libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "lib/util/iov_buf.h"
  29 #include "../libcli/smb/smb_common.h"
  30 #include "../libcli/smb/smb_seal.h"
  31 #include "../libcli/smb/smb_signing.h"
  32 #include "../libcli/smb/read_smb.h"
  33 #include "smbXcli_base.h"
  34 #include "librpc/ndr/libndr.h"
  35 #include "libcli/smb/smb2_negotiate_context.h"
  36 #include "libcli/smb/smb2_signing.h"
  37
  38 #include "lib/crypto/gnutls_helpers.h"
  39 #include <gnutls/gnutls.h>
  40 #include <gnutls/crypto.h>
  41
  42 struct smbXcli_conn;
  43 struct smbXcli_req;
  44 struct smbXcli_session;
  45 struct smbXcli_tcon;
  46
  47 struct smbXcli_conn {
  48         int sock_fd;
  49         struct sockaddr_storage local_ss;
  50         struct sockaddr_storage remote_ss;
  51         const char *remote_name;
  52
  53         struct tevent_queue *outgoing;
  54         struct tevent_req **pending;
  55         struct tevent_req *read_smb_req;
  56         struct tevent_req *suicide_req;
  57
  58         enum protocol_types min_protocol;
  59         enum protocol_types max_protocol;
  60         enum protocol_types protocol;
  61         bool allow_signing;
  62         bool desire_signing;
  63         bool mandatory_signing;
  64
  65         /*
  66          * The incoming dispatch function should return:
  67          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  68          * - NT_STATUS_OK, if no more processing is desired, e.g.
  69          *                 the dispatch function called
  70          *                 tevent_req_done().
  71          * - All other return values disconnect the connection.
  72          */
  73         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  74                                       TALLOC_CTX *tmp_mem,
  75                                       uint8_t *inbuf);
  76
  77         struct {
  78                 struct {
  79                         uint32_t capabilities;
  80                         uint32_t max_xmit;
  81                 } client;
  82
  83                 struct {
  84                         uint32_t capabilities;
  85                         uint32_t max_xmit;
  86                         uint16_t max_mux;
  87                         uint16_t security_mode;
  88                         bool readbraw;
  89                         bool writebraw;
  90                         bool lockread;
  91                         bool writeunlock;
  92                         uint32_t session_key;
  93                         struct GUID guid;
  94                         DATA_BLOB gss_blob;
  95                         uint8_t challenge[8];
  96                         const char *workgroup;
  97                         const char *name;
  98                         int time_zone;
  99                         NTTIME system_time;
 100                 } server;
 101
 102                 uint32_t capabilities;
 103                 uint32_t max_xmit;
 104
 105                 uint16_t mid;
 106
 107                 struct smb1_signing_state *signing;
 108                 struct smb_trans_enc_state *trans_enc;
 109
 110                 struct tevent_req *read_braw_req;
 111         } smb1;
 112
 113         struct {
 114                 struct {
 115                         uint32_t capabilities;
 116                         uint16_t security_mode;
 117                         struct GUID guid;
 118                         struct smb311_capabilities smb3_capabilities;
 119                 } client;
 120
 121                 struct {
 122                         uint32_t capabilities;
 123                         uint16_t security_mode;
 124                         struct GUID guid;
 125                         uint32_t max_trans_size;
 126                         uint32_t max_read_size;
 127                         uint32_t max_write_size;
 128                         NTTIME system_time;
 129                         NTTIME start_time;
 130                         DATA_BLOB gss_blob;
 131                         uint16_t sign_algo;
 132                         uint16_t cipher;
 133                         bool smb311_posix;
 134                 } server;
 135
 136                 uint64_t mid;
 137                 uint16_t cur_credits;
 138                 uint16_t max_credits;
 139
 140                 uint32_t cc_chunk_len;
 141                 uint32_t cc_max_chunks;
 142
 143                 uint8_t io_priority;
 144
 145                 bool force_channel_sequence;
 146
 147                 uint8_t preauth_sha512[64];
 148         } smb2;
 149
 150         struct smbXcli_session *sessions;
 151 };
 152
 153 struct smb2cli_session {
 154         uint64_t session_id;
 155         uint16_t session_flags;
 156         struct smb2_signing_key *application_key;
 157         struct smb2_signing_key *signing_key;
 158         bool should_sign;
 159         bool should_encrypt;
 160         struct smb2_signing_key *encryption_key;
 161         struct smb2_signing_key *decryption_key;
 162         uint64_t nonce_high_random;
 163         uint64_t nonce_high_max;
 164         uint64_t nonce_high;
 165         uint64_t nonce_low;
 166         uint16_t channel_sequence;
 167         bool replay_active;
 168         bool require_signed_response;
 169
 170         /*
 171          * The following are just for torture tests
 172          */
 173         bool anonymous_signing;
 174         bool anonymous_encryption;
 175         bool no_signing_disconnect;
 176 };
 177
 178 struct smbXcli_session {
 179         struct smbXcli_session *prev, *next;
 180         struct smbXcli_conn *conn;
 181
 182         struct {
 183                 uint16_t session_id;
 184                 uint16_t action;
 185                 DATA_BLOB application_key;
 186                 bool protected_key;
 187         } smb1;
 188
 189         struct smb2cli_session *smb2;
 190
 191         struct {
 192                 struct smb2_signing_key *signing_key;
 193                 uint8_t preauth_sha512[64];
 194         } smb2_channel;
 195
 196         /*
 197          * this should be a short term hack
 198          * until the upper layers have implemented
 199          * re-authentication.
 200          */
 201         bool disconnect_expired;
 202 };
 203
 204 struct smbXcli_tcon {
 205         bool is_smb1;
 206         uint32_t fs_attributes;
 207
 208         struct {
 209                 uint16_t tcon_id;
 210                 uint16_t optional_support;
 211                 uint32_t maximal_access;
 212                 uint32_t guest_maximal_access;
 213                 char *service;
 214                 char *fs_type;
 215         } smb1;
 216
 217         struct {
 218                 uint32_t tcon_id;
 219                 uint8_t type;
 220                 uint32_t flags;
 221                 uint32_t capabilities;
 222                 uint32_t maximal_access;
 223                 bool should_sign;
 224                 bool should_encrypt;
 225         } smb2;
 226 };
 227
 228 struct smbXcli_req_state {
 229         struct tevent_context *ev;
 230         struct smbXcli_conn *conn;
 231         struct smbXcli_session *session; /* maybe NULL */
 232         struct smbXcli_tcon *tcon; /* maybe NULL */
 233
 234         uint8_t length_hdr[4];
 235
 236         bool one_way;
 237
 238         uint8_t *inbuf;
 239
 240         struct tevent_req *write_req;
 241
 242         struct timeval endtime;
 243
 244         struct {
 245                 /* Space for the header including the wct */
 246                 uint8_t hdr[HDR_VWV];
 247
 248                 /*
 249                  * For normal requests, smb1cli_req_send chooses a mid.
 250                  * SecondaryV trans requests need to use the mid of the primary
 251                  * request, so we need a place to store it.
 252                  * Assume it is set if != 0.
 253                  */
 254                 uint16_t mid;
 255
 256                 uint16_t *vwv;
 257                 uint8_t bytecount_buf[2];
 258
 259 #define MAX_SMB_IOV 10
 260                 /* length_hdr, hdr, words, byte_count, buffers */
 261                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 262                 int iov_count;
 263
 264                 bool one_way_seqnum;
 265                 uint32_t seqnum;
 266                 struct tevent_req **chained_requests;
 267
 268                 uint8_t recv_cmd;
 269                 NTSTATUS recv_status;
 270                 /* always an array of 3 talloc elements */
 271                 struct iovec *recv_iov;
 272         } smb1;
 273
 274         struct {
 275                 const uint8_t *fixed;
 276                 uint16_t fixed_len;
 277                 const uint8_t *dyn;
 278                 uint32_t dyn_len;
 279
 280                 uint8_t transform[SMB2_TF_HDR_SIZE];
 281                 uint8_t hdr[SMB2_HDR_BODY];
 282                 uint8_t pad[7]; /* padding space for compounding */
 283
 284                 /*
 285                  * always an array of 3 talloc elements
 286                  * (without a SMB2_TRANSFORM header!)
 287                  *
 288                  * HDR, BODY, DYN
 289                  */
 290                 struct iovec *recv_iov;
 291
 292                 /*
 293                  * the expected max for the response dyn_len
 294                  */
 295                 uint32_t max_dyn_len;
 296
 297                 uint16_t credit_charge;
 298
 299                 bool should_sign;
 300                 bool should_encrypt;
 301                 uint64_t encryption_session_id;
 302
 303                 bool signing_skipped;
 304                 bool require_signed_response;
 305                 bool notify_async;
 306                 bool got_async;
 307                 uint16_t cancel_flags;
 308                 uint64_t cancel_mid;
 309                 uint64_t cancel_aid;
 310         } smb2;
 311 };
 312
 313 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 314 {
 315         /*
 316          * NT_STATUS_OK, means we do not notify the callers
 317          */
 318         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 319
 320         while (conn->sessions) {
 321                 conn->sessions->conn = NULL;
 322                 DLIST_REMOVE(conn->sessions, conn->sessions);
 323         }
 324
 325         if (conn->smb1.trans_enc) {
 326                 TALLOC_FREE(conn->smb1.trans_enc);
 327         }
 328
 329         return 0;
 330 }
 331
 332 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 333                                          int fd,
 334                                          const char *remote_name,
 335                                          enum smb_signing_setting signing_state,
 336                                          uint32_t smb1_capabilities,
 337                                          struct GUID *client_guid,
 338                                          uint32_t smb2_capabilities,
 339                                          const struct smb311_capabilities *smb3_capabilities)
 340 {
 341         struct smbXcli_conn *conn = NULL;
 342         void *ss = NULL;
 343         struct sockaddr *sa = NULL;
 344         socklen_t sa_length;
 345         int ret;
 346
 347         if (smb3_capabilities != NULL) {
 348                 const struct smb3_signing_capabilities *sign_algos =
 349                         &smb3_capabilities->signing;
 350                 const struct smb3_encryption_capabilities *ciphers =
 351                         &smb3_capabilities->encryption;
 352
 353                 SMB_ASSERT(sign_algos->num_algos <= SMB3_SIGNING_CAPABILITIES_MAX_ALGOS);
 354                 SMB_ASSERT(ciphers->num_algos <= SMB3_ENCRYTION_CAPABILITIES_MAX_ALGOS);
 355         }
 356
 357         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 358         if (!conn) {
 359                 return NULL;
 360         }
 361
 362         ret = set_blocking(fd, false);
 363         if (ret < 0) {
 364                 goto error;
 365         }
 366         conn->sock_fd = fd;
 367
 368         conn->remote_name = talloc_strdup(conn, remote_name);
 369         if (conn->remote_name == NULL) {
 370                 goto error;
 371         }
 372
 373         ss = (void *)&conn->local_ss;
 374         sa = (struct sockaddr *)ss;
 375         sa_length = sizeof(conn->local_ss);
 376         ret = getsockname(fd, sa, &sa_length);
 377         if (ret == -1) {
 378                 goto error;
 379         }
 380         ss = (void *)&conn->remote_ss;
 381         sa = (struct sockaddr *)ss;
 382         sa_length = sizeof(conn->remote_ss);
 383         ret = getpeername(fd, sa, &sa_length);
 384         if (ret == -1) {
 385                 goto error;
 386         }
 387
 388         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 389         if (conn->outgoing == NULL) {
 390                 goto error;
 391         }
 392         conn->pending = NULL;
 393
 394         conn->min_protocol = PROTOCOL_NONE;
 395         conn->max_protocol = PROTOCOL_NONE;
 396         conn->protocol = PROTOCOL_NONE;
 397
 398         switch (signing_state) {
 399         case SMB_SIGNING_OFF:
 400                 /* never */
 401                 conn->allow_signing = false;
 402                 conn->desire_signing = false;
 403                 conn->mandatory_signing = false;
 404                 break;
 405         case SMB_SIGNING_DEFAULT:
 406         case SMB_SIGNING_IF_REQUIRED:
 407                 /* if the server requires it */
 408                 conn->allow_signing = true;
 409                 conn->desire_signing = false;
 410                 conn->mandatory_signing = false;
 411                 break;
 412         case SMB_SIGNING_DESIRED:
 413                 /* if the server desires it */
 414                 conn->allow_signing = true;
 415                 conn->desire_signing = true;
 416                 conn->mandatory_signing = false;
 417                 break;
 418         case SMB_SIGNING_IPC_DEFAULT:
 419         case SMB_SIGNING_REQUIRED:
 420                 /* always */
 421                 conn->allow_signing = true;
 422                 conn->desire_signing = true;
 423                 conn->mandatory_signing = true;
 424                 break;
 425         }
 426
 427         conn->smb1.client.capabilities = smb1_capabilities;
 428         conn->smb1.client.max_xmit = UINT16_MAX;
 429
 430         conn->smb1.capabilities = conn->smb1.client.capabilities;
 431         conn->smb1.max_xmit = 1024;
 432
 433         conn->smb1.mid = 1;
 434
 435         /* initialise signing */
 436         conn->smb1.signing = smb1_signing_init(conn,
 437                                               conn->allow_signing,
 438                                               conn->desire_signing,
 439                                               conn->mandatory_signing);
 440         if (!conn->smb1.signing) {
 441                 goto error;
 442         }
 443
 444         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 445         if (conn->mandatory_signing) {
 446                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 447         }
 448         if (client_guid) {
 449                 conn->smb2.client.guid = *client_guid;
 450         }
 451         conn->smb2.client.capabilities = smb2_capabilities;
 452         if (smb3_capabilities != NULL) {
 453                 conn->smb2.client.smb3_capabilities = *smb3_capabilities;
 454         }
 455
 456         conn->smb2.cur_credits = 1;
 457         conn->smb2.max_credits = 0;
 458         conn->smb2.io_priority = 1;
 459
 460         /*
 461          * Samba and Windows servers accept a maximum of 16 MiB with a maximum
 462          * chunk length of 1 MiB.
 463          */
 464         conn->smb2.cc_chunk_len = 1024 * 1024;
 465         conn->smb2.cc_max_chunks = 16;
 466
 467         talloc_set_destructor(conn, smbXcli_conn_destructor);
 468         return conn;
 469
 470  error:
 471         TALLOC_FREE(conn);
 472         return NULL;
 473 }
 474
 475 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 476 {
 477         if (conn == NULL) {
 478                 return false;
 479         }
 480
 481         if (conn->sock_fd == -1) {
 482                 return false;
 483         }
 484
 485         return true;
 486 }
 487
 488 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 489 {
 490         return conn->protocol;
 491 }
 492
 493 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 494 {
 495         if (conn->protocol >= PROTOCOL_SMB2_02) {
 496                 return true;
 497         }
 498
 499         if (conn->smb1.capabilities & CAP_UNICODE) {
 500                 return true;
 501         }
 502
 503         return false;
 504 }
 505
 506 bool smbXcli_conn_signing_mandatory(struct smbXcli_conn *conn)
 507 {
 508         return conn->mandatory_signing;
 509 }
 510
 511 bool smbXcli_conn_have_posix(struct smbXcli_conn *conn)
 512 {
 513         if (conn->protocol >= PROTOCOL_SMB3_11) {
 514                 return conn->smb2.server.smb311_posix;
 515         }
 516         if (conn->protocol <= PROTOCOL_NT1) {
 517                 return (conn->smb1.capabilities & CAP_UNIX);
 518         }
 519         return false;
 520 }
 521
 522 /*
 523  * [MS-SMB] 2.2.2.3.5 - SMB1 support for passing through
 524  * query/set commands to the file system
 525  */
 526 bool smbXcli_conn_support_passthrough(struct smbXcli_conn *conn)
 527 {
 528         if (conn->protocol >= PROTOCOL_SMB2_02) {
 529                 return true;
 530         }
 531
 532         if (conn->smb1.capabilities & CAP_W2K_SMBS) {
 533                 return true;
 534         }
 535
 536         return false;
 537 }
 538
 539 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 540 {
 541         set_socket_options(conn->sock_fd, options);
 542 }
 543
 544 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 545 {
 546         return &conn->local_ss;
 547 }
 548
 549 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 550 {
 551         return &conn->remote_ss;
 552 }
 553
 554 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 555 {
 556         return conn->remote_name;
 557 }
 558
 559 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 560 {
 561         if (conn->protocol >= PROTOCOL_SMB2_02) {
 562                 /*
 563                  * TODO...
 564                  */
 565                 return 1;
 566         }
 567
 568         return conn->smb1.server.max_mux;
 569 }
 570
 571 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 572 {
 573         if (conn->protocol >= PROTOCOL_SMB2_02) {
 574                 return conn->smb2.server.system_time;
 575         }
 576
 577         return conn->smb1.server.system_time;
 578 }
 579
 580 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 581 {
 582         if (conn->protocol >= PROTOCOL_SMB2_02) {
 583                 return &conn->smb2.server.gss_blob;
 584         }
 585
 586         return &conn->smb1.server.gss_blob;
 587 }
 588
 589 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 590 {
 591         if (conn->protocol >= PROTOCOL_SMB2_02) {
 592                 return &conn->smb2.server.guid;
 593         }
 594
 595         return &conn->smb1.server.guid;
 596 }
 597
 598 bool smbXcli_conn_get_force_channel_sequence(struct smbXcli_conn *conn)
 599 {
 600         return conn->smb2.force_channel_sequence;
 601 }
 602
 603 void smbXcli_conn_set_force_channel_sequence(struct smbXcli_conn *conn,
 604                                              bool v)
 605 {
 606         conn->smb2.force_channel_sequence = v;
 607 }
 608
 609 struct smbXcli_conn_samba_suicide_state {
 610         struct smbXcli_conn *conn;
 611         struct iovec iov;
 612         uint8_t buf[9];
 613         struct tevent_req *write_req;
 614 };
 615
 616 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 617                                                enum tevent_req_state req_state);
 618 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 619
 620 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 621                                                    struct tevent_context *ev,
 622                                                    struct smbXcli_conn *conn,
 623                                                    uint8_t exitcode)
 624 {
 625         struct tevent_req *req, *subreq;
 626         struct smbXcli_conn_samba_suicide_state *state;
 627
 628         req = tevent_req_create(mem_ctx, &state,
 629                                 struct smbXcli_conn_samba_suicide_state);
 630         if (req == NULL) {
 631                 return NULL;
 632         }
 633         state->conn = conn;
 634         SIVAL(state->buf, 4, SMB_SUICIDE_PACKET);
 635         SCVAL(state->buf, 8, exitcode);
 636         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 637
 638         if (conn->suicide_req != NULL) {
 639                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 640                 return tevent_req_post(req, ev);
 641         }
 642
 643         state->iov.iov_base = state->buf;
 644         state->iov.iov_len = sizeof(state->buf);
 645
 646         subreq = writev_send(state, ev, conn->outgoing, conn->sock_fd,
 647                              false, &state->iov, 1);
 648         if (tevent_req_nomem(subreq, req)) {
 649                 return tevent_req_post(req, ev);
 650         }
 651         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 652         state->write_req = subreq;
 653
 654         tevent_req_set_cleanup_fn(req, smbXcli_conn_samba_suicide_cleanup);
 655
 656         /*
 657          * We need to use tevent_req_defer_callback()
 658          * in order to allow smbXcli_conn_disconnect()
 659          * to do a safe cleanup.
 660          */
 661         tevent_req_defer_callback(req, ev);
 662         conn->suicide_req = req;
 663
 664         return req;
 665 }
 666
 667 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 668                                                enum tevent_req_state req_state)
 669 {
 670         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 671                 req, struct smbXcli_conn_samba_suicide_state);
 672
 673         TALLOC_FREE(state->write_req);
 674
 675         if (state->conn == NULL) {
 676                 return;
 677         }
 678
 679         if (state->conn->suicide_req == req) {
 680                 state->conn->suicide_req = NULL;
 681         }
 682         state->conn = NULL;
 683 }
 684
 685 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 686 {
 687         struct tevent_req *req = tevent_req_callback_data(
 688                 subreq, struct tevent_req);
 689         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 690                 req, struct smbXcli_conn_samba_suicide_state);
 691         ssize_t nwritten;
 692         int err;
 693
 694         state->write_req = NULL;
 695
 696         nwritten = writev_recv(subreq, &err);
 697         TALLOC_FREE(subreq);
 698         if (nwritten == -1) {
 699                 /* here, we need to notify all pending requests */
 700                 NTSTATUS status = map_nt_error_from_unix_common(err);
 701                 smbXcli_conn_disconnect(state->conn, status);
 702                 return;
 703         }
 704         tevent_req_done(req);
 705 }
 706
 707 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 708 {
 709         return tevent_req_simple_recv_ntstatus(req);
 710 }
 711
 712 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 713                                     uint8_t exitcode)
 714 {
 715         TALLOC_CTX *frame = talloc_stackframe();
 716         struct tevent_context *ev;
 717         struct tevent_req *req;
 718         NTSTATUS status = NT_STATUS_NO_MEMORY;
 719         bool ok;
 720
 721         if (smbXcli_conn_has_async_calls(conn)) {
 722                 /*
 723                  * Can't use sync call while an async call is in flight
 724                  */
 725                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 726                 goto fail;
 727         }
 728         ev = samba_tevent_context_init(frame);
 729         if (ev == NULL) {
 730                 goto fail;
 731         }
 732         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 733         if (req == NULL) {
 734                 goto fail;
 735         }
 736         ok = tevent_req_poll_ntstatus(req, ev, &status);
 737         if (!ok) {
 738                 goto fail;
 739         }
 740         status = smbXcli_conn_samba_suicide_recv(req);
 741  fail:
 742         TALLOC_FREE(frame);
 743         return status;
 744 }
 745
 746 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 747 {
 748         return conn->smb1.capabilities;
 749 }
 750
 751 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 752 {
 753         return conn->smb1.max_xmit;
 754 }
 755
 756 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
 757 {
 758         size_t pending = talloc_array_length(conn->pending);
 759         uint16_t possible = conn->smb1.server.max_mux;
 760
 761         if (pending >= possible) {
 762                 return false;
 763         }
 764
 765         return true;
 766 }
 767
 768 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 769 {
 770         return conn->smb1.server.session_key;
 771 }
 772
 773 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 774 {
 775         return conn->smb1.server.challenge;
 776 }
 777
 778 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 779 {
 780         return conn->smb1.server.security_mode;
 781 }
 782
 783 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 784 {
 785         return conn->smb1.server.readbraw;
 786 }
 787
 788 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 789 {
 790         return conn->smb1.server.writebraw;
 791 }
 792
 793 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 794 {
 795         return conn->smb1.server.lockread;
 796 }
 797
 798 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 799 {
 800         return conn->smb1.server.writeunlock;
 801 }
 802
 803 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 804 {
 805         return conn->smb1.server.time_zone;
 806 }
 807
 808 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 809                                    const DATA_BLOB user_session_key,
 810                                    const DATA_BLOB response)
 811 {
 812         return smb1_signing_activate(conn->smb1.signing,
 813                                     user_session_key,
 814                                     response);
 815 }
 816
 817 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 818                                 const uint8_t *buf, uint32_t seqnum)
 819 {
 820         const uint8_t *hdr = buf + NBT_HDR_SIZE;
 821         size_t len = smb_len_nbt(buf);
 822
 823         return smb1_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
 824 }
 825
 826 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 827 {
 828         return smb1_signing_is_active(conn->smb1.signing);
 829 }
 830
 831 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 832                                  struct smb_trans_enc_state *es)
 833 {
 834         /* Replace the old state, if any. */
 835         if (conn->smb1.trans_enc) {
 836                 TALLOC_FREE(conn->smb1.trans_enc);
 837         }
 838         conn->smb1.trans_enc = es;
 839 }
 840
 841 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 842 {
 843         return common_encryption_on(conn->smb1.trans_enc);
 844 }
 845
 846
 847 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 848 {
 849         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 850         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 851
 852         if (NT_STATUS_IS_OK(status)) {
 853                 return NT_STATUS_OK;
 854         }
 855
 856         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 857                 return status;
 858         }
 859
 860         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 861 }
 862
 863 /**
 864  * Is the SMB command able to hold an AND_X successor
 865  * @param[in] cmd       The SMB command in question
 866  * @retval Can we add a chained request after "cmd"?
 867  */
 868 bool smb1cli_is_andx_req(uint8_t cmd)
 869 {
 870         switch (cmd) {
 871         case SMBtconX:
 872         case SMBlockingX:
 873         case SMBopenX:
 874         case SMBreadX:
 875         case SMBwriteX:
 876         case SMBsesssetupX:
 877         case SMBulogoffX:
 878         case SMBntcreateX:
 879                 return true;
 880                 break;
 881         default:
 882                 break;
 883         }
 884
 885         return false;
 886 }
 887
 888 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 889 {
 890         size_t num_pending = talloc_array_length(conn->pending);
 891         uint16_t result;
 892
 893         if (conn->protocol == PROTOCOL_NONE) {
 894                 /*
 895                  * This is what windows sends on the SMB1 Negprot request
 896                  * and some vendors reuse the SMB1 MID as SMB2 sequence number.
 897                  */
 898                 return 0;
 899         }
 900
 901         while (true) {
 902                 size_t i;
 903
 904                 result = conn->smb1.mid++;
 905                 if ((result == 0) || (result == 0xffff)) {
 906                         continue;
 907                 }
 908
 909                 for (i=0; i<num_pending; i++) {
 910                         if (result == smb1cli_req_mid(conn->pending[i])) {
 911                                 break;
 912                         }
 913                 }
 914
 915                 if (i == num_pending) {
 916                         return result;
 917                 }
 918         }
 919 }
 920
 921 static NTSTATUS smbXcli_req_cancel_write_req(struct tevent_req *req)
 922 {
 923         struct smbXcli_req_state *state =
 924                 tevent_req_data(req,
 925                 struct smbXcli_req_state);
 926         struct smbXcli_conn *conn = state->conn;
 927         size_t num_pending = talloc_array_length(conn->pending);
 928         ssize_t ret;
 929         int err;
 930         bool ok;
 931
 932         if (state->write_req == NULL) {
 933                 return NT_STATUS_OK;
 934         }
 935
 936         /*
 937          * Check if it's possible to cancel the request.
 938          * If the result is true it's not too late.
 939          * See writev_cancel().
 940          */
 941         ok = tevent_req_cancel(state->write_req);
 942         if (ok) {
 943                 TALLOC_FREE(state->write_req);
 944
 945                 if (conn->protocol >= PROTOCOL_SMB2_02) {
 946                         /*
 947                          * SMB2 has a sane signing state.
 948                          */
 949                         return NT_STATUS_OK;
 950                 }
 951
 952                 if (num_pending > 1) {
 953                         /*
 954                          * We have more pending requests following us.  This
 955                          * means the signing state will be broken for them.
 956                          *
 957                          * As a solution we could add the requests directly to
 958                          * our outgoing queue and do the signing in the trigger
 959                          * function and then use writev_send() without passing a
 960                          * queue.  That way we'll only sign packets we're most
 961                          * likely send to the wire.
 962                          */
 963                         return NT_STATUS_REQUEST_OUT_OF_SEQUENCE;
 964                 }
 965
 966                 /*
 967                  * If we're the only request that's
 968                  * pending, we're able to recover the signing
 969                  * state.
 970                  */
 971                 smb1_signing_cancel_reply(conn->smb1.signing,
 972                                          state->smb1.one_way_seqnum);
 973                 return NT_STATUS_OK;
 974         }
 975
 976         ret = writev_recv(state->write_req, &err);
 977         TALLOC_FREE(state->write_req);
 978         if (ret == -1) {
 979                 return map_nt_error_from_unix_common(err);
 980         }
 981
 982         return NT_STATUS_OK;
 983 }
 984
 985 void smbXcli_req_unset_pending(struct tevent_req *req)
 986 {
 987         struct smbXcli_req_state *state =
 988                 tevent_req_data(req,
 989                 struct smbXcli_req_state);
 990         struct smbXcli_conn *conn = state->conn;
 991         size_t num_pending = talloc_array_length(conn->pending);
 992         size_t i;
 993         NTSTATUS cancel_status;
 994
 995         cancel_status = smbXcli_req_cancel_write_req(req);
 996
 997         if (state->smb1.mid != 0) {
 998                 /*
 999                  * This is a [nt]trans[2] request which waits
1000                  * for more than one reply.
1001                  */
1002                 if (!NT_STATUS_IS_OK(cancel_status)) {
1003                         /*
1004                          * If the write_req cancel didn't work
1005                          * we can't use the connection anymore.
1006                          */
1007                         smbXcli_conn_disconnect(conn, cancel_status);
1008                         return;
1009                 }
1010                 return;
1011         }
1012
1013         tevent_req_set_cleanup_fn(req, NULL);
1014
1015         if (num_pending == 1) {
1016                 /*
1017                  * The pending read_smb tevent_req is a child of
1018                  * conn->pending. So if nothing is pending anymore, we need to
1019                  * delete the socket read fde.
1020                  */
1021                 /* TODO: smbXcli_conn_cancel_read_req */
1022                 TALLOC_FREE(conn->pending);
1023                 conn->read_smb_req = NULL;
1024
1025                 if (!NT_STATUS_IS_OK(cancel_status)) {
1026                         /*
1027                          * If the write_req cancel didn't work
1028                          * we can't use the connection anymore.
1029                          */
1030                         smbXcli_conn_disconnect(conn, cancel_status);
1031                         return;
1032                 }
1033                 return;
1034         }
1035
1036         for (i=0; i<num_pending; i++) {
1037                 if (req == conn->pending[i]) {
1038                         break;
1039                 }
1040         }
1041         if (i == num_pending) {
1042                 /*
1043                  * Something's seriously broken. Just returning here is the
1044                  * right thing nevertheless, the point of this routine is to
1045                  * remove ourselves from conn->pending.
1046                  */
1047
1048                 if (!NT_STATUS_IS_OK(cancel_status)) {
1049                         /*
1050                          * If the write_req cancel didn't work
1051                          * we can't use the connection anymore.
1052                          */
1053                         smbXcli_conn_disconnect(conn, cancel_status);
1054                         return;
1055                 }
1056                 return;
1057         }
1058
1059         /*
1060          * Remove ourselves from the conn->pending array
1061          */
1062         for (; i < (num_pending - 1); i++) {
1063                 conn->pending[i] = conn->pending[i+1];
1064         }
1065
1066         /*
1067          * No NULL check here, we're shrinking by sizeof(void *), and
1068          * talloc_realloc just adjusts the size for this.
1069          */
1070         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
1071                                        num_pending - 1);
1072
1073         if (!NT_STATUS_IS_OK(cancel_status)) {
1074                 /*
1075                  * If the write_req cancel didn't work
1076                  * we can't use the connection anymore.
1077                  */
1078                 smbXcli_conn_disconnect(conn, cancel_status);
1079                 return;
1080         }
1081         return;
1082 }
1083
1084 static void smbXcli_req_cleanup(struct tevent_req *req,
1085                                 enum tevent_req_state req_state)
1086 {
1087         struct smbXcli_req_state *state =
1088                 tevent_req_data(req,
1089                 struct smbXcli_req_state);
1090         struct smbXcli_conn *conn = state->conn;
1091         NTSTATUS cancel_status;
1092
1093         switch (req_state) {
1094         case TEVENT_REQ_RECEIVED:
1095                 /*
1096                  * Make sure we really remove it from
1097                  * the pending array on destruction.
1098                  *
1099                  * smbXcli_req_unset_pending() calls
1100                  * smbXcli_req_cancel_write_req() internal
1101                  */
1102                 state->smb1.mid = 0;
1103                 smbXcli_req_unset_pending(req);
1104                 return;
1105         default:
1106                 cancel_status = smbXcli_req_cancel_write_req(req);
1107                 if (!NT_STATUS_IS_OK(cancel_status)) {
1108                         /*
1109                          * If the write_req cancel didn't work
1110                          * we can't use the connection anymore.
1111                          */
1112                         smbXcli_conn_disconnect(conn, cancel_status);
1113                         return;
1114                 }
1115                 return;
1116         }
1117 }
1118
1119 static bool smb1cli_req_cancel(struct tevent_req *req);
1120 static bool smb2cli_req_cancel(struct tevent_req *req);
1121
1122 static bool smbXcli_req_cancel(struct tevent_req *req)
1123 {
1124         struct smbXcli_req_state *state =
1125                 tevent_req_data(req,
1126                 struct smbXcli_req_state);
1127
1128         if (!smbXcli_conn_is_connected(state->conn)) {
1129                 return false;
1130         }
1131
1132         if (state->conn->protocol == PROTOCOL_NONE) {
1133                 return false;
1134         }
1135
1136         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
1137                 return smb2cli_req_cancel(req);
1138         }
1139
1140         return smb1cli_req_cancel(req);
1141 }
1142
1143 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
1144
1145 bool smbXcli_req_set_pending(struct tevent_req *req)
1146 {
1147         struct smbXcli_req_state *state =
1148                 tevent_req_data(req,
1149                 struct smbXcli_req_state);
1150         struct smbXcli_conn *conn;
1151         struct tevent_req **pending;
1152         size_t num_pending;
1153
1154         conn = state->conn;
1155
1156         if (!smbXcli_conn_is_connected(conn)) {
1157                 return false;
1158         }
1159
1160         num_pending = talloc_array_length(conn->pending);
1161
1162         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
1163                                  num_pending+1);
1164         if (pending == NULL) {
1165                 return false;
1166         }
1167         pending[num_pending] = req;
1168         conn->pending = pending;
1169         tevent_req_set_cleanup_fn(req, smbXcli_req_cleanup);
1170         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1171
1172         if (!smbXcli_conn_receive_next(conn)) {
1173                 /*
1174                  * the caller should notify the current request
1175                  *
1176                  * And all other pending requests get notified
1177                  * by smbXcli_conn_disconnect().
1178                  */
1179                 smbXcli_req_unset_pending(req);
1180                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1181                 return false;
1182         }
1183
1184         return true;
1185 }
1186
1187 static void smbXcli_conn_received(struct tevent_req *subreq);
1188
1189 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
1190 {
1191         size_t num_pending = talloc_array_length(conn->pending);
1192         struct tevent_req *req;
1193         struct smbXcli_req_state *state;
1194
1195         if (conn->read_smb_req != NULL) {
1196                 return true;
1197         }
1198
1199         if (num_pending == 0) {
1200                 if (conn->smb2.mid < UINT64_MAX) {
1201                         /* no more pending requests, so we are done for now */
1202                         return true;
1203                 }
1204
1205                 /*
1206                  * If there are no more SMB2 requests possible,
1207                  * because we are out of message ids,
1208                  * we need to disconnect.
1209                  */
1210                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
1211                 return true;
1212         }
1213
1214         req = conn->pending[0];
1215         state = tevent_req_data(req, struct smbXcli_req_state);
1216
1217         /*
1218          * We're the first ones, add the read_smb request that waits for the
1219          * answer from the server
1220          */
1221         conn->read_smb_req = read_smb_send(conn->pending,
1222                                            state->ev,
1223                                            conn->sock_fd);
1224         if (conn->read_smb_req == NULL) {
1225                 return false;
1226         }
1227         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
1228         return true;
1229 }
1230
1231 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
1232 {
1233         struct smbXcli_session *session;
1234         int sock_fd = conn->sock_fd;
1235
1236         tevent_queue_stop(conn->outgoing);
1237
1238         conn->sock_fd = -1;
1239
1240         session = conn->sessions;
1241         if (talloc_array_length(conn->pending) == 0) {
1242                 /*
1243                  * if we do not have pending requests
1244                  * there is no need to update the channel_sequence
1245                  */
1246                 session = NULL;
1247         }
1248         for (; session; session = session->next) {
1249                 smb2cli_session_increment_channel_sequence(session);
1250         }
1251
1252         if (conn->suicide_req != NULL) {
1253                 /*
1254                  * smbXcli_conn_samba_suicide_send()
1255                  * used tevent_req_defer_callback() already.
1256                  */
1257                 if (!NT_STATUS_IS_OK(status)) {
1258                         tevent_req_nterror(conn->suicide_req, status);
1259                 }
1260                 conn->suicide_req = NULL;
1261         }
1262
1263         /*
1264          * Cancel all pending requests. We do not do a for-loop walking
1265          * conn->pending because that array changes in
1266          * smbXcli_req_unset_pending.
1267          */
1268         while (conn->pending != NULL &&
1269                talloc_array_length(conn->pending) > 0) {
1270                 struct tevent_req *req;
1271                 struct smbXcli_req_state *state;
1272                 struct tevent_req **chain;
1273                 size_t num_chained;
1274                 size_t i;
1275
1276                 req = conn->pending[0];
1277                 state = tevent_req_data(req, struct smbXcli_req_state);
1278
1279                 if (state->smb1.chained_requests == NULL) {
1280                         bool in_progress;
1281
1282                         /*
1283                          * We're dead. No point waiting for trans2
1284                          * replies.
1285                          */
1286                         state->smb1.mid = 0;
1287
1288                         smbXcli_req_unset_pending(req);
1289
1290                         if (NT_STATUS_IS_OK(status)) {
1291                                 /* do not notify the callers */
1292                                 continue;
1293                         }
1294
1295                         in_progress = tevent_req_is_in_progress(req);
1296                         if (!in_progress) {
1297                                 /*
1298                                  * already finished
1299                                  */
1300                                 continue;
1301                         }
1302
1303                         /*
1304                          * we need to defer the callback, because we may notify
1305                          * more then one caller.
1306                          */
1307                         tevent_req_defer_callback(req, state->ev);
1308                         tevent_req_nterror(req, status);
1309                         continue;
1310                 }
1311
1312                 chain = talloc_move(conn, &state->smb1.chained_requests);
1313                 num_chained = talloc_array_length(chain);
1314
1315                 for (i=0; i<num_chained; i++) {
1316                         bool in_progress;
1317
1318                         req = chain[i];
1319                         state = tevent_req_data(req, struct smbXcli_req_state);
1320
1321                         /*
1322                          * We're dead. No point waiting for trans2
1323                          * replies.
1324                          */
1325                         state->smb1.mid = 0;
1326
1327                         smbXcli_req_unset_pending(req);
1328
1329                         if (NT_STATUS_IS_OK(status)) {
1330                                 /* do not notify the callers */
1331                                 continue;
1332                         }
1333
1334                         in_progress = tevent_req_is_in_progress(req);
1335                         if (!in_progress) {
1336                                 /*
1337                                  * already finished
1338                                  */
1339                                 continue;
1340                         }
1341
1342                         /*
1343                          * we need to defer the callback, because we may notify
1344                          * more than one caller.
1345                          */
1346                         tevent_req_defer_callback(req, state->ev);
1347                         tevent_req_nterror(req, status);
1348                 }
1349                 TALLOC_FREE(chain);
1350         }
1351
1352         if (sock_fd != -1) {
1353                 close(sock_fd);
1354         }
1355 }
1356
1357 /*
1358  * Fetch a smb request's mid. Only valid after the request has been sent by
1359  * smb1cli_req_send().
1360  */
1361 uint16_t smb1cli_req_mid(struct tevent_req *req)
1362 {
1363         struct smbXcli_req_state *state =
1364                 tevent_req_data(req,
1365                 struct smbXcli_req_state);
1366
1367         if (state->smb1.mid != 0) {
1368                 return state->smb1.mid;
1369         }
1370
1371         return SVAL(state->smb1.hdr, HDR_MID);
1372 }
1373
1374 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1375 {
1376         struct smbXcli_req_state *state =
1377                 tevent_req_data(req,
1378                 struct smbXcli_req_state);
1379
1380         state->smb1.mid = mid;
1381 }
1382
1383 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1384 {
1385         struct smbXcli_req_state *state =
1386                 tevent_req_data(req,
1387                 struct smbXcli_req_state);
1388
1389         return state->smb1.seqnum;
1390 }
1391
1392 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1393 {
1394         struct smbXcli_req_state *state =
1395                 tevent_req_data(req,
1396                 struct smbXcli_req_state);
1397
1398         state->smb1.seqnum = seqnum;
1399 }
1400
1401 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1402 {
1403         ssize_t ret = iov_buflen(iov, count);
1404
1405         /* Ignore the overflow case for now ... */
1406         return ret;
1407 }
1408
1409 static void smb1cli_req_flags(enum protocol_types protocol,
1410                               uint32_t smb1_capabilities,
1411                               uint8_t smb_command,
1412                               uint8_t additional_flags,
1413                               uint8_t clear_flags,
1414                               uint8_t *_flags,
1415                               uint16_t additional_flags2,
1416                               uint16_t clear_flags2,
1417                               uint16_t *_flags2)
1418 {
1419         uint8_t flags = 0;
1420         uint16_t flags2 = 0;
1421
1422         if (protocol >= PROTOCOL_LANMAN1) {
1423                 flags |= FLAG_CASELESS_PATHNAMES;
1424                 flags |= FLAG_CANONICAL_PATHNAMES;
1425         }
1426
1427         if (protocol >= PROTOCOL_LANMAN2) {
1428                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1429                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1430         }
1431
1432         if (protocol >= PROTOCOL_NT1) {
1433                 flags2 |= FLAGS2_IS_LONG_NAME;
1434
1435                 if (smb1_capabilities & CAP_UNICODE) {
1436                         flags2 |= FLAGS2_UNICODE_STRINGS;
1437                 }
1438                 if (smb1_capabilities & CAP_STATUS32) {
1439                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1440                 }
1441                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1442                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1443                 }
1444         }
1445
1446         flags |= additional_flags;
1447         flags &= ~clear_flags;
1448         flags2 |= additional_flags2;
1449         flags2 &= ~clear_flags2;
1450
1451         *_flags = flags;
1452         *_flags2 = flags2;
1453 }
1454
1455 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1456
1457 static bool smb1cli_req_cancel(struct tevent_req *req)
1458 {
1459         struct smbXcli_req_state *state =
1460                 tevent_req_data(req,
1461                 struct smbXcli_req_state);
1462         uint8_t flags;
1463         uint16_t flags2;
1464         uint32_t pid;
1465         uint16_t mid;
1466         struct tevent_req *subreq;
1467         NTSTATUS status;
1468
1469         flags = CVAL(state->smb1.hdr, HDR_FLG);
1470         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1471         pid  = SVAL(state->smb1.hdr, HDR_PID);
1472         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1473         mid = SVAL(state->smb1.hdr, HDR_MID);
1474
1475         subreq = smb1cli_req_create(state, state->ev,
1476                                     state->conn,
1477                                     SMBntcancel,
1478                                     flags, 0,
1479                                     flags2, 0,
1480                                     0, /* timeout */
1481                                     pid,
1482                                     state->tcon,
1483                                     state->session,
1484                                     0, NULL, /* vwv */
1485                                     0, NULL); /* bytes */
1486         if (subreq == NULL) {
1487                 return false;
1488         }
1489         smb1cli_req_set_mid(subreq, mid);
1490
1491         status = smb1cli_req_chain_submit(&subreq, 1);
1492         if (!NT_STATUS_IS_OK(status)) {
1493                 TALLOC_FREE(subreq);
1494                 return false;
1495         }
1496         smb1cli_req_set_mid(subreq, 0);
1497
1498         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1499
1500         return true;
1501 }
1502
1503 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1504 {
1505         /* we do not care about the result */
1506         TALLOC_FREE(subreq);
1507 }
1508
1509 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1510                                       struct tevent_context *ev,
1511                                       struct smbXcli_conn *conn,
1512                                       uint8_t smb_command,
1513                                       uint8_t additional_flags,
1514                                       uint8_t clear_flags,
1515                                       uint16_t additional_flags2,
1516                                       uint16_t clear_flags2,
1517                                       uint32_t timeout_msec,
1518                                       uint32_t pid,
1519                                       struct smbXcli_tcon *tcon,
1520                                       struct smbXcli_session *session,
1521                                       uint8_t wct, uint16_t *vwv,
1522                                       int iov_count,
1523                                       struct iovec *bytes_iov)
1524 {
1525         struct tevent_req *req;
1526         struct smbXcli_req_state *state;
1527         uint8_t flags = 0;
1528         uint16_t flags2 = 0;
1529         uint16_t uid = 0;
1530         uint16_t tid = 0;
1531         ssize_t num_bytes;
1532
1533         if (iov_count > MAX_SMB_IOV) {
1534                 /*
1535                  * Should not happen :-)
1536                  */
1537                 return NULL;
1538         }
1539
1540         req = tevent_req_create(mem_ctx, &state,
1541                                 struct smbXcli_req_state);
1542         if (req == NULL) {
1543                 return NULL;
1544         }
1545         state->ev = ev;
1546         state->conn = conn;
1547         state->session = session;
1548         state->tcon = tcon;
1549
1550         if (session) {
1551                 uid = session->smb1.session_id;
1552         }
1553
1554         if (tcon) {
1555                 tid = tcon->smb1.tcon_id;
1556
1557                 if (tcon->fs_attributes & FILE_CASE_SENSITIVE_SEARCH) {
1558                         clear_flags |= FLAG_CASELESS_PATHNAMES;
1559                 } else {
1560                         /* Default setting, case insensitive. */
1561                         additional_flags |= FLAG_CASELESS_PATHNAMES;
1562                 }
1563
1564                 if (smbXcli_conn_dfs_supported(conn) &&
1565                     smbXcli_tcon_is_dfs_share(tcon))
1566                 {
1567                         additional_flags2 |= FLAGS2_DFS_PATHNAMES;
1568                 }
1569         }
1570
1571         state->smb1.recv_cmd = 0xFF;
1572         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1573         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1574         if (state->smb1.recv_iov == NULL) {
1575                 TALLOC_FREE(req);
1576                 return NULL;
1577         }
1578
1579         smb1cli_req_flags(conn->protocol,
1580                           conn->smb1.capabilities,
1581                           smb_command,
1582                           additional_flags,
1583                           clear_flags,
1584                           &flags,
1585                           additional_flags2,
1586                           clear_flags2,
1587                           &flags2);
1588
1589         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1590         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1591         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1592         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1593         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1594         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1595         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1596         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1597         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1598         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1599         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1600
1601         state->smb1.vwv = vwv;
1602
1603         num_bytes = iov_buflen(bytes_iov, iov_count);
1604         if (num_bytes == -1) {
1605                 /*
1606                  * I'd love to add a check for num_bytes<=UINT16_MAX here, but
1607                  * the smbclient->samba connections can lie and transfer more.
1608                  */
1609                 TALLOC_FREE(req);
1610                 return NULL;
1611         }
1612
1613         SSVAL(state->smb1.bytecount_buf, 0, num_bytes);
1614
1615         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1616         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1617         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1618         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1619         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1620         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1621         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1622         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1623
1624         if (iov_count != 0) {
1625                 memcpy(&state->smb1.iov[4], bytes_iov,
1626                        iov_count * sizeof(*bytes_iov));
1627         }
1628         state->smb1.iov_count = iov_count + 4;
1629
1630         if (timeout_msec > 0) {
1631                 state->endtime = timeval_current_ofs_msec(timeout_msec);
1632                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
1633                         return req;
1634                 }
1635         }
1636
1637         switch (smb_command) {
1638         case SMBtranss:
1639         case SMBtranss2:
1640         case SMBnttranss:
1641                 state->one_way = true;
1642                 break;
1643         case SMBntcancel:
1644                 state->one_way = true;
1645                 state->smb1.one_way_seqnum = true;
1646                 break;
1647         case SMBlockingX:
1648                 if ((wct == 8) &&
1649                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1650                         state->one_way = true;
1651                 }
1652                 break;
1653         }
1654
1655         return req;
1656 }
1657
1658 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1659                                    struct iovec *iov, int iov_count,
1660                                    uint32_t *seqnum,
1661                                    bool one_way_seqnum)
1662 {
1663         TALLOC_CTX *frame = NULL;
1664         NTSTATUS status;
1665         uint8_t *buf;
1666
1667         /*
1668          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1669          * iovec directly. MD5Update would do that just fine.
1670          */
1671
1672         if (iov_count < 4) {
1673                 return NT_STATUS_INVALID_PARAMETER_MIX;
1674         }
1675         if (iov[0].iov_len != NBT_HDR_SIZE) {
1676                 return NT_STATUS_INVALID_PARAMETER_MIX;
1677         }
1678         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1679                 return NT_STATUS_INVALID_PARAMETER_MIX;
1680         }
1681         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1682                 return NT_STATUS_INVALID_PARAMETER_MIX;
1683         }
1684         if (iov[3].iov_len != sizeof(uint16_t)) {
1685                 return NT_STATUS_INVALID_PARAMETER_MIX;
1686         }
1687
1688         frame = talloc_stackframe();
1689
1690         buf = iov_concat(frame, &iov[1], iov_count - 1);
1691         if (buf == NULL) {
1692                 return NT_STATUS_NO_MEMORY;
1693         }
1694
1695         *seqnum = smb1_signing_next_seqnum(conn->smb1.signing,
1696                                           one_way_seqnum);
1697         status = smb1_signing_sign_pdu(conn->smb1.signing,
1698                                       buf,
1699                                       talloc_get_size(buf),
1700                                       *seqnum);
1701         if (!NT_STATUS_IS_OK(status)) {
1702                 return status;
1703         }
1704         memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1705
1706         TALLOC_FREE(frame);
1707         return NT_STATUS_OK;
1708 }
1709
1710 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1711 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1712                                                TALLOC_CTX *tmp_mem,
1713                                                uint8_t *inbuf);
1714
1715 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1716                                           struct smbXcli_req_state *state,
1717                                           struct iovec *iov, int iov_count)
1718 {
1719         struct tevent_req *subreq;
1720         NTSTATUS status;
1721         uint8_t cmd;
1722         uint16_t mid;
1723         ssize_t nbtlen;
1724
1725         if (!smbXcli_conn_is_connected(state->conn)) {
1726                 return NT_STATUS_CONNECTION_DISCONNECTED;
1727         }
1728
1729         if (state->conn->protocol > PROTOCOL_NT1) {
1730                 DBG_ERR("called for dialect[%s] server[%s]\n",
1731                         smb_protocol_types_string(state->conn->protocol),
1732                         smbXcli_conn_remote_name(state->conn));
1733                 return NT_STATUS_REVISION_MISMATCH;
1734         }
1735
1736         if (iov_count < 4) {
1737                 return NT_STATUS_INVALID_PARAMETER_MIX;
1738         }
1739         if (iov[0].iov_len != NBT_HDR_SIZE) {
1740                 return NT_STATUS_INVALID_PARAMETER_MIX;
1741         }
1742         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1743                 return NT_STATUS_INVALID_PARAMETER_MIX;
1744         }
1745         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1746                 return NT_STATUS_INVALID_PARAMETER_MIX;
1747         }
1748         if (iov[3].iov_len != sizeof(uint16_t)) {
1749                 return NT_STATUS_INVALID_PARAMETER_MIX;
1750         }
1751
1752         cmd = CVAL(iov[1].iov_base, HDR_COM);
1753         if (cmd == SMBreadBraw) {
1754                 if (smbXcli_conn_has_async_calls(state->conn)) {
1755                         return NT_STATUS_INVALID_PARAMETER_MIX;
1756                 }
1757                 state->conn->smb1.read_braw_req = req;
1758         }
1759
1760         if (state->smb1.mid != 0) {
1761                 mid = state->smb1.mid;
1762         } else {
1763                 mid = smb1cli_alloc_mid(state->conn);
1764         }
1765         SSVAL(iov[1].iov_base, HDR_MID, mid);
1766
1767         nbtlen = iov_buflen(&iov[1], iov_count-1);
1768         if ((nbtlen == -1) || (nbtlen > 0x1FFFF)) {
1769                 return NT_STATUS_INVALID_PARAMETER_MIX;
1770         }
1771
1772         _smb_setlen_nbt(iov[0].iov_base, nbtlen);
1773
1774         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1775                                     &state->smb1.seqnum,
1776                                     state->smb1.one_way_seqnum);
1777
1778         if (!NT_STATUS_IS_OK(status)) {
1779                 return status;
1780         }
1781
1782         /*
1783          * If we supported multiple encryption contexts
1784          * here we'd look up based on tid.
1785          */
1786         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1787                 char *buf, *enc_buf;
1788
1789                 buf = (char *)iov_concat(talloc_tos(), iov, iov_count);
1790                 if (buf == NULL) {
1791                         return NT_STATUS_NO_MEMORY;
1792                 }
1793                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1794                                                (char *)buf, &enc_buf);
1795                 TALLOC_FREE(buf);
1796                 if (!NT_STATUS_IS_OK(status)) {
1797                         DEBUG(0, ("Error in encrypting client message: %s\n",
1798                                   nt_errstr(status)));
1799                         return status;
1800                 }
1801                 buf = (char *)talloc_memdup(state, enc_buf,
1802                                             smb_len_nbt(enc_buf)+4);
1803                 SAFE_FREE(enc_buf);
1804                 if (buf == NULL) {
1805                         return NT_STATUS_NO_MEMORY;
1806                 }
1807                 iov[0].iov_base = (void *)buf;
1808                 iov[0].iov_len = talloc_get_size(buf);
1809                 iov_count = 1;
1810         }
1811
1812         if (state->conn->dispatch_incoming == NULL) {
1813                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1814         }
1815
1816         if (!smbXcli_req_set_pending(req)) {
1817                 return NT_STATUS_NO_MEMORY;
1818         }
1819
1820         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1821
1822         subreq = writev_send(state, state->ev, state->conn->outgoing,
1823                              state->conn->sock_fd, false, iov, iov_count);
1824         if (subreq == NULL) {
1825                 return NT_STATUS_NO_MEMORY;
1826         }
1827         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1828         state->write_req = subreq;
1829
1830         return NT_STATUS_OK;
1831 }
1832
1833 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1834                                     struct tevent_context *ev,
1835                                     struct smbXcli_conn *conn,
1836                                     uint8_t smb_command,
1837                                     uint8_t additional_flags,
1838                                     uint8_t clear_flags,
1839                                     uint16_t additional_flags2,
1840                                     uint16_t clear_flags2,
1841                                     uint32_t timeout_msec,
1842                                     uint32_t pid,
1843                                     struct smbXcli_tcon *tcon,
1844                                     struct smbXcli_session *session,
1845                                     uint8_t wct, uint16_t *vwv,
1846                                     uint32_t num_bytes,
1847                                     const uint8_t *bytes)
1848 {
1849         struct tevent_req *req;
1850         struct iovec iov;
1851         NTSTATUS status;
1852
1853         iov.iov_base = discard_const_p(void, bytes);
1854         iov.iov_len = num_bytes;
1855
1856         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1857                                  additional_flags, clear_flags,
1858                                  additional_flags2, clear_flags2,
1859                                  timeout_msec,
1860                                  pid, tcon, session,
1861                                  wct, vwv, 1, &iov);
1862         if (req == NULL) {
1863                 return NULL;
1864         }
1865         if (!tevent_req_is_in_progress(req)) {
1866                 return tevent_req_post(req, ev);
1867         }
1868         status = smb1cli_req_chain_submit(&req, 1);
1869         if (tevent_req_nterror(req, status)) {
1870                 return tevent_req_post(req, ev);
1871         }
1872         return req;
1873 }
1874
1875 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1876 {
1877         struct tevent_req *req =
1878                 tevent_req_callback_data(subreq,
1879                 struct tevent_req);
1880         struct smbXcli_req_state *state =
1881                 tevent_req_data(req,
1882                 struct smbXcli_req_state);
1883         ssize_t nwritten;
1884         int err;
1885
1886         state->write_req = NULL;
1887
1888         nwritten = writev_recv(subreq, &err);
1889         TALLOC_FREE(subreq);
1890         if (nwritten == -1) {
1891                 /* here, we need to notify all pending requests */
1892                 NTSTATUS status = map_nt_error_from_unix_common(err);
1893                 smbXcli_conn_disconnect(state->conn, status);
1894                 return;
1895         }
1896
1897         if (state->one_way) {
1898                 state->inbuf = NULL;
1899                 tevent_req_done(req);
1900                 return;
1901         }
1902 }
1903
1904 static void smbXcli_conn_received(struct tevent_req *subreq)
1905 {
1906         struct smbXcli_conn *conn =
1907                 tevent_req_callback_data(subreq,
1908                 struct smbXcli_conn);
1909         TALLOC_CTX *frame = talloc_stackframe();
1910         NTSTATUS status;
1911         uint8_t *inbuf;
1912         ssize_t received;
1913         int err;
1914
1915         if (subreq != conn->read_smb_req) {
1916                 DEBUG(1, ("Internal error: cli_smb_received called with "
1917                           "unexpected subreq\n"));
1918                 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1919                 TALLOC_FREE(frame);
1920                 return;
1921         }
1922         conn->read_smb_req = NULL;
1923
1924         received = read_smb_recv(subreq, frame, &inbuf, &err);
1925         TALLOC_FREE(subreq);
1926         if (received == -1) {
1927                 status = map_nt_error_from_unix_common(err);
1928                 smbXcli_conn_disconnect(conn, status);
1929                 TALLOC_FREE(frame);
1930                 return;
1931         }
1932
1933         status = conn->dispatch_incoming(conn, frame, inbuf);
1934         TALLOC_FREE(frame);
1935         if (NT_STATUS_IS_OK(status)) {
1936                 /*
1937                  * We should not do any more processing
1938                  * as the dispatch function called
1939                  * tevent_req_done().
1940                  */
1941                 return;
1942         }
1943
1944         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1945                 /*
1946                  * We got an error, so notify all pending requests
1947                  */
1948                 smbXcli_conn_disconnect(conn, status);
1949                 return;
1950         }
1951
1952         /*
1953          * We got NT_STATUS_RETRY, so we may ask for a
1954          * next incoming pdu.
1955          */
1956         if (!smbXcli_conn_receive_next(conn)) {
1957                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1958         }
1959 }
1960
1961 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1962                                           struct iovec **piov, int *pnum_iov)
1963 {
1964         struct iovec *iov;
1965         size_t num_iov;
1966         size_t buflen;
1967         size_t taken;
1968         size_t remaining;
1969         uint8_t *hdr;
1970         uint8_t cmd;
1971         uint32_t wct_ofs;
1972         NTSTATUS status;
1973         size_t min_size = MIN_SMB_SIZE;
1974
1975         buflen = smb_len_tcp(buf);
1976         taken = 0;
1977
1978         hdr = buf + NBT_HDR_SIZE;
1979
1980         status = smb1cli_pull_raw_error(hdr);
1981         if (NT_STATUS_IS_ERR(status)) {
1982                 /*
1983                  * This is an ugly hack to support OS/2
1984                  * which skips the byte_count in the DATA block
1985                  * on some error responses.
1986                  *
1987                  * See bug #9096
1988                  */
1989                 min_size -= sizeof(uint16_t);
1990         }
1991
1992         if (buflen < min_size) {
1993                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1994         }
1995
1996         /*
1997          * This returns iovec elements in the following order:
1998          *
1999          * - SMB header
2000          *
2001          * - Parameter Block
2002          * - Data Block
2003          *
2004          * - Parameter Block
2005          * - Data Block
2006          *
2007          * - Parameter Block
2008          * - Data Block
2009          */
2010         num_iov = 1;
2011
2012         iov = talloc_array(mem_ctx, struct iovec, num_iov);
2013         if (iov == NULL) {
2014                 return NT_STATUS_NO_MEMORY;
2015         }
2016         iov[0].iov_base = hdr;
2017         iov[0].iov_len = HDR_WCT;
2018         taken += HDR_WCT;
2019
2020         cmd = CVAL(hdr, HDR_COM);
2021         wct_ofs = HDR_WCT;
2022
2023         while (true) {
2024                 size_t len = buflen - taken;
2025                 struct iovec *cur;
2026                 struct iovec *iov_tmp;
2027                 uint8_t wct;
2028                 uint32_t bcc_ofs;
2029                 uint16_t bcc;
2030                 size_t needed;
2031
2032                 /*
2033                  * we need at least WCT
2034                  */
2035                 needed = sizeof(uint8_t);
2036                 if (len < needed) {
2037                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2038                                    __location__, (int)len, (int)needed));
2039                         goto inval;
2040                 }
2041
2042                 /*
2043                  * Now we check if the specified words are there
2044                  */
2045                 wct = CVAL(hdr, wct_ofs);
2046                 needed += wct * sizeof(uint16_t);
2047                 if (len < needed) {
2048                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2049                                    __location__, (int)len, (int)needed));
2050                         goto inval;
2051                 }
2052
2053                 if ((num_iov == 1) &&
2054                     (len == needed) &&
2055                     NT_STATUS_IS_ERR(status))
2056                 {
2057                         /*
2058                          * This is an ugly hack to support OS/2
2059                          * which skips the byte_count in the DATA block
2060                          * on some error responses.
2061                          *
2062                          * See bug #9096
2063                          */
2064                         iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2065                                                  num_iov + 2);
2066                         if (iov_tmp == NULL) {
2067                                 TALLOC_FREE(iov);
2068                                 return NT_STATUS_NO_MEMORY;
2069                         }
2070                         iov = iov_tmp;
2071                         cur = &iov[num_iov];
2072                         num_iov += 2;
2073
2074                         cur[0].iov_len = 0;
2075                         cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2076                         cur[1].iov_len = 0;
2077                         cur[1].iov_base = cur[0].iov_base;
2078
2079                         taken += needed;
2080                         break;
2081                 }
2082
2083                 /*
2084                  * we need at least BCC
2085                  */
2086                 needed += sizeof(uint16_t);
2087                 if (len < needed) {
2088                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2089                                    __location__, (int)len, (int)needed));
2090                         goto inval;
2091                 }
2092
2093                 /*
2094                  * Now we check if the specified bytes are there
2095                  */
2096                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
2097                 bcc = SVAL(hdr, bcc_ofs);
2098                 needed += bcc * sizeof(uint8_t);
2099                 if (len < needed) {
2100                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2101                                    __location__, (int)len, (int)needed));
2102                         goto inval;
2103                 }
2104
2105                 /*
2106                  * we allocate 2 iovec structures for words and bytes
2107                  */
2108                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2109                                          num_iov + 2);
2110                 if (iov_tmp == NULL) {
2111                         TALLOC_FREE(iov);
2112                         return NT_STATUS_NO_MEMORY;
2113                 }
2114                 iov = iov_tmp;
2115                 cur = &iov[num_iov];
2116                 num_iov += 2;
2117
2118                 cur[0].iov_len = wct * sizeof(uint16_t);
2119                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2120                 cur[1].iov_len = bcc * sizeof(uint8_t);
2121                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
2122
2123                 taken += needed;
2124
2125                 if (!smb1cli_is_andx_req(cmd)) {
2126                         /*
2127                          * If the current command does not have AndX chanining
2128                          * we are done.
2129                          */
2130                         break;
2131                 }
2132
2133                 if (wct == 0 && bcc == 0) {
2134                         /*
2135                          * An empty response also ends the chain,
2136                          * most likely with an error.
2137                          */
2138                         break;
2139                 }
2140
2141                 if (wct < 2) {
2142                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
2143                                    __location__, (int)wct, (int)cmd));
2144                         goto inval;
2145                 }
2146                 cmd = CVAL(cur[0].iov_base, 0);
2147                 if (cmd == 0xFF) {
2148                         /*
2149                          * If it is the end of the chain we are also done.
2150                          */
2151                         break;
2152                 }
2153                 wct_ofs = SVAL(cur[0].iov_base, 2);
2154
2155                 if (wct_ofs < taken) {
2156                         goto inval;
2157                 }
2158                 if (wct_ofs > buflen) {
2159                         goto inval;
2160                 }
2161
2162                 /*
2163                  * we consumed everything up to the start of the next
2164                  * parameter block.
2165                  */
2166                 taken = wct_ofs;
2167         }
2168
2169         remaining = buflen - taken;
2170
2171         if (remaining > 0 && num_iov >= 3) {
2172                 /*
2173                  * The last DATA block gets the remaining
2174                  * bytes, this is needed to support
2175                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
2176                  */
2177                 iov[num_iov-1].iov_len += remaining;
2178         }
2179
2180         *piov = iov;
2181         *pnum_iov = num_iov;
2182         return NT_STATUS_OK;
2183
2184 inval:
2185         TALLOC_FREE(iov);
2186         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2187 }
2188
2189 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2190                                                TALLOC_CTX *tmp_mem,
2191                                                uint8_t *inbuf)
2192 {
2193         struct tevent_req *req;
2194         struct smbXcli_req_state *state;
2195         NTSTATUS status;
2196         size_t num_pending;
2197         size_t i;
2198         uint8_t cmd;
2199         uint16_t mid;
2200         bool oplock_break;
2201         uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
2202         size_t len = smb_len_tcp(inbuf);
2203         struct iovec *iov = NULL;
2204         int num_iov = 0;
2205         struct tevent_req **chain = NULL;
2206         size_t num_chained = 0;
2207         size_t num_responses = 0;
2208
2209         if (conn->smb1.read_braw_req != NULL) {
2210                 req = conn->smb1.read_braw_req;
2211                 conn->smb1.read_braw_req = NULL;
2212                 state = tevent_req_data(req, struct smbXcli_req_state);
2213
2214                 smbXcli_req_unset_pending(req);
2215
2216                 if (state->smb1.recv_iov == NULL) {
2217                         /*
2218                          * For requests with more than
2219                          * one response, we have to readd the
2220                          * recv_iov array.
2221                          */
2222                         state->smb1.recv_iov = talloc_zero_array(state,
2223                                                                  struct iovec,
2224                                                                  3);
2225                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2226                                 return NT_STATUS_OK;
2227                         }
2228                 }
2229
2230                 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
2231                 state->smb1.recv_iov[0].iov_len = len;
2232                 ZERO_STRUCT(state->smb1.recv_iov[1]);
2233                 ZERO_STRUCT(state->smb1.recv_iov[2]);
2234
2235                 state->smb1.recv_cmd = SMBreadBraw;
2236                 state->smb1.recv_status = NT_STATUS_OK;
2237                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2238
2239                 tevent_req_done(req);
2240                 return NT_STATUS_OK;
2241         }
2242
2243         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
2244             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
2245                 DEBUG(10, ("Got non-SMB PDU\n"));
2246                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2247         }
2248
2249         /*
2250          * If we supported multiple encryption contexts
2251          * here we'd look up based on tid.
2252          */
2253         if (common_encryption_on(conn->smb1.trans_enc)
2254             && (CVAL(inbuf, 0) == 0)) {
2255                 uint16_t enc_ctx_num;
2256
2257                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
2258                 if (!NT_STATUS_IS_OK(status)) {
2259                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
2260                                    nt_errstr(status)));
2261                         return status;
2262                 }
2263
2264                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
2265                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
2266                                    enc_ctx_num,
2267                                    conn->smb1.trans_enc->enc_ctx_num));
2268                         return NT_STATUS_INVALID_HANDLE;
2269                 }
2270
2271                 status = common_decrypt_buffer(conn->smb1.trans_enc,
2272                                                (char *)inbuf);
2273                 if (!NT_STATUS_IS_OK(status)) {
2274                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
2275                                    nt_errstr(status)));
2276                         return status;
2277                 }
2278                 inhdr = inbuf + NBT_HDR_SIZE;
2279                 len = smb_len_nbt(inbuf);
2280         }
2281
2282         mid = SVAL(inhdr, HDR_MID);
2283         num_pending = talloc_array_length(conn->pending);
2284
2285         for (i=0; i<num_pending; i++) {
2286                 if (mid == smb1cli_req_mid(conn->pending[i])) {
2287                         break;
2288                 }
2289         }
2290         if (i == num_pending) {
2291                 /* Dump unexpected reply */
2292                 return NT_STATUS_RETRY;
2293         }
2294
2295         oplock_break = false;
2296
2297         if (mid == 0xffff) {
2298                 /*
2299                  * Paranoia checks that this is really an oplock break request.
2300                  */
2301                 oplock_break = (len == 51); /* hdr + 8 words */
2302                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
2303                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
2304                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
2305                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
2306
2307                 if (!oplock_break) {
2308                         /* Dump unexpected reply */
2309                         return NT_STATUS_RETRY;
2310                 }
2311         }
2312
2313         req = conn->pending[i];
2314         state = tevent_req_data(req, struct smbXcli_req_state);
2315
2316         if (!oplock_break /* oplock breaks are not signed */
2317             && !smb1_signing_check_pdu(conn->smb1.signing,
2318                                       inhdr, len, state->smb1.seqnum+1)) {
2319                 DEBUG(10, ("cli_check_sign_mac failed\n"));
2320                 return NT_STATUS_ACCESS_DENIED;
2321         }
2322
2323         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
2324                                            &iov, &num_iov);
2325         if (!NT_STATUS_IS_OK(status)) {
2326                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
2327                           nt_errstr(status)));
2328                 return status;
2329         }
2330
2331         cmd = CVAL(inhdr, HDR_COM);
2332         status = smb1cli_pull_raw_error(inhdr);
2333
2334         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2335             (state->session != NULL) && state->session->disconnect_expired)
2336         {
2337                 /*
2338                  * this should be a short term hack
2339                  * until the upper layers have implemented
2340                  * re-authentication.
2341                  */
2342                 return status;
2343         }
2344
2345         if (state->smb1.chained_requests == NULL) {
2346                 if (num_iov != 3) {
2347                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2348                 }
2349
2350                 smbXcli_req_unset_pending(req);
2351
2352                 if (state->smb1.recv_iov == NULL) {
2353                         /*
2354                          * For requests with more than
2355                          * one response, we have to readd the
2356                          * recv_iov array.
2357                          */
2358                         state->smb1.recv_iov = talloc_zero_array(state,
2359                                                                  struct iovec,
2360                                                                  3);
2361                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2362                                 return NT_STATUS_OK;
2363                         }
2364                 }
2365
2366                 state->smb1.recv_cmd = cmd;
2367                 state->smb1.recv_status = status;
2368                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2369
2370                 state->smb1.recv_iov[0] = iov[0];
2371                 state->smb1.recv_iov[1] = iov[1];
2372                 state->smb1.recv_iov[2] = iov[2];
2373
2374                 if (talloc_array_length(conn->pending) == 0) {
2375                         tevent_req_done(req);
2376                         return NT_STATUS_OK;
2377                 }
2378
2379                 tevent_req_defer_callback(req, state->ev);
2380                 tevent_req_done(req);
2381                 return NT_STATUS_RETRY;
2382         }
2383
2384         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2385         num_chained = talloc_array_length(chain);
2386         num_responses = (num_iov - 1)/2;
2387
2388         if (num_responses > num_chained) {
2389                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2390         }
2391
2392         for (i=0; i<num_chained; i++) {
2393                 size_t iov_idx = 1 + (i*2);
2394                 struct iovec *cur = &iov[iov_idx];
2395                 uint8_t *inbuf_ref;
2396
2397                 req = chain[i];
2398                 state = tevent_req_data(req, struct smbXcli_req_state);
2399
2400                 smbXcli_req_unset_pending(req);
2401
2402                 /*
2403                  * as we finish multiple requests here
2404                  * we need to defer the callbacks as
2405                  * they could destroy our current stack state.
2406                  */
2407                 tevent_req_defer_callback(req, state->ev);
2408
2409                 if (i >= num_responses) {
2410                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2411                         continue;
2412                 }
2413
2414                 if (state->smb1.recv_iov == NULL) {
2415                         /*
2416                          * For requests with more than
2417                          * one response, we have to readd the
2418                          * recv_iov array.
2419                          */
2420                         state->smb1.recv_iov = talloc_zero_array(state,
2421                                                                  struct iovec,
2422                                                                  3);
2423                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2424                                 continue;
2425                         }
2426                 }
2427
2428                 state->smb1.recv_cmd = cmd;
2429
2430                 if (i == (num_responses - 1)) {
2431                         /*
2432                          * The last request in the chain gets the status
2433                          */
2434                         state->smb1.recv_status = status;
2435                 } else {
2436                         cmd = CVAL(cur[0].iov_base, 0);
2437                         state->smb1.recv_status = NT_STATUS_OK;
2438                 }
2439
2440                 state->inbuf = inbuf;
2441
2442                 /*
2443                  * Note: here we use talloc_reference() in a way
2444                  *       that does not expose it to the caller.
2445                  */
2446                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2447                 if (tevent_req_nomem(inbuf_ref, req)) {
2448                         continue;
2449                 }
2450
2451                 /* copy the related buffers */
2452                 state->smb1.recv_iov[0] = iov[0];
2453                 state->smb1.recv_iov[1] = cur[0];
2454                 state->smb1.recv_iov[2] = cur[1];
2455
2456                 tevent_req_done(req);
2457         }
2458
2459         return NT_STATUS_RETRY;
2460 }
2461
2462 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2463                           TALLOC_CTX *mem_ctx,
2464                           struct iovec **piov,
2465                           uint8_t **phdr,
2466                           uint8_t *pwct,
2467                           uint16_t **pvwv,
2468                           uint32_t *pvwv_offset,
2469                           uint32_t *pnum_bytes,
2470                           uint8_t **pbytes,
2471                           uint32_t *pbytes_offset,
2472                           uint8_t **pinbuf,
2473                           const struct smb1cli_req_expected_response *expected,
2474                           size_t num_expected)
2475 {
2476         struct smbXcli_req_state *state =
2477                 tevent_req_data(req,
2478                 struct smbXcli_req_state);
2479         NTSTATUS status = NT_STATUS_OK;
2480         struct iovec *recv_iov = NULL;
2481         uint8_t *hdr = NULL;
2482         uint8_t wct = 0;
2483         uint32_t vwv_offset = 0;
2484         uint16_t *vwv = NULL;
2485         uint32_t num_bytes = 0;
2486         uint32_t bytes_offset = 0;
2487         uint8_t *bytes = NULL;
2488         size_t i;
2489         bool found_status = false;
2490         bool found_size = false;
2491
2492         if (piov != NULL) {
2493                 *piov = NULL;
2494         }
2495         if (phdr != NULL) {
2496                 *phdr = 0;
2497         }
2498         if (pwct != NULL) {
2499                 *pwct = 0;
2500         }
2501         if (pvwv != NULL) {
2502                 *pvwv = NULL;
2503         }
2504         if (pvwv_offset != NULL) {
2505                 *pvwv_offset = 0;
2506         }
2507         if (pnum_bytes != NULL) {
2508                 *pnum_bytes = 0;
2509         }
2510         if (pbytes != NULL) {
2511                 *pbytes = NULL;
2512         }
2513         if (pbytes_offset != NULL) {
2514                 *pbytes_offset = 0;
2515         }
2516         if (pinbuf != NULL) {
2517                 *pinbuf = NULL;
2518         }
2519
2520         if (state->inbuf != NULL) {
2521                 recv_iov = state->smb1.recv_iov;
2522                 state->smb1.recv_iov = NULL;
2523                 if (state->smb1.recv_cmd != SMBreadBraw) {
2524                         hdr = (uint8_t *)recv_iov[0].iov_base;
2525                         wct = recv_iov[1].iov_len/2;
2526                         vwv = (uint16_t *)recv_iov[1].iov_base;
2527                         vwv_offset = PTR_DIFF(vwv, hdr);
2528                         num_bytes = recv_iov[2].iov_len;
2529                         bytes = (uint8_t *)recv_iov[2].iov_base;
2530                         bytes_offset = PTR_DIFF(bytes, hdr);
2531                 }
2532         }
2533
2534         if (tevent_req_is_nterror(req, &status)) {
2535                 for (i=0; i < num_expected; i++) {
2536                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2537                                 found_status = true;
2538                                 break;
2539                         }
2540                 }
2541
2542                 if (found_status) {
2543                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2544                 }
2545
2546                 return status;
2547         }
2548
2549         if (num_expected == 0) {
2550                 found_status = true;
2551                 found_size = true;
2552         }
2553
2554         status = state->smb1.recv_status;
2555
2556         for (i=0; i < num_expected; i++) {
2557                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2558                         continue;
2559                 }
2560
2561                 found_status = true;
2562                 if (expected[i].wct == 0) {
2563                         found_size = true;
2564                         break;
2565                 }
2566
2567                 if (expected[i].wct == wct) {
2568                         found_size = true;
2569                         break;
2570                 }
2571         }
2572
2573         if (!found_status) {
2574                 return status;
2575         }
2576
2577         if (!found_size) {
2578                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2579         }
2580
2581         if (piov != NULL) {
2582                 *piov = talloc_move(mem_ctx, &recv_iov);
2583         }
2584
2585         if (phdr != NULL) {
2586                 *phdr = hdr;
2587         }
2588         if (pwct != NULL) {
2589                 *pwct = wct;
2590         }
2591         if (pvwv != NULL) {
2592                 *pvwv = vwv;
2593         }
2594         if (pvwv_offset != NULL) {
2595                 *pvwv_offset = vwv_offset;
2596         }
2597         if (pnum_bytes != NULL) {
2598                 *pnum_bytes = num_bytes;
2599         }
2600         if (pbytes != NULL) {
2601                 *pbytes = bytes;
2602         }
2603         if (pbytes_offset != NULL) {
2604                 *pbytes_offset = bytes_offset;
2605         }
2606         if (pinbuf != NULL) {
2607                 *pinbuf = state->inbuf;
2608         }
2609
2610         return status;
2611 }
2612
2613 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2614 {
2615         size_t wct_ofs;
2616         int i;
2617
2618         wct_ofs = HDR_WCT;
2619
2620         for (i=0; i<num_reqs; i++) {
2621                 struct smbXcli_req_state *state;
2622                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2623                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2624                                            state->smb1.iov_count-2);
2625                 wct_ofs = (wct_ofs + 3) & ~3;
2626         }
2627         return wct_ofs;
2628 }
2629
2630 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2631 {
2632         struct smbXcli_req_state *first_state =
2633                 tevent_req_data(reqs[0],
2634                 struct smbXcli_req_state);
2635         struct smbXcli_req_state *state;
2636         size_t wct_offset;
2637         size_t chain_padding = 0;
2638         int i, iovlen;
2639         struct iovec *iov = NULL;
2640         struct iovec *this_iov;
2641         NTSTATUS status;
2642         ssize_t nbt_len;
2643
2644         if (num_reqs == 1) {
2645                 return smb1cli_req_writev_submit(reqs[0], first_state,
2646                                                  first_state->smb1.iov,
2647                                                  first_state->smb1.iov_count);
2648         }
2649
2650         iovlen = 0;
2651         for (i=0; i<num_reqs; i++) {
2652                 if (!tevent_req_is_in_progress(reqs[i])) {
2653                         return NT_STATUS_INTERNAL_ERROR;
2654                 }
2655
2656                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2657
2658                 if (state->smb1.iov_count < 4) {
2659                         return NT_STATUS_INVALID_PARAMETER_MIX;
2660                 }
2661
2662                 if (i == 0) {
2663                         /*
2664                          * The NBT and SMB header
2665                          */
2666                         iovlen += 2;
2667                 } else {
2668                         /*
2669                          * Chain padding
2670                          */
2671                         iovlen += 1;
2672                 }
2673
2674                 /*
2675                  * words and bytes
2676                  */
2677                 iovlen += state->smb1.iov_count - 2;
2678         }
2679
2680         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2681         if (iov == NULL) {
2682                 return NT_STATUS_NO_MEMORY;
2683         }
2684
2685         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2686                 first_state, reqs, sizeof(*reqs) * num_reqs);
2687         if (first_state->smb1.chained_requests == NULL) {
2688                 TALLOC_FREE(iov);
2689                 return NT_STATUS_NO_MEMORY;
2690         }
2691
2692         wct_offset = HDR_WCT;
2693         this_iov = iov;
2694
2695         for (i=0; i<num_reqs; i++) {
2696                 size_t next_padding = 0;
2697                 uint16_t *vwv;
2698
2699                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2700
2701                 if (i < num_reqs-1) {
2702                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2703                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2704                                 TALLOC_FREE(iov);
2705                                 TALLOC_FREE(first_state->smb1.chained_requests);
2706                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2707                         }
2708                 }
2709
2710                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2711                                               state->smb1.iov_count-2) + 1;
2712                 if ((wct_offset % 4) != 0) {
2713                         next_padding = 4 - (wct_offset % 4);
2714                 }
2715                 wct_offset += next_padding;
2716                 vwv = state->smb1.vwv;
2717
2718                 if (i < num_reqs-1) {
2719                         struct smbXcli_req_state *next_state =
2720                                 tevent_req_data(reqs[i+1],
2721                                 struct smbXcli_req_state);
2722                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2723                         SCVAL(vwv+0, 1, 0);
2724                         SSVAL(vwv+1, 0, wct_offset);
2725                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2726                         /* properly end the chain */
2727                         SCVAL(vwv+0, 0, 0xff);
2728                         SCVAL(vwv+0, 1, 0xff);
2729                         SSVAL(vwv+1, 0, 0);
2730                 }
2731
2732                 if (i == 0) {
2733                         /*
2734                          * The NBT and SMB header
2735                          */
2736                         this_iov[0] = state->smb1.iov[0];
2737                         this_iov[1] = state->smb1.iov[1];
2738                         this_iov += 2;
2739                 } else {
2740                         /*
2741                          * This one is a bit subtle. We have to add
2742                          * chain_padding bytes between the requests, and we
2743                          * have to also include the wct field of the
2744                          * subsequent requests. We use the subsequent header
2745                          * for the padding, it contains the wct field in its
2746                          * last byte.
2747                          */
2748                         this_iov[0].iov_len = chain_padding+1;
2749                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2750                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2751                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2752                         this_iov += 1;
2753                 }
2754
2755                 /*
2756                  * copy the words and bytes
2757                  */
2758                 memcpy(this_iov, state->smb1.iov+2,
2759                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2760                 this_iov += state->smb1.iov_count - 2;
2761                 chain_padding = next_padding;
2762         }
2763
2764         nbt_len = iov_buflen(&iov[1], iovlen-1);
2765         if ((nbt_len == -1) || (nbt_len > first_state->conn->smb1.max_xmit)) {
2766                 TALLOC_FREE(iov);
2767                 TALLOC_FREE(first_state->smb1.chained_requests);
2768                 return NT_STATUS_INVALID_PARAMETER_MIX;
2769         }
2770
2771         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2772         if (!NT_STATUS_IS_OK(status)) {
2773                 TALLOC_FREE(iov);
2774                 TALLOC_FREE(first_state->smb1.chained_requests);
2775                 return status;
2776         }
2777
2778         return NT_STATUS_OK;
2779 }
2780
2781 struct tevent_queue *smbXcli_conn_send_queue(struct smbXcli_conn *conn)
2782 {
2783         return conn->outgoing;
2784 }
2785
2786 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2787 {
2788         return ((tevent_queue_length(conn->outgoing) != 0)
2789                 || (talloc_array_length(conn->pending) != 0));
2790 }
2791
2792 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn)
2793 {
2794         if (conn->protocol >= PROTOCOL_SMB2_02) {
2795                 return (smb2cli_conn_server_capabilities(conn) & SMB2_CAP_DFS);
2796         }
2797
2798         return (smb1cli_conn_capabilities(conn) & CAP_DFS);
2799 }
2800
2801 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2802 {
2803         uint16_t credits = 1;
2804
2805         if (conn->smb2.cur_credits == 0) {
2806                 if (max_dyn_len != NULL) {
2807                         *max_dyn_len = 0;
2808                 }
2809                 return false;
2810         }
2811
2812         if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2813                 credits = conn->smb2.cur_credits;
2814         }
2815
2816         if (max_dyn_len != NULL) {
2817                 *max_dyn_len = credits * 65536;
2818         }
2819
2820         return true;
2821 }
2822
2823 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2824 {
2825         return conn->smb2.server.capabilities;
2826 }
2827
2828 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2829 {
2830         return conn->smb2.server.security_mode;
2831 }
2832
2833 uint16_t smb2cli_conn_server_signing_algo(struct smbXcli_conn *conn)
2834 {
2835         return conn->smb2.server.sign_algo;
2836 }
2837
2838 uint16_t smb2cli_conn_server_encryption_algo(struct smbXcli_conn *conn)
2839 {
2840         return conn->smb2.server.cipher;
2841 }
2842
2843 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2844 {
2845         return conn->smb2.server.max_trans_size;
2846 }
2847
2848 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2849 {
2850         return conn->smb2.server.max_read_size;
2851 }
2852
2853 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2854 {
2855         return conn->smb2.server.max_write_size;
2856 }
2857
2858 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2859                                   uint16_t max_credits)
2860 {
2861         conn->smb2.max_credits = max_credits;
2862 }
2863
2864 uint16_t smb2cli_conn_get_cur_credits(struct smbXcli_conn *conn)
2865 {
2866         return conn->smb2.cur_credits;
2867 }
2868
2869 uint8_t smb2cli_conn_get_io_priority(struct smbXcli_conn *conn)
2870 {
2871         if (conn->protocol < PROTOCOL_SMB3_11) {
2872                 return 0;
2873         }
2874
2875         return conn->smb2.io_priority;
2876 }
2877
2878 void smb2cli_conn_set_io_priority(struct smbXcli_conn *conn,
2879                                   uint8_t io_priority)
2880 {
2881         conn->smb2.io_priority = io_priority;
2882 }
2883
2884 uint32_t smb2cli_conn_cc_chunk_len(struct smbXcli_conn *conn)
2885 {
2886         return conn->smb2.cc_chunk_len;
2887 }
2888
2889 void smb2cli_conn_set_cc_chunk_len(struct smbXcli_conn *conn,
2890                                     uint32_t chunk_len)
2891 {
2892         conn->smb2.cc_chunk_len = chunk_len;
2893 }
2894
2895 uint32_t smb2cli_conn_cc_max_chunks(struct smbXcli_conn *conn)
2896 {
2897         return conn->smb2.cc_max_chunks;
2898 }
2899
2900 void smb2cli_conn_set_cc_max_chunks(struct smbXcli_conn *conn,
2901                                     uint32_t max_chunks)
2902 {
2903         conn->smb2.cc_max_chunks = max_chunks;
2904 }
2905
2906 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2907
2908 static bool smb2cli_req_cancel(struct tevent_req *req)
2909 {
2910         struct smbXcli_req_state *state =
2911                 tevent_req_data(req,
2912                 struct smbXcli_req_state);
2913         struct smbXcli_tcon *tcon = state->tcon;
2914         struct smbXcli_session *session = state->session;
2915         uint8_t *fixed = state->smb2.pad;
2916         uint16_t fixed_len = 4;
2917         struct tevent_req *subreq;
2918         struct smbXcli_req_state *substate;
2919         NTSTATUS status;
2920
2921         if (state->smb2.cancel_mid == UINT64_MAX) {
2922                 /*
2923                  * We already send a cancel,
2924                  * make sure we don't do it
2925                  * twice, otherwise we may
2926                  * expose the same NONCE for
2927                  * AES-128-GMAC signing
2928                  */
2929                 return true;
2930         }
2931
2932         SSVAL(fixed, 0, 0x04);
2933         SSVAL(fixed, 2, 0);
2934
2935         subreq = smb2cli_req_create(state, state->ev,
2936                                     state->conn,
2937                                     SMB2_OP_CANCEL,
2938                                     0, 0, /* flags */
2939                                     0, /* timeout */
2940                                     tcon, session,
2941                                     fixed, fixed_len,
2942                                     NULL, 0, 0);
2943         if (subreq == NULL) {
2944                 return false;
2945         }
2946         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2947
2948         substate->smb2.cancel_mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
2949
2950         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, state->smb2.cancel_flags);
2951         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, state->smb2.cancel_mid);
2952         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, state->smb2.cancel_aid);
2953
2954         /*
2955          * remember that we don't send a cancel again
2956          */
2957         state->smb2.cancel_mid = UINT64_MAX;
2958
2959         status = smb2cli_req_compound_submit(&subreq, 1);
2960         if (!NT_STATUS_IS_OK(status)) {
2961                 TALLOC_FREE(subreq);
2962                 return false;
2963         }
2964
2965         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2966
2967         return true;
2968 }
2969
2970 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2971 {
2972         /* we do not care about the result */
2973         TALLOC_FREE(subreq);
2974 }
2975
2976 struct timeval smbXcli_req_endtime(struct tevent_req *req)
2977 {
2978         struct smbXcli_req_state *state = tevent_req_data(
2979                 req, struct smbXcli_req_state);
2980
2981         return state->endtime;
2982 }
2983
2984 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2985                                       struct tevent_context *ev,
2986                                       struct smbXcli_conn *conn,
2987                                       uint16_t cmd,
2988                                       uint32_t additional_flags,
2989                                       uint32_t clear_flags,
2990                                       uint32_t timeout_msec,
2991                                       struct smbXcli_tcon *tcon,
2992                                       struct smbXcli_session *session,
2993                                       const uint8_t *fixed,
2994                                       uint16_t fixed_len,
2995                                       const uint8_t *dyn,
2996                                       uint32_t dyn_len,
2997                                       uint32_t max_dyn_len)
2998 {
2999         struct tevent_req *req;
3000         struct smbXcli_req_state *state;
3001         uint32_t flags = 0;
3002         uint32_t tid = 0;
3003         uint64_t uid = 0;
3004         bool use_channel_sequence = conn->smb2.force_channel_sequence;
3005         uint16_t channel_sequence = 0;
3006         bool use_replay_flag = false;
3007         enum protocol_types proto = smbXcli_conn_protocol(conn);
3008
3009         req = tevent_req_create(mem_ctx, &state,
3010                                 struct smbXcli_req_state);
3011         if (req == NULL) {
3012                 return NULL;
3013         }
3014
3015         if ((proto > PROTOCOL_NONE) && (proto < PROTOCOL_SMB2_02)) {
3016                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
3017                 return req;
3018         }
3019
3020         state->ev = ev;
3021         state->conn = conn;
3022         state->session = session;
3023         state->tcon = tcon;
3024
3025         if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
3026                 use_channel_sequence = true;
3027         } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
3028                 use_channel_sequence = true;
3029         }
3030
3031         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_00) {
3032                 use_replay_flag = true;
3033         }
3034
3035         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_11) {
3036                 flags |= SMB2_PRIORITY_VALUE_TO_MASK(conn->smb2.io_priority);
3037         }
3038
3039         if (session) {
3040                 uid = session->smb2->session_id;
3041
3042                 if (use_channel_sequence) {
3043                         channel_sequence = session->smb2->channel_sequence;
3044                 }
3045
3046                 if (use_replay_flag && session->smb2->replay_active) {
3047                         additional_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
3048                 }
3049
3050                 state->smb2.should_sign = session->smb2->should_sign;
3051                 state->smb2.should_encrypt = session->smb2->should_encrypt;
3052                 state->smb2.require_signed_response =
3053                         session->smb2->require_signed_response;
3054
3055                 if (cmd == SMB2_OP_SESSSETUP &&
3056                     !smb2_signing_key_valid(session->smb2_channel.signing_key) &&
3057                     smb2_signing_key_valid(session->smb2->signing_key))
3058                 {
3059                         /*
3060                          * a session bind needs to be signed
3061                          */
3062                         state->smb2.should_sign = true;
3063                 }
3064
3065                 if (cmd == SMB2_OP_SESSSETUP &&
3066                     !smb2_signing_key_valid(session->smb2_channel.signing_key)) {
3067                         state->smb2.should_encrypt = false;
3068                 }
3069
3070                 if (additional_flags & SMB2_HDR_FLAG_SIGNED) {
3071                         if (!smb2_signing_key_valid(session->smb2_channel.signing_key)) {
3072                                 tevent_req_nterror(req, NT_STATUS_NO_USER_SESSION_KEY);
3073                                 return req;
3074                         }
3075
3076                         additional_flags &= ~SMB2_HDR_FLAG_SIGNED;
3077                         state->smb2.should_sign = true;
3078                 }
3079         }
3080
3081         if (tcon) {
3082                 tid = tcon->smb2.tcon_id;
3083
3084                 if (tcon->smb2.should_sign) {
3085                         state->smb2.should_sign = true;
3086                 }
3087                 if (tcon->smb2.should_encrypt) {
3088                         state->smb2.should_encrypt = true;
3089                 }
3090         }
3091
3092         if (state->smb2.should_encrypt) {
3093                 state->smb2.should_sign = false;
3094         }
3095
3096         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
3097         if (tevent_req_nomem(state->smb2.recv_iov, req)) {
3098                 return req;
3099         }
3100
3101         flags |= additional_flags;
3102         flags &= ~clear_flags;
3103
3104         state->smb2.fixed = fixed;
3105         state->smb2.fixed_len = fixed_len;
3106         state->smb2.dyn = dyn;
3107         state->smb2.dyn_len = dyn_len;
3108         state->smb2.max_dyn_len = max_dyn_len;
3109
3110         if (state->smb2.should_encrypt) {
3111                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3112                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
3113         }
3114
3115         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
3116         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
3117         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
3118         SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
3119         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
3120         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            0); /* reserved */
3121         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
3122         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
3123
3124         switch (cmd) {
3125         case SMB2_OP_CANCEL:
3126                 state->one_way = true;
3127                 break;
3128         case SMB2_OP_BREAK:
3129                 /*
3130                  * If this is a dummy request, it will have
3131                  * UINT64_MAX as message id.
3132                  * If we send on break acknowledgement,
3133                  * this gets overwritten later.
3134                  */
3135                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
3136                 break;
3137         }
3138
3139         if (timeout_msec > 0) {
3140                 state->endtime = timeval_current_ofs_msec(timeout_msec);
3141                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
3142                         return req;
3143                 }
3144         }
3145
3146         return req;
3147 }
3148
3149 void smb2cli_req_set_notify_async(struct tevent_req *req)
3150 {
3151         struct smbXcli_req_state *state =
3152                 tevent_req_data(req,
3153                 struct smbXcli_req_state);
3154
3155         state->smb2.notify_async = true;
3156 }
3157
3158 static void smb2cli_req_writev_done(struct tevent_req *subreq);
3159 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3160                                                TALLOC_CTX *tmp_mem,
3161                                                uint8_t *inbuf);
3162
3163 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
3164                                      int num_reqs)
3165 {
3166         struct smbXcli_req_state *state;
3167         struct tevent_req *subreq;
3168         struct iovec *iov;
3169         int i, num_iov, nbt_len;
3170         int tf_iov = -1;
3171         struct smb2_signing_key *encryption_key = NULL;
3172         uint64_t encryption_session_id = 0;
3173         uint64_t nonce_high = UINT64_MAX;
3174         uint64_t nonce_low = UINT64_MAX;
3175
3176         /*
3177          * 1 for the nbt length, optional TRANSFORM
3178          * per request: HDR, fixed, dyn, padding
3179          * -1 because the last one does not need padding
3180          */
3181
3182         iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
3183         if (iov == NULL) {
3184                 return NT_STATUS_NO_MEMORY;
3185         }
3186
3187         num_iov = 1;
3188         nbt_len = 0;
3189
3190         /*
3191          * the session of the first request that requires encryption
3192          * specifies the encryption key.
3193          */
3194         for (i=0; i<num_reqs; i++) {
3195                 if (!tevent_req_is_in_progress(reqs[i])) {
3196                         return NT_STATUS_INTERNAL_ERROR;
3197                 }
3198
3199                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3200
3201                 if (!smbXcli_conn_is_connected(state->conn)) {
3202                         return NT_STATUS_CONNECTION_DISCONNECTED;
3203                 }
3204
3205                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3206                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3207                         return NT_STATUS_REVISION_MISMATCH;
3208                 }
3209
3210                 if (state->session == NULL) {
3211                         continue;
3212                 }
3213
3214                 if (!state->smb2.should_encrypt) {
3215                         continue;
3216                 }
3217
3218                 encryption_key = state->session->smb2->encryption_key;
3219                 if (!smb2_signing_key_valid(encryption_key)) {
3220                         return NT_STATUS_INVALID_PARAMETER_MIX;
3221                 }
3222
3223                 encryption_session_id = state->session->smb2->session_id;
3224
3225                 state->session->smb2->nonce_low += 1;
3226                 if (state->session->smb2->nonce_low == 0) {
3227                         state->session->smb2->nonce_high += 1;
3228                         state->session->smb2->nonce_low += 1;
3229                 }
3230
3231                 /*
3232                  * CCM and GCM algorithms must never have their
3233                  * nonce wrap, or the security of the whole
3234                  * communication and the keys is destroyed.
3235                  * We must drop the connection once we have
3236                  * transferred too much data.
3237                  *
3238                  * NOTE: We assume nonces greater than 8 bytes.
3239                  */
3240                 if (state->session->smb2->nonce_high >=
3241                     state->session->smb2->nonce_high_max)
3242                 {
3243                         return NT_STATUS_ENCRYPTION_FAILED;
3244                 }
3245
3246                 nonce_high = state->session->smb2->nonce_high_random;
3247                 nonce_high += state->session->smb2->nonce_high;
3248                 nonce_low = state->session->smb2->nonce_low;
3249
3250                 tf_iov = num_iov;
3251                 iov[num_iov].iov_base = state->smb2.transform;
3252                 iov[num_iov].iov_len  = sizeof(state->smb2.transform);
3253                 num_iov += 1;
3254
3255                 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3256                 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
3257                       nonce_low);
3258                 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
3259                       nonce_high);
3260                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
3261                       encryption_session_id);
3262
3263                 nbt_len += SMB2_TF_HDR_SIZE;
3264                 break;
3265         }
3266
3267         for (i=0; i<num_reqs; i++) {
3268                 int hdr_iov;
3269                 size_t reqlen;
3270                 bool ret;
3271                 uint16_t opcode;
3272                 uint64_t avail;
3273                 uint16_t charge;
3274                 uint16_t credits;
3275                 uint64_t mid;
3276                 struct smb2_signing_key *signing_key = NULL;
3277
3278                 if (!tevent_req_is_in_progress(reqs[i])) {
3279                         return NT_STATUS_INTERNAL_ERROR;
3280                 }
3281
3282                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3283
3284                 if (!smbXcli_conn_is_connected(state->conn)) {
3285                         return NT_STATUS_CONNECTION_DISCONNECTED;
3286                 }
3287
3288                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3289                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3290                         return NT_STATUS_REVISION_MISMATCH;
3291                 }
3292
3293                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3294                 if (opcode == SMB2_OP_CANCEL) {
3295                         goto skip_credits;
3296                 }
3297
3298                 avail = UINT64_MAX - state->conn->smb2.mid;
3299                 if (avail < 1) {
3300                         return NT_STATUS_CONNECTION_ABORTED;
3301                 }
3302
3303                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3304                         uint32_t max_dyn_len = 1;
3305
3306                         max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
3307                         max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
3308
3309                         charge = (max_dyn_len - 1)/ 65536 + 1;
3310                 } else {
3311                         charge = 1;
3312                 }
3313
3314                 charge = MAX(state->smb2.credit_charge, charge);
3315
3316                 avail = MIN(avail, state->conn->smb2.cur_credits);
3317                 if (avail < charge) {
3318                         DBG_ERR("Insufficient credits. "
3319                                 "%"PRIu64" available, %"PRIu16" needed\n",
3320                                 avail, charge);
3321                         return NT_STATUS_INTERNAL_ERROR;
3322                 }
3323
3324                 credits = 0;
3325                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
3326                         credits = state->conn->smb2.max_credits -
3327                                   state->conn->smb2.cur_credits;
3328                 }
3329                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
3330                         credits += 1;
3331                 }
3332
3333                 mid = state->conn->smb2.mid;
3334                 state->conn->smb2.mid += charge;
3335                 state->conn->smb2.cur_credits -= charge;
3336
3337                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3338                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
3339                 }
3340                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
3341                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
3342
3343                 state->smb2.cancel_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3344                 state->smb2.cancel_flags &= ~SMB2_HDR_FLAG_CHAINED;
3345                 if (state->conn->smb2.server.sign_algo >= SMB2_SIGNING_AES128_GMAC) {
3346                         state->smb2.cancel_mid = mid;
3347                 } else {
3348                         state->smb2.cancel_mid = 0;
3349                 }
3350                 state->smb2.cancel_aid = 0;
3351
3352 skip_credits:
3353                 if (state->session && encryption_key == NULL) {
3354                         /*
3355                          * We prefer the channel signing key if it is
3356                          * already there.
3357                          */
3358                         if (state->smb2.should_sign) {
3359                                 signing_key = state->session->smb2_channel.signing_key;
3360                         }
3361
3362                         /*
3363                          * If it is a channel binding, we already have the main
3364                          * signing key and try that one.
3365                          */
3366                         if (signing_key != NULL &&
3367                             !smb2_signing_key_valid(signing_key)) {
3368                                 signing_key = state->session->smb2->signing_key;
3369                         }
3370
3371                         /*
3372                          * If we do not have any session key yet, we skip the
3373                          * signing of SMB2_OP_SESSSETUP requests.
3374                          */
3375                         if (signing_key != NULL &&
3376                             !smb2_signing_key_valid(signing_key)) {
3377                                 signing_key = NULL;
3378                         }
3379                 }
3380
3381                 hdr_iov = num_iov;
3382                 iov[num_iov].iov_base = state->smb2.hdr;
3383                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
3384                 num_iov += 1;
3385
3386                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
3387                 iov[num_iov].iov_len  = state->smb2.fixed_len;
3388                 num_iov += 1;
3389
3390                 if (state->smb2.dyn != NULL) {
3391                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
3392                         iov[num_iov].iov_len  = state->smb2.dyn_len;
3393                         num_iov += 1;
3394                 }
3395
3396                 reqlen  = sizeof(state->smb2.hdr);
3397                 reqlen += state->smb2.fixed_len;
3398                 reqlen += state->smb2.dyn_len;
3399
3400                 if (i < num_reqs-1) {
3401                         if ((reqlen % 8) > 0) {
3402                                 uint8_t pad = 8 - (reqlen % 8);
3403                                 iov[num_iov].iov_base = state->smb2.pad;
3404                                 iov[num_iov].iov_len = pad;
3405                                 num_iov += 1;
3406                                 reqlen += pad;
3407                         }
3408                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
3409                 }
3410
3411                 state->smb2.encryption_session_id = encryption_session_id;
3412
3413                 if (signing_key != NULL) {
3414                         NTSTATUS status;
3415
3416                         status = smb2_signing_sign_pdu(signing_key,
3417                                                        &iov[hdr_iov], num_iov - hdr_iov);
3418                         if (!NT_STATUS_IS_OK(status)) {
3419                                 return status;
3420                         }
3421                 }
3422
3423                 nbt_len += reqlen;
3424
3425                 ret = smbXcli_req_set_pending(reqs[i]);
3426                 if (!ret) {
3427                         return NT_STATUS_NO_MEMORY;
3428                 }
3429         }
3430
3431         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
3432         _smb_setlen_tcp(state->length_hdr, nbt_len);
3433         iov[0].iov_base = state->length_hdr;
3434         iov[0].iov_len  = sizeof(state->length_hdr);
3435
3436         if (encryption_key != NULL) {
3437                 NTSTATUS status;
3438                 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
3439                 uint8_t *buf;
3440                 int vi;
3441
3442                 buf = talloc_array(iov, uint8_t, buflen);
3443                 if (buf == NULL) {
3444                         return NT_STATUS_NO_MEMORY;
3445                 }
3446
3447                 /*
3448                  * We copy the buffers before encrypting them,
3449                  * this is at least currently needed for the
3450                  * to keep state->smb2.hdr.
3451                  *
3452                  * Also the callers may expect there buffers
3453                  * to be const.
3454                  */
3455                 for (vi = tf_iov + 1; vi < num_iov; vi++) {
3456                         struct iovec *v = &iov[vi];
3457                         const uint8_t *o = (const uint8_t *)v->iov_base;
3458
3459                         memcpy(buf, o, v->iov_len);
3460                         v->iov_base = (void *)buf;
3461                         buf += v->iov_len;
3462                 }
3463
3464                 status = smb2_signing_encrypt_pdu(encryption_key,
3465                                         &iov[tf_iov], num_iov - tf_iov);
3466                 if (!NT_STATUS_IS_OK(status)) {
3467                         return status;
3468                 }
3469         }
3470
3471         if (state->conn->dispatch_incoming == NULL) {
3472                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3473         }
3474
3475         subreq = writev_send(state, state->ev, state->conn->outgoing,
3476                              state->conn->sock_fd, false, iov, num_iov);
3477         if (subreq == NULL) {
3478                 return NT_STATUS_NO_MEMORY;
3479         }
3480         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3481         state->write_req = subreq;
3482
3483         return NT_STATUS_OK;
3484 }
3485
3486 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3487 {
3488         struct smbXcli_req_state *state =
3489                 tevent_req_data(req,
3490                 struct smbXcli_req_state);
3491
3492         state->smb2.credit_charge = charge;
3493 }
3494
3495 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3496                                     struct tevent_context *ev,
3497                                     struct smbXcli_conn *conn,
3498                                     uint16_t cmd,
3499                                     uint32_t additional_flags,
3500                                     uint32_t clear_flags,
3501                                     uint32_t timeout_msec,
3502                                     struct smbXcli_tcon *tcon,
3503                                     struct smbXcli_session *session,
3504                                     const uint8_t *fixed,
3505                                     uint16_t fixed_len,
3506                                     const uint8_t *dyn,
3507                                     uint32_t dyn_len,
3508                                     uint32_t max_dyn_len)
3509 {
3510         struct tevent_req *req;
3511         NTSTATUS status;
3512
3513         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3514                                  additional_flags, clear_flags,
3515                                  timeout_msec,
3516                                  tcon, session,
3517                                  fixed, fixed_len,
3518                                  dyn, dyn_len,
3519                                  max_dyn_len);
3520         if (req == NULL) {
3521                 return NULL;
3522         }
3523         if (!tevent_req_is_in_progress(req)) {
3524                 return tevent_req_post(req, ev);
3525         }
3526         status = smb2cli_req_compound_submit(&req, 1);
3527         if (tevent_req_nterror(req, status)) {
3528                 return tevent_req_post(req, ev);
3529         }
3530         return req;
3531 }
3532
3533 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3534 {
3535         struct tevent_req *req =
3536                 tevent_req_callback_data(subreq,
3537                 struct tevent_req);
3538         struct smbXcli_req_state *state =
3539                 tevent_req_data(req,
3540                 struct smbXcli_req_state);
3541         ssize_t nwritten;
3542         int err;
3543
3544         state->write_req = NULL;
3545
3546         nwritten = writev_recv(subreq, &err);
3547         TALLOC_FREE(subreq);
3548         if (nwritten == -1) {
3549                 /* here, we need to notify all pending requests */
3550                 NTSTATUS status = map_nt_error_from_unix_common(err);
3551                 smbXcli_conn_disconnect(state->conn, status);
3552                 return;
3553         }
3554 }
3555
3556 static struct smbXcli_session* smbXcli_session_by_uid(struct smbXcli_conn *conn,
3557                                                      uint64_t uid)
3558 {
3559         struct smbXcli_session *s = conn->sessions;
3560
3561         for (; s; s = s->next) {
3562                 if (s->smb2->session_id != uid) {
3563                         continue;
3564                 }
3565                 break;
3566         }
3567
3568         return s;
3569 }
3570
3571 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3572                                              uint8_t *buf,
3573                                              size_t buflen,
3574                                              TALLOC_CTX *mem_ctx,
3575                                              struct iovec **piov,
3576                                              size_t *pnum_iov)
3577 {
3578         struct iovec *iov;
3579         int num_iov = 0;
3580         size_t taken = 0;
3581         uint8_t *first_hdr = buf;
3582         size_t verified_buflen = 0;
3583         uint8_t *tf = NULL;
3584         size_t tf_len = 0;
3585
3586         iov = talloc_array(mem_ctx, struct iovec, num_iov);
3587         if (iov == NULL) {
3588                 return NT_STATUS_NO_MEMORY;
3589         }
3590
3591         while (taken < buflen) {
3592                 size_t len = buflen - taken;
3593                 uint8_t *hdr = first_hdr + taken;
3594                 struct iovec *cur;
3595                 size_t full_size;
3596                 size_t next_command_ofs;
3597                 uint16_t body_size;
3598                 struct iovec *iov_tmp;
3599
3600                 if (verified_buflen > taken) {
3601                         len = verified_buflen - taken;
3602                 } else {
3603                         tf = NULL;
3604                         tf_len = 0;
3605                 }
3606
3607                 if (len < 4) {
3608                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3609                                    (int)len, 4));
3610                         goto inval;
3611                 }
3612                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3613                         struct smbXcli_session *s;
3614                         uint64_t uid;
3615                         struct iovec tf_iov[2];
3616                         size_t enc_len;
3617                         NTSTATUS status;
3618
3619                         if (len < SMB2_TF_HDR_SIZE) {
3620                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3621                                            (int)len, SMB2_TF_HDR_SIZE));
3622                                 goto inval;
3623                         }
3624                         tf = hdr;
3625                         tf_len = SMB2_TF_HDR_SIZE;
3626                         taken += tf_len;
3627
3628                         hdr = first_hdr + taken;
3629                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3630                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
3631
3632                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
3633                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3634                                            (int)len,
3635                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
3636                                 goto inval;
3637                         }
3638
3639                         s = smbXcli_session_by_uid(conn, uid);
3640                         if (s == NULL) {
3641                                 DEBUG(10, ("unknown session_id %llu\n",
3642                                            (unsigned long long)uid));
3643                                 goto inval;
3644                         }
3645
3646                         tf_iov[0].iov_base = (void *)tf;
3647                         tf_iov[0].iov_len = tf_len;
3648                         tf_iov[1].iov_base = (void *)hdr;
3649                         tf_iov[1].iov_len = enc_len;
3650
3651                         status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3652                                                           tf_iov, 2);
3653                         if (!NT_STATUS_IS_OK(status)) {
3654                                 TALLOC_FREE(iov);
3655                                 return status;
3656                         }
3657
3658                         verified_buflen = taken + enc_len;
3659                         len = enc_len;
3660                 }
3661
3662                 /*
3663                  * We need the header plus the body length field
3664                  */
3665
3666                 if (len < SMB2_HDR_BODY + 2) {
3667                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3668                                    (int)len, SMB2_HDR_BODY));
3669                         goto inval;
3670                 }
3671                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3672                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3673                                    IVAL(hdr, 0)));
3674                         goto inval;
3675                 }
3676                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3677                         DEBUG(10, ("Got HDR len %d, expected %d\n",
3678                                    SVAL(hdr, 4), SMB2_HDR_BODY));
3679                         goto inval;
3680                 }
3681
3682                 full_size = len;
3683                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3684                 body_size = SVAL(hdr, SMB2_HDR_BODY);
3685
3686                 if (next_command_ofs != 0) {
3687                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3688                                 goto inval;
3689                         }
3690                         if (next_command_ofs > full_size) {
3691                                 goto inval;
3692                         }
3693                         full_size = next_command_ofs;
3694                 }
3695                 if (body_size < 2) {
3696                         goto inval;
3697                 }
3698                 body_size &= 0xfffe;
3699
3700                 if (body_size > (full_size - SMB2_HDR_BODY)) {
3701                         goto inval;
3702                 }
3703
3704                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3705                                          num_iov + 4);
3706                 if (iov_tmp == NULL) {
3707                         TALLOC_FREE(iov);
3708                         return NT_STATUS_NO_MEMORY;
3709                 }
3710                 iov = iov_tmp;
3711                 cur = &iov[num_iov];
3712                 num_iov += 4;
3713
3714                 cur[0].iov_base = tf;
3715                 cur[0].iov_len  = tf_len;
3716                 cur[1].iov_base = hdr;
3717                 cur[1].iov_len  = SMB2_HDR_BODY;
3718                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3719                 cur[2].iov_len  = body_size;
3720                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3721                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
3722
3723                 taken += full_size;
3724         }
3725
3726         *piov = iov;
3727         *pnum_iov = num_iov;
3728         return NT_STATUS_OK;
3729
3730 inval:
3731         TALLOC_FREE(iov);
3732         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3733 }
3734
3735 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3736                                                     uint64_t mid)
3737 {
3738         size_t num_pending = talloc_array_length(conn->pending);
3739         size_t i;
3740
3741         for (i=0; i<num_pending; i++) {
3742                 struct tevent_req *req = conn->pending[i];
3743                 struct smbXcli_req_state *state =
3744                         tevent_req_data(req,
3745                         struct smbXcli_req_state);
3746
3747                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3748                         return req;
3749                 }
3750         }
3751         return NULL;
3752 }
3753
3754 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3755                                                TALLOC_CTX *tmp_mem,
3756                                                uint8_t *inbuf)
3757 {
3758         struct tevent_req *req;
3759         struct smbXcli_req_state *state = NULL;
3760         struct iovec *iov = NULL;
3761         size_t i, num_iov = 0;
3762         NTSTATUS status;
3763         bool defer = true;
3764         struct smbXcli_session *last_session = NULL;
3765         size_t inbuf_len = smb_len_tcp(inbuf);
3766
3767         status = smb2cli_inbuf_parse_compound(conn,
3768                                               inbuf + NBT_HDR_SIZE,
3769                                               inbuf_len,
3770                                               tmp_mem,
3771                                               &iov, &num_iov);
3772         if (!NT_STATUS_IS_OK(status)) {
3773                 return status;
3774         }
3775
3776         for (i=0; i<num_iov; i+=4) {
3777                 uint8_t *inbuf_ref = NULL;
3778                 struct iovec *cur = &iov[i];
3779                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3780                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3781                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3782                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3783                 uint16_t req_opcode;
3784                 uint32_t req_flags;
3785                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3786                 uint32_t new_credits;
3787                 struct smbXcli_session *session = NULL;
3788                 struct smb2_signing_key *signing_key = NULL;
3789                 bool was_encrypted = false;
3790
3791                 new_credits = conn->smb2.cur_credits;
3792                 new_credits += credits;
3793                 if (new_credits > UINT16_MAX) {
3794                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3795                 }
3796                 conn->smb2.cur_credits += credits;
3797
3798                 req = smb2cli_conn_find_pending(conn, mid);
3799                 if (req == NULL) {
3800                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3801                 }
3802                 state = tevent_req_data(req, struct smbXcli_req_state);
3803
3804                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3805                 if (opcode != req_opcode) {
3806                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3807                 }
3808                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3809
3810                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3811                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3812                 }
3813
3814                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3815                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3816                     NT_STATUS_EQUAL(status, NT_STATUS_PENDING)) {
3817                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3818
3819                         if (state->smb2.got_async) {
3820                                 /* We only expect one STATUS_PENDING response */
3821                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3822                         }
3823                         state->smb2.got_async = true;
3824
3825                         /*
3826                          * async interim responses are not signed,
3827                          * even if the SMB2_HDR_FLAG_SIGNED flag
3828                          * is set.
3829                          */
3830                         state->smb2.cancel_flags |= SMB2_HDR_FLAG_ASYNC;
3831                         state->smb2.cancel_aid = async_id;
3832
3833                         if (state->smb2.notify_async) {
3834                                 tevent_req_defer_callback(req, state->ev);
3835                                 tevent_req_notify_callback(req);
3836                         }
3837                         continue;
3838                 }
3839
3840                 session = state->session;
3841                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3842                         session = last_session;
3843                 }
3844                 last_session = session;
3845
3846                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3847                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3848
3849                         if (session == NULL) {
3850                                 session = smbXcli_session_by_uid(state->conn,
3851                                                                  uid);
3852                         }
3853
3854                         if (session == NULL) {
3855                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3856                         }
3857
3858                         last_session = session;
3859                         signing_key = session->smb2_channel.signing_key;
3860                 }
3861
3862                 if (opcode == SMB2_OP_SESSSETUP) {
3863                         /*
3864                          * We prefer the channel signing key, if it is
3865                          * already there.
3866                          *
3867                          * If we do not have a channel signing key yet,
3868                          * we try the main signing key, if it is not
3869                          * the final response.
3870                          */
3871                         if (signing_key != NULL &&
3872                             !smb2_signing_key_valid(signing_key) &&
3873                             !NT_STATUS_IS_OK(status)) {
3874                                 signing_key = session->smb2->signing_key;
3875                         }
3876
3877                         if (signing_key != NULL &&
3878                             !smb2_signing_key_valid(signing_key)) {
3879                                 /*
3880                                  * If we do not have a session key to
3881                                  * verify the signature, we defer the
3882                                  * signing check to the caller.
3883                                  *
3884                                  * The caller gets NT_STATUS_OK, it
3885                                  * has to call
3886                                  * smb2cli_session_set_session_key()
3887                                  * or
3888                                  * smb2cli_session_set_channel_key()
3889                                  * which will check the signature
3890                                  * with the channel signing key.
3891                                  */
3892                                 signing_key = NULL;
3893                         }
3894
3895                         if (!NT_STATUS_IS_OK(status)) {
3896                                 /*
3897                                  * Only check the signature of the last response
3898                                  * of a successful session auth. This matches
3899                                  * Windows behaviour for NTLM auth and reauth.
3900                                  */
3901                                 state->smb2.require_signed_response = false;
3902                         }
3903                 }
3904
3905                 if (state->smb2.should_sign ||
3906                     state->smb2.require_signed_response)
3907                 {
3908                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3909                                 return NT_STATUS_ACCESS_DENIED;
3910                         }
3911                 }
3912
3913                 if (!smb2_signing_key_valid(signing_key) &&
3914                     state->smb2.require_signed_response) {
3915                         signing_key = session->smb2_channel.signing_key;
3916                 }
3917
3918                 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3919                         const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3920                         uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3921
3922                         /*
3923                          * If the response was encrypted in a SMB2_TRANSFORM
3924                          * pdu, which belongs to the correct session,
3925                          * we do not need to do signing checks
3926                          *
3927                          * It could be the session the response belongs to
3928                          * or the session that was used to encrypt the
3929                          * SMB2_TRANSFORM request.
3930                          */
3931                         if ((session && session->smb2->session_id == uid) ||
3932                             (state->smb2.encryption_session_id == uid)) {
3933                                 signing_key = NULL;
3934                                 was_encrypted = true;
3935                         }
3936                 }
3937
3938                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3939                         /*
3940                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3941                          * the response is not signed and we should
3942                          * propagate the NT_STATUS_USER_SESSION_DELETED
3943                          * status to the caller.
3944                          */
3945                         state->smb2.signing_skipped = true;
3946                         signing_key = NULL;
3947                 }
3948                 if (NT_STATUS_EQUAL(status, NT_STATUS_REQUEST_OUT_OF_SEQUENCE)) {
3949                         /*
3950                          * if the server returns
3951                          * NT_STATUS_REQUEST_OUT_OF_SEQUENCE for a session setup
3952                          * request, the response is not signed and we should
3953                          * propagate the NT_STATUS_REQUEST_OUT_OF_SEQUENCE
3954                          * status to the caller
3955                          */
3956                         if (opcode == SMB2_OP_SESSSETUP) {
3957                                 state->smb2.signing_skipped = true;
3958                                 signing_key = NULL;
3959                         }
3960                 }
3961                 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
3962                         /*
3963                          * if the server returns NT_STATUS_NOT_SUPPORTED
3964                          * for a session setup request, the response is not
3965                          * signed and we should propagate the NT_STATUS_NOT_SUPPORTED
3966                          * status to the caller.
3967                          */
3968                         if (opcode == SMB2_OP_SESSSETUP) {
3969                                 state->smb2.signing_skipped = true;
3970                                 signing_key = NULL;
3971                         }
3972                 }
3973                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
3974                         /*
3975                          * if the server returns
3976                          * NT_STATUS_ACCESS_DENIED for a session setup
3977                          * request, the response is not signed and we should
3978                          * propagate the NT_STATUS_ACCESS_DENIED
3979                          * status to the caller without disconnecting
3980                          * the connection because we where not able to
3981                          * verify the response signature.
3982                          */
3983                         if (opcode == SMB2_OP_SESSSETUP) {
3984                                 state->smb2.signing_skipped = true;
3985                                 signing_key = NULL;
3986                         }
3987                 }
3988
3989                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3990                         /*
3991                          * if the server returns
3992                          * NT_STATUS_INVALID_PARAMETER
3993                          * the response might not be encrypted.
3994                          */
3995                         if (state->smb2.should_encrypt && !was_encrypted) {
3996                                 state->smb2.signing_skipped = true;
3997                                 signing_key = NULL;
3998                         }
3999                 }
4000
4001                 if (state->smb2.should_encrypt && !was_encrypted) {
4002                         if (!state->smb2.signing_skipped) {
4003                                 return NT_STATUS_ACCESS_DENIED;
4004                         }
4005                 }
4006
4007                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
4008                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
4009                     (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED) &&
4010                      session != NULL &&
4011                      session->smb2->no_signing_disconnect) ||
4012                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
4013                         /*
4014                          * if the server returns
4015                          * NT_STATUS_NETWORK_NAME_DELETED
4016                          * NT_STATUS_FILE_CLOSED
4017                          * NT_STATUS_INVALID_PARAMETER
4018                          * the response might not be signed
4019                          * as this happens before the signing checks.
4020                          *
4021                          * If server echos the signature (or all zeros)
4022                          * we should report the status from the server
4023                          * to the caller.
4024                          */
4025                         if (signing_key) {
4026                                 bool cmp;
4027
4028                                 cmp = mem_equal_const_time(inhdr+SMB2_HDR_SIGNATURE,
4029                                                            state->smb2.hdr+SMB2_HDR_SIGNATURE,
4030                                                            16);
4031                                 if (cmp) {
4032                                         state->smb2.signing_skipped = true;
4033                                         signing_key = NULL;
4034                                 }
4035                         }
4036                         if (signing_key) {
4037                                 bool zero;
4038                                 zero = all_zero(inhdr+SMB2_HDR_SIGNATURE, 16);
4039                                 if (zero) {
4040                                         state->smb2.signing_skipped = true;
4041                                         signing_key = NULL;
4042                                 }
4043                         }
4044                 }
4045
4046                 if (signing_key) {
4047                         NTSTATUS signing_status;
4048
4049                         signing_status = smb2_signing_check_pdu(signing_key,
4050                                                                 &cur[1], 3);
4051                         if (!NT_STATUS_IS_OK(signing_status)) {
4052                                 /*
4053                                  * If the signing check fails, we disconnect
4054                                  * the connection.
4055                                  *
4056                                  * Unless
4057                                  * smb2cli_session_torture_no_signing_disconnect
4058                                  * was called in torture tests
4059                                  */
4060
4061                                 if (!NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
4062                                         return signing_status;
4063                                 }
4064
4065                                 if (!NT_STATUS_EQUAL(status, signing_status)) {
4066                                         return signing_status;
4067                                 }
4068
4069                                 if (session == NULL) {
4070                                         return signing_status;
4071                                 }
4072
4073                                 if (!session->smb2->no_signing_disconnect) {
4074                                         return signing_status;
4075                                 }
4076
4077                                 state->smb2.signing_skipped = true;
4078                         }
4079                 }
4080
4081                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
4082                     (session != NULL) && session->disconnect_expired)
4083                 {
4084                         /*
4085                          * this should be a short term hack
4086                          * until the upper layers have implemented
4087                          * re-authentication.
4088                          */
4089                         return status;
4090                 }
4091
4092                 smbXcli_req_unset_pending(req);
4093
4094                 /*
4095                  * There might be more than one response
4096                  * we need to defer the notifications
4097                  */
4098                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
4099                         defer = false;
4100                 }
4101
4102                 if (defer) {
4103                         tevent_req_defer_callback(req, state->ev);
4104                 }
4105
4106                 /*
4107                  * Note: here we use talloc_reference() in a way
4108                  *       that does not expose it to the caller.
4109                  */
4110                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
4111                 if (tevent_req_nomem(inbuf_ref, req)) {
4112                         continue;
4113                 }
4114
4115                 /* copy the related buffers */
4116                 state->smb2.recv_iov[0] = cur[1];
4117                 state->smb2.recv_iov[1] = cur[2];
4118                 state->smb2.recv_iov[2] = cur[3];
4119
4120                 tevent_req_done(req);
4121         }
4122
4123         if (defer) {
4124                 return NT_STATUS_RETRY;
4125         }
4126
4127         return NT_STATUS_OK;
4128 }
4129
4130 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
4131                           struct iovec **piov,
4132                           const struct smb2cli_req_expected_response *expected,
4133                           size_t num_expected)
4134 {
4135         struct smbXcli_req_state *state =
4136                 tevent_req_data(req,
4137                 struct smbXcli_req_state);
4138         NTSTATUS status;
4139         size_t body_size;
4140         bool found_status = false;
4141         bool found_size = false;
4142         size_t i;
4143
4144         if (piov != NULL) {
4145                 *piov = NULL;
4146         }
4147
4148         if (tevent_req_is_in_progress(req) && state->smb2.got_async) {
4149                 return NT_STATUS_PENDING;
4150         }
4151
4152         if (tevent_req_is_nterror(req, &status)) {
4153                 for (i=0; i < num_expected; i++) {
4154                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
4155                                 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
4156                         }
4157                 }
4158
4159                 return status;
4160         }
4161
4162         if (num_expected == 0) {
4163                 found_status = true;
4164                 found_size = true;
4165         }
4166
4167         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
4168         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
4169
4170         for (i=0; i < num_expected; i++) {
4171                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
4172                         continue;
4173                 }
4174
4175                 found_status = true;
4176                 if (expected[i].body_size == 0) {
4177                         found_size = true;
4178                         break;
4179                 }
4180
4181                 if (expected[i].body_size == body_size) {
4182                         found_size = true;
4183                         break;
4184                 }
4185         }
4186
4187         if (!found_status) {
4188                 return status;
4189         }
4190
4191         if (state->smb2.signing_skipped) {
4192                 if (num_expected > 0) {
4193                         return NT_STATUS_ACCESS_DENIED;
4194                 }
4195                 if (!NT_STATUS_IS_ERR(status)) {
4196                         return NT_STATUS_ACCESS_DENIED;
4197                 }
4198         }
4199
4200         if (!found_size) {
4201                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4202         }
4203
4204         if (piov != NULL) {
4205                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
4206         }
4207
4208         return status;
4209 }
4210
4211 NTSTATUS smb2cli_req_get_sent_iov(struct tevent_req *req,
4212                                   struct iovec *sent_iov)
4213 {
4214         struct smbXcli_req_state *state =
4215                 tevent_req_data(req,
4216                 struct smbXcli_req_state);
4217
4218         if (tevent_req_is_in_progress(req)) {
4219                 return NT_STATUS_PENDING;
4220         }
4221
4222         sent_iov[0].iov_base = state->smb2.hdr;
4223         sent_iov[0].iov_len  = sizeof(state->smb2.hdr);
4224
4225         sent_iov[1].iov_base = discard_const(state->smb2.fixed);
4226         sent_iov[1].iov_len  = state->smb2.fixed_len;
4227
4228         if (state->smb2.dyn != NULL) {
4229                 sent_iov[2].iov_base = discard_const(state->smb2.dyn);
4230                 sent_iov[2].iov_len  = state->smb2.dyn_len;
4231         } else {
4232                 sent_iov[2].iov_base = NULL;
4233                 sent_iov[2].iov_len  = 0;
4234         }
4235
4236         return NT_STATUS_OK;
4237 }
4238
4239 static const struct {
4240         enum protocol_types proto;
4241         const char *smb1_name;
4242 } smb1cli_prots[] = {
4243         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
4244         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
4245         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
4246         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
4247         {PROTOCOL_LANMAN2,      "LM1.2X002"},
4248         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
4249         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
4250         {PROTOCOL_LANMAN2,      "Samba"},
4251         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
4252         {PROTOCOL_NT1,          "NT LM 0.12"},
4253         {PROTOCOL_SMB2_02,      "SMB 2.002"},
4254         {PROTOCOL_SMB2_10,      "SMB 2.???"},
4255 };
4256
4257 static const struct {
4258         enum protocol_types proto;
4259         uint16_t smb2_dialect;
4260 } smb2cli_prots[] = {
4261         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
4262         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
4263         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
4264         {PROTOCOL_SMB3_02,      SMB3_DIALECT_REVISION_302},
4265         {PROTOCOL_SMB3_11,      SMB3_DIALECT_REVISION_311},
4266 };
4267
4268 struct smbXcli_negprot_state {
4269         struct smbXcli_conn *conn;
4270         struct tevent_context *ev;
4271         struct smb2_negotiate_contexts *in_ctx;
4272         struct smb2_negotiate_contexts *out_ctx;
4273         uint32_t timeout_msec;
4274
4275         struct {
4276                 uint8_t fixed[36];
4277         } smb2;
4278 };
4279
4280 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
4281 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
4282 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
4283 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
4284 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
4285 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4286                                                   TALLOC_CTX *frame,
4287                                                   uint8_t *inbuf);
4288
4289 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
4290                                         struct tevent_context *ev,
4291                                         struct smbXcli_conn *conn,
4292                                         uint32_t timeout_msec,
4293                                         enum protocol_types min_protocol,
4294                                         enum protocol_types max_protocol,
4295                                         uint16_t max_credits,
4296                                         struct smb2_negotiate_contexts *in_ctx)
4297 {
4298         struct tevent_req *req, *subreq;
4299         struct smbXcli_negprot_state *state;
4300
4301         req = tevent_req_create(mem_ctx, &state,
4302                                 struct smbXcli_negprot_state);
4303         if (req == NULL) {
4304                 return NULL;
4305         }
4306         state->conn = conn;
4307         state->ev = ev;
4308         state->in_ctx = in_ctx;
4309         state->timeout_msec = timeout_msec;
4310
4311         if (min_protocol == PROTOCOL_NONE) {
4312                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4313                 return tevent_req_post(req, ev);
4314         }
4315
4316         if (max_protocol == PROTOCOL_NONE) {
4317                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4318                 return tevent_req_post(req, ev);
4319         }
4320
4321         if (min_protocol > max_protocol) {
4322                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4323                 return tevent_req_post(req, ev);
4324         }
4325
4326         conn->min_protocol = min_protocol;
4327         conn->max_protocol = max_protocol;
4328         conn->protocol = PROTOCOL_NONE;
4329
4330         if (max_protocol >= PROTOCOL_SMB2_02) {
4331                 conn->smb2.max_credits = max_credits;
4332         }
4333
4334         if ((min_protocol < PROTOCOL_SMB2_02) &&
4335             (max_protocol < PROTOCOL_SMB2_02)) {
4336                 /*
4337                  * SMB1 only...
4338                  */
4339                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4340
4341                 subreq = smbXcli_negprot_smb1_subreq(state);
4342                 if (tevent_req_nomem(subreq, req)) {
4343                         return tevent_req_post(req, ev);
4344                 }
4345                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4346                 return req;
4347         }
4348
4349         if ((min_protocol >= PROTOCOL_SMB2_02) &&
4350             (max_protocol >= PROTOCOL_SMB2_02)) {
4351                 /*
4352                  * SMB2 only...
4353                  */
4354                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4355
4356                 subreq = smbXcli_negprot_smb2_subreq(state);
4357                 if (tevent_req_nomem(subreq, req)) {
4358                         return tevent_req_post(req, ev);
4359                 }
4360                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4361                 return req;
4362         }
4363
4364         /*
4365          * We send an SMB1 negprot with the SMB2 dialects
4366          * and expect a SMB1 or a SMB2 response.
4367          *
4368          * smbXcli_negprot_dispatch_incoming() will fix the
4369          * callback to match protocol of the response.
4370          */
4371         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
4372
4373         subreq = smbXcli_negprot_smb1_subreq(state);
4374         if (tevent_req_nomem(subreq, req)) {
4375                 return tevent_req_post(req, ev);
4376         }
4377         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
4378         return req;
4379 }
4380
4381 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
4382 {
4383         struct tevent_req *req =
4384                 tevent_req_callback_data(subreq,
4385                 struct tevent_req);
4386         NTSTATUS status;
4387
4388         /*
4389          * we just want the low level error
4390          */
4391         status = tevent_req_simple_recv_ntstatus(subreq);
4392         TALLOC_FREE(subreq);
4393         if (tevent_req_nterror(req, status)) {
4394                 return;
4395         }
4396
4397         /* this should never happen */
4398         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
4399 }
4400
4401 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
4402 {
4403         size_t i;
4404         DATA_BLOB bytes = data_blob_null;
4405         uint8_t flags;
4406         uint16_t flags2;
4407
4408         /* setup the protocol strings */
4409         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4410                 uint8_t c = 2;
4411                 bool ok;
4412
4413                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4414                         continue;
4415                 }
4416
4417                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4418                         continue;
4419                 }
4420
4421                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
4422                 if (!ok) {
4423                         return NULL;
4424                 }
4425
4426                 /*
4427                  * We know it is already ascii and
4428                  * we want NULL termination.
4429                  */
4430                 ok = data_blob_append(state, &bytes,
4431                                       smb1cli_prots[i].smb1_name,
4432                                       strlen(smb1cli_prots[i].smb1_name)+1);
4433                 if (!ok) {
4434                         return NULL;
4435                 }
4436         }
4437
4438         smb1cli_req_flags(state->conn->max_protocol,
4439                           state->conn->smb1.client.capabilities,
4440                           SMBnegprot,
4441                           0, 0, &flags,
4442                           0, 0, &flags2);
4443
4444         return smb1cli_req_send(state, state->ev, state->conn,
4445                                 SMBnegprot,
4446                                 flags, ~flags,
4447                                 flags2, ~flags2,
4448                                 state->timeout_msec,
4449                                 0xFFFE, 0, NULL, /* pid, tid, session */
4450                                 0, NULL, /* wct, vwv */
4451                                 bytes.length, bytes.data);
4452 }
4453
4454 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
4455 {
4456         struct tevent_req *req =
4457                 tevent_req_callback_data(subreq,
4458                 struct tevent_req);
4459         struct smbXcli_negprot_state *state =
4460                 tevent_req_data(req,
4461                 struct smbXcli_negprot_state);
4462         struct smbXcli_conn *conn = state->conn;
4463         struct iovec *recv_iov = NULL;
4464         uint8_t *inhdr = NULL;
4465         uint8_t wct;
4466         uint16_t *vwv;
4467         uint32_t num_bytes;
4468         uint8_t *bytes;
4469         NTSTATUS status;
4470         uint16_t protnum;
4471         size_t i;
4472         size_t num_prots = 0;
4473         uint8_t flags;
4474         uint32_t client_capabilities = conn->smb1.client.capabilities;
4475         uint32_t both_capabilities;
4476         uint32_t server_capabilities = 0;
4477         uint32_t capabilities;
4478         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
4479         uint32_t server_max_xmit = 0;
4480         uint32_t max_xmit;
4481         uint32_t server_max_mux = 0;
4482         uint16_t server_security_mode = 0;
4483         uint32_t server_session_key = 0;
4484         bool server_readbraw = false;
4485         bool server_writebraw = false;
4486         bool server_lockread = false;
4487         bool server_writeunlock = false;
4488         struct GUID server_guid = GUID_zero();
4489         DATA_BLOB server_gss_blob = data_blob_null;
4490         uint8_t server_challenge[8];
4491         char *server_workgroup = NULL;
4492         char *server_name = NULL;
4493         int server_time_zone = 0;
4494         NTTIME server_system_time = 0;
4495         static const struct smb1cli_req_expected_response expected[] = {
4496         {
4497                 .status = NT_STATUS_OK,
4498                 .wct = 0x11, /* NT1 */
4499         },
4500         {
4501                 .status = NT_STATUS_OK,
4502                 .wct = 0x0D, /* LM */
4503         },
4504         {
4505                 .status = NT_STATUS_OK,
4506                 .wct = 0x01, /* CORE */
4507         }
4508         };
4509
4510         ZERO_STRUCT(server_challenge);
4511
4512         status = smb1cli_req_recv(subreq, state,
4513                                   &recv_iov,
4514                                   &inhdr,
4515                                   &wct,
4516                                   &vwv,
4517                                   NULL, /* pvwv_offset */
4518                                   &num_bytes,
4519                                   &bytes,
4520                                   NULL, /* pbytes_offset */
4521                                   NULL, /* pinbuf */
4522                                   expected, ARRAY_SIZE(expected));
4523         TALLOC_FREE(subreq);
4524         if (tevent_req_nterror(req, status)) {
4525                 return;
4526         }
4527         if (inhdr == NULL) {
4528                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
4529                 return;
4530         }
4531
4532         flags = CVAL(inhdr, HDR_FLG);
4533
4534         protnum = SVAL(vwv, 0);
4535
4536         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4537                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4538                         continue;
4539                 }
4540
4541                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4542                         continue;
4543                 }
4544
4545                 if (protnum != num_prots) {
4546                         num_prots++;
4547                         continue;
4548                 }
4549
4550                 conn->protocol = smb1cli_prots[i].proto;
4551                 break;
4552         }
4553
4554         if (conn->protocol == PROTOCOL_NONE) {
4555                 DBG_ERR("No compatible protocol selected by server.\n");
4556                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4557                 return;
4558         }
4559
4560         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
4561                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
4562                          "and the selected protocol level doesn't support it.\n"));
4563                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4564                 return;
4565         }
4566
4567         if (flags & FLAG_SUPPORT_LOCKREAD) {
4568                 server_lockread = true;
4569                 server_writeunlock = true;
4570         }
4571
4572         if (conn->protocol >= PROTOCOL_NT1) {
4573                 const char *client_signing = NULL;
4574                 bool server_mandatory = false;
4575                 bool server_allowed = false;
4576                 const char *server_signing = NULL;
4577                 bool ok;
4578                 uint8_t key_len;
4579
4580                 if (wct != 0x11) {
4581                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4582                         return;
4583                 }
4584
4585                 /* NT protocol */
4586                 server_security_mode = CVAL(vwv + 1, 0);
4587                 server_max_mux = SVAL(vwv + 1, 1);
4588                 server_max_xmit = IVAL(vwv + 3, 1);
4589                 server_session_key = IVAL(vwv + 7, 1);
4590                 server_time_zone = SVALS(vwv + 15, 1);
4591                 server_time_zone *= 60;
4592                 /* this time arrives in real GMT */
4593                 server_system_time = BVAL(vwv + 11, 1);
4594                 server_capabilities = IVAL(vwv + 9, 1);
4595
4596                 key_len = CVAL(vwv + 16, 1);
4597
4598                 if (server_capabilities & CAP_RAW_MODE) {
4599                         server_readbraw = true;
4600                         server_writebraw = true;
4601                 }
4602                 if (server_capabilities & CAP_LOCK_AND_READ) {
4603                         server_lockread = true;
4604                 }
4605
4606                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4607                         DATA_BLOB blob1, blob2;
4608
4609                         if (num_bytes < 16) {
4610                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4611                                 return;
4612                         }
4613
4614                         blob1 = data_blob_const(bytes, 16);
4615                         status = GUID_from_data_blob(&blob1, &server_guid);
4616                         if (tevent_req_nterror(req, status)) {
4617                                 return;
4618                         }
4619
4620                         blob1 = data_blob_const(bytes+16, num_bytes-16);
4621                         blob2 = data_blob_dup_talloc(state, blob1);
4622                         if (blob1.length > 0 &&
4623                             tevent_req_nomem(blob2.data, req)) {
4624                                 return;
4625                         }
4626                         server_gss_blob = blob2;
4627                 } else {
4628                         DATA_BLOB blob1, blob2;
4629
4630                         if (num_bytes < key_len) {
4631                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4632                                 return;
4633                         }
4634
4635                         if (key_len != 0 && key_len != 8) {
4636                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4637                                 return;
4638                         }
4639
4640                         if (key_len == 8) {
4641                                 memcpy(server_challenge, bytes, 8);
4642                         }
4643
4644                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4645                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4646                         if (blob1.length > 0) {
4647                                 size_t len;
4648
4649                                 len = utf16_null_terminated_len_n(blob1.data,
4650                                                                   blob1.length);
4651                                 blob1.length = len;
4652
4653                                 ok = convert_string_talloc(state,
4654                                                            CH_UTF16LE,
4655                                                            CH_UNIX,
4656                                                            blob1.data,
4657                                                            blob1.length,
4658                                                            &server_workgroup,
4659                                                            &len);
4660                                 if (!ok) {
4661                                         status = map_nt_error_from_unix_common(errno);
4662                                         tevent_req_nterror(req, status);
4663                                         return;
4664                                 }
4665                         }
4666
4667                         blob2.data += blob1.length;
4668                         blob2.length -= blob1.length;
4669                         if (blob2.length > 0) {
4670                                 size_t len;
4671
4672                                 ok = convert_string_talloc(state,
4673                                                            CH_UTF16LE,
4674                                                            CH_UNIX,
4675                                                            blob2.data,
4676                                                            blob2.length,
4677                                                            &server_name,
4678                                                            &len);
4679                                 if (!ok) {
4680                                         status = map_nt_error_from_unix_common(errno);
4681                                         tevent_req_nterror(req, status);
4682                                         return;
4683                                 }
4684                         }
4685                 }
4686
4687                 client_signing = "disabled";
4688                 if (conn->allow_signing) {
4689                         client_signing = "allowed";
4690                 }
4691                 if (conn->mandatory_signing) {
4692                         client_signing = "required";
4693                 }
4694
4695                 server_signing = "not supported";
4696                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4697                         server_signing = "supported";
4698                         server_allowed = true;
4699                 } else if (conn->mandatory_signing) {
4700                         /*
4701                          * We have mandatory signing as client
4702                          * lets assume the server will look at our
4703                          * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4704                          * flag in the session setup
4705                          */
4706                         server_signing = "not announced";
4707                         server_allowed = true;
4708                 }
4709                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4710                         server_signing = "required";
4711                         server_mandatory = true;
4712                 }
4713
4714                 ok = smb1_signing_set_negotiated(conn->smb1.signing,
4715                                                 server_allowed,
4716                                                 server_mandatory);
4717                 if (!ok) {
4718                         DEBUG(1,("cli_negprot: SMB signing is required, "
4719                                  "but client[%s] and server[%s] mismatch\n",
4720                                  client_signing, server_signing));
4721                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4722                         return;
4723                 }
4724
4725         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4726                 DATA_BLOB blob1;
4727                 uint8_t key_len;
4728                 time_t t;
4729
4730                 if (wct != 0x0D) {
4731                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4732                         return;
4733                 }
4734
4735                 server_security_mode = SVAL(vwv + 1, 0);
4736                 server_max_xmit = SVAL(vwv + 2, 0);
4737                 server_max_mux = SVAL(vwv + 3, 0);
4738                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4739                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4740                 server_session_key = IVAL(vwv + 6, 0);
4741                 server_time_zone = SVALS(vwv + 10, 0);
4742                 server_time_zone *= 60;
4743                 /* this time is converted to GMT by make_unix_date */
4744                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4745                 unix_to_nt_time(&server_system_time, t);
4746                 key_len = SVAL(vwv + 11, 0);
4747
4748                 if (num_bytes < key_len) {
4749                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4750                         return;
4751                 }
4752
4753                 if (key_len != 0 && key_len != 8) {
4754                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4755                         return;
4756                 }
4757
4758                 if (key_len == 8) {
4759                         memcpy(server_challenge, bytes, 8);
4760                 }
4761
4762                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4763                 if (blob1.length > 0) {
4764                         size_t len;
4765                         bool ok;
4766
4767                         len = utf16_null_terminated_len_n(blob1.data,
4768                                                           blob1.length);
4769                         blob1.length = len;
4770
4771                         ok = convert_string_talloc(state,
4772                                                    CH_DOS,
4773                                                    CH_UNIX,
4774                                                    blob1.data,
4775                                                    blob1.length,
4776                                                    &server_workgroup,
4777                                                    &len);
4778                         if (!ok) {
4779                                 status = map_nt_error_from_unix_common(errno);
4780                                 tevent_req_nterror(req, status);
4781                                 return;
4782                         }
4783                 }
4784
4785         } else {
4786                 /* the old core protocol */
4787                 server_time_zone = get_time_zone(time(NULL));
4788                 server_max_xmit = 1024;
4789                 server_max_mux = 1;
4790         }
4791
4792         if (server_max_xmit < 1024) {
4793                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4794                 return;
4795         }
4796
4797         if (server_max_mux < 1) {
4798                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4799                 return;
4800         }
4801
4802         /*
4803          * Now calculate the negotiated capabilities
4804          * based on the mask for:
4805          * - client only flags
4806          * - flags used in both directions
4807          * - server only flags
4808          */
4809         both_capabilities = client_capabilities & server_capabilities;
4810         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4811         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4812         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4813
4814         max_xmit = MIN(client_max_xmit, server_max_xmit);
4815
4816         conn->smb1.server.capabilities = server_capabilities;
4817         conn->smb1.capabilities = capabilities;
4818
4819         conn->smb1.server.max_xmit = server_max_xmit;
4820         conn->smb1.max_xmit = max_xmit;
4821
4822         conn->smb1.server.max_mux = server_max_mux;
4823
4824         conn->smb1.server.security_mode = server_security_mode;
4825
4826         conn->smb1.server.readbraw = server_readbraw;
4827         conn->smb1.server.writebraw = server_writebraw;
4828         conn->smb1.server.lockread = server_lockread;
4829         conn->smb1.server.writeunlock = server_writeunlock;
4830
4831         conn->smb1.server.session_key = server_session_key;
4832
4833         talloc_steal(conn, server_gss_blob.data);
4834         conn->smb1.server.gss_blob = server_gss_blob;
4835         conn->smb1.server.guid = server_guid;
4836         memcpy(conn->smb1.server.challenge, server_challenge, 8);
4837         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4838         conn->smb1.server.name = talloc_move(conn, &server_name);
4839
4840         conn->smb1.server.time_zone = server_time_zone;
4841         conn->smb1.server.system_time = server_system_time;
4842
4843         tevent_req_done(req);
4844 }
4845
4846 static size_t smbXcli_padding_helper(uint32_t offset, size_t n)
4847 {
4848         if ((offset & (n-1)) == 0) return 0;
4849         return n - (offset & (n-1));
4850 }
4851
4852 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4853 {
4854         size_t i;
4855         uint8_t *buf;
4856         uint16_t dialect_count = 0;
4857         DATA_BLOB dyn = data_blob_null;
4858
4859         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4860                 bool ok;
4861                 uint8_t val[2];
4862
4863                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4864                         continue;
4865                 }
4866
4867                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4868                         continue;
4869                 }
4870
4871                 SSVAL(val, 0, smb2cli_prots[i].smb2_dialect);
4872
4873                 ok = data_blob_append(state, &dyn, val, sizeof(val));
4874                 if (!ok) {
4875                         return NULL;
4876                 }
4877
4878                 dialect_count++;
4879         }
4880
4881         buf = state->smb2.fixed;
4882         SSVAL(buf, 0, 36);
4883         SSVAL(buf, 2, dialect_count);
4884         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4885         SSVAL(buf, 6, 0);       /* Reserved */
4886         if (state->conn->max_protocol >= PROTOCOL_SMB3_00) {
4887                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4888         } else {
4889                 SIVAL(buf, 8, 0);       /* Capabilities */
4890         }
4891         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4892                 struct GUID_ndr_buf guid_buf = { .buf = {0}, };
4893
4894                 GUID_to_ndr_buf(&state->conn->smb2.client.guid, &guid_buf);
4895                 memcpy(buf+12, guid_buf.buf, 16); /* ClientGuid */
4896         } else {
4897                 memset(buf+12, 0, 16);  /* ClientGuid */
4898         }
4899
4900         if (state->conn->max_protocol >= PROTOCOL_SMB3_11) {
4901                 const struct smb3_signing_capabilities *client_sign_algos =
4902                         &state->conn->smb2.client.smb3_capabilities.signing;
4903                 const struct smb3_encryption_capabilities *client_ciphers =
4904                         &state->conn->smb2.client.smb3_capabilities.encryption;
4905                 NTSTATUS status;
4906                 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4907                 uint8_t *netname_utf16 = NULL;
4908                 size_t netname_utf16_len = 0;
4909                 uint32_t offset;
4910                 DATA_BLOB b;
4911                 uint8_t p[38];
4912                 const uint8_t zeros[8] = {0, };
4913                 size_t pad;
4914                 bool ok;
4915
4916                 SSVAL(p, 0,  1); /* HashAlgorithmCount */
4917                 SSVAL(p, 2, 32); /* SaltLength */
4918                 SSVAL(p, 4, SMB2_PREAUTH_INTEGRITY_SHA512);
4919                 generate_random_buffer(p + 6, 32);
4920
4921                 status = smb2_negotiate_context_add(
4922                         state, &c, SMB2_PREAUTH_INTEGRITY_CAPABILITIES, p, 38);
4923                 if (!NT_STATUS_IS_OK(status)) {
4924                         return NULL;
4925                 }
4926
4927                 if (client_ciphers->num_algos > 0) {
4928                         size_t ofs = 0;
4929                         SSVAL(p, ofs, client_ciphers->num_algos);
4930                         ofs += 2;
4931
4932                         for (i = 0; i < client_ciphers->num_algos; i++) {
4933                                 size_t next_ofs = ofs + 2;
4934                                 SMB_ASSERT(next_ofs < ARRAY_SIZE(p));
4935                                 SSVAL(p, ofs, client_ciphers->algos[i]);
4936                                 ofs = next_ofs;
4937                         }
4938
4939                         status = smb2_negotiate_context_add(
4940                                 state, &c, SMB2_ENCRYPTION_CAPABILITIES, p, ofs);
4941                         if (!NT_STATUS_IS_OK(status)) {
4942                                 return NULL;
4943                         }
4944                 }
4945
4946                 if (client_sign_algos->num_algos > 0) {
4947                         size_t ofs = 0;
4948                         SSVAL(p, ofs, client_sign_algos->num_algos);
4949                         ofs += 2;
4950
4951                         for (i = 0; i < client_sign_algos->num_algos; i++) {
4952                                 size_t next_ofs = ofs + 2;
4953                                 SMB_ASSERT(next_ofs < ARRAY_SIZE(p));
4954                                 SSVAL(p, ofs, client_sign_algos->algos[i]);
4955                                 ofs = next_ofs;
4956                         }
4957
4958                         status = smb2_negotiate_context_add(
4959                                 state, &c, SMB2_SIGNING_CAPABILITIES, p, ofs);
4960                         if (!NT_STATUS_IS_OK(status)) {
4961                                 return NULL;
4962                         }
4963                 }
4964
4965                 ok = convert_string_talloc(state, CH_UNIX, CH_UTF16,
4966                                            state->conn->remote_name,
4967                                            strlen(state->conn->remote_name),
4968                                            &netname_utf16, &netname_utf16_len);
4969                 if (!ok) {
4970                         return NULL;
4971                 }
4972
4973                 status = smb2_negotiate_context_add(state, &c,
4974                                         SMB2_NETNAME_NEGOTIATE_CONTEXT_ID,
4975                                         netname_utf16, netname_utf16_len);
4976                 if (!NT_STATUS_IS_OK(status)) {
4977                         return NULL;
4978                 }
4979
4980                 if (state->in_ctx != NULL) {
4981                         struct smb2_negotiate_contexts *ctxs = state->in_ctx;
4982
4983                         for (i=0; i<ctxs->num_contexts; i++) {
4984                                 struct smb2_negotiate_context *ctx =
4985                                         &ctxs->contexts[i];
4986
4987                                 status = smb2_negotiate_context_add(
4988                                         state,
4989                                         &c,
4990                                         ctx->type,
4991                                         ctx->data.data,
4992                                         ctx->data.length);
4993                                 if (!NT_STATUS_IS_OK(status)) {
4994                                         return NULL;
4995                                 }
4996                         }
4997                 }
4998
4999                 status = smb2_negotiate_context_push(state, &b, c);
5000                 if (!NT_STATUS_IS_OK(status)) {
5001                         return NULL;
5002                 }
5003
5004                 offset = SMB2_HDR_BODY + sizeof(state->smb2.fixed) + dyn.length;
5005                 pad = smbXcli_padding_helper(offset, 8);
5006
5007                 ok = data_blob_append(state, &dyn, zeros, pad);
5008                 if (!ok) {
5009                         return NULL;
5010                 }
5011                 offset += pad;
5012
5013                 ok = data_blob_append(state, &dyn, b.data, b.length);
5014                 if (!ok) {
5015                         return NULL;
5016                 }
5017
5018                 SIVAL(buf, 28, offset);   /* NegotiateContextOffset */
5019                 SSVAL(buf, 32, c.num_contexts); /* NegotiateContextCount */
5020                 SSVAL(buf, 34, 0);        /* Reserved */
5021         } else {
5022                 SBVAL(buf, 28, 0);      /* Reserved/ClientStartTime */
5023         }
5024
5025         return smb2cli_req_send(state, state->ev,
5026                                 state->conn, SMB2_OP_NEGPROT,
5027                                 0, 0, /* flags */
5028                                 state->timeout_msec,
5029                                 NULL, NULL, /* tcon, session */
5030                                 state->smb2.fixed, sizeof(state->smb2.fixed),
5031                                 dyn.data, dyn.length,
5032                                 UINT16_MAX); /* max_dyn_len */
5033 }
5034
5035 static NTSTATUS smbXcli_negprot_smb3_check_capabilities(struct tevent_req *req);
5036
5037 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
5038 {
5039         struct tevent_req *req =
5040                 tevent_req_callback_data(subreq,
5041                 struct tevent_req);
5042         struct smbXcli_negprot_state *state =
5043                 tevent_req_data(req,
5044                 struct smbXcli_negprot_state);
5045         struct smbXcli_conn *conn = state->conn;
5046         size_t security_offset, security_length;
5047         DATA_BLOB blob;
5048         NTSTATUS status;
5049         struct iovec *iov = NULL;
5050         uint8_t *body;
5051         size_t i;
5052         uint16_t dialect_revision;
5053         uint32_t negotiate_context_offset = 0;
5054         uint16_t negotiate_context_count = 0;
5055         DATA_BLOB negotiate_context_blob = data_blob_null;
5056         size_t avail;
5057         size_t ctx_ofs;
5058         size_t needed;
5059         struct smb2_negotiate_context *preauth = NULL;
5060         uint16_t hash_count;
5061         uint16_t salt_length;
5062         uint16_t hash_selected;
5063         gnutls_hash_hd_t hash_hnd = NULL;
5064         struct smb2_negotiate_context *sign_algo = NULL;
5065         struct smb2_negotiate_context *cipher = NULL;
5066         struct smb2_negotiate_context *posix = NULL;
5067         struct iovec sent_iov[3] = {{0}, {0}, {0}};
5068         static const struct smb2cli_req_expected_response expected[] = {
5069         {
5070                 .status = NT_STATUS_OK,
5071                 .body_size = 0x41
5072         }
5073         };
5074         int rc;
5075
5076         status = smb2cli_req_recv(subreq, state, &iov,
5077                                   expected, ARRAY_SIZE(expected));
5078         if (tevent_req_nterror(req, status)) {
5079                 return;
5080         }
5081         if (iov == NULL) {
5082                 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
5083                 return;
5084         }
5085
5086         body = (uint8_t *)iov[1].iov_base;
5087
5088         dialect_revision = SVAL(body, 4);
5089
5090         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5091                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5092                         continue;
5093                 }
5094
5095                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5096                         continue;
5097                 }
5098
5099                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
5100                         continue;
5101                 }
5102
5103                 conn->protocol = smb2cli_prots[i].proto;
5104                 break;
5105         }
5106
5107         if (conn->protocol == PROTOCOL_NONE) {
5108                 TALLOC_FREE(subreq);
5109
5110                 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5111                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5112                         return;
5113                 }
5114
5115                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
5116                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5117                         return;
5118                 }
5119
5120                 /* make sure we do not loop forever */
5121                 state->conn->min_protocol = PROTOCOL_SMB2_02;
5122
5123                 /*
5124                  * send a SMB2 negprot, in order to negotiate
5125                  * the SMB2 dialect.
5126                  */
5127                 subreq = smbXcli_negprot_smb2_subreq(state);
5128                 if (tevent_req_nomem(subreq, req)) {
5129                         return;
5130                 }
5131                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5132                 return;
5133         }
5134
5135         conn->smb2.server.security_mode = SVAL(body, 2);
5136         if (conn->protocol >= PROTOCOL_SMB3_11) {
5137                 negotiate_context_count = SVAL(body, 6);
5138         }
5139
5140         blob = data_blob_const(body + 8, 16);
5141         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
5142         if (tevent_req_nterror(req, status)) {
5143                 return;
5144         }
5145
5146         conn->smb2.server.capabilities  = IVAL(body, 24);
5147         conn->smb2.server.max_trans_size= IVAL(body, 28);
5148         conn->smb2.server.max_read_size = IVAL(body, 32);
5149         conn->smb2.server.max_write_size= IVAL(body, 36);
5150         conn->smb2.server.system_time   = BVAL(body, 40);
5151         conn->smb2.server.start_time    = BVAL(body, 48);
5152
5153         if (conn->smb2.server.max_trans_size == 0 ||
5154             conn->smb2.server.max_read_size == 0 ||
5155             conn->smb2.server.max_write_size == 0) {
5156                 /*
5157                  * We can't connect to servers we can't
5158                  * do any operations on.
5159                  */
5160                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5161                 return;
5162         }
5163
5164         security_offset = SVAL(body, 56);
5165         security_length = SVAL(body, 58);
5166
5167         if (security_offset == 0) {
5168                 /*
5169                  * Azure sends security_offset = 0 and security_length = 0
5170                  *
5171                  * We just set security_offset to the expected value
5172                  * in order to allow the further logic to work
5173                  * as before.
5174                  */
5175                 if (security_length != 0) {
5176                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5177                         return;
5178                 }
5179                 security_offset = SMB2_HDR_BODY + iov[1].iov_len;
5180         }
5181
5182         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
5183                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5184                 return;
5185         }
5186
5187         if (security_length > iov[2].iov_len) {
5188                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5189                 return;
5190         }
5191
5192         conn->smb2.server.gss_blob = data_blob_talloc(conn,
5193                                                 iov[2].iov_base,
5194                                                 security_length);
5195         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
5196                 return;
5197         }
5198
5199         if (conn->protocol >= PROTOCOL_SMB3_00) {
5200                 conn->smb2.server.sign_algo = SMB2_SIGNING_AES128_CMAC;
5201         } else {
5202                 conn->smb2.server.sign_algo = SMB2_SIGNING_HMAC_SHA256;
5203         }
5204
5205         if (conn->protocol < PROTOCOL_SMB3_11) {
5206                 TALLOC_FREE(subreq);
5207
5208                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
5209                         conn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
5210                 }
5211
5212                 status = smbXcli_negprot_smb3_check_capabilities(req);
5213                 if (tevent_req_nterror(req, status)) {
5214                         return;
5215                 }
5216
5217                 tevent_req_done(req);
5218                 return;
5219         }
5220
5221         /*
5222          * Here we are now at SMB3_11, so encryption should be
5223          * negotiated via context, not capabilities.
5224          */
5225
5226         if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
5227                 /*
5228                  * Server set SMB2_CAP_ENCRYPTION capability,
5229                  * but *SHOULD* not, not *MUST* not. Just mask it off.
5230                  * NetApp seems to do this:
5231                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009
5232                  */
5233                 conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION;
5234         }
5235
5236         negotiate_context_offset = IVAL(body, 60);
5237         if (negotiate_context_offset < security_offset) {
5238                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5239                 return;
5240         }
5241
5242         ctx_ofs = negotiate_context_offset - security_offset;
5243         if (ctx_ofs > iov[2].iov_len) {
5244                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5245                 return;
5246         }
5247         avail = iov[2].iov_len - security_length;
5248         needed = iov[2].iov_len - ctx_ofs;
5249         if (needed > avail) {
5250                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5251                 return;
5252         }
5253
5254         negotiate_context_blob.data = (uint8_t *)iov[2].iov_base;
5255         negotiate_context_blob.length = iov[2].iov_len;
5256
5257         negotiate_context_blob.data += ctx_ofs;
5258         negotiate_context_blob.length -= ctx_ofs;
5259
5260         state->out_ctx = talloc_zero(state, struct smb2_negotiate_contexts);
5261         if (tevent_req_nomem(state->out_ctx, req)) {
5262                 return;
5263         }
5264
5265         status = smb2_negotiate_context_parse(state->out_ctx,
5266                                               negotiate_context_blob,
5267                                               negotiate_context_count,
5268                                               state->out_ctx);
5269         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5270                 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
5271         }
5272         if (tevent_req_nterror(req, status)) {
5273                 return;
5274         }
5275
5276         preauth = smb2_negotiate_context_find(
5277                 state->out_ctx, SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
5278         if (preauth == NULL) {
5279                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5280                 return;
5281         }
5282
5283         if (preauth->data.length < 6) {
5284                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5285                 return;
5286         }
5287
5288         hash_count = SVAL(preauth->data.data, 0);
5289         salt_length = SVAL(preauth->data.data, 2);
5290         hash_selected = SVAL(preauth->data.data, 4);
5291
5292         if (hash_count != 1) {
5293                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5294                 return;
5295         }
5296
5297         if (preauth->data.length != (6 + salt_length)) {
5298                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5299                 return;
5300         }
5301
5302         if (hash_selected != SMB2_PREAUTH_INTEGRITY_SHA512) {
5303                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5304                 return;
5305         }
5306
5307         sign_algo = smb2_negotiate_context_find(
5308                 state->out_ctx, SMB2_SIGNING_CAPABILITIES);
5309         if (sign_algo != NULL) {
5310                 const struct smb3_signing_capabilities *client_sign_algos =
5311                         &state->conn->smb2.client.smb3_capabilities.signing;
5312                 bool found_selected = false;
5313                 uint16_t sign_algo_count;
5314                 uint16_t sign_algo_selected;
5315
5316                 if (client_sign_algos->num_algos == 0) {
5317                         /*
5318                          * We didn't ask for SMB2_ENCRYPTION_CAPABILITIES
5319                          */
5320                         tevent_req_nterror(req,
5321                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5322                         return;
5323                 }
5324
5325                 if (sign_algo->data.length < 2) {
5326                         tevent_req_nterror(req,
5327                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5328                         return;
5329                 }
5330
5331                 sign_algo_count = SVAL(sign_algo->data.data, 0);
5332                 if (sign_algo_count != 1) {
5333                         tevent_req_nterror(req,
5334                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5335                         return;
5336                 }
5337
5338                 if (sign_algo->data.length < (2 + 2 * sign_algo_count)) {
5339                         tevent_req_nterror(req,
5340                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5341                         return;
5342                 }
5343                 sign_algo_selected = SVAL(sign_algo->data.data, 2);
5344
5345                 for (i = 0; i < client_sign_algos->num_algos; i++) {
5346                         if (client_sign_algos->algos[i] == sign_algo_selected) {
5347                                 /*
5348                                  * We found a match
5349                                  */
5350                                 found_selected = true;
5351                                 break;
5352                         }
5353                 }
5354
5355                 if (!found_selected) {
5356                         /*
5357                          * The server send a sign_algo we didn't offer.
5358                          */
5359                         tevent_req_nterror(req,
5360                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5361                         return;
5362                 }
5363
5364                 conn->smb2.server.sign_algo = sign_algo_selected;
5365         }
5366
5367         cipher = smb2_negotiate_context_find(
5368                 state->out_ctx, SMB2_ENCRYPTION_CAPABILITIES);
5369         if (cipher != NULL) {
5370                 const struct smb3_encryption_capabilities *client_ciphers =
5371                         &state->conn->smb2.client.smb3_capabilities.encryption;
5372                 bool found_selected = false;
5373                 uint16_t cipher_count;
5374                 uint16_t cipher_selected;
5375
5376                 if (client_ciphers->num_algos == 0) {
5377                         /*
5378                          * We didn't ask for SMB2_ENCRYPTION_CAPABILITIES
5379                          */
5380                         tevent_req_nterror(req,
5381                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5382                         return;
5383                 }
5384
5385                 if (cipher->data.length < 2) {
5386                         tevent_req_nterror(req,
5387                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5388                         return;
5389                 }
5390
5391                 cipher_count = SVAL(cipher->data.data, 0);
5392                 if (cipher_count != 1) {
5393                         tevent_req_nterror(req,
5394                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5395                         return;
5396                 }
5397
5398                 if (cipher->data.length < (2 + 2 * cipher_count)) {
5399                         tevent_req_nterror(req,
5400                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5401                         return;
5402                 }
5403                 cipher_selected = SVAL(cipher->data.data, 2);
5404
5405                 for (i = 0; i < client_ciphers->num_algos; i++) {
5406                         if (cipher_selected == SMB2_ENCRYPTION_NONE) {
5407                                 /*
5408                                  * encryption not supported
5409                                  */
5410                                 found_selected = true;
5411                                 break;
5412                         }
5413                         if (client_ciphers->algos[i] == cipher_selected) {
5414                                 /*
5415                                  * We found a match
5416                                  */
5417                                 found_selected = true;
5418                                 break;
5419                         }
5420                 }
5421
5422                 if (!found_selected) {
5423                         /*
5424                          * The server send a cipher we didn't offer.
5425                          */
5426                         tevent_req_nterror(req,
5427                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5428                         return;
5429                 }
5430
5431                 conn->smb2.server.cipher = cipher_selected;
5432         }
5433
5434         posix = smb2_negotiate_context_find(
5435                 state->out_ctx, SMB2_POSIX_EXTENSIONS_AVAILABLE);
5436         if (posix != NULL) {
5437                 DATA_BLOB posix_blob = data_blob_const(
5438                         SMB2_CREATE_TAG_POSIX, strlen(SMB2_CREATE_TAG_POSIX));
5439                 int cmp = data_blob_cmp(&posix->data, &posix_blob);
5440
5441                 conn->smb2.server.smb311_posix = (cmp == 0);
5442         }
5443
5444
5445         /* First we hash the request */
5446         smb2cli_req_get_sent_iov(subreq, sent_iov);
5447
5448         rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_SHA512);
5449         if (rc < 0) {
5450                 tevent_req_nterror(req,
5451                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5452                 return;
5453         }
5454
5455         rc = gnutls_hash(hash_hnd,
5456                          conn->smb2.preauth_sha512,
5457                          sizeof(conn->smb2.preauth_sha512));
5458         if (rc < 0) {
5459                 gnutls_hash_deinit(hash_hnd, NULL);
5460                 tevent_req_nterror(req,
5461                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5462                 return;
5463         }
5464         for (i = 0; i < 3; i++) {
5465                 rc = gnutls_hash(hash_hnd,
5466                                  sent_iov[i].iov_base,
5467                                  sent_iov[i].iov_len);
5468                 if (rc < 0) {
5469                         gnutls_hash_deinit(hash_hnd, NULL);
5470                         tevent_req_nterror(req,
5471                                            gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5472                         return;
5473                 }
5474         }
5475
5476         /* This resets the hash state */
5477         gnutls_hash_output(hash_hnd, conn->smb2.preauth_sha512);
5478         TALLOC_FREE(subreq);
5479
5480         /* And now we hash the response */
5481         rc = gnutls_hash(hash_hnd,
5482                          conn->smb2.preauth_sha512,
5483                          sizeof(conn->smb2.preauth_sha512));
5484         if (rc < 0) {
5485                 gnutls_hash_deinit(hash_hnd, NULL);
5486                 tevent_req_nterror(req,
5487                                    gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5488                 return;
5489         }
5490         for (i = 0; i < 3; i++) {
5491                 rc = gnutls_hash(hash_hnd,
5492                                  iov[i].iov_base,
5493                                  iov[i].iov_len);
5494                 if (rc < 0) {
5495                         gnutls_hash_deinit(hash_hnd, NULL);
5496                         tevent_req_nterror(req,
5497                                            gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED));
5498                         return;
5499                 }
5500         }
5501         gnutls_hash_deinit(hash_hnd, conn->smb2.preauth_sha512);
5502         if (rc < 0) {
5503                 tevent_req_nterror(req,
5504                                    NT_STATUS_UNSUCCESSFUL);
5505                 return;
5506         }
5507
5508         status = smbXcli_negprot_smb3_check_capabilities(req);
5509         if (tevent_req_nterror(req, status)) {
5510                 return;
5511         }
5512
5513         tevent_req_done(req);
5514 }
5515
5516 static NTSTATUS smbXcli_negprot_smb3_check_capabilities(struct tevent_req *req)
5517 {
5518         struct smbXcli_negprot_state *state =
5519                 tevent_req_data(req,
5520                 struct smbXcli_negprot_state);
5521         struct smbXcli_conn *conn = state->conn;
5522
5523         return smb311_capabilities_check(&conn->smb2.client.smb3_capabilities,
5524                                          "smbXcli_negprot",
5525                                          DBGLVL_ERR,
5526                                          NT_STATUS_ACCESS_DENIED,
5527                                          "client",
5528                                          conn->protocol,
5529                                          conn->smb2.server.sign_algo,
5530                                          conn->smb2.server.cipher);
5531 }
5532
5533 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
5534                                                   TALLOC_CTX *tmp_mem,
5535                                                   uint8_t *inbuf)
5536 {
5537         size_t num_pending = talloc_array_length(conn->pending);
5538         struct tevent_req *subreq;
5539         struct smbXcli_req_state *substate;
5540         struct tevent_req *req;
5541         uint32_t protocol_magic;
5542         size_t inbuf_len = smb_len_nbt(inbuf);
5543
5544         if (num_pending != 1) {
5545                 return NT_STATUS_INTERNAL_ERROR;
5546         }
5547
5548         if (inbuf_len < 4) {
5549                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
5550         }
5551
5552         subreq = conn->pending[0];
5553         substate = tevent_req_data(subreq, struct smbXcli_req_state);
5554         req = tevent_req_callback_data(subreq, struct tevent_req);
5555
5556         protocol_magic = IVAL(inbuf, 4);
5557
5558         switch (protocol_magic) {
5559         case SMB_MAGIC:
5560                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
5561                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
5562                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5563
5564         case SMB2_MAGIC:
5565                 if (substate->smb2.recv_iov == NULL) {
5566                         /*
5567                          * For the SMB1 negprot we have move it.
5568                          */
5569                         substate->smb2.recv_iov = substate->smb1.recv_iov;
5570                         substate->smb1.recv_iov = NULL;
5571                 }
5572
5573                 /*
5574                  * we got an SMB2 answer, which consumed sequence number 0
5575                  * so we need to use 1 as the next one.
5576                  *
5577                  * we also need to set the current credits to 0
5578                  * as we consumed the initial one. The SMB2 answer
5579                  * hopefully grant us a new credit.
5580                  */
5581                 conn->smb2.mid = 1;
5582                 conn->smb2.cur_credits = 0;
5583                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5584                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
5585                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5586         }
5587
5588         DEBUG(10, ("Got non-SMB PDU\n"));
5589         return NT_STATUS_INVALID_NETWORK_RESPONSE;
5590 }
5591
5592 NTSTATUS smbXcli_negprot_recv(
5593         struct tevent_req *req,
5594         TALLOC_CTX *mem_ctx,
5595         struct smb2_negotiate_contexts **out_ctx)
5596 {
5597         struct smbXcli_negprot_state *state = tevent_req_data(
5598                 req, struct smbXcli_negprot_state);
5599         NTSTATUS status;
5600
5601         if (tevent_req_is_nterror(req, &status)) {
5602                 tevent_req_received(req);
5603                 return status;
5604         }
5605
5606         if (out_ctx != NULL) {
5607                 *out_ctx = talloc_move(mem_ctx, &state->out_ctx);
5608         }
5609
5610         tevent_req_received(req);
5611         return NT_STATUS_OK;
5612 }
5613
5614 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
5615                          uint32_t timeout_msec,
5616                          enum protocol_types min_protocol,
5617                          enum protocol_types max_protocol,
5618                          struct smb2_negotiate_contexts *in_ctx,
5619                          TALLOC_CTX *mem_ctx,
5620                          struct smb2_negotiate_contexts **out_ctx)
5621 {
5622         TALLOC_CTX *frame = talloc_stackframe();
5623         struct tevent_context *ev;
5624         struct tevent_req *req;
5625         NTSTATUS status = NT_STATUS_NO_MEMORY;
5626         bool ok;
5627
5628         if (smbXcli_conn_has_async_calls(conn)) {
5629                 /*
5630                  * Can't use sync call while an async call is in flight
5631                  */
5632                 status = NT_STATUS_INVALID_PARAMETER_MIX;
5633                 goto fail;
5634         }
5635         ev = samba_tevent_context_init(frame);
5636         if (ev == NULL) {
5637                 goto fail;
5638         }
5639         req = smbXcli_negprot_send(
5640                 frame,
5641                 ev,
5642                 conn,
5643                 timeout_msec,
5644                 min_protocol,
5645                 max_protocol,
5646                 WINDOWS_CLIENT_PURE_SMB2_NEGPROT_INITIAL_CREDIT_ASK,
5647                 in_ctx);
5648         if (req == NULL) {
5649                 goto fail;
5650         }
5651         ok = tevent_req_poll_ntstatus(req, ev, &status);
5652         if (!ok) {
5653                 goto fail;
5654         }
5655         status = smbXcli_negprot_recv(req, mem_ctx, out_ctx);
5656  fail:
5657         TALLOC_FREE(frame);
5658         return status;
5659 }
5660
5661 struct smb2cli_validate_negotiate_info_state {
5662         struct smbXcli_conn *conn;
5663         DATA_BLOB in_input_buffer;
5664         DATA_BLOB in_output_buffer;
5665         DATA_BLOB out_input_buffer;
5666         DATA_BLOB out_output_buffer;
5667         uint16_t dialect;
5668 };
5669
5670 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq);
5671
5672 struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx,
5673                                                 struct tevent_context *ev,
5674                                                 struct smbXcli_conn *conn,
5675                                                 uint32_t timeout_msec,
5676                                                 struct smbXcli_session *session,
5677                                                 struct smbXcli_tcon *tcon)
5678 {
5679         struct tevent_req *req;
5680         struct smb2cli_validate_negotiate_info_state *state;
5681         uint8_t *buf;
5682         uint16_t dialect_count = 0;
5683         struct tevent_req *subreq;
5684         bool _save_should_sign;
5685         size_t i;
5686
5687         req = tevent_req_create(mem_ctx, &state,
5688                                 struct smb2cli_validate_negotiate_info_state);
5689         if (req == NULL) {
5690                 return NULL;
5691         }
5692         state->conn = conn;
5693
5694         state->in_input_buffer = data_blob_talloc_zero(state,
5695                                         4 + 16 + 1 + 1 + 2);
5696         if (tevent_req_nomem(state->in_input_buffer.data, req)) {
5697                 return tevent_req_post(req, ev);
5698         }
5699         buf = state->in_input_buffer.data;
5700
5701         if (state->conn->max_protocol >= PROTOCOL_SMB3_00) {
5702                 SIVAL(buf, 0, conn->smb2.client.capabilities);
5703         } else {
5704                 SIVAL(buf, 0, 0); /* Capabilities */
5705         }
5706         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
5707                 struct GUID_ndr_buf guid_buf = { .buf = {0}, };
5708
5709                 GUID_to_ndr_buf(&conn->smb2.client.guid, &guid_buf);
5710                 memcpy(buf+4, guid_buf.buf, 16); /* ClientGuid */
5711         } else {
5712                 memset(buf+4, 0, 16);   /* ClientGuid */
5713         }
5714         if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5715                 SCVAL(buf, 20, conn->smb2.client.security_mode);
5716         } else {
5717                 SCVAL(buf, 20, 0);
5718         }
5719         SCVAL(buf, 21, 0); /* reserved */
5720
5721         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5722                 bool ok;
5723                 size_t ofs;
5724
5725                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5726                         continue;
5727                 }
5728
5729                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5730                         continue;
5731                 }
5732
5733                 if (smb2cli_prots[i].proto == state->conn->protocol) {
5734                         state->dialect = smb2cli_prots[i].smb2_dialect;
5735                 }
5736
5737                 ofs = state->in_input_buffer.length;
5738                 ok = data_blob_realloc(state, &state->in_input_buffer,
5739                                        ofs + 2);
5740                 if (!ok) {
5741                         tevent_req_oom(req);
5742                         return tevent_req_post(req, ev);
5743                 }
5744
5745                 buf = state->in_input_buffer.data;
5746                 SSVAL(buf, ofs, smb2cli_prots[i].smb2_dialect);
5747
5748                 dialect_count++;
5749         }
5750         buf = state->in_input_buffer.data;
5751         SSVAL(buf, 22, dialect_count);
5752
5753         _save_should_sign = smb2cli_tcon_is_signing_on(tcon);
5754         smb2cli_tcon_should_sign(tcon, true);
5755         subreq = smb2cli_ioctl_send(state, ev, conn,
5756                                     timeout_msec, session, tcon,
5757                                     UINT64_MAX, /* in_fid_persistent */
5758                                     UINT64_MAX, /* in_fid_volatile */
5759                                     FSCTL_VALIDATE_NEGOTIATE_INFO,
5760                                     0, /* in_max_input_length */
5761                                     &state->in_input_buffer,
5762                                     24, /* in_max_output_length */
5763                                     &state->in_output_buffer,
5764                                     SMB2_IOCTL_FLAG_IS_FSCTL);
5765         smb2cli_tcon_should_sign(tcon, _save_should_sign);
5766         if (tevent_req_nomem(subreq, req)) {
5767                 return tevent_req_post(req, ev);
5768         }
5769         tevent_req_set_callback(subreq,
5770                                 smb2cli_validate_negotiate_info_done,
5771                                 req);
5772
5773         return req;
5774 }
5775
5776 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq)
5777 {
5778         struct tevent_req *req =
5779                 tevent_req_callback_data(subreq,
5780                 struct tevent_req);
5781         struct smb2cli_validate_negotiate_info_state *state =
5782                 tevent_req_data(req,
5783                 struct smb2cli_validate_negotiate_info_state);
5784         NTSTATUS status;
5785         const uint8_t *buf;
5786         uint32_t capabilities;
5787         DATA_BLOB guid_blob;
5788         struct GUID server_guid;
5789         uint16_t security_mode;
5790         uint16_t dialect;
5791
5792         status = smb2cli_ioctl_recv(subreq, state,
5793                                     &state->out_input_buffer,
5794                                     &state->out_output_buffer);
5795         TALLOC_FREE(subreq);
5796
5797         /*
5798          * This response must be signed correctly for
5799          * these "normal" error codes to be processed.
5800          * If the packet wasn't signed correctly we will get
5801          * NT_STATUS_ACCESS_DENIED or NT_STATUS_HMAC_NOT_SUPPORTED,
5802          * or NT_STATUS_INVALID_NETWORK_RESPONSE
5803          * from smb2_signing_check_pdu().
5804          *
5805          * We must never ignore the above errors here.
5806          */
5807
5808         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED)) {
5809                 /*
5810                  * The response was signed, but not supported
5811                  *
5812                  * Older Windows and Samba releases return
5813                  * NT_STATUS_FILE_CLOSED.
5814                  */
5815                 tevent_req_done(req);
5816                 return;
5817         }
5818         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST)) {
5819                 /*
5820                  * The response was signed, but not supported
5821                  *
5822                  * This is returned by the NTVFS based Samba 4.x file server
5823                  * for file shares.
5824                  */
5825                 tevent_req_done(req);
5826                 return;
5827         }
5828         if (NT_STATUS_EQUAL(status, NT_STATUS_FS_DRIVER_REQUIRED)) {
5829                 /*
5830                  * The response was signed, but not supported
5831                  *
5832                  * This is returned by the NTVFS based Samba 4.x file server
5833                  * for ipc shares.
5834                  */
5835                 tevent_req_done(req);
5836                 return;
5837         }
5838         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
5839                 /*
5840                  * The response was signed, but not supported
5841                  *
5842                  * This might be returned by older Windows versions or by
5843                  * NetApp SMB server implementations.
5844                  *
5845                  * See
5846                  *
5847                  * https://blogs.msdn.microsoft.com/openspecification/2012/06/28/smb3-secure-dialect-negotiation/
5848                  *
5849                  */
5850                 tevent_req_done(req);
5851                 return;
5852         }
5853         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
5854                 /*
5855                  * The response was signed, but not supported
5856                  *
5857                  * This might be returned by NetApp Ontap 7.3.7 SMB server
5858                  * implementations.
5859                  *
5860                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=14607
5861                  *
5862                  */
5863                 tevent_req_done(req);
5864                 return;
5865         }
5866         if (tevent_req_nterror(req, status)) {
5867                 return;
5868         }
5869
5870         if (state->out_output_buffer.length != 24) {
5871                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5872                 return;
5873         }
5874
5875         buf = state->out_output_buffer.data;
5876
5877         capabilities = IVAL(buf, 0);
5878         guid_blob = data_blob_const(buf + 4, 16);
5879         status = GUID_from_data_blob(&guid_blob, &server_guid);
5880         if (tevent_req_nterror(req, status)) {
5881                 return;
5882         }
5883         security_mode = CVAL(buf, 20);
5884         dialect = SVAL(buf, 22);
5885
5886         if (capabilities != state->conn->smb2.server.capabilities) {
5887                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5888                 return;
5889         }
5890
5891         if (!GUID_equal(&server_guid, &state->conn->smb2.server.guid)) {
5892                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5893                 return;
5894         }
5895
5896         if (security_mode != state->conn->smb2.server.security_mode) {
5897                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5898                 return;
5899         }
5900
5901         if (dialect != state->dialect) {
5902                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5903                 return;
5904         }
5905
5906         tevent_req_done(req);
5907 }
5908
5909 NTSTATUS smb2cli_validate_negotiate_info_recv(struct tevent_req *req)
5910 {
5911         return tevent_req_simple_recv_ntstatus(req);
5912 }
5913
5914 static int smbXcli_session_destructor(struct smbXcli_session *session)
5915 {
5916         if (session->conn == NULL) {
5917                 return 0;
5918         }
5919
5920         DLIST_REMOVE(session->conn->sessions, session);
5921         return 0;
5922 }
5923
5924 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
5925                                                struct smbXcli_conn *conn)
5926 {
5927         struct smbXcli_session *session;
5928         NTSTATUS status;
5929
5930         session = talloc_zero(mem_ctx, struct smbXcli_session);
5931         if (session == NULL) {
5932                 return NULL;
5933         }
5934         session->smb2 = talloc_zero(session, struct smb2cli_session);
5935         if (session->smb2 == NULL) {
5936                 talloc_free(session);
5937                 return NULL;
5938         }
5939         talloc_set_destructor(session, smbXcli_session_destructor);
5940
5941         status = smb2_signing_key_sign_create(session->smb2,
5942                                               conn->smb2.server.sign_algo,
5943                                               NULL, /* no master key */
5944                                               NULL, /* derivations */
5945                                               &session->smb2->signing_key);
5946         if (!NT_STATUS_IS_OK(status)) {
5947                 talloc_free(session);
5948                 return NULL;
5949         }
5950
5951         DLIST_ADD_END(conn->sessions, session);
5952         session->conn = conn;
5953
5954         status = smb2_signing_key_sign_create(session,
5955                                               conn->smb2.server.sign_algo,
5956                                               NULL, /* no master key */
5957                                               NULL, /* derivations */
5958                                               &session->smb2_channel.signing_key);
5959         if (!NT_STATUS_IS_OK(status)) {
5960                 talloc_free(session);
5961                 return NULL;
5962         }
5963
5964         memcpy(session->smb2_channel.preauth_sha512,
5965                conn->smb2.preauth_sha512,
5966                sizeof(session->smb2_channel.preauth_sha512));
5967
5968         return session;
5969 }
5970
5971 struct smbXcli_session *smbXcli_session_shallow_copy(TALLOC_CTX *mem_ctx,
5972                                                 struct smbXcli_session *src)
5973 {
5974         struct smbXcli_session *session;
5975         struct timespec ts;
5976         NTTIME nt;
5977
5978         session = talloc_zero(mem_ctx, struct smbXcli_session);
5979         if (session == NULL) {
5980                 return NULL;
5981         }
5982         session->smb2 = talloc_zero(session, struct smb2cli_session);
5983         if (session->smb2 == NULL) {
5984                 talloc_free(session);
5985                 return NULL;
5986         }
5987
5988         /*
5989          * Note we keep a pointer to the session keys of the
5990          * main session and rely on the caller to free the
5991          * shallow copy first!
5992          */
5993         session->conn = src->conn;
5994         *session->smb2 = *src->smb2;
5995         session->smb2_channel = src->smb2_channel;
5996         session->disconnect_expired = src->disconnect_expired;
5997
5998         /*
5999          * This is only supposed to be called in test code
6000          * but we should not reuse nonces!
6001          *
6002          * Add the current timestamp as NTTIME to nonce_high
6003          * and set nonce_low to a value we can recognize in captures.
6004          */
6005         clock_gettime_mono(&ts);
6006         nt = unix_timespec_to_nt_time(ts);
6007         nt &= session->smb2->nonce_high_max;
6008         if (nt == session->smb2->nonce_high_max || nt < UINT8_MAX) {
6009                 talloc_free(session);
6010                 return NULL;
6011         }
6012         session->smb2->nonce_high += nt;
6013         session->smb2->nonce_low = UINT32_MAX;
6014
6015         DLIST_ADD_END(src->conn->sessions, session);
6016         talloc_set_destructor(session, smbXcli_session_destructor);
6017
6018         return session;
6019 }
6020
6021 bool smbXcli_session_is_guest(struct smbXcli_session *session)
6022 {
6023         if (session == NULL) {
6024                 return false;
6025         }
6026
6027         if (session->conn == NULL) {
6028                 return false;
6029         }
6030
6031         if (session->conn->mandatory_signing) {
6032                 return false;
6033         }
6034
6035         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
6036                 if (session->smb2->session_flags & SMB2_SESSION_FLAG_IS_GUEST) {
6037                         return true;
6038                 }
6039                 return false;
6040         }
6041
6042         if (session->smb1.action & SMB_SETUP_GUEST) {
6043                 return true;
6044         }
6045
6046         return false;
6047 }
6048
6049 bool smbXcli_session_is_authenticated(struct smbXcli_session *session)
6050 {
6051         const DATA_BLOB *application_key;
6052
6053         if (session == NULL) {
6054                 return false;
6055         }
6056
6057         if (session->conn == NULL) {
6058                 return false;
6059         }
6060
6061         /*
6062          * If we have an application key we had a session key negotiated
6063          * at auth time.
6064          */
6065         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
6066                 if (!smb2_signing_key_valid(session->smb2->application_key)) {
6067                         return false;
6068                 }
6069                 application_key = &session->smb2->application_key->blob;
6070         } else {
6071                 application_key = &session->smb1.application_key;
6072         }
6073
6074         if (application_key->length == 0) {
6075                 return false;
6076         }
6077
6078         return true;
6079 }
6080
6081 NTSTATUS smb2cli_session_signing_key(struct smbXcli_session *session,
6082                                      TALLOC_CTX *mem_ctx,
6083                                      DATA_BLOB *key)
6084 {
6085         const struct smb2_signing_key *sig = NULL;
6086
6087         if (session->conn == NULL) {
6088                 return NT_STATUS_NO_USER_SESSION_KEY;
6089         }
6090
6091         /*
6092          * Use channel signing key if there is one, otherwise fallback
6093          * to session.
6094          */
6095
6096         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6097                 sig = session->smb2_channel.signing_key;
6098         } else if (smb2_signing_key_valid(session->smb2->signing_key)) {
6099                 sig = session->smb2->signing_key;
6100         } else {
6101                 return NT_STATUS_NO_USER_SESSION_KEY;
6102         }
6103
6104         *key = data_blob_dup_talloc(mem_ctx, sig->blob);
6105         if (key->data == NULL) {
6106                 return NT_STATUS_NO_MEMORY;
6107         }
6108
6109         return NT_STATUS_OK;
6110 }
6111
6112 NTSTATUS smb2cli_session_encryption_key(struct smbXcli_session *session,
6113                                         TALLOC_CTX *mem_ctx,
6114                                         DATA_BLOB *key)
6115 {
6116         if (session->conn == NULL) {
6117                 return NT_STATUS_NO_USER_SESSION_KEY;
6118         }
6119
6120         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6121                 return NT_STATUS_NO_USER_SESSION_KEY;
6122         }
6123
6124         if (!smb2_signing_key_valid(session->smb2->encryption_key)) {
6125                 return NT_STATUS_NO_USER_SESSION_KEY;
6126         }
6127
6128         *key = data_blob_dup_talloc(mem_ctx, session->smb2->encryption_key->blob);
6129         if (key->data == NULL) {
6130                 return NT_STATUS_NO_MEMORY;
6131         }
6132
6133         return NT_STATUS_OK;
6134 }
6135
6136 NTSTATUS smb2cli_session_decryption_key(struct smbXcli_session *session,
6137                                         TALLOC_CTX *mem_ctx,
6138                                         DATA_BLOB *key)
6139 {
6140         if (session->conn == NULL) {
6141                 return NT_STATUS_NO_USER_SESSION_KEY;
6142         }
6143
6144         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6145                 return NT_STATUS_NO_USER_SESSION_KEY;
6146         }
6147
6148         if (!smb2_signing_key_valid(session->smb2->decryption_key)) {
6149                 return NT_STATUS_NO_USER_SESSION_KEY;
6150         }
6151
6152         *key = data_blob_dup_talloc(mem_ctx, session->smb2->decryption_key->blob);
6153         if (key->data == NULL) {
6154                 return NT_STATUS_NO_MEMORY;
6155         }
6156
6157         return NT_STATUS_OK;
6158 }
6159
6160 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
6161                                          TALLOC_CTX *mem_ctx,
6162                                          DATA_BLOB *key)
6163 {
6164         const DATA_BLOB *application_key;
6165
6166         *key = data_blob_null;
6167
6168         if (session->conn == NULL) {
6169                 return NT_STATUS_NO_USER_SESSION_KEY;
6170         }
6171
6172         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
6173                 if (!smb2_signing_key_valid(session->smb2->application_key)) {
6174                         return NT_STATUS_NO_USER_SESSION_KEY;
6175                 }
6176                 application_key = &session->smb2->application_key->blob;
6177         } else {
6178                 application_key = &session->smb1.application_key;
6179         }
6180
6181         if (application_key->length == 0) {
6182                 return NT_STATUS_NO_USER_SESSION_KEY;
6183         }
6184
6185         *key = data_blob_dup_talloc(mem_ctx, *application_key);
6186         if (key->data == NULL) {
6187                 return NT_STATUS_NO_MEMORY;
6188         }
6189
6190         return NT_STATUS_OK;
6191 }
6192
6193 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
6194 {
6195         session->disconnect_expired = true;
6196 }
6197
6198 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
6199 {
6200         return session->smb1.session_id;
6201 }
6202
6203 void smb1cli_session_set_id(struct smbXcli_session *session,
6204                             uint16_t session_id)
6205 {
6206         session->smb1.session_id = session_id;
6207 }
6208
6209 void smb1cli_session_set_action(struct smbXcli_session *session,
6210                                 uint16_t action)
6211 {
6212         session->smb1.action = action;
6213 }
6214
6215 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
6216                                          const DATA_BLOB _session_key)
6217 {
6218         struct smbXcli_conn *conn = session->conn;
6219         uint8_t session_key[16];
6220
6221         if (conn == NULL) {
6222                 return NT_STATUS_INVALID_PARAMETER_MIX;
6223         }
6224
6225         if (session->smb1.application_key.length != 0) {
6226                 /*
6227                  * TODO: do not allow this...
6228                  *
6229                  * return NT_STATUS_INVALID_PARAMETER_MIX;
6230                  */
6231                 data_blob_clear_free(&session->smb1.application_key);
6232                 session->smb1.protected_key = false;
6233         }
6234
6235         if (_session_key.length == 0) {
6236                 return NT_STATUS_OK;
6237         }
6238
6239         ZERO_STRUCT(session_key);
6240         memcpy(session_key, _session_key.data,
6241                MIN(_session_key.length, sizeof(session_key)));
6242
6243         session->smb1.application_key = data_blob_talloc(session,
6244                                                          session_key,
6245                                                          sizeof(session_key));
6246         ZERO_STRUCT(session_key);
6247         if (session->smb1.application_key.data == NULL) {
6248                 return NT_STATUS_NO_MEMORY;
6249         }
6250
6251         session->smb1.protected_key = false;
6252
6253         return NT_STATUS_OK;
6254 }
6255
6256 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
6257 {
6258         NTSTATUS status;
6259
6260         if (session->smb1.protected_key) {
6261                 /* already protected */
6262                 return NT_STATUS_OK;
6263         }
6264
6265         if (session->smb1.application_key.length != 16) {
6266                 return NT_STATUS_INVALID_PARAMETER_MIX;
6267         }
6268
6269         status = smb1_key_derivation(session->smb1.application_key.data,
6270                                     session->smb1.application_key.length,
6271                                     session->smb1.application_key.data);
6272         if (!NT_STATUS_IS_OK(status)) {
6273                 return status;
6274         }
6275
6276         session->smb1.protected_key = true;
6277
6278         return NT_STATUS_OK;
6279 }
6280
6281 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
6282 {
6283         struct smbXcli_conn *conn = session->conn;
6284         uint8_t security_mode = 0;
6285
6286         if (conn == NULL) {
6287                 return security_mode;
6288         }
6289
6290         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
6291         if (conn->mandatory_signing) {
6292                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
6293         }
6294         if (session->smb2->should_sign) {
6295                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
6296         }
6297
6298         return security_mode;
6299 }
6300
6301 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
6302 {
6303         return session->smb2->session_id;
6304 }
6305
6306 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
6307 {
6308         return session->smb2->session_flags;
6309 }
6310
6311 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
6312                                       uint64_t session_id,
6313                                       uint16_t session_flags)
6314 {
6315         session->smb2->session_id = session_id;
6316         session->smb2->session_flags = session_flags;
6317 }
6318
6319 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
6320 {
6321         session->smb2->channel_sequence += 1;
6322 }
6323
6324 uint16_t smb2cli_session_reset_channel_sequence(struct smbXcli_session *session,
6325                                                 uint16_t channel_sequence)
6326 {
6327         uint16_t prev_cs;
6328
6329         prev_cs = session->smb2->channel_sequence;
6330         session->smb2->channel_sequence = channel_sequence;
6331
6332         return prev_cs;
6333 }
6334
6335 uint16_t smb2cli_session_current_channel_sequence(struct smbXcli_session *session)
6336 {
6337         return session->smb2->channel_sequence;
6338 }
6339
6340 void smb2cli_session_start_replay(struct smbXcli_session *session)
6341 {
6342         session->smb2->replay_active = true;
6343 }
6344
6345 void smb2cli_session_stop_replay(struct smbXcli_session *session)
6346 {
6347         session->smb2->replay_active = false;
6348 }
6349
6350 void smb2cli_session_require_signed_response(struct smbXcli_session *session,
6351                                              bool require_signed_response)
6352 {
6353         session->smb2->require_signed_response = require_signed_response;
6354 }
6355
6356 void smb2cli_session_torture_anonymous_signing(struct smbXcli_session *session,
6357                                                bool anonymous_signing)
6358 {
6359         session->smb2->anonymous_signing = anonymous_signing;
6360 }
6361
6362 void smb2cli_session_torture_anonymous_encryption(struct smbXcli_session *session,
6363                                                   bool anonymous_encryption)
6364 {
6365         session->smb2->anonymous_encryption = anonymous_encryption;
6366 }
6367
6368 void smb2cli_session_torture_no_signing_disconnect(struct smbXcli_session *session)
6369 {
6370         session->smb2->no_signing_disconnect = true;
6371 }
6372
6373 NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
6374                                         const struct iovec *iov)
6375 {
6376         gnutls_hash_hd_t hash_hnd = NULL;
6377         size_t i;
6378         int rc;
6379
6380         if (session->conn == NULL) {
6381                 return NT_STATUS_INTERNAL_ERROR;
6382         }
6383
6384         if (session->conn->protocol < PROTOCOL_SMB3_11) {
6385                 return NT_STATUS_OK;
6386         }
6387
6388         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6389                 return NT_STATUS_OK;
6390         }
6391
6392         rc = gnutls_hash_init(&hash_hnd,
6393                               GNUTLS_DIG_SHA512);
6394         if (rc < 0) {
6395                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6396         }
6397
6398         rc = gnutls_hash(hash_hnd,
6399                          session->smb2_channel.preauth_sha512,
6400                          sizeof(session->smb2_channel.preauth_sha512));
6401         if (rc < 0) {
6402                 gnutls_hash_deinit(hash_hnd, NULL);
6403                 return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6404         }
6405         for (i = 0; i < 3; i++) {
6406                 rc = gnutls_hash(hash_hnd,
6407                                  iov[i].iov_base,
6408                                  iov[i].iov_len);
6409                 if (rc < 0) {
6410                         gnutls_hash_deinit(hash_hnd, NULL);
6411                         return gnutls_error_to_ntstatus(rc, NT_STATUS_HASH_NOT_SUPPORTED);
6412                 }
6413         }
6414         gnutls_hash_deinit(hash_hnd, session->smb2_channel.preauth_sha512);
6415
6416         return NT_STATUS_OK;
6417 }
6418
6419 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
6420                                          const DATA_BLOB _session_key,
6421                                          const struct iovec *recv_iov)
6422 {
6423         struct smbXcli_conn *conn = session->conn;
6424         uint16_t no_sign_flags = 0;
6425         bool check_signature = true;
6426         uint32_t hdr_flags;
6427         NTSTATUS status;
6428         struct smb2_signing_derivations derivations = {
6429                 .signing = NULL,
6430         };
6431         DATA_BLOB preauth_hash = data_blob_null;
6432         size_t nonce_size = 0;
6433
6434         if (conn == NULL) {
6435                 return NT_STATUS_INVALID_PARAMETER_MIX;
6436         }
6437
6438         if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
6439                 return NT_STATUS_INVALID_PARAMETER_MIX;
6440         }
6441
6442         if (!conn->mandatory_signing) {
6443                 /*
6444                  * only allow guest sessions without
6445                  * mandatory signing.
6446                  *
6447                  * If we try an authentication with username != ""
6448                  * and the server let us in without verifying the
6449                  * password we don't have a negotiated session key
6450                  * for signing.
6451                  */
6452                 no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST;
6453         }
6454
6455         if (session->smb2->session_flags & no_sign_flags) {
6456                 session->smb2->should_sign = false;
6457                 return NT_STATUS_OK;
6458         }
6459
6460         if (smb2_signing_key_valid(session->smb2->signing_key)) {
6461                 return NT_STATUS_INVALID_PARAMETER_MIX;
6462         }
6463
6464         if (conn->protocol >= PROTOCOL_SMB3_11) {
6465                 preauth_hash = data_blob_const(session->smb2_channel.preauth_sha512,
6466                                 sizeof(session->smb2_channel.preauth_sha512));
6467         }
6468
6469         smb2_signing_derivations_fill_const_stack(&derivations,
6470                                                   conn->protocol,
6471                                                   preauth_hash);
6472
6473         if (session->smb2->anonymous_encryption) {
6474                 goto skip_signing_key;
6475         }
6476
6477         status = smb2_signing_key_sign_create(session->smb2,
6478                                               conn->smb2.server.sign_algo,
6479                                               &_session_key,
6480                                               derivations.signing,
6481                                               &session->smb2->signing_key);
6482         if (!NT_STATUS_IS_OK(status)) {
6483                 return status;
6484         }
6485
6486         if (session->smb2->anonymous_signing) {
6487                 /*
6488                  * skip encryption and application keys
6489                  */
6490                 goto skip_application_key;
6491         }
6492
6493 skip_signing_key:
6494
6495         status = smb2_signing_key_cipher_create(session->smb2,
6496                                                 conn->smb2.server.cipher,
6497                                                 &_session_key,
6498                                                 derivations.cipher_c2s,
6499                                                 &session->smb2->encryption_key);
6500         if (!NT_STATUS_IS_OK(status)) {
6501                 return status;
6502         }
6503
6504         status = smb2_signing_key_cipher_create(session->smb2,
6505                                                 conn->smb2.server.cipher,
6506                                                 &_session_key,
6507                                                 derivations.cipher_s2c,
6508                                                 &session->smb2->decryption_key);
6509         if (!NT_STATUS_IS_OK(status)) {
6510                 return status;
6511         }
6512
6513         if (session->smb2->anonymous_encryption) {
6514                 goto skip_application_key;
6515         }
6516
6517         status = smb2_signing_key_sign_create(session->smb2,
6518                                               conn->smb2.server.sign_algo,
6519                                               &_session_key,
6520                                               derivations.application,
6521                                               &session->smb2->application_key);
6522         if (!NT_STATUS_IS_OK(status)) {
6523                 return status;
6524         }
6525
6526 skip_application_key:
6527
6528         status = smb2_signing_key_copy(session,
6529                                        session->smb2->signing_key,
6530                                        &session->smb2_channel.signing_key);
6531         if (!NT_STATUS_IS_OK(status)) {
6532                 return status;
6533         }
6534
6535         check_signature = conn->mandatory_signing;
6536
6537         if (conn->protocol >= PROTOCOL_SMB3_11) {
6538                 check_signature = true;
6539         }
6540
6541         if (session->smb2->anonymous_signing) {
6542                 check_signature = false;
6543         }
6544
6545         if (session->smb2->anonymous_encryption) {
6546                 check_signature = false;
6547         }
6548
6549         hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
6550         if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
6551                 /*
6552                  * Sadly some vendors don't sign the
6553                  * final SMB2 session setup response
6554                  *
6555                  * At least Windows and Samba are always doing this
6556                  * if there's a session key available.
6557                  *
6558                  * We only check the signature if it's mandatory
6559                  * or SMB2_HDR_FLAG_SIGNED is provided.
6560                  */
6561                 check_signature = true;
6562         }
6563
6564         if (check_signature) {
6565                 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6566                                                 recv_iov, 3);
6567                 if (!NT_STATUS_IS_OK(status)) {
6568                         return status;
6569                 }
6570         }
6571
6572         session->smb2->should_sign = false;
6573         session->smb2->should_encrypt = false;
6574
6575         if (conn->desire_signing) {
6576                 session->smb2->should_sign = true;
6577         }
6578
6579         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
6580                 session->smb2->should_sign = true;
6581         }
6582
6583         if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
6584                 session->smb2->should_encrypt = true;
6585         }
6586
6587         if (conn->protocol < PROTOCOL_SMB3_00) {
6588                 session->smb2->should_encrypt = false;
6589         }
6590
6591         if (conn->smb2.server.cipher == 0) {
6592                 session->smb2->should_encrypt = false;
6593         }
6594
6595         if (session->smb2->anonymous_signing) {
6596                 session->smb2->should_sign = true;
6597         }
6598
6599         if (session->smb2->anonymous_encryption) {
6600                 session->smb2->should_encrypt = true;
6601                 session->smb2->should_sign = false;
6602         }
6603
6604         /*
6605          * CCM and GCM algorithms must never have their
6606          * nonce wrap, or the security of the whole
6607          * communication and the keys is destroyed.
6608          * We must drop the connection once we have
6609          * transferred too much data.
6610          *
6611          * NOTE: We assume nonces greater than 8 bytes.
6612          */
6613         generate_nonce_buffer((uint8_t *)&session->smb2->nonce_high_random,
6614                               sizeof(session->smb2->nonce_high_random));
6615         switch (conn->smb2.server.cipher) {
6616         case SMB2_ENCRYPTION_AES128_CCM:
6617                 nonce_size = SMB2_AES_128_CCM_NONCE_SIZE;
6618                 break;
6619         case SMB2_ENCRYPTION_AES128_GCM:
6620                 nonce_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_128_GCM);
6621                 break;
6622         case SMB2_ENCRYPTION_AES256_CCM:
6623                 nonce_size = SMB2_AES_128_CCM_NONCE_SIZE;
6624                 break;
6625         case SMB2_ENCRYPTION_AES256_GCM:
6626                 nonce_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_256_GCM);
6627                 break;
6628         default:
6629                 nonce_size = 0;
6630                 break;
6631         }
6632         session->smb2->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
6633         session->smb2->nonce_high = 0;
6634         session->smb2->nonce_low = 0;
6635
6636         return NT_STATUS_OK;
6637 }
6638
6639 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
6640                                         struct smbXcli_session *session1,
6641                                         struct smbXcli_conn *conn,
6642                                         struct smbXcli_session **_session2)
6643 {
6644         struct smbXcli_session *session2;
6645         NTSTATUS status;
6646
6647         if (!smb2_signing_key_valid(session1->smb2->signing_key)) {
6648                 return NT_STATUS_INVALID_PARAMETER_MIX;
6649         }
6650
6651         if (conn == NULL) {
6652                 return NT_STATUS_INVALID_PARAMETER_MIX;
6653         }
6654
6655         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
6656         if (session2 == NULL) {
6657                 return NT_STATUS_NO_MEMORY;
6658         }
6659         session2->smb2 = talloc_reference(session2, session1->smb2);
6660         if (session2->smb2 == NULL) {
6661                 talloc_free(session2);
6662                 return NT_STATUS_NO_MEMORY;
6663         }
6664
6665         talloc_set_destructor(session2, smbXcli_session_destructor);
6666         DLIST_ADD_END(conn->sessions, session2);
6667         session2->conn = conn;
6668
6669         status = smb2_signing_key_sign_create(session2,
6670                                               conn->smb2.server.sign_algo,
6671                                               NULL, /* no master key */
6672                                               NULL, /* derivations */
6673                                               &session2->smb2_channel.signing_key);
6674         if (!NT_STATUS_IS_OK(status)) {
6675                 talloc_free(session2);
6676                 return NT_STATUS_NO_MEMORY;
6677         }
6678
6679         memcpy(session2->smb2_channel.preauth_sha512,
6680                conn->smb2.preauth_sha512,
6681                sizeof(session2->smb2_channel.preauth_sha512));
6682
6683         *_session2 = session2;
6684         return NT_STATUS_OK;
6685 }
6686
6687 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
6688                                          const DATA_BLOB _channel_key,
6689                                          const struct iovec *recv_iov)
6690 {
6691         struct smbXcli_conn *conn = session->conn;
6692         uint8_t channel_key[16];
6693         NTSTATUS status;
6694         struct _derivation {
6695                 DATA_BLOB label;
6696                 DATA_BLOB context;
6697         };
6698         struct {
6699                 struct _derivation signing;
6700         } derivation = {
6701                 .signing.label.length = 0,
6702         };
6703
6704         if (conn == NULL) {
6705                 return NT_STATUS_INVALID_PARAMETER_MIX;
6706         }
6707
6708         if (smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6709                 return NT_STATUS_INVALID_PARAMETER_MIX;
6710         }
6711
6712         if (conn->protocol >= PROTOCOL_SMB3_11) {
6713                 struct _derivation *d;
6714                 DATA_BLOB p;
6715
6716                 p = data_blob_const(session->smb2_channel.preauth_sha512,
6717                                 sizeof(session->smb2_channel.preauth_sha512));
6718
6719                 d = &derivation.signing;
6720                 d->label = data_blob_string_const_null("SMBSigningKey");
6721                 d->context = p;
6722         } else if (conn->protocol >= PROTOCOL_SMB3_00) {
6723                 struct _derivation *d;
6724
6725                 d = &derivation.signing;
6726                 d->label = data_blob_string_const_null("SMB2AESCMAC");
6727                 d->context = data_blob_string_const_null("SmbSign");
6728         }
6729
6730         ZERO_STRUCT(channel_key);
6731         memcpy(channel_key, _channel_key.data,
6732                MIN(_channel_key.length, sizeof(channel_key)));
6733
6734         session->smb2_channel.signing_key->blob =
6735                 data_blob_talloc(session->smb2_channel.signing_key,
6736                                  channel_key,
6737                                  sizeof(channel_key));
6738         if (!smb2_signing_key_valid(session->smb2_channel.signing_key)) {
6739                 ZERO_STRUCT(channel_key);
6740                 return NT_STATUS_NO_MEMORY;
6741         }
6742
6743         if (conn->protocol >= PROTOCOL_SMB3_00) {
6744                 struct _derivation *d = &derivation.signing;
6745
6746                 status = samba_gnutls_sp800_108_derive_key(
6747                         channel_key,
6748                         sizeof(channel_key),
6749                         NULL,
6750                         0,
6751                         d->label.data,
6752                         d->label.length,
6753                         d->context.data,
6754                         d->context.length,
6755                         GNUTLS_MAC_SHA256,
6756                         session->smb2_channel.signing_key->blob.data,
6757                         session->smb2_channel.signing_key->blob.length);
6758                 if (!NT_STATUS_IS_OK(status)) {
6759                         return status;
6760                 }
6761         }
6762         ZERO_STRUCT(channel_key);
6763
6764         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6765                                         recv_iov, 3);
6766         if (!NT_STATUS_IS_OK(status)) {
6767                 return status;
6768         }
6769
6770         return NT_STATUS_OK;
6771 }
6772
6773 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
6774 {
6775         if (session->smb2->anonymous_signing) {
6776                 return NT_STATUS_INVALID_PARAMETER_MIX;
6777         }
6778
6779         if (session->smb2->anonymous_encryption) {
6780                 SMB_ASSERT(session->smb2->should_encrypt);
6781                 SMB_ASSERT(!session->smb2->should_sign);
6782                 return NT_STATUS_OK;
6783         }
6784
6785         if (!session->smb2->should_sign) {
6786                 /*
6787                  * We need required signing on the session
6788                  * in order to prevent man in the middle attacks.
6789                  */
6790                 return NT_STATUS_INVALID_PARAMETER_MIX;
6791         }
6792
6793         if (session->smb2->should_encrypt) {
6794                 return NT_STATUS_OK;
6795         }
6796
6797         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6798                 return NT_STATUS_NOT_SUPPORTED;
6799         }
6800
6801         if (session->conn->smb2.server.cipher == 0) {
6802                 return NT_STATUS_NOT_SUPPORTED;
6803         }
6804
6805         if (!smb2_signing_key_valid(session->smb2->signing_key)) {
6806                 return NT_STATUS_NOT_SUPPORTED;
6807         }
6808         session->smb2->should_encrypt = true;
6809         return NT_STATUS_OK;
6810 }
6811
6812 uint16_t smb2cli_session_get_encryption_cipher(struct smbXcli_session *session)
6813 {
6814         if (session->conn->protocol < PROTOCOL_SMB3_00) {
6815                 return 0;
6816         }
6817
6818         if (!session->smb2->should_encrypt) {
6819                 return 0;
6820         }
6821
6822         return session->conn->smb2.server.cipher;
6823 }
6824
6825 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
6826 {
6827         struct smbXcli_tcon *tcon;
6828
6829         tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
6830         if (tcon == NULL) {
6831                 return NULL;
6832         }
6833
6834         return tcon;
6835 }
6836
6837 /*
6838  * Return a deep structure copy of a struct smbXcli_tcon *
6839  */
6840
6841 struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx,
6842                                 const struct smbXcli_tcon *tcon_in)
6843 {
6844         struct smbXcli_tcon *tcon;
6845
6846         tcon = talloc_memdup(mem_ctx, tcon_in, sizeof(struct smbXcli_tcon));
6847         if (tcon == NULL) {
6848                 return NULL;
6849         }
6850
6851         /* Deal with the SMB1 strings. */
6852         if (tcon_in->smb1.service != NULL) {
6853                 tcon->smb1.service = talloc_strdup(tcon, tcon_in->smb1.service);
6854                 if (tcon->smb1.service == NULL) {
6855                         TALLOC_FREE(tcon);
6856                         return NULL;
6857                 }
6858         }
6859         if (tcon->smb1.fs_type != NULL) {
6860                 tcon->smb1.fs_type = talloc_strdup(tcon, tcon_in->smb1.fs_type);
6861                 if (tcon->smb1.fs_type == NULL) {
6862                         TALLOC_FREE(tcon);
6863                         return NULL;
6864                 }
6865         }
6866         return tcon;
6867 }
6868
6869 void smbXcli_tcon_set_fs_attributes(struct smbXcli_tcon *tcon,
6870                                     uint32_t fs_attributes)
6871 {
6872         tcon->fs_attributes = fs_attributes;
6873 }
6874
6875 uint32_t smbXcli_tcon_get_fs_attributes(struct smbXcli_tcon *tcon)
6876 {
6877         return tcon->fs_attributes;
6878 }
6879
6880 bool smbXcli_tcon_is_dfs_share(struct smbXcli_tcon *tcon)
6881 {
6882         if (tcon == NULL) {
6883                 return false;
6884         }
6885
6886         if (tcon->is_smb1) {
6887                 if (tcon->smb1.optional_support & SMB_SHARE_IN_DFS) {
6888                         return true;
6889                 }
6890
6891                 return false;
6892         }
6893
6894         if (tcon->smb2.capabilities & SMB2_SHARE_CAP_DFS) {
6895                 return true;
6896         }
6897
6898         return false;
6899 }
6900
6901 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
6902 {
6903         return tcon->smb1.tcon_id;
6904 }
6905
6906 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
6907 {
6908         tcon->is_smb1 = true;
6909         tcon->smb1.tcon_id = tcon_id;
6910 }
6911
6912 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
6913                              uint16_t tcon_id,
6914                              uint16_t optional_support,
6915                              uint32_t maximal_access,
6916                              uint32_t guest_maximal_access,
6917                              const char *service,
6918                              const char *fs_type)
6919 {
6920         tcon->is_smb1 = true;
6921         tcon->fs_attributes = 0;
6922         tcon->smb1.tcon_id = tcon_id;
6923         tcon->smb1.optional_support = optional_support;
6924         tcon->smb1.maximal_access = maximal_access;
6925         tcon->smb1.guest_maximal_access = guest_maximal_access;
6926
6927         TALLOC_FREE(tcon->smb1.service);
6928         tcon->smb1.service = talloc_strdup(tcon, service);
6929         if (service != NULL && tcon->smb1.service == NULL) {
6930                 return false;
6931         }
6932
6933         TALLOC_FREE(tcon->smb1.fs_type);
6934         tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
6935         if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
6936                 return false;
6937         }
6938
6939         return true;
6940 }
6941
6942 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
6943 {
6944         return tcon->smb2.tcon_id;
6945 }
6946
6947 void smb2cli_tcon_set_id(struct smbXcli_tcon *tcon, uint32_t tcon_id)
6948 {
6949         tcon->smb2.tcon_id = tcon_id;
6950 }
6951
6952 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
6953 {
6954         return tcon->smb2.capabilities;
6955 }
6956
6957 uint32_t smb2cli_tcon_flags(struct smbXcli_tcon *tcon)
6958 {
6959         return tcon->smb2.flags;
6960 }
6961
6962 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
6963                              struct smbXcli_session *session,
6964                              uint32_t tcon_id,
6965                              uint8_t type,
6966                              uint32_t flags,
6967                              uint32_t capabilities,
6968                              uint32_t maximal_access)
6969 {
6970         tcon->is_smb1 = false;
6971         tcon->fs_attributes = 0;
6972         tcon->smb2.tcon_id = tcon_id;
6973         tcon->smb2.type = type;
6974         tcon->smb2.flags = flags;
6975         tcon->smb2.capabilities = capabilities;
6976         tcon->smb2.maximal_access = maximal_access;
6977
6978         tcon->smb2.should_sign = false;
6979         tcon->smb2.should_encrypt = false;
6980
6981         if (session == NULL) {
6982                 return;
6983         }
6984
6985         tcon->smb2.should_sign = session->smb2->should_sign;
6986         tcon->smb2.should_encrypt = session->smb2->should_encrypt;
6987
6988         if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
6989                 tcon->smb2.should_encrypt = true;
6990         }
6991 }
6992
6993 void smb2cli_tcon_should_sign(struct smbXcli_tcon *tcon,
6994                               bool should_sign)
6995 {
6996         tcon->smb2.should_sign = should_sign;
6997 }
6998
6999 bool smb2cli_tcon_is_signing_on(struct smbXcli_tcon *tcon)
7000 {
7001         if (tcon->smb2.should_encrypt) {
7002                 return true;
7003         }
7004
7005         return tcon->smb2.should_sign;
7006 }
7007
7008 void smb2cli_tcon_should_encrypt(struct smbXcli_tcon *tcon,
7009                                  bool should_encrypt)
7010 {
7011         tcon->smb2.should_encrypt = should_encrypt;
7012 }
7013
7014 bool smb2cli_tcon_is_encryption_on(struct smbXcli_tcon *tcon)
7015 {
7016         return tcon->smb2.should_encrypt;
7017 }
7018
7019 void smb2cli_conn_set_mid(struct smbXcli_conn *conn, uint64_t mid)
7020 {
7021         conn->smb2.mid = mid;
7022 }
7023
7024 uint64_t smb2cli_conn_get_mid(struct smbXcli_conn *conn)
7025 {
7026         return conn->smb2.mid;
7027 }
7028
7029 NTSTATUS smb2cli_parse_dyn_buffer(uint32_t dyn_offset,
7030                                   const DATA_BLOB dyn_buffer,
7031                                   uint32_t min_offset,
7032                                   uint32_t buffer_offset,
7033                                   uint32_t buffer_length,
7034                                   uint32_t max_length,
7035                                   uint32_t *next_offset,
7036                                   DATA_BLOB *buffer)
7037 {
7038         uint32_t offset;
7039         bool oob;
7040
7041         *buffer = data_blob_null;
7042         *next_offset = dyn_offset;
7043
7044         if (buffer_offset == 0) {
7045                 /*
7046                  * If the offset is 0, we better ignore
7047                  * the buffer_length field.
7048                  */
7049                 return NT_STATUS_OK;
7050         }
7051
7052         if (buffer_length == 0) {
7053                 /*
7054                  * If the length is 0, we better ignore
7055                  * the buffer_offset field.
7056                  */
7057                 return NT_STATUS_OK;
7058         }
7059
7060         if ((buffer_offset % 8) != 0) {
7061                 /*
7062                  * The offset needs to be 8 byte aligned.
7063                  */
7064                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
7065         }
7066
7067         /*
7068          * We used to enforce buffer_offset to be
7069          * an exact match of the expected minimum,
7070          * but the NetApp Ontap 7.3.7 SMB server
7071          * gets the padding wrong and aligns the
7072          * input_buffer_offset by a value of 8.
7073          *
7074          * So we just enforce that the offset is
7075          * not lower than the expected value.
7076          */
7077         SMB_ASSERT(min_offset >= dyn_offset);
7078         if (buffer_offset < min_offset) {
7079                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
7080         }
7081
7082         /*
7083          * Make [input|output]_buffer_offset relative to "dyn_buffer"
7084          */
7085         offset = buffer_offset - dyn_offset;
7086         oob = smb_buffer_oob(dyn_buffer.length, offset, buffer_length);
7087         if (oob) {
7088                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
7089         }
7090
7091         /*
7092          * Give the caller a hint what we consumed,
7093          * the caller may need to add possible padding.
7094          */
7095         *next_offset = buffer_offset + buffer_length;
7096
7097         if (max_length == 0) {
7098                 /*
7099                  * If max_input_length is 0 we ignore the
7100                  * input_buffer_length, because Windows 2008 echos the
7101                  * DCERPC request from the requested input_buffer to
7102                  * the response input_buffer.
7103                  *
7104                  * We just use the same logic also for max_output_length...
7105                  */
7106                 buffer_length = 0;
7107         }
7108
7109         if (buffer_length > max_length) {
7110                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
7111         }
7112
7113         *buffer = (DATA_BLOB) {
7114                 .data = dyn_buffer.data + offset,
7115                 .length = buffer_length,
7116         };
7117         return NT_STATUS_OK;
7118 }