585                                       const uint8_t *dyn,
2586                                       uint32_t dyn_len,
2587                                       uint32_t max_dyn_len)
2588 {
2589         struct tevent_req *req;
2590         struct smbXcli_req_state *state;
2591         uint32_t flags = 0;
2592         uint32_t tid = 0;
2593         uint64_t uid = 0;
2594         bool use_channel_sequence = false;
2595         uint16_t channel_sequence = 0;
2596
2597         req = tevent_req_create(mem_ctx, &state,
2598                                 struct smbXcli_req_state);
2599         if (req == NULL) {
2600                 return NULL;
2601         }
2602
2603         state->ev = ev;
2604         state->conn = conn;
2605         state->session = session;
2606         state->tcon = tcon;
2607
2608         if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
2609                 use_channel_sequence = true;
2610         } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
2611                 use_channel_sequence = true;
2612         }
2613
2614         if (session) {
2615                 uid = session->smb2->session_id;
2616
2617                 if (use_channel_sequence) {
2618                         channel_sequence = session->smb2->channel_sequence;
2619                 }
2620
2621                 state->smb2.should_sign = session->smb2->should_sign;
2622                 state->smb2.should_encrypt = session->smb2->should_encrypt;
2623
2624                 if (cmd == SMB2_OP_SESSSETUP &&
2625                     session->smb2->signing_key.length != 0) {
2626                         state->smb2.should_sign = true;
2627                 }
2628
2629                 if (cmd == SMB2_OP_SESSSETUP &&
2630                     session->smb2_channel.signing_key.length == 0) {
2631                         state->smb2.should_encrypt = false;
2632                 }
2633         }
2634
2635         if (tcon) {
2636                 tid = tcon->smb2.tcon_id;
2637
2638                 if (tcon->smb2.should_encrypt) {
2639                         state->smb2.should_encrypt = true;
2640                 }
2641         }
2642
2643         if (state->smb2.should_encrypt) {
2644                 state->smb2.should_sign = false;
2645         }
2646
2647         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
2648         if (state->smb2.recv_iov == NULL) {
2649                 TALLOC_FREE(req);
2650                 return NULL;
2651         }
2652
2653         flags |= additional_flags;
2654         flags &= ~clear_flags;
2655
2656         state->smb2.fixed = fixed;
2657         state->smb2.fixed_len = fixed_len;
2658         state->smb2.dyn = dyn;
2659         state->smb2.dyn_len = dyn_len;
2660         state->smb2.max_dyn_len = max_dyn_len;
2661
2662         if (state->smb2.should_encrypt) {
2663                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2664                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
2665         }
2666
2667         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
2668         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
2669         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
2670         SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
2671         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
2672         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            0); /* reserved */
2673         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
2674         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
2675
2676         switch (cmd) {
2677         case SMB2_OP_CANCEL:
2678                 state->one_way = true;
2679                 break;
2680         case SMB2_OP_BREAK:
2681                 /*
2682                  * If this is a dummy request, it will have
2683                  * UINT64_MAX as message id.
2684                  * If we send on break acknowledgement,
2685                  * this gets overwritten later.
2686                  */
2687                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2688                 break;
2689         }
2690
2691         if (timeout_msec > 0) {
2692                 struct timeval endtime;
2693
2694                 endtime = timeval_current_ofs_msec(timeout_msec);
2695                 if (!tevent_req_set_endtime(req, ev, endtime)) {
2696                         return req;
2697                 }
2698         }
2699
2700         return req;
2701 }
2702
2703 void smb2cli_req_set_notify_async(struct tevent_req *req)
2704 {
2705         struct smbXcli_req_state *state =
2706                 tevent_req_data(req,
2707                 struct smbXcli_req_state);
2708
2709         state->smb2.notify_async = true;
2710 }
2711
2712 static void smb2cli_req_writev_done(struct tevent_req *subreq);
2713 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2714                                                TALLOC_CTX *tmp_mem,
2715                                                uint8_t *inbuf);
2716
2717 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
2718                                      int num_reqs)
2719 {
2720         struct smbXcli_req_state *state;
2721         struct tevent_req *subreq;
2722         struct iovec *iov;
2723         int i, num_iov, nbt_len;
2724         int tf_iov = -1;
2725         const DATA_BLOB *encryption_key = NULL;
2726         uint64_t encryption_session_id = 0;
2727
2728         /*
2729          * 1 for the nbt length, optional TRANSFORM
2730          * per request: HDR, fixed, dyn, padding
2731          * -1 because the last one does not need padding
2732          */
2733
2734         iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
2735         if (iov == NULL) {
2736                 return NT_STATUS_NO_MEMORY;
2737         }
2738
2739         num_iov = 1;
2740         nbt_len = 0;
2741
2742         /*
2743          * the session of the first request that requires encryption
2744          * specifies the encryption key.
2745          */
2746         for (i=0; i<num_reqs; i++) {
2747                 if (!tevent_req_is_in_progress(reqs[i])) {
2748                         return NT_STATUS_INTERNAL_ERROR;
2749                 }
2750
2751                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2752
2753                 if (!smbXcli_conn_is_connected(state->conn)) {
2754                         return NT_STATUS_CONNECTION_DISCONNECTED;
2755                 }
2756
2757                 if ((state->conn->protocol != PROTOCOL_NONE) &&
2758                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
2759                         return NT_STATUS_REVISION_MISMATCH;
2760                 }
2761
2762                 if (state->session == NULL) {
2763                         continue;
2764                 }
2765
2766                 if (!state->smb2.should_encrypt) {
2767                         continue;
2768                 }
2769
2770                 encryption_key = &state->session->smb2->encryption_key;
2771                 if (encryption_key->length == 0) {
2772                         return NT_STATUS_INVALID_PARAMETER_MIX;
2773                 }
2774
2775                 encryption_session_id = state->session->smb2->session_id;
2776
2777                 tf_iov = num_iov;
2778                 iov[num_iov].iov_base = state->smb2.transform;
2779                 iov[num_iov].iov_len  = sizeof(state->smb2.transform);
2780                 num_iov += 1;
2781
2782                 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2783                 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
2784                       state->session->smb2->nonce_low);
2785                 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
2786                       state->session->smb2->nonce_high);
2787                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
2788                       encryption_session_id);
2789
2790                 state->session->smb2->nonce_low += 1;
2791                 if (state->session->smb2->nonce_low == 0) {
2792                         state->session->smb2->nonce_high += 1;
2793                         state->session->smb2->nonce_low += 1;
2794                 }
2795
2796                 nbt_len += SMB2_TF_HDR_SIZE;
2797                 break;
2798         }
2799
2800         for (i=0; i<num_reqs; i++) {
2801                 int hdr_iov;
2802                 size_t reqlen;
2803                 bool ret;
2804                 uint16_t opcode;
2805                 uint64_t avail;
2806                 uint16_t charge;
2807                 uint16_t credits;
2808                 uint64_t mid;
2809                 const DATA_BLOB *signing_key = NULL;
2810
2811                 if (!tevent_req_is_in_progress(reqs[i])) {
2812                         return NT_STATUS_INTERNAL_ERROR;
2813                 }
2814
2815                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2816
2817                 if (!smbXcli_conn_is_connected(state->conn)) {
2818                         return NT_STATUS_CONNECTION_DISCONNECTED;
2819                 }
2820
2821                 if ((state->conn->protocol != PROTOCOL_NONE) &&
2822                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
2823                         return NT_STATUS_REVISION_MISMATCH;
2824                 }
2825
2826                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
2827                 if (opcode == SMB2_OP_CANCEL) {
2828                         goto skip_credits;
2829                 }
2830
2831                 avail = UINT64_MAX - state->conn->smb2.mid;
2832                 if (avail < 1) {
2833                         return NT_STATUS_CONNECTION_ABORTED;
2834                 }
2835
2836                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2837                         uint32_t max_dyn_len = 1;
2838
2839                         max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
2840                         max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
2841
2842                         charge = (max_dyn_len - 1)/ 65536 + 1;
2843                 } else {
2844                         charge = 1;
2845                 }
2846
2847                 charge = MAX(state->smb2.credit_charge, charge);
2848
2849                 avail = MIN(avail, state->conn->smb2.cur_credits);
2850                 if (avail < charge) {
2851                         return NT_STATUS_INTERNAL_ERROR;
2852                 }
2853
2854                 credits = 0;
2855                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
2856                         credits = state->conn->smb2.max_credits -
2857                                   state->conn->smb2.cur_credits;
2858                 }
2859                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
2860                         credits += 1;
2861                 }
2862
2863                 mid = state->conn->smb2.mid;
2864                 state->conn->smb2.mid += charge;
2865                 state->conn->smb2.cur_credits -= charge;
2866
2867                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2868                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
2869                 }
2870                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
2871                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2872
2873 skip_credits:
2874                 if (state->session && encryption_key == NULL) {
2875                         /*
2876                          * We prefer the channel signing key if it is
2877                          * already there.
2878                          */
2879                         if (state->smb2.should_sign) {
2880                                 signing_key = &state->session->smb2_channel.signing_key;
2881                         }
2882
2883                         /*
2884                          * If it is a channel binding, we already have the main
2885                          * signing key and try that one.
2886                          */
2887                         if (signing_key && signing_key->length == 0) {
2888                                 signing_key = &state->session->smb2->signing_key;
2889                         }
2890
2891                         /*
2892                          * If we do not have any session key yet, we skip the
2893                          * signing of SMB2_OP_SESSSETUP requests.
2894                          */
2895                         if (signing_key && signing_key->length == 0) {
2896                                 signing_key = NULL;
2897                         }
2898                 }
2899
2900                 hdr_iov = num_iov;
2901                 iov[num_iov].iov_base = state->smb2.hdr;
2902                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
2903                 num_iov += 1;
2904
2905                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
2906                 iov[num_iov].iov_len  = state->smb2.fixed_len;
2907                 num_iov += 1;
2908
2909                 if (state->smb2.dyn != NULL) {
2910                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
2911                         iov[num_iov].iov_len  = state->smb2.dyn_len;
2912                         num_iov += 1;
2913                 }
2914
2915                 reqlen  = sizeof(state->smb2.hdr);
2916                 reqlen += state->smb2.fixed_len;
2917                 reqlen += state->smb2.dyn_len;
2918
2919                 if (i < num_reqs-1) {
2920                         if ((reqlen % 8) > 0) {
2921                                 uint8_t pad = 8 - (reqlen % 8);
2922                                 iov[num_iov].iov_base = state->smb2.pad;
2923                                 iov[num_iov].iov_len = pad;
2924                                 num_iov += 1;
2925                                 reqlen += pad;
2926                         }
2927                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
2928                 }
2929
2930                 state->smb2.encryption_session_id = encryption_session_id;
2931
2932                 if (signing_key != NULL) {
2933                         NTSTATUS status;
2934
2935                         status = smb2_signing_sign_pdu(*signing_key,
2936                                                        state->session->conn->protocol,
2937                                                        &iov[hdr_iov], num_iov - hdr_iov);
2938                         if (!NT_STATUS_IS_OK(status)) {
2939                                 return status;
2940                         }
2941                 }
2942
2943                 nbt_len += reqlen;
2944
2945                 ret = smbXcli_req_set_pending(reqs[i]);
2946                 if (!ret) {
2947                         return NT_STATUS_NO_MEMORY;
2948                 }
2949         }
2950
2951         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
2952         _smb_setlen_tcp(state->length_hdr, nbt_len);
2953         iov[0].iov_base = state->length_hdr;
2954         iov[0].iov_len  = sizeof(state->length_hdr);
2955
2956         if (encryption_key != NULL) {
2957                 NTSTATUS status;
2958                 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
2959                 uint8_t *buf;
2960                 int vi;
2961
2962                 buf = talloc_array(iov, uint8_t, buflen);
2963                 if (buf == NULL) {
2964                         return NT_STATUS_NO_MEMORY;
2965                 }
2966
2967                 /*
2968                  * We copy the buffers before encrypting them,
2969                  * this is at least currently needed for the
2970                  * to keep state->smb2.hdr.
2971                  *
2972                  * Also the callers may expect there buffers
2973                  * to be const.
2974                  */
2975                 for (vi = tf_iov + 1; vi < num_iov; vi++) {
2976                         struct iovec *v = &iov[vi];
2977                         const uint8_t *o = (const uint8_t *)v->iov_base;
2978
2979                         memcpy(buf, o, v->iov_len);
2980                         v->iov_base = (void *)buf;
2981                         buf += v->iov_len;
2982                 }
2983
2984                 status = smb2_signing_encrypt_pdu(*encryption_key,
2985                                         state->conn->protocol,
2986                                         &iov[tf_iov], num_iov - tf_iov);
2987                 if (!NT_STATUS_IS_OK(status)) {
2988                         return status;
2989                 }
2990         }
2991
2992         if (state->conn->dispatch_incoming == NULL) {
2993                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
2994         }
2995
2996         subreq = writev_send(state, state->ev, state->conn->outgoing,
2997                              state->conn->write_fd, false, iov, num_iov);
2998         if (subreq == NULL) {
2999                 return NT_STATUS_NO_MEMORY;
3000         }
3001         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3002         return NT_STATUS_OK;
3003 }
3004
3005 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3006 {
3007         struct smbXcli_req_state *state =
3008                 tevent_req_data(req,
3009                 struct smbXcli_req_state);
3010
3011         state->smb2.credit_charge = charge;
3012 }
3013
3014 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3015                                     struct tevent_context *ev,
3016                                     struct smbXcli_conn *conn,
3017                                     uint16_t cmd,
3018                                     uint32_t additional_flags,
3019                                     uint32_t clear_flags,
3020                                     uint32_t timeout_msec,
3021                                     struct smbXcli_tcon *tcon,
3022                                     struct smbXcli_session *session,
3023                                     const uint8_t *fixed,
3024                                     uint16_t fixed_len,
3025                                     const uint8_t *dyn,
3026                                     uint32_t dyn_len,
3027                                     uint32_t max_dyn_len)
3028 {
3029         struct tevent_req *req;
3030         NTSTATUS status;
3031
3032         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3033                                  additional_flags, clear_flags,
3034                                  timeout_msec,
3035                                  tcon, session,
3036                                  fixed, fixed_len,
3037                                  dyn, dyn_len,
3038                                  max_dyn_len);
3039         if (req == NULL) {
3040                 return NULL;
3041         }
3042         if (!tevent_req_is_in_progress(req)) {
3043                 return tevent_req_post(req, ev);
3044         }
3045         status = smb2cli_req_compound_submit(&req, 1);
3046         if (tevent_req_nterror(req, status)) {
3047                 return tevent_req_post(req, ev);
3048         }
3049         return req;
3050 }
3051
3052 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3053 {
3054         struct tevent_req *req =
3055                 tevent_req_callback_data(subreq,
3056                 struct tevent_req);
3057         struct smbXcli_req_state *state =
3058                 tevent_req_data(req,
3059                 struct smbXcli_req_state);
3060         ssize_t nwritten;
3061         int err;
3062
3063         nwritten = writev_recv(subreq, &err);
3064         TALLOC_FREE(subreq);
3065         if (nwritten == -1) {
3066                 /* here, we need to notify all pending requests */
3067                 NTSTATUS status = map_nt_error_from_unix_common(err);
3068                 smbXcli_conn_disconnect(state->conn, status);
3069                 return;
3070         }
3071 }
3072
3073 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3074                                              uint8_t *buf,
3075                                              size_t buflen,
3076                                              TALLOC_CTX *mem_ctx,
3077                                              struct iovec **piov, int *pnum_iov)
3078 {
3079         struct iovec *iov;
3080         int num_iov = 0;
3081         size_t taken = 0;
3082         uint8_t *first_hdr = buf;
3083         size_t verified_buflen = 0;
3084         uint8_t *tf = NULL;
3085         size_t tf_len = 0;
3086
3087         iov = talloc_array(mem_ctx, struct iovec, num_iov);
3088         if (iov == NULL) {
3089                 return NT_STATUS_NO_MEMORY;
3090         }
3091
3092         while (taken < buflen) {
3093                 size_t len = buflen - taken;
3094                 uint8_t *hdr = first_hdr + taken;
3095                 struct iovec *cur;
3096                 size_t full_size;
3097                 size_t next_command_ofs;
3098                 uint16_t body_size;
3099                 struct iovec *iov_tmp;
3100
3101                 if (verified_buflen > taken) {
3102                         len = verified_buflen - taken;
3103                 } else {
3104                         tf = NULL;
3105                         tf_len = 0;
3106                 }
3107
3108                 if (len < 4) {
3109                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3110                                    (int)len, 4));
3111                         goto inval;
3112                 }
3113                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3114                         struct smbXcli_session *s;
3115                         uint64_t uid;
3116                         struct iovec tf_iov[2];
3117                         size_t enc_len;
3118                         NTSTATUS status;
3119
3120                         if (len < SMB2_TF_HDR_SIZE) {
3121                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3122                                            (int)len, SMB2_TF_HDR_SIZE));
3123                                 goto inval;
3124                         }
3125                         tf = hdr;
3126                         tf_len = SMB2_TF_HDR_SIZE;
3127                         taken += tf_len;
3128
3129                         hdr = first_hdr + taken;
3130                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3131                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
3132
3133                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
3134                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3135                                            (int)len,
3136                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
3137                                 goto inval;
3138                         }
3139
3140                         s = conn->sessions;
3141                         for (; s; s = s->next) {
3142                                 if (s->smb2->session_id != uid) {
3143                                         continue;
3144                                 }
3145                                 break;
3146                         }
3147
3148                         if (s == NULL) {
3149                                 DEBUG(10, ("unknown session_id %llu\n",
3150                                            (unsigned long long)uid));
3151                                 goto inval;
3152                         }
3153
3154                         tf_iov[0].iov_base = (void *)tf;
3155                         tf_iov[0].iov_len = tf_len;
3156                         tf_iov[1].iov_base = (void *)hdr;
3157                         tf_iov[1].iov_len = enc_len;
3158
3159                         status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3160                                                           conn->protocol,
3161                                                           tf_iov, 2);
3162                         if (!NT_STATUS_IS_OK(status)) {
3163                                 TALLOC_FREE(iov);
3164                                 return status;
3165                         }
3166
3167                         verified_buflen = taken + enc_len;
3168                         len = enc_len;
3169                 }
3170
3171                 /*
3172                  * We need the header plus the body length field
3173                  */
3174
3175                 if (len < SMB2_HDR_BODY + 2) {
3176                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3177                                    (int)len, SMB2_HDR_BODY));
3178                         goto inval;
3179                 }
3180                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3181                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3182                                    IVAL(hdr, 0)));
3183                         goto inval;
3184                 }
3185                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3186                         DEBUG(10, ("Got HDR len %d, expected %d\n",
3187                                    SVAL(hdr, 4), SMB2_HDR_BODY));
3188                         goto inval;
3189                 }
3190
3191                 full_size = len;
3192                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3193                 body_size = SVAL(hdr, SMB2_HDR_BODY);
3194
3195                 if (next_command_ofs != 0) {
3196                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3197                                 goto inval;
3198                         }
3199                         if (next_command_ofs > full_size) {
3200                                 goto inval;
3201                         }
3202                         full_size = next_command_ofs;
3203                 }
3204                 if (body_size < 2) {
3205                         goto inval;
3206                 }
3207                 body_size &= 0xfffe;
3208
3209                 if (body_size > (full_size - SMB2_HDR_BODY)) {
3210                         goto inval;
3211                 }
3212
3213                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3214                                          num_iov + 4);
3215                 if (iov_tmp == NULL) {
3216                         TALLOC_FREE(iov);
3217                         return NT_STATUS_NO_MEMORY;
3218                 }
3219                 iov = iov_tmp;
3220                 cur = &iov[num_iov];
3221                 num_iov += 4;
3222
3223                 cur[0].iov_base = tf;
3224                 cur[0].iov_len  = tf_len;
3225                 cur[1].iov_base = hdr;
3226                 cur[1].iov_len  = SMB2_HDR_BODY;
3227                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3228                 cur[2].iov_len  = body_size;
3229                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3230                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
3231
3232                 taken += full_size;
3233         }
3234
3235         *piov = iov;
3236         *pnum_iov = num_iov;
3237         return NT_STATUS_OK;
3238
3239 inval:
3240         TALLOC_FREE(iov);
3241         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3242 }
3243
3244 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3245                                                     uint64_t mid)
3246 {
3247         size_t num_pending = talloc_array_length(conn->pending);
3248         size_t i;
3249
3250         for (i=0; i<num_pending; i++) {
3251                 struct tevent_req *req = conn->pending[i];
3252                 struct smbXcli_req_state *state =
3253                         tevent_req_data(req,
3254                         struct smbXcli_req_state);
3255
3256                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3257                         return req;
3258                 }
3259         }
3260         return NULL;
3261 }
3262
3263 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3264                                                TALLOC_CTX *tmp_mem,
3265                                                uint8_t *inbuf)
3266 {
3267         struct tevent_req *req;
3268         struct smbXcli_req_state *state = NULL;
3269         struct iovec *iov;
3270         int i, num_iov;
3271         NTSTATUS status;
3272         bool defer = true;
3273         struct smbXcli_session *last_session = NULL;
3274         size_t inbuf_len = smb_len_tcp(inbuf);
3275
3276         status = smb2cli_inbuf_parse_compound(conn,
3277                                               inbuf + NBT_HDR_SIZE,
3278                                               inbuf_len,
3279                                               tmp_mem,
3280                                               &iov, &num_iov);
3281         if (!NT_STATUS_IS_OK(status)) {
3282                 return status;
3283         }
3284
3285         for (i=0; i<num_iov; i+=4) {
3286                 uint8_t *inbuf_ref = NULL;
3287                 struct iovec *cur = &iov[i];
3288                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3289                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3290                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3291                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3292                 uint16_t req_opcode;
3293                 uint32_t req_flags;
3294                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3295                 uint32_t new_credits;
3296                 struct smbXcli_session *session = NULL;
3297                 const DATA_BLOB *signing_key = NULL;
3298                 bool was_encrypted = false;
3299
3300                 new_credits = conn->smb2.cur_credits;
3301                 new_credits += credits;
3302                 if (new_credits > UINT16_MAX) {
3303                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3304                 }
3305                 conn->smb2.cur_credits += credits;
3306
3307                 req = smb2cli_conn_find_pending(conn, mid);
3308                 if (req == NULL) {
3309                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3310                 }
3311                 state = tevent_req_data(req, struct smbXcli_req_state);
3312
3313                 state->smb2.got_async = false;
3314
3315                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3316                 if (opcode != req_opcode) {
3317                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3318                 }
3319                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3320
3321                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3322                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3323                 }
3324
3325                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3326                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3327                     NT_STATUS_EQUAL(status, STATUS_PENDING)) {
3328                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3329
3330                         /*
3331                          * async interim responses are not signed,
3332                          * even if the SMB2_HDR_FLAG_SIGNED flag
3333                          * is set.
3334                          */
3335                         req_flags |= SMB2_HDR_FLAG_ASYNC;
3336                         SBVAL(state->smb2.hdr, SMB2_HDR_FLAGS, req_flags);
3337                         SBVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID, async_id);
3338
3339                         if (state->smb2.notify_async) {
3340                                 state->smb2.got_async = true;
3341                                 tevent_req_defer_callback(req, state->ev);
3342                                 tevent_req_notify_callback(req);
3343                         }
3344                         continue;
3345                 }
3346
3347                 session = state->session;
3348                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3349                         session = last_session;
3350                 }
3351                 last_session = session;
3352
3353                 if (state->smb2.should_sign) {
3354                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3355                                 return NT_STATUS_ACCESS_DENIED;
3356                         }
3357                 }
3358
3359                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3360                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3361
3362                         if (session == NULL) {
3363                                 struct smbXcli_session *s;
3364
3365                                 s = state->conn->sessions;
3366                                 for (; s; s = s->next) {
3367                                         if (s->smb2->session_id != uid) {
3368                                                 continue;
3369                                         }
3370
3371                                         session = s;
3372                                         break;
3373                                 }
3374                         }
3375
3376                         if (session == NULL) {
3377                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3378                         }
3379
3380                         last_session = session;
3381                         signing_key = &session->smb2_channel.signing_key;
3382                 }
3383
3384                 if (opcode == SMB2_OP_SESSSETUP) {
3385                         /*
3386                          * We prefer the channel signing key, if it is
3387                          * already there.
3388                          *
3389                          * If we do not have a channel signing key yet,
3390                          * we try the main signing key, if it is not
3391                          * the final response.
3392                          */
3393                         if (signing_key && signing_key->length == 0 &&
3394                             !NT_STATUS_IS_OK(status)) {
3395                                 signing_key = &session->smb2->signing_key;
3396                         }
3397
3398                         if (signing_key && signing_key->length == 0) {
3399                                 /*
3400                                  * If we do not have a session key to
3401                                  * verify the signature, we defer the
3402                                  * signing check to the caller.
3403                                  *
3404                                  * The caller gets NT_STATUS_OK, it
3405                                  * has to call
3406                                  * smb2cli_session_set_session_key()
3407                                  * or
3408                                  * smb2cli_session_set_channel_key()
3409                                  * which will check the signature
3410                                  * with the channel signing key.
3411                                  */
3412                                 signing_key = NULL;
3413                         }
3414                 }
3415
3416                 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3417                         const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3418                         uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3419
3420                         /*
3421                          * If the response was encrypted in a SMB2_TRANSFORM
3422                          * pdu, which belongs to the correct session,
3423                          * we do not need to do signing checks
3424                          *
3425                          * It could be the session the response belongs to
3426                          * or the session that was used to encrypt the
3427                          * SMB2_TRANSFORM request.
3428                          */
3429                         if ((session && session->smb2->session_id == uid) ||
3430                             (state->smb2.encryption_session_id == uid)) {
3431                                 signing_key = NULL;
3432                                 was_encrypted = true;
3433                         }
3434                 }
3435
3436                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3437                         /*
3438                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3439                          * the response is not signed and we should
3440                          * propagate the NT_STATUS_USER_SESSION_DELETED
3441                          * status to the caller.
3442                          */
3443                         state->smb2.signing_skipped = true;
3444                         signing_key = NULL;
3445                 }
3446
3447                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3448                         /*
3449                          * if the server returns
3450                          * NT_STATUS_INVALID_PARAMETER
3451                          * the response might not be encrypted.
3452                          */
3453                         if (state->smb2.should_encrypt && !was_encrypted) {
3454                                 state->smb2.signing_skipped = true;
3455                                 signing_key = NULL;
3456                         }
3457                 }
3458
3459                 if (state->smb2.should_encrypt && !was_encrypted) {
3460                         if (!state->smb2.signing_skipped) {
3461                                 return NT_STATUS_ACCESS_DENIED;
3462                         }
3463                 }
3464
3465                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3466                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3467                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3468                         /*
3469                          * if the server returns
3470                          * NT_STATUS_NETWORK_NAME_DELETED
3471                          * NT_STATUS_FILE_CLOSED
3472                          * NT_STATUS_INVALID_PARAMETER
3473                          * the response might not be signed
3474                          * as this happens before the signing checks.
3475                          *
3476                          * If server echos the signature (or all zeros)
3477                          * we should report the status from the server
3478                          * to the caller.
3479                          */
3480                         if (signing_key) {
3481                                 int cmp;
3482
3483                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3484                                              state->smb2.hdr+SMB2_HDR_SIGNATURE,
3485                                              16);
3486                                 if (cmp == 0) {
3487                                         state->smb2.signing_skipped = true;
3488                                         signing_key = NULL;
3489                                 }
3490                         }
3491                         if (signing_key) {
3492                                 int cmp;
3493                                 static const uint8_t zeros[16];
3494
3495                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3496                                              zeros,
3497                                              16);
3498                                 if (cmp == 0) {
3499                                         state->smb2.signing_skipped = true;
3500                                         signing_key = NULL;
3501                                 }
3502                         }
3503                 }
3504
3505                 if (signing_key) {
3506                         status = smb2_signing_check_pdu(*signing_key,
3507                                                         state->conn->protocol,
3508                                                         &cur[1], 3);
3509                         if (!NT_STATUS_IS_OK(status)) {
3510                                 /*
3511                                  * If the signing check fails, we disconnect
3512                                  * the connection.
3513                                  */
3514                                 return status;
3515                         }
3516                 }
3517
3518                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
3519                     (session != NULL) && session->disconnect_expired)
3520                 {
3521                         /*
3522                          * this should be a short term hack
3523                          * until the upper layers have implemented
3524                          * re-authentication.
3525                          */
3526                         return status;
3527                 }
3528
3529                 smbXcli_req_unset_pending(req);
3530
3531                 /*
3532                  * There might be more than one response
3533                  * we need to defer the notifications
3534                  */
3535                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
3536                         defer = false;
3537                 }
3538
3539                 if (defer) {
3540                         tevent_req_defer_callback(req, state->ev);
3541                 }
3542
3543                 /*
3544                  * Note: here we use talloc_reference() in a way
3545                  *       that does not expose it to the caller.
3546                  */
3547                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
3548                 if (tevent_req_nomem(inbuf_ref, req)) {
3549                         continue;
3550                 }
3551
3552                 /* copy the related buffers */
3553                 state->smb2.recv_iov[0] = cur[1];
3554                 state->smb2.recv_iov[1] = cur[2];
3555                 state->smb2.recv_iov[2] = cur[3];
3556
3557                 tevent_req_done(req);
3558         }
3559
3560         if (defer) {
3561                 return NT_STATUS_RETRY;
3562         }
3563
3564         return NT_STATUS_OK;
3565 }
3566
3567 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3568                           struct iovec **piov,
3569                           const struct smb2cli_req_expected_response *expected,
3570                           size_t num_expected)
3571 {
3572         struct smbXcli_req_state *state =
3573                 tevent_req_data(req,
3574                 struct smbXcli_req_state);
3575         NTSTATUS status;
3576         size_t body_size;
3577         bool found_status = false;
3578         bool found_size = false;
3579         size_t i;
3580
3581         if (piov != NULL) {
3582                 *piov = NULL;
3583         }
3584
3585         if (state->smb2.got_async) {
3586                 return STATUS_PENDING;
3587         }
3588
3589         if (tevent_req_is_nterror(req, &status)) {
3590                 for (i=0; i < num_expected; i++) {
3591                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
3592                                 found_status = true;
3593                                 break;
3594                         }
3595                 }
3596
3597                 if (found_status) {
3598                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
3599                 }
3600
3601                 return status;
3602         }
3603
3604         if (num_expected == 0) {
3605                 found_status = true;
3606                 found_size = true;
3607         }
3608
3609         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
3610         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
3611
3612         for (i=0; i < num_expected; i++) {
3613                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
3614                         continue;
3615                 }
3616
3617                 found_status = true;
3618                 if (expected[i].body_size == 0) {
3619                         found_size = true;
3620                         break;
3621                 }
3622
3623                 if (expected[i].body_size == body_size) {
3624                         found_size = true;
3625                         break;
3626                 }
3627         }
3628
3629         if (!found_status) {
3630                 return status;
3631         }
3632
3633         if (state->smb2.signing_skipped) {
3634                 if (num_expected > 0) {
3635                         return NT_STATUS_ACCESS_DENIED;
3636                 }
3637                 if (!NT_STATUS_IS_ERR(status)) {
3638                         return NT_STATUS_ACCESS_DENIED;
3639                 }
3640         }
3641
3642         if (!found_size) {
3643                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3644         }
3645
3646         if (piov != NULL) {
3647                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
3648         }
3649
3650         return status;
3651 }
3652
3653 static const struct {
3654         enum protocol_types proto;
3655         const char *smb1_name;
3656 } smb1cli_prots[] = {
3657         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
3658         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
3659         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
3660         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
3661         {PROTOCOL_LANMAN2,      "LM1.2X002"},
3662         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
3663         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
3664         {PROTOCOL_LANMAN2,      "Samba"},
3665         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
3666         {PROTOCOL_NT1,          "NT LM 0.12"},
3667         {PROTOCOL_SMB2_02,      "SMB 2.002"},
3668         {PROTOCOL_SMB2_10,      "SMB 2.???"},
3669 };
3670
3671 static const struct {
3672         enum protocol_types proto;
3673         uint16_t smb2_dialect;
3674 } smb2cli_prots[] = {
3675         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
3676         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
3677         {PROTOCOL_SMB2_22,      SMB2_DIALECT_REVISION_222},
3678         {PROTOCOL_SMB2_24,      SMB2_DIALECT_REVISION_224},
3679         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
3680 };
3681
3682 struct smbXcli_negprot_state {
3683         struct smbXcli_conn *conn;
3684         struct tevent_context *ev;
3685         uint32_t timeout_msec;
3686         enum protocol_types min_protocol;
3687         enum protocol_types max_protocol;
3688
3689         struct {
3690                 uint8_t fixed[36];
3691                 uint8_t dyn[ARRAY_SIZE(smb2cli_prots)*2];
3692         } smb2;
3693 };
3694
3695 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
3696 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
3697 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
3698 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
3699 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
3700 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
3701                                                   TALLOC_CTX *frame,
3702                                                   uint8_t *inbuf);
3703
3704 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
3705                                         struct tevent_context *ev,
3706                                         struct smbXcli_conn *conn,
3707                                         uint32_t timeout_msec,
3708                                         enum protocol_types min_protocol,
3709                                         enum protocol_types max_protocol)
3710 {
3711         struct tevent_req *req, *subreq;
3712         struct smbXcli_negprot_state *state;
3713
3714         req = tevent_req_create(mem_ctx, &state,
3715                                 struct smbXcli_negprot_state);
3716         if (req == NULL) {
3717                 return NULL;
3718         }
3719         state->conn = conn;
3720         state->ev = ev;
3721         state->timeout_msec = timeout_msec;
3722         state->min_protocol = min_protocol;
3723         state->max_protocol = max_protocol;
3724
3725         if (min_protocol == PROTOCOL_NONE) {
3726                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3727                 return tevent_req_post(req, ev);
3728         }
3729
3730         if (max_protocol == PROTOCOL_NONE) {
3731                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3732                 return tevent_req_post(req, ev);
3733         }
3734
3735         if (min_protocol > max_protocol) {
3736                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3737                 return tevent_req_post(req, ev);
3738         }
3739
3740         if ((min_protocol < PROTOCOL_SMB2_02) &&
3741             (max_protocol < PROTOCOL_SMB2_02)) {
3742                 /*
3743                  * SMB1 only...
3744                  */
3745                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
3746
3747                 subreq = smbXcli_negprot_smb1_subreq(state);
3748                 if (tevent_req_nomem(subreq, req)) {
3749                         return tevent_req_post(req, ev);
3750                 }
3751                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
3752                 return req;
3753         }
3754
3755         if ((min_protocol >= PROTOCOL_SMB2_02) &&
3756             (max_protocol >= PROTOCOL_SMB2_02)) {
3757                 /*
3758                  * SMB2 only...
3759                  */
3760                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3761
3762                 subreq = smbXcli_negprot_smb2_subreq(state);
3763                 if (tevent_req_nomem(subreq, req)) {
3764                         return tevent_req_post(req, ev);
3765                 }
3766                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
3767                 return req;
3768         }
3769
3770         /*
3771          * We send an SMB1 negprot with the SMB2 dialects
3772          * and expect a SMB1 or a SMB2 response.
3773          *
3774          * smbXcli_negprot_dispatch_incoming() will fix the
3775          * callback to match protocol of the response.
3776          */
3777         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
3778
3779         subreq = smbXcli_negprot_smb1_subreq(state);
3780         if (tevent_req_nomem(subreq, req)) {
3781                 return tevent_req_post(req, ev);
3782         }
3783         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
3784         return req;
3785 }
3786
3787 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
3788 {
3789         struct tevent_req *req =
3790                 tevent_req_callback_data(subreq,
3791                 struct tevent_req);
3792         NTSTATUS status;
3793
3794         /*
3795          * we just want the low level error
3796          */
3797         status = tevent_req_simple_recv_ntstatus(subreq);
3798         TALLOC_FREE(subreq);
3799         if (tevent_req_nterror(req, status)) {
3800                 return;
3801         }
3802
3803         /* this should never happen */
3804         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
3805 }
3806
3807 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
3808 {
3809         size_t i;
3810         DATA_BLOB bytes = data_blob_null;
3811         uint8_t flags;
3812         uint16_t flags2;
3813
3814         /* setup the protocol strings */
3815         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
3816                 uint8_t c = 2;
3817                 bool ok;
3818
3819                 if (smb1cli_prots[i].proto < state->min_protocol) {
3820                         continue;
3821                 }
3822
3823                 if (smb1cli_prots[i].proto > state->max_protocol) {
3824                         continue;
3825                 }
3826
3827                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
3828                 if (!ok) {
3829                         return NULL;
3830                 }
3831
3832                 /*
3833                  * We now it is already ascii and
3834                  * we want NULL termination.
3835                  */
3836                 ok = data_blob_append(state, &bytes,
3837                                       smb1cli_prots[i].smb1_name,
3838                                       strlen(smb1cli_prots[i].smb1_name)+1);
3839                 if (!ok) {
3840                         return NULL;
3841                 }
3842         }
3843
3844         smb1cli_req_flags(state->max_protocol,
3845                           state->conn->smb1.client.capabilities,
3846                           SMBnegprot,
3847                           0, 0, &flags,
3848                           0, 0, &flags2);
3849
3850         return smb1cli_req_send(state, state->ev, state->conn,
3851                                 SMBnegprot,
3852                                 flags, ~flags,
3853                                 flags2, ~flags2,
3854                                 state->timeout_msec,
3855                                 0xFFFE, 0, NULL, /* pid, tid, session */
3856                                 0, NULL, /* wct, vwv */
3857                                 bytes.length, bytes.data);
3858 }
3859
3860 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
3861 {
3862         struct tevent_req *req =
3863                 tevent_req_callback_data(subreq,
3864                 struct tevent_req);
3865         struct smbXcli_negprot_state *state =
3866                 tevent_req_data(req,
3867                 struct smbXcli_negprot_state);
3868         struct smbXcli_conn *conn = state->conn;
3869         struct iovec *recv_iov = NULL;
3870         uint8_t *inhdr;
3871         uint8_t wct;
3872         uint16_t *vwv;
3873         uint32_t num_bytes;
3874         uint8_t *bytes;
3875         NTSTATUS status;
3876         uint16_t protnum;
3877         size_t i;
3878         size_t num_prots = 0;
3879         uint8_t flags;
3880         uint32_t client_capabilities = conn->smb1.client.capabilities;
3881         uint32_t both_capabilities;
3882         uint32_t server_capabilities = 0;
3883         uint32_t capabilities;
3884         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
3885         uint32_t server_max_xmit = 0;
3886         uint32_t max_xmit;
3887         uint32_t server_max_mux = 0;
3888         uint16_t server_security_mode = 0;
3889         uint32_t server_session_key = 0;
3890         bool server_readbraw = false;
3891         bool server_writebraw = false;
3892         bool server_lockread = false;
3893         bool server_writeunlock = false;
3894         struct GUID server_guid = GUID_zero();
3895         DATA_BLOB server_gss_blob = data_blob_null;
3896         uint8_t server_challenge[8];
3897         char *server_workgroup = NULL;
3898         char *server_name = NULL;
3899         int server_time_zone = 0;
3900         NTTIME server_system_time = 0;
3901         static const struct smb1cli_req_expected_response expected[] = {
3902         {
3903                 .status = NT_STATUS_OK,
3904                 .wct = 0x11, /* NT1 */
3905         },
3906         {
3907                 .status = NT_STATUS_OK,
3908                 .wct = 0x0D, /* LM */
3909         },
3910         {
3911                 .status = NT_STATUS_OK,
3912                 .wct = 0x01, /* CORE */
3913         }
3914         };
3915
3916         ZERO_STRUCT(server_challenge);
3917
3918         status = smb1cli_req_recv(subreq, state,
3919                                   &recv_iov,
3920                                   &inhdr,
3921                                   &wct,
3922                                   &vwv,
3923                                   NULL, /* pvwv_offset */
3924                                   &num_bytes,
3925                                   &bytes,
3926                                   NULL, /* pbytes_offset */
3927                                   NULL, /* pinbuf */
3928                                   expected, ARRAY_SIZE(expected));
3929         TALLOC_FREE(subreq);
3930         if (tevent_req_nterror(req, status)) {
3931                 return;
3932         }
3933
3934         flags = CVAL(inhdr, HDR_FLG);
3935
3936         protnum = SVAL(vwv, 0);
3937
3938         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
3939                 if (smb1cli_prots[i].proto < state->min_protocol) {
3940                         continue;
3941                 }
3942
3943                 if (smb1cli_prots[i].proto > state->max_protocol) {
3944                         continue;
3945                 }
3946
3947                 if (protnum != num_prots) {
3948                         num_prots++;
3949                         continue;
3950                 }
3951
3952                 conn->protocol = smb1cli_prots[i].proto;
3953                 break;
3954         }
3955
3956         if (conn->protocol == PROTOCOL_NONE) {
3957                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3958                 return;
3959         }
3960
3961         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
3962                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
3963                          "and the selected protocol level doesn't support it.\n"));
3964                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
3965                 return;
3966         }
3967
3968         if (flags & FLAG_SUPPORT_LOCKREAD) {
3969                 server_lockread = true;
3970                 server_writeunlock = true;
3971         }
3972
3973         if (conn->protocol >= PROTOCOL_NT1) {
3974                 const char *client_signing = NULL;
3975                 bool server_mandatory = false;
3976                 bool server_allowed = false;
3977                 const char *server_signing = NULL;
3978                 bool ok;
3979                 uint8_t key_len;
3980
3981                 if (wct != 0x11) {
3982                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
3983                         return;
3984                 }
3985
3986                 /* NT protocol */
3987                 server_security_mode = CVAL(vwv + 1, 0);
3988                 server_max_mux = SVAL(vwv + 1, 1);
3989                 server_max_xmit = IVAL(vwv + 3, 1);
3990                 server_session_key = IVAL(vwv + 7, 1);
3991                 server_time_zone = SVALS(vwv + 15, 1);
3992                 server_time_zone *= 60;
3993                 /* this time arrives in real GMT */
3994                 server_system_time = BVAL(vwv + 11, 1);
3995                 server_capabilities = IVAL(vwv + 9, 1);
3996
3997                 key_len = CVAL(vwv + 16, 1);
3998
3999                 if (server_capabilities & CAP_RAW_MODE) {
4000                         server_readbraw = true;
4001                         server_writebraw = true;
4002                 }
4003                 if (server_capabilities & CAP_LOCK_AND_READ) {
4004                         server_lockread = true;
4005                 }
4006
4007                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4008                         DATA_BLOB blob1, blob2;
4009
4010                         if (num_bytes < 16) {
4011                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4012                                 return;
4013                         }
4014
4015                         blob1 = data_blob_const(bytes, 16);
4016                         status = GUID_from_data_blob(&blob1, &server_guid);
4017                         if (tevent_req_nterror(req, status)) {
4018                                 return;
4019                         }
4020
4021                         blob1 = data_blob_const(bytes+16, num_bytes-16);
4022                         blob2 = data_blob_dup_talloc(state, blob1);
4023                         if (blob1.length > 0 &&
4024                             tevent_req_nomem(blob2.data, req)) {
4025                                 return;
4026                         }
4027                         server_gss_blob = blob2;
4028                 } else {
4029                         DATA_BLOB blob1, blob2;
4030
4031                         if (num_bytes < key_len) {
4032                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4033                                 return;
4034                         }
4035
4036                         if (key_len != 0 && key_len != 8) {
4037                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4038                                 return;
4039                         }
4040
4041                         if (key_len == 8) {
4042                                 memcpy(server_challenge, bytes, 8);
4043                         }
4044
4045                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4046                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4047                         if (blob1.length > 0) {
4048                                 size_t len;
4049
4050                                 len = utf16_len_n(blob1.data,
4051                                                   blob1.length);
4052                                 blob1.length = len;
4053
4054                                 ok = convert_string_talloc(state,
4055                                                            CH_UTF16LE,
4056                                                            CH_UNIX,
4057                                                            blob1.data,
4058                                                            blob1.length,
4059                                                            &server_workgroup,
4060                                                            &len);
4061                                 if (!ok) {
4062                                         status = map_nt_error_from_unix_common(errno);
4063                                         tevent_req_nterror(req, status);
4064                                         return;
4065                                 }
4066                         }
4067
4068                         blob2.data += blob1.length;
4069                         blob2.length -= blob1.length;
4070                         if (blob2.length > 0) {
4071                                 size_t len;
4072
4073                                 len = utf16_len_n(blob1.data,
4074                                                   blob1.length);
4075                                 blob1.length = len;
4076
4077                                 ok = convert_string_talloc(state,
4078                                                            CH_UTF16LE,
4079                                                            CH_UNIX,
4080                                                            blob2.data,
4081                                                            blob2.length,
4082                                                            &server_name,
4083                                                            &len);
4084                                 if (!ok) {
4085                                         status = map_nt_error_from_unix_common(errno);
4086                                         tevent_req_nterror(req, status);
4087                                         return;
4088                                 }
4089                         }
4090                 }
4091
4092                 client_signing = "disabled";
4093                 if (conn->allow_signing) {
4094                         client_signing = "allowed";
4095                 }
4096                 if (conn->mandatory_signing) {
4097                         client_signing = "required";
4098                 }
4099
4100                 server_signing = "not supported";
4101                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4102                         server_signing = "supported";
4103                         server_allowed = true;
4104                 } else if (conn->mandatory_signing) {
4105                         /*
4106                          * We have mandatory signing as client
4107                          * lets assume the server will look at our
4108                          * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4109                          * flag in the session setup
4110                          */
4111                         server_signing = "not announced";
4112                         server_allowed = true;
4113                 }
4114                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4115                         server_signing = "required";
4116                         server_mandatory = true;
4117                 }
4118
4119                 ok = smb_signing_set_negotiated(conn->smb1.signing,
4120                                                 server_allowed,
4121                                                 server_mandatory);
4122                 if (!ok) {
4123                         DEBUG(1,("cli_negprot: SMB signing is required, "
4124                                  "but client[%s] and server[%s] mismatch\n",
4125                                  client_signing, server_signing));
4126                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4127                         return;
4128                 }
4129
4130         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4131                 DATA_BLOB blob1;
4132                 uint8_t key_len;
4133                 time_t t;
4134
4135                 if (wct != 0x0D) {
4136                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4137                         return;
4138                 }
4139
4140                 server_security_mode = SVAL(vwv + 1, 0);
4141                 server_max_xmit = SVAL(vwv + 2, 0);
4142                 server_max_mux = SVAL(vwv + 3, 0);
4143                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4144                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4145                 server_session_key = IVAL(vwv + 6, 0);
4146                 server_time_zone = SVALS(vwv + 10, 0);
4147                 server_time_zone *= 60;
4148                 /* this time is converted to GMT by make_unix_date */
4149                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4150                 unix_to_nt_time(&server_system_time, t);
4151                 key_len = SVAL(vwv + 11, 0);
4152
4153                 if (num_bytes < key_len) {
4154                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4155                         return;
4156                 }
4157
4158                 if (key_len != 0 && key_len != 8) {
4159                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4160                         return;
4161                 }
4162
4163                 if (key_len == 8) {
4164                         memcpy(server_challenge, bytes, 8);
4165                 }
4166
4167                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4168                 if (blob1.length > 0) {
4169                         size_t len;
4170                         bool ok;
4171
4172                         len = utf16_len_n(blob1.data,
4173                                           blob1.length);
4174                         blob1.length = len;
4175
4176                         ok = convert_string_talloc(state,
4177                                                    CH_DOS,
4178                                                    CH_UNIX,
4179                                                    blob1.data,
4180                                                    blob1.length,
4181                                                    &server_workgroup,
4182                                                    &len);
4183                         if (!ok) {
4184                                 status = map_nt_error_from_unix_common(errno);
4185                                 tevent_req_nterror(req, status);
4186                                 return;
4187                         }
4188                 }
4189
4190         } else {
4191                 /* the old core protocol */
4192                 server_time_zone = get_time_zone(time(NULL));
4193                 server_max_xmit = 1024;
4194                 server_max_mux = 1;
4195         }
4196
4197         if (server_max_xmit < 1024) {
4198                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4199                 return;
4200         }
4201
4202         if (server_max_mux < 1) {
4203                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4204                 return;
4205         }
4206
4207         /*
4208          * Now calculate the negotiated capabilities
4209          * based on the mask for:
4210          * - client only flags
4211          * - flags used in both directions
4212          * - server only flags
4213          */
4214         both_capabilities = client_capabilities & server_capabilities;
4215         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4216         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4217         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4218
4219         max_xmit = MIN(client_max_xmit, server_max_xmit);
4220
4221         conn->smb1.server.capabilities = server_capabilities;
4222         conn->smb1.capabilities = capabilities;
4223
4224         conn->smb1.server.max_xmit = server_max_xmit;
4225         conn->smb1.max_xmit = max_xmit;
4226
4227         conn->smb1.server.max_mux = server_max_mux;
4228
4229         conn->smb1.server.security_mode = server_security_mode;
4230
4231         conn->smb1.server.readbraw = server_readbraw;
4232         conn->smb1.server.writebraw = server_writebraw;
4233         conn->smb1.server.lockread = server_lockread;
4234         conn->smb1.server.writeunlock = server_writeunlock;
4235
4236         conn->smb1.server.session_key = server_session_key;
4237
4238         talloc_steal(conn, server_gss_blob.data);
4239         conn->smb1.server.gss_blob = server_gss_blob;
4240         conn->smb1.server.guid = server_guid;
4241         memcpy(conn->smb1.server.challenge, server_challenge, 8);
4242         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4243         conn->smb1.server.name = talloc_move(conn, &server_name);
4244
4245         conn->smb1.server.time_zone = server_time_zone;
4246         conn->smb1.server.system_time = server_system_time;
4247
4248         tevent_req_done(req);
4249 }
4250
4251 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4252 {
4253         size_t i;
4254         uint8_t *buf;
4255         uint16_t dialect_count = 0;
4256
4257         buf = state->smb2.dyn;
4258         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4259                 if (smb2cli_prots[i].proto < state->min_protocol) {
4260                         continue;
4261                 }
4262
4263                 if (smb2cli_prots[i].proto > state->max_protocol) {
4264                         continue;
4265                 }
4266
4267                 SSVAL(buf, dialect_count*2, smb2cli_prots[i].smb2_dialect);
4268                 dialect_count++;
4269         }
4270
4271         buf = state->smb2.fixed;
4272         SSVAL(buf, 0, 36);
4273         SSVAL(buf, 2, dialect_count);
4274         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4275         SSVAL(buf, 6, 0);       /* Reserved */
4276         if (state->max_protocol >= PROTOCOL_SMB2_22) {
4277                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4278         } else {
4279                 SIVAL(buf, 8, 0);       /* Capabilities */
4280         }
4281         if (state->max_protocol >= PROTOCOL_SMB2_10) {
4282                 NTSTATUS status;
4283                 DATA_BLOB blob;
4284
4285                 status = GUID_to_ndr_blob(&state->conn->smb2.client.guid,
4286                                           state, &blob);
4287                 if (!NT_STATUS_IS_OK(status)) {
4288                         return NULL;
4289                 }
4290                 memcpy(buf+12, blob.data, 16); /* ClientGuid */
4291         } else {
4292                 memset(buf+12, 0, 16);  /* ClientGuid */
4293         }
4294         SBVAL(buf, 28, 0);      /* ClientStartTime */
4295
4296         return smb2cli_req_send(state, state->ev,
4297                                 state->conn, SMB2_OP_NEGPROT,
4298                                 0, 0, /* flags */
4299                                 state->timeout_msec,
4300                                 NULL, NULL, /* tcon, session */
4301                                 state->smb2.fixed, sizeof(state->smb2.fixed),
4302                                 state->smb2.dyn, dialect_count*2,
4303                                 UINT16_MAX); /* max_dyn_len */
4304 }
4305
4306 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
4307 {
4308         struct tevent_req *req =
4309                 tevent_req_callback_data(subreq,
4310                 struct tevent_req);
4311         struct smbXcli_negprot_state *state =
4312                 tevent_req_data(req,
4313                 struct smbXcli_negprot_state);
4314         struct smbXcli_conn *conn = state->conn;
4315         size_t security_offset, security_length;
4316         DATA_BLOB blob;
4317         NTSTATUS status;
4318         struct iovec *iov;
4319         uint8_t *body;
4320         size_t i;
4321         uint16_t dialect_revision;
4322         static const struct smb2cli_req_expected_response expected[] = {
4323         {
4324                 .status = NT_STATUS_OK,
4325                 .body_size = 0x41
4326         }
4327         };
4328
4329         status = smb2cli_req_recv(subreq, state, &iov,
4330                                   expected, ARRAY_SIZE(expected));
4331         TALLOC_FREE(subreq);
4332         if (tevent_req_nterror(req, status)) {
4333                 return;
4334         }
4335
4336         body = (uint8_t *)iov[1].iov_base;
4337
4338         dialect_revision = SVAL(body, 4);
4339
4340         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4341                 if (smb2cli_prots[i].proto < state->min_protocol) {
4342                         continue;
4343                 }
4344
4345                 if (smb2cli_prots[i].proto > state->max_protocol) {
4346                         continue;
4347                 }
4348
4349                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
4350                         continue;
4351                 }
4352
4353                 conn->protocol = smb2cli_prots[i].proto;
4354                 break;
4355         }
4356
4357         if (conn->protocol == PROTOCOL_NONE) {
4358                 if (state->min_protocol >= PROTOCOL_SMB2_02) {
4359                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4360                         return;
4361                 }
4362
4363                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
4364                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4365                         return;
4366                 }
4367
4368                 /* make sure we do not loop forever */
4369                 state->min_protocol = PROTOCOL_SMB2_02;
4370
4371                 /*
4372                  * send a SMB2 negprot, in order to negotiate
4373                  * the SMB2 dialect.
4374                  */
4375                 subreq = smbXcli_negprot_smb2_subreq(state);
4376                 if (tevent_req_nomem(subreq, req)) {
4377                         return;
4378                 }
4379                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4380                 return;
4381         }
4382
4383         conn->smb2.server.security_mode = SVAL(body, 2);
4384
4385         blob = data_blob_const(body + 8, 16);
4386         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
4387         if (tevent_req_nterror(req, status)) {
4388                 return;
4389         }
4390
4391         conn->smb2.server.capabilities  = IVAL(body, 24);
4392         conn->smb2.server.max_trans_size= IVAL(body, 28);
4393         conn->smb2.server.max_read_size = IVAL(body, 32);
4394         conn->smb2.server.max_write_size= IVAL(body, 36);
4395         conn->smb2.server.system_time   = BVAL(body, 40);
4396         conn->smb2.server.start_time    = BVAL(body, 48);
4397
4398         security_offset = SVAL(body, 56);
4399         security_length = SVAL(body, 58);
4400
4401         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
4402                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4403                 return;
4404         }
4405
4406         if (security_length > iov[2].iov_len) {
4407                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4408                 return;
4409         }
4410
4411         conn->smb2.server.gss_blob = data_blob_talloc(conn,
4412                                                 iov[2].iov_base,
4413                                                 security_length);
4414         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
4415                 return;
4416         }
4417
4418         tevent_req_done(req);
4419 }
4420
4421 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4422                                                   TALLOC_CTX *tmp_mem,
4423                                                   uint8_t *inbuf)
4424 {
4425         size_t num_pending = talloc_array_length(conn->pending);
4426         struct tevent_req *subreq;
4427         struct smbXcli_req_state *substate;
4428         struct tevent_req *req;
4429         uint32_t protocol_magic;
4430         size_t inbuf_len = smb_len_nbt(inbuf);
4431
4432         if (num_pending != 1) {
4433                 return NT_STATUS_INTERNAL_ERROR;
4434         }
4435
4436         if (inbuf_len < 4) {
4437                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4438         }
4439
4440         subreq = conn->pending[0];
4441         substate = tevent_req_data(subreq, struct smbXcli_req_state);
4442         req = tevent_req_callback_data(subreq, struct tevent_req);
4443
4444         protocol_magic = IVAL(inbuf, 4);
4445
4446         switch (protocol_magic) {
4447         case SMB_MAGIC:
4448                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4449                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4450                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4451
4452         case SMB2_MAGIC:
4453                 if (substate->smb2.recv_iov == NULL) {
4454                         /*
4455                          * For the SMB1 negprot we have move it.
4456                          */
4457                         substate->smb2.recv_iov = substate->smb1.recv_iov;
4458                         substate->smb1.recv_iov = NULL;
4459                 }
4460
4461                 /*
4462                  * we got an SMB2 answer, which consumed sequence number 0
4463                  * so we need to use 1 as the next one.
4464                  *
4465                  * we also need to set the current credits to 0
4466                  * as we consumed the initial one. The SMB2 answer
4467                  * hopefully grant us a new credit.
4468                  */
4469                 conn->smb2.mid = 1;
4470                 conn->smb2.cur_credits = 0;
4471                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4472                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4473                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4474         }
4475
4476         DEBUG(10, ("Got non-SMB PDU\n"));
4477         return NT_STATUS_INVALID_NETWORK_RESPONSE;
4478 }
4479
4480 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
4481 {
4482         return tevent_req_simple_recv_ntstatus(req);
4483 }
4484
4485 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
4486                          uint32_t timeout_msec,
4487                          enum protocol_types min_protocol,
4488                          enum protocol_types max_protocol)
4489 {
4490         TALLOC_CTX *frame = talloc_stackframe();
4491         struct tevent_context *ev;
4492         struct tevent_req *req;
4493         NTSTATUS status = NT_STATUS_NO_MEMORY;
4494         bool ok;
4495
4496         if (smbXcli_conn_has_async_calls(conn)) {
4497                 /*
4498                  * Can't use sync call while an async call is in flight
4499                  */
4500                 status = NT_STATUS_INVALID_PARAMETER_MIX;
4501                 goto fail;
4502         }
4503         ev = samba_tevent_context_init(frame);
4504         if (ev == NULL) {
4505                 goto fail;
4506         }
4507         req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
4508                                    min_protocol, max_protocol);
4509         if (req == NULL) {
4510                 goto fail;
4511         }
4512         ok = tevent_req_poll(req, ev);
4513         if (!ok) {
4514                 status = map_nt_error_from_unix_common(errno);
4515                 goto fail;
4516         }
4517         status = smbXcli_negprot_recv(req);
4518  fail:
4519         TALLOC_FREE(frame);
4520         return status;
4521 }
4522
4523 static int smbXcli_session_destructor(struct smbXcli_session *session)
4524 {
4525         if (session->conn == NULL) {
4526                 return 0;
4527         }
4528
4529         DLIST_REMOVE(session->conn->sessions, session);
4530         return 0;
4531 }
4532
4533 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
4534                                                struct smbXcli_conn *conn)
4535 {
4536         struct smbXcli_session *session;
4537
4538         session = talloc_zero(mem_ctx, struct smbXcli_session);
4539         if (session == NULL) {
4540                 return NULL;
4541         }
4542         session->smb2 = talloc_zero(session, struct smb2cli_session);
4543         if (session->smb2 == NULL) {
4544                 talloc_free(session);
4545                 return NULL;
4546         }
4547         talloc_set_destructor(session, smbXcli_session_destructor);
4548
4549         DLIST_ADD_END(conn->sessions, session, struct smbXcli_session *);
4550         session->conn = conn;
4551
4552         return session;
4553 }
4554
4555 struct smbXcli_session *smbXcli_session_copy(TALLOC_CTX *mem_ctx,
4556                                                 struct smbXcli_session *src)
4557 {
4558         struct smbXcli_session *session;
4559
4560         session = talloc_zero(mem_ctx, struct smbXcli_session);
4561         if (session == NULL) {
4562                 return NULL;
4563         }
4564         session->smb2 = talloc_zero(session, struct smb2cli_session);
4565         if (session->smb2 == NULL) {
4566                 talloc_free(session);
4567                 return NULL;
4568         }
4569
4570         session->conn = src->conn;
4571         *session->smb2 = *src->smb2;
4572         session->smb2_channel = src->smb2_channel;
4573         session->disconnect_expired = src->disconnect_expired;
4574
4575         DLIST_ADD_END(src->conn->sessions, session, struct smbXcli_session *);
4576         talloc_set_destructor(session, smbXcli_session_destructor);
4577
4578         return session;
4579 }
4580
4581
4582 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
4583                                          TALLOC_CTX *mem_ctx,
4584                                          DATA_BLOB *key)
4585 {
4586         const DATA_BLOB *application_key;
4587
4588         *key = data_blob_null;
4589
4590         if (session->conn == NULL) {
4591                 return NT_STATUS_NO_USER_SESSION_KEY;
4592         }
4593
4594         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
4595                 application_key = &session->smb2->application_key;
4596         } else {
4597                 application_key = &session->smb1.application_key;
4598         }
4599
4600         if (application_key->length == 0) {
4601                 return NT_STATUS_NO_USER_SESSION_KEY;
4602         }
4603
4604         *key = data_blob_dup_talloc(mem_ctx, *application_key);
4605         if (key->data == NULL) {
4606                 return NT_STATUS_NO_MEMORY;
4607         }
4608
4609         return NT_STATUS_OK;
4610 }
4611
4612 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
4613 {
4614         session->disconnect_expired = true;
4615 }
4616
4617 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
4618 {
4619         return session->smb1.session_id;
4620 }
4621
4622 void smb1cli_session_set_id(struct smbXcli_session *session,
4623                             uint16_t session_id)
4624 {
4625         session->smb1.session_id = session_id;
4626 }
4627
4628 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
4629                                          const DATA_BLOB _session_key)
4630 {
4631         struct smbXcli_conn *conn = session->conn;
4632         uint8_t session_key[16];
4633
4634         if (conn == NULL) {
4635                 return NT_STATUS_INVALID_PARAMETER_MIX;
4636         }
4637
4638         if (session->smb1.application_key.length != 0) {
4639                 /*
4640                  * TODO: do not allow this...
4641                  *
4642                  * return NT_STATUS_INVALID_PARAMETER_MIX;
4643                  */
4644                 data_blob_clear_free(&session->smb1.application_key);
4645                 session->smb1.protected_key = false;
4646         }
4647
4648         if (_session_key.length == 0) {
4649                 return NT_STATUS_OK;
4650         }
4651
4652         ZERO_STRUCT(session_key);
4653         memcpy(session_key, _session_key.data,
4654                MIN(_session_key.length, sizeof(session_key)));
4655
4656         session->smb1.application_key = data_blob_talloc(session,
4657                                                          session_key,
4658                                                          sizeof(session_key));
4659         ZERO_STRUCT(session_key);
4660         if (session->smb1.application_key.data == NULL) {
4661                 return NT_STATUS_NO_MEMORY;
4662         }
4663
4664         session->smb1.protected_key = false;
4665
4666         return NT_STATUS_OK;
4667 }
4668
4669 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
4670 {
4671         if (session->smb1.protected_key) {
4672                 /* already protected */
4673                 return NT_STATUS_OK;
4674         }
4675
4676         if (session->smb1.application_key.length != 16) {
4677                 return NT_STATUS_INVALID_PARAMETER_MIX;
4678         }
4679
4680         smb_key_derivation(session->smb1.application_key.data,
4681                            session->smb1.application_key.length,
4682                            session->smb1.application_key.data);
4683
4684         session->smb1.protected_key = true;
4685
4686         return NT_STATUS_OK;
4687 }
4688
4689 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
4690 {
4691         struct smbXcli_conn *conn = session->conn;
4692         uint8_t security_mode = 0;
4693
4694         if (conn == NULL) {
4695                 return security_mode;
4696         }
4697
4698         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
4699         if (conn->mandatory_signing) {
4700                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
4701         }
4702
4703         return security_mode;
4704 }
4705
4706 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
4707 {
4708         return session->smb2->session_id;
4709 }
4710
4711 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
4712 {
4713         return session->smb2->session_flags;
4714 }
4715
4716 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
4717                                       uint64_t session_id,
4718                                       uint16_t session_flags)
4719 {
4720         session->smb2->session_id = session_id;
4721         session->smb2->session_flags = session_flags;
4722 }
4723
4724 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
4725 {
4726         session->smb2->channel_sequence += 1;
4727 }
4728
4729 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
4730                                          const DATA_BLOB _session_key,
4731                                          const struct iovec *recv_iov)
4732 {
4733         struct smbXcli_conn *conn = session->conn;
4734         uint16_t no_sign_flags;
4735         uint8_t session_key[16];
4736         NTSTATUS status;
4737
4738         if (conn == NULL) {
4739                 return NT_STATUS_INVALID_PARAMETER_MIX;
4740         }
4741
4742         no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
4743
4744         if (session->smb2->session_flags & no_sign_flags) {
4745                 session->smb2->should_sign = false;
4746                 return NT_STATUS_OK;
4747         }
4748
4749         if (session->smb2->signing_key.length != 0) {
4750                 return NT_STATUS_INVALID_PARAMETER_MIX;
4751         }
4752
4753         ZERO_STRUCT(session_key);
4754         memcpy(session_key, _session_key.data,
4755                MIN(_session_key.length, sizeof(session_key)));
4756
4757         session->smb2->signing_key = data_blob_talloc(session,
4758                                                      session_key,
4759                                                      sizeof(session_key));
4760         if (session->smb2->signing_key.data == NULL) {
4761                 ZERO_STRUCT(session_key);
4762                 return NT_STATUS_NO_MEMORY;
4763         }
4764
4765         if (conn->protocol >= PROTOCOL_SMB2_24) {
4766                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
4767                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
4768
4769                 smb2_key_derivation(session_key, sizeof(session_key),
4770                                     label.data, label.length,
4771                                     context.data, context.length,
4772                                     session->smb2->signing_key.data);
4773         }
4774
4775         session->smb2->encryption_key = data_blob_dup_talloc(session,
4776                                                 session->smb2->signing_key);
4777         if (session->smb2->encryption_key.data == NULL) {
4778                 ZERO_STRUCT(session_key);
4779                 return NT_STATUS_NO_MEMORY;
4780         }
4781
4782         if (conn->protocol >= PROTOCOL_SMB2_24) {
4783                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
4784                 const DATA_BLOB context = data_blob_string_const_null("ServerIn ");
4785
4786                 smb2_key_derivation(session_key, sizeof(session_key),
4787                                     label.data, label.length,
4788                                     context.data, context.length,
4789                                     session->smb2->encryption_key.data);
4790         }
4791
4792         session->smb2->decryption_key = data_blob_dup_talloc(session,
4793                                                 session->smb2->signing_key);
4794         if (session->smb2->decryption_key.data == NULL) {
4795                 ZERO_STRUCT(session_key);
4796                 return NT_STATUS_NO_MEMORY;
4797         }
4798
4799         if (conn->protocol >= PROTOCOL_SMB2_24) {
4800                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
4801                 const DATA_BLOB context = data_blob_string_const_null("ServerOut");
4802
4803                 smb2_key_derivation(session_key, sizeof(session_key),
4804                                     label.data, label.length,
4805                                     context.data, context.length,
4806                                     session->smb2->decryption_key.data);
4807         }
4808
4809         session->smb2->application_key = data_blob_dup_talloc(session,
4810                                                 session->smb2->signing_key);
4811         if (session->smb2->application_key.data == NULL) {
4812                 ZERO_STRUCT(session_key);
4813                 return NT_STATUS_NO_MEMORY;
4814         }
4815
4816         if (conn->protocol >= PROTOCOL_SMB2_24) {
4817                 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
4818                 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
4819
4820                 smb2_key_derivation(session_key, sizeof(session_key),
4821                                     label.data, label.length,
4822                                     context.data, context.length,
4823                                     session->smb2->application_key.data);
4824         }
4825         ZERO_STRUCT(session_key);
4826
4827         session->smb2_channel.signing_key = data_blob_dup_talloc(session,
4828                                                 session->smb2->signing_key);
4829         if (session->smb2_channel.signing_key.data == NULL) {
4830                 return NT_STATUS_NO_MEMORY;
4831         }
4832
4833         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
4834                                         session->conn->protocol,
4835                                         recv_iov, 3);
4836         if (!NT_STATUS_IS_OK(status)) {
4837                 return status;
4838         }
4839
4840         session->smb2->should_sign = false;
4841         session->smb2->should_encrypt = false;
4842
4843         if (conn->desire_signing) {
4844                 session->smb2->should_sign = true;
4845         }
4846
4847         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
4848                 session->smb2->should_sign = true;
4849         }
4850
4851         if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
4852                 session->smb2->should_encrypt = true;
4853         }
4854
4855         if (conn->protocol < PROTOCOL_SMB2_24) {
4856                 session->smb2->should_encrypt = false;
4857         }
4858
4859         if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
4860                 session->smb2->should_encrypt = false;
4861         }
4862
4863         generate_random_buffer((uint8_t *)&session->smb2->nonce_high,
4864                                sizeof(session->smb2->nonce_high));
4865         session->smb2->nonce_low = 1;
4866
4867         return NT_STATUS_OK;
4868 }
4869
4870 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
4871                                         struct smbXcli_session *session1,
4872                                         struct smbXcli_conn *conn,
4873                                         struct smbXcli_session **_session2)
4874 {
4875         struct smbXcli_session *session2;
4876
4877         if (session1->smb2->signing_key.length == 0) {
4878                 return NT_STATUS_INVALID_PARAMETER_MIX;
4879         }
4880
4881         if (conn == NULL) {
4882                 return NT_STATUS_INVALID_PARAMETER_MIX;
4883         }
4884
4885         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
4886         if (session2 == NULL) {
4887                 return NT_STATUS_NO_MEMORY;
4888         }
4889         session2->smb2 = talloc_reference(session2, session1->smb2);
4890         if (session2->smb2 == NULL) {
4891                 talloc_free(session2);
4892                 return NT_STATUS_NO_MEMORY;
4893         }
4894
4895         talloc_set_destructor(session2, smbXcli_session_destructor);
4896         DLIST_ADD_END(conn->sessions, session2, struct smbXcli_session *);
4897         session2->conn = conn;
4898
4899         *_session2 = session2;
4900         return NT_STATUS_OK;
4901 }
4902
4903 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
4904                                          const DATA_BLOB _channel_key,
4905                                          const struct iovec *recv_iov)
4906 {
4907         struct smbXcli_conn *conn = session->conn;
4908         uint8_t channel_key[16];
4909         NTSTATUS status;
4910
4911         if (conn == NULL) {
4912                 return NT_STATUS_INVALID_PARAMETER_MIX;
4913         }
4914
4915         if (session->smb2_channel.signing_key.length != 0) {
4916                 return NT_STATUS_INVALID_PARAMETER_MIX;
4917         }
4918
4919         ZERO_STRUCT(channel_key);
4920         memcpy(channel_key, _channel_key.data,
4921                MIN(_channel_key.length, sizeof(channel_key)));
4922
4923         session->smb2_channel.signing_key = data_blob_talloc(session,
4924                                                 channel_key,
4925                                                 sizeof(channel_key));
4926         if (session->smb2_channel.signing_key.data == NULL) {
4927                 ZERO_STRUCT(channel_key);
4928                 return NT_STATUS_NO_MEMORY;
4929         }
4930
4931         if (conn->protocol >= PROTOCOL_SMB2_24) {
4932                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
4933                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
4934
4935                 smb2_key_derivation(channel_key, sizeof(channel_key),
4936                                     label.data, label.length,
4937                                     context.data, context.length,
4938                                     session->smb2_channel.signing_key.data);
4939         }
4940         ZERO_STRUCT(channel_key);
4941
4942         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
4943                                         session->conn->protocol,
4944                                         recv_iov, 3);
4945         if (!NT_STATUS_IS_OK(status)) {
4946                 return status;
4947         }
4948
4949         return NT_STATUS_OK;
4950 }
4951
4952 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
4953 {
4954         if (session->smb2->should_encrypt) {
4955                 return NT_STATUS_OK;
4956         }
4957
4958         if (session->conn->protocol < PROTOCOL_SMB2_24) {
4959                 return NT_STATUS_NOT_SUPPORTED;
4960         }
4961
4962         if (!(session->conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
4963                 return NT_STATUS_NOT_SUPPORTED;
4964         }
4965
4966         if (session->smb2->signing_key.data == NULL) {
4967                 return NT_STATUS_NOT_SUPPORTED;
4968         }
4969         session->smb2->should_encrypt = true;
4970         return NT_STATUS_OK;
4971 }
4972
4973 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
4974 {
4975         struct smbXcli_tcon *tcon;
4976
4977         tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
4978         if (tcon == NULL) {
4979                 return NULL;
4980         }
4981
4982         return tcon;
4983 }
4984
4985 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
4986 {
4987         return tcon->smb1.tcon_id;
4988 }
4989
4990 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
4991 {
4992         tcon->smb1.tcon_id = tcon_id;
4993 }
4994
4995 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
4996                              uint16_t tcon_id,
4997                              uint16_t optional_support,
4998                              uint32_t maximal_access,
4999                              uint32_t guest_maximal_access,
5000                              const char *service,
5001                              const char *fs_type)
5002 {
5003         tcon->smb1.tcon_id = tcon_id;
5004         tcon->smb1.optional_support = optional_support;
5005         tcon->smb1.maximal_access = maximal_access;
5006         tcon->smb1.guest_maximal_access = guest_maximal_access;
5007
5008         TALLOC_FREE(tcon->smb1.service);
5009         tcon->smb1.service = talloc_strdup(tcon, service);
5010         if (service != NULL && tcon->smb1.service == NULL) {
5011                 return false;
5012         }
5013
5014         TALLOC_FREE(tcon->smb1.fs_type);
5015         tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
5016         if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
5017                 return false;
5018         }
5019
5020         return true;
5021 }
5022
5023 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
5024 {
5025         return tcon->smb2.tcon_id;
5026 }
5027
5028 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
5029 {
5030         return tcon->smb2.capabilities;
5031 }
5032
5033 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
5034                              struct smbXcli_session *session,
5035                              uint32_t tcon_id,
5036                              uint8_t type,
5037                              uint32_t flags,
5038                              uint32_t capabilities,
5039                              uint32_t maximal_access)
5040 {
5041         tcon->smb2.tcon_id = tcon_id;
5042         tcon->smb2.type = type;
5043         tcon->smb2.flags = flags;
5044         tcon->smb2.capabilities = capabilities;
5045         tcon->smb2.maximal_access = maximal_access;
5046
5047         tcon->smb2.should_encrypt = false;
5048
5049         if (session == NULL) {
5050                 return;
5051         }
5052
5053         tcon->smb2.should_encrypt = session->smb2->should_encrypt;
5054
5055         if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
5056                 tcon->smb2.should_encrypt = true;
5057         }
5058 }