s3:libsmb: remove unused cli_smb_inbuf()
[metze/samba/wip.git] / source3 / libsmb / async_smb.c
index 6faf96c207f6e397ce0dcc7af3fa789c2e19cc37..0493a52a0fd1f8cabae66d33783f857af6dfef8a 100644 (file)
 */
 
 #include "includes.h"
-
-/**
- * Fetch an error out of a NBT packet
- * @param[in] buf      The SMB packet
- * @retval             The error, converted to NTSTATUS
- */
-
-NTSTATUS cli_pull_error(char *buf)
+#include "libsmb/libsmb.h"
+#include "../lib/async_req/async_sock.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "../lib/util/tevent_unix.h"
+#include "async_smb.h"
+#include "smb_crypt.h"
+#include "libsmb/nmblib.h"
+#include "read_smb.h"
+
+static NTSTATUS cli_pull_raw_error(const uint8_t *buf)
 {
        uint32_t flags2 = SVAL(buf, smb_flg2);
 
@@ -33,212 +35,9 @@ NTSTATUS cli_pull_error(char *buf)
                return NT_STATUS(IVAL(buf, smb_rcls));
        }
 
-       /* if the client uses dos errors, but there is no error,
-          we should return no error here, otherwise it looks
-          like an unknown bad NT_STATUS. jmcd */
-       if (CVAL(buf, smb_rcls) == 0)
-               return NT_STATUS_OK;
-
        return NT_STATUS_DOS(CVAL(buf, smb_rcls), SVAL(buf,smb_err));
 }
 
-/**
- * Compatibility helper for the sync APIs: Fake NTSTATUS in cli->inbuf
- * @param[in] cli      The client connection that just received an error
- * @param[in] status   The error to set on "cli"
- */
-
-void cli_set_error(struct cli_state *cli, NTSTATUS status)
-{
-       uint32_t flags2 = SVAL(cli->inbuf, smb_flg2);
-
-       if (NT_STATUS_IS_DOS(status)) {
-               SSVAL(cli->inbuf, smb_flg2,
-                     flags2 & ~FLAGS2_32_BIT_ERROR_CODES);
-               SCVAL(cli->inbuf, smb_rcls, NT_STATUS_DOS_CLASS(status));
-               SSVAL(cli->inbuf, smb_err, NT_STATUS_DOS_CODE(status));
-               return;
-       }
-
-       SSVAL(cli->inbuf, smb_flg2, flags2 | FLAGS2_32_BIT_ERROR_CODES);
-       SIVAL(cli->inbuf, smb_rcls, NT_STATUS_V(status));
-       return;
-}
-
-/**
- * @brief Find the smb_cmd offset of the last command pushed
- * @param[in] buf      The buffer we're building up
- * @retval             Where can we put our next andx cmd?
- *
- * While chaining requests, the "next" request we're looking at needs to put
- * its SMB_Command before the data the previous request already built up added
- * to the chain. Find the offset to the place where we have to put our cmd.
- */
-
-static bool find_andx_cmd_ofs(uint8_t *buf, size_t *pofs)
-{
-       uint8_t cmd;
-       size_t ofs;
-
-       cmd = CVAL(buf, smb_com);
-
-       SMB_ASSERT(is_andx_req(cmd));
-
-       ofs = smb_vwv0;
-
-       while (CVAL(buf, ofs) != 0xff) {
-
-               if (!is_andx_req(CVAL(buf, ofs))) {
-                       return false;
-               }
-
-               /*
-                * ofs is from start of smb header, so add the 4 length
-                * bytes. The next cmd is right after the wct field.
-                */
-               ofs = SVAL(buf, ofs+2) + 4 + 1;
-
-               SMB_ASSERT(ofs+4 < talloc_get_size(buf));
-       }
-
-       *pofs = ofs;
-       return true;
-}
-
-/**
- * @brief Do the smb chaining at a buffer level
- * @param[in] poutbuf          Pointer to the talloc'ed buffer to be modified
- * @param[in] smb_command      The command that we want to issue
- * @param[in] wct              How many words?
- * @param[in] vwv              The words, already in network order
- * @param[in] bytes_alignment  How shall we align "bytes"?
- * @param[in] num_bytes                How many bytes?
- * @param[in] bytes            The data the request ships
- *
- * smb_splice_chain() adds the vwv and bytes to the request already present in
- * *poutbuf.
- */
-
-bool smb_splice_chain(uint8_t **poutbuf, uint8_t smb_command,
-                     uint8_t wct, const uint16_t *vwv,
-                     size_t bytes_alignment,
-                     uint32_t num_bytes, const uint8_t *bytes)
-{
-       uint8_t *outbuf;
-       size_t old_size, new_size;
-       size_t ofs;
-       size_t chain_padding = 0;
-       size_t bytes_padding = 0;
-       bool first_request;
-
-       old_size = talloc_get_size(*poutbuf);
-
-       /*
-        * old_size == smb_wct means we're pushing the first request in for
-        * libsmb/
-        */
-
-       first_request = (old_size == smb_wct);
-
-       if (!first_request && ((old_size % 4) != 0)) {
-               /*
-                * Align the wct field of subsequent requests to a 4-byte
-                * boundary
-                */
-               chain_padding = 4 - (old_size % 4);
-       }
-
-       /*
-        * After the old request comes the new wct field (1 byte), the vwv's
-        * and the num_bytes field. After at we might need to align the bytes
-        * given to us to "bytes_alignment", increasing the num_bytes value.
-        */
-
-       new_size = old_size + chain_padding + 1 + wct * sizeof(uint16_t) + 2;
-
-       if ((bytes_alignment != 0) && ((new_size % bytes_alignment) != 0)) {
-               bytes_padding = bytes_alignment - (new_size % bytes_alignment);
-       }
-
-       new_size += bytes_padding + num_bytes;
-
-       if ((smb_command != SMBwriteX) && (new_size > 0xffff)) {
-               DEBUG(1, ("splice_chain: %u bytes won't fit\n",
-                         (unsigned)new_size));
-               return false;
-       }
-
-       outbuf = TALLOC_REALLOC_ARRAY(NULL, *poutbuf, uint8_t, new_size);
-       if (outbuf == NULL) {
-               DEBUG(0, ("talloc failed\n"));
-               return false;
-       }
-       *poutbuf = outbuf;
-
-       if (first_request) {
-               SCVAL(outbuf, smb_com, smb_command);
-       } else {
-               size_t andx_cmd_ofs;
-
-               if (!find_andx_cmd_ofs(outbuf, &andx_cmd_ofs)) {
-                       DEBUG(1, ("invalid command chain\n"));
-                       *poutbuf = TALLOC_REALLOC_ARRAY(
-                               NULL, *poutbuf, uint8_t, old_size);
-                       return false;
-               }
-
-               if (chain_padding != 0) {
-                       memset(outbuf + old_size, 0, chain_padding);
-                       old_size += chain_padding;
-               }
-
-               SCVAL(outbuf, andx_cmd_ofs, smb_command);
-               SSVAL(outbuf, andx_cmd_ofs + 2, old_size - 4);
-       }
-
-       ofs = old_size;
-
-       /*
-        * Push the chained request:
-        *
-        * wct field
-        */
-
-       SCVAL(outbuf, ofs, wct);
-       ofs += 1;
-
-       /*
-        * vwv array
-        */
-
-       memcpy(outbuf + ofs, vwv, sizeof(uint16_t) * wct);
-       ofs += sizeof(uint16_t) * wct;
-
-       /*
-        * bcc (byte count)
-        */
-
-       SSVAL(outbuf, ofs, num_bytes + bytes_padding);
-       ofs += sizeof(uint16_t);
-
-       /*
-        * padding
-        */
-
-       if (bytes_padding != 0) {
-               memset(outbuf + ofs, 0, bytes_padding);
-               ofs += bytes_padding;
-       }
-
-       /*
-        * The bytes field
-        */
-
-       memcpy(outbuf + ofs, bytes, num_bytes);
-
-       return true;
-}
-
 /**
  * Figure out if there is an andx command behind the current one
  * @param[in] buf      The smb buffer to look at
@@ -288,6 +87,7 @@ struct cli_smb_state {
        uint8_t *inbuf;
        uint32_t seqnum;
        int chain_num;
+       int chain_length;
        struct tevent_req **chained_requests;
 };
 
@@ -324,6 +124,14 @@ void cli_smb_req_unset_pending(struct tevent_req *req)
        int num_pending = talloc_array_length(cli->pending);
        int i;
 
+       if (state->mid != 0) {
+               /*
+                * This is a [nt]trans[2] request which waits
+                * for more than one reply.
+                */
+               return;
+       }
+
        if (num_pending == 1) {
                /*
                 * The pending read_smb tevent_req is a child of
@@ -351,9 +159,7 @@ void cli_smb_req_unset_pending(struct tevent_req *req)
        /*
         * Remove ourselves from the cli->pending array
         */
-       if (num_pending > 1) {
-               cli->pending[i] = cli->pending[num_pending-1];
-       }
+       cli->pending[i] = cli->pending[num_pending-1];
 
        /*
         * No NULL check here, we're shrinking by sizeof(void *), and
@@ -366,6 +172,13 @@ void cli_smb_req_unset_pending(struct tevent_req *req)
 
 static int cli_smb_req_destructor(struct tevent_req *req)
 {
+       struct cli_smb_state *state = tevent_req_data(
+               req, struct cli_smb_state);
+       /*
+        * Make sure we really remove it from
+        * the pending array on destruction.
+        */
+       state->mid = 0;
        cli_smb_req_unset_pending(req);
        return 0;
 }
@@ -428,6 +241,20 @@ void cli_smb_req_set_mid(struct tevent_req *req, uint16_t mid)
        state->mid = mid;
 }
 
+uint32_t cli_smb_req_seqnum(struct tevent_req *req)
+{
+       struct cli_smb_state *state = tevent_req_data(
+               req, struct cli_smb_state);
+       return state->seqnum;
+}
+
+void cli_smb_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
+{
+       struct cli_smb_state *state = tevent_req_data(
+               req, struct cli_smb_state);
+       state->seqnum = seqnum;
+}
+
 static size_t iov_len(const struct iovec *iov, int count)
 {
        size_t result = 0;
@@ -469,6 +296,7 @@ struct tevent_req *cli_smb_req_create(TALLOC_CTX *mem_ctx,
 {
        struct tevent_req *result;
        struct cli_smb_state *state;
+       struct timeval endtime;
 
        if (iov_count > MAX_SMB_IOV) {
                /*
@@ -496,11 +324,11 @@ struct tevent_req *cli_smb_req_create(TALLOC_CTX *mem_ctx,
 
        SSVAL(state->bytecount_buf, 0, iov_len(bytes_iov, iov_count));
 
-       state->iov[0].iov_base = state->header;
+       state->iov[0].iov_base = (void *)state->header;
        state->iov[0].iov_len  = sizeof(state->header);
-       state->iov[1].iov_base = state->vwv;
+       state->iov[1].iov_base = (void *)state->vwv;
        state->iov[1].iov_len  = wct * sizeof(uint16_t);
-       state->iov[2].iov_base = state->bytecount_buf;
+       state->iov[2].iov_base = (void *)state->bytecount_buf;
        state->iov[2].iov_len  = sizeof(uint16_t);
 
        if (iov_count != 0) {
@@ -509,11 +337,17 @@ struct tevent_req *cli_smb_req_create(TALLOC_CTX *mem_ctx,
        }
        state->iov_count = iov_count + 3;
 
+       if (cli->timeout) {
+               endtime = timeval_current_ofs_msec(cli->timeout);
+               if (!tevent_req_set_endtime(result, ev, endtime)) {
+                       tevent_req_oom(result);
+               }
+       }
        return result;
 }
 
-static bool cli_signv(struct cli_state *cli, struct iovec *iov, int count,
-                     uint32_t *seqnum)
+static NTSTATUS cli_signv(struct cli_state *cli, struct iovec *iov, int count,
+                         uint32_t *seqnum)
 {
        uint8_t *buf;
 
@@ -523,83 +357,88 @@ static bool cli_signv(struct cli_state *cli, struct iovec *iov, int count,
         */
 
        if ((count <= 0) || (iov[0].iov_len < smb_wct)) {
-               return false;
+               return NT_STATUS_INVALID_PARAMETER;
        }
 
        buf = iov_concat(talloc_tos(), iov, count);
        if (buf == NULL) {
-               return false;
+               return NT_STATUS_NO_MEMORY;
        }
 
        cli_calculate_sign_mac(cli, (char *)buf, seqnum);
        memcpy(iov[0].iov_base, buf, iov[0].iov_len);
 
        TALLOC_FREE(buf);
-       return true;
+       return NT_STATUS_OK;
 }
 
 static void cli_smb_sent(struct tevent_req *subreq);
 
-static bool cli_smb_req_iov_send(struct tevent_req *req,
-                                struct cli_smb_state *state,
-                                struct iovec *iov, int iov_count)
+static NTSTATUS cli_smb_req_iov_send(struct tevent_req *req,
+                                    struct cli_smb_state *state,
+                                    struct iovec *iov, int iov_count)
 {
        struct tevent_req *subreq;
+       NTSTATUS status;
+
+       if (state->cli->fd == -1) {
+               return NT_STATUS_CONNECTION_INVALID;
+       }
 
        if (iov[0].iov_len < smb_wct) {
-               return false;
+               return NT_STATUS_INVALID_PARAMETER;
        }
 
        if (state->mid != 0) {
                SSVAL(iov[0].iov_base, smb_mid, state->mid);
        } else {
-               SSVAL(iov[0].iov_base, smb_mid, cli_alloc_mid(state->cli));
+               uint16_t mid = cli_alloc_mid(state->cli);
+               SSVAL(iov[0].iov_base, smb_mid, mid);
        }
 
        smb_setlen((char *)iov[0].iov_base, iov_len(iov, iov_count) - 4);
 
-       if (!cli_signv(state->cli, iov, iov_count, &state->seqnum)) {
-               return false;
+       status = cli_signv(state->cli, iov, iov_count, &state->seqnum);
+
+       if (!NT_STATUS_IS_OK(status)) {
+               return status;
        }
 
        if (cli_encryption_on(state->cli)) {
-               NTSTATUS status;
                char *buf, *enc_buf;
 
                buf = (char *)iov_concat(talloc_tos(), iov, iov_count);
                if (buf == NULL) {
-                       return false;
+                       return NT_STATUS_NO_MEMORY;
                }
-               status = cli_encrypt_message(state->cli, (char *)buf,
-                                            &enc_buf);
+               status = common_encrypt_buffer(state->cli->trans_enc_state,
+                                              (char *)buf, &enc_buf);
                TALLOC_FREE(buf);
                if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(0, ("Error in encrypting client message: %s\n",
                                  nt_errstr(status)));
-                       return false;
+                       return status;
                }
                buf = (char *)talloc_memdup(state, enc_buf,
                                            smb_len(enc_buf)+4);
                SAFE_FREE(enc_buf);
                if (buf == NULL) {
-                       return false;
+                       return NT_STATUS_NO_MEMORY;
                }
-               iov[0].iov_base = buf;
+               iov[0].iov_base = (void *)buf;
                iov[0].iov_len = talloc_get_size(buf);
-               subreq = writev_send(state, state->ev, state->cli->outgoing,
-                                    state->cli->fd, iov, 1);
-       } else {
-               subreq = writev_send(state, state->ev, state->cli->outgoing,
-                                    state->cli->fd, iov, iov_count);
+               iov_count = 1;
        }
+       subreq = writev_send(state, state->ev, state->cli->outgoing,
+                            state->cli->fd, false, iov, iov_count);
        if (subreq == NULL) {
-               return false;
+               return NT_STATUS_NO_MEMORY;
        }
        tevent_req_set_callback(subreq, cli_smb_sent, req);
-       return true;
+       return NT_STATUS_OK;
 }
 
-bool cli_smb_req_send(struct tevent_req *req)
+NTSTATUS cli_smb_req_send(struct tevent_req *req)
 {
        struct cli_smb_state *state = tevent_req_data(
                req, struct cli_smb_state);
@@ -618,8 +457,9 @@ struct tevent_req *cli_smb_send(TALLOC_CTX *mem_ctx,
 {
        struct tevent_req *req;
        struct iovec iov;
+       NTSTATUS status;
 
-       iov.iov_base = CONST_DISCARD(char *, bytes);
+       iov.iov_base = discard_const_p(void, bytes);
        iov.iov_len = num_bytes;
 
        req = cli_smb_req_create(mem_ctx, ev, cli, smb_command,
@@ -627,8 +467,11 @@ struct tevent_req *cli_smb_send(TALLOC_CTX *mem_ctx,
        if (req == NULL) {
                return NULL;
        }
-       if (!cli_smb_req_send(req)) {
-               TALLOC_FREE(req);
+
+       status = cli_smb_req_send(req);
+       if (!NT_STATUS_IS_OK(status)) {
+               tevent_req_nterror(req, status);
+               return tevent_req_post(req, ev);
        }
        return req;
 }
@@ -645,6 +488,10 @@ static void cli_smb_sent(struct tevent_req *subreq)
        nwritten = writev_recv(subreq, &err);
        TALLOC_FREE(subreq);
        if (nwritten == -1) {
+               if (state->cli->fd != -1) {
+                       close(state->cli->fd);
+                       state->cli->fd = -1;
+               }
                tevent_req_nterror(req, map_nt_error_from_unix(err));
                return;
        }
@@ -678,7 +525,6 @@ static void cli_smb_received(struct tevent_req *subreq)
                subreq, struct cli_state);
        struct tevent_req *req;
        struct cli_smb_state *state;
-       struct tevent_context *ev;
        NTSTATUS status;
        uint8_t *inbuf;
        ssize_t received;
@@ -690,6 +536,10 @@ static void cli_smb_received(struct tevent_req *subreq)
        received = read_smb_recv(subreq, talloc_tos(), &inbuf, &err);
        TALLOC_FREE(subreq);
        if (received == -1) {
+               if (cli->fd != -1) {
+                       close(cli->fd);
+                       cli->fd = -1;
+               }
                status = map_nt_error_from_unix(err);
                goto fail;
        }
@@ -763,20 +613,23 @@ static void cli_smb_received(struct tevent_req *subreq)
 
        req = cli->pending[i];
        state = tevent_req_data(req, struct cli_smb_state);
-       ev = state->ev;
 
        if (!oplock_break /* oplock breaks are not signed */
            && !cli_check_sign_mac(cli, (char *)inbuf, state->seqnum+1)) {
                DEBUG(10, ("cli_check_sign_mac failed\n"));
                TALLOC_FREE(inbuf);
                status = NT_STATUS_ACCESS_DENIED;
+               close(cli->fd);
+               cli->fd = -1;
                goto fail;
        }
 
        if (state->chained_requests == NULL) {
                state->inbuf = talloc_move(state, &inbuf);
                talloc_set_destructor(req, NULL);
-               cli_smb_req_destructor(req);
+               cli_smb_req_unset_pending(req);
+               state->chain_num = 0;
+               state->chain_length = 1;
                tevent_req_done(req);
        } else {
                struct tevent_req **chain = talloc_move(
@@ -788,6 +641,7 @@ static void cli_smb_received(struct tevent_req *subreq)
                                                cli_smb_state);
                        state->inbuf = inbuf;
                        state->chain_num = i;
+                       state->chain_length = num_chained;
                        tevent_req_done(chain[i]);
                }
                TALLOC_FREE(inbuf);
@@ -817,13 +671,14 @@ static void cli_smb_received(struct tevent_req *subreq)
        while (talloc_array_length(cli->pending) > 0) {
                req = cli->pending[0];
                talloc_set_destructor(req, NULL);
-               cli_smb_req_destructor(req);
+               cli_smb_req_unset_pending(req);
                tevent_req_nterror(req, status);
        }
 }
 
-NTSTATUS cli_smb_recv(struct tevent_req *req, uint8_t min_wct,
-                     uint8_t *pwct, uint16_t **pvwv,
+NTSTATUS cli_smb_recv(struct tevent_req *req,
+                     TALLOC_CTX *mem_ctx, uint8_t **pinbuf,
+                     uint8_t min_wct, uint8_t *pwct, uint16_t **pvwv,
                      uint32_t *pnum_bytes, uint8_t **pbytes)
 {
        struct cli_smb_state *state = tevent_req_data(
@@ -839,6 +694,24 @@ NTSTATUS cli_smb_recv(struct tevent_req *req, uint8_t min_wct,
        }
 
        if (state->inbuf == NULL) {
+               if (min_wct != 0) {
+                       return NT_STATUS_INVALID_NETWORK_RESPONSE;
+               }
+               if (pinbuf) {
+                       *pinbuf = NULL;
+               }
+               if (pwct) {
+                       *pwct = 0;
+               }
+               if (pvwv) {
+                       *pvwv = NULL;
+               }
+               if (pnum_bytes) {
+                       *pnum_bytes = 0;
+               }
+               if (pbytes) {
+                       *pbytes = NULL;
+               }
                /* This was a request without a reply */
                return NT_STATUS_OK;
        }
@@ -879,18 +752,45 @@ NTSTATUS cli_smb_recv(struct tevent_req *req, uint8_t min_wct,
                cmd = CVAL(state->inbuf, wct_ofs + 1);
        }
 
-       status = cli_pull_error((char *)state->inbuf);
-
-       if (!have_andx_command((char *)state->inbuf, wct_ofs)
-           && NT_STATUS_IS_ERR(status)) {
+       state->cli->raw_status = cli_pull_raw_error(state->inbuf);
+       if (NT_STATUS_IS_DOS(state->cli->raw_status)) {
+               uint8_t eclass = NT_STATUS_DOS_CLASS(state->cli->raw_status);
+               uint16_t ecode = NT_STATUS_DOS_CODE(state->cli->raw_status);
                /*
-                * The last command takes the error code. All further commands
-                * down the requested chain will get a
-                * NT_STATUS_REQUEST_ABORTED.
+                * TODO: is it really a good idea to do a mapping here?
+                *
+                * The old cli_pull_error() also does it, so I do not change
+                * the behavior yet.
                 */
-               return status;
+               status = dos_to_ntstatus(eclass, ecode);
+       } else {
+               status = state->cli->raw_status;
        }
 
+       if (!have_andx_command((char *)state->inbuf, wct_ofs)) {
+
+               if ((cmd == SMBsesssetupX)
+                   && NT_STATUS_EQUAL(
+                           status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+                       /*
+                        * NT_STATUS_MORE_PROCESSING_REQUIRED is a
+                        * valid return code for session setup
+                        */
+                       goto no_err;
+               }
+
+               if (NT_STATUS_IS_ERR(status)) {
+                       /*
+                        * The last command takes the error code. All
+                        * further commands down the requested chain
+                        * will get a NT_STATUS_REQUEST_ABORTED.
+                        */
+                       return status;
+               }
+       }
+
+no_err:
+
        wct = CVAL(state->inbuf, wct_ofs);
        bytes_offset = wct_ofs + 1 + wct * sizeof(uint16_t);
        num_bytes = SVAL(state->inbuf, bytes_offset);
@@ -921,8 +821,15 @@ NTSTATUS cli_smb_recv(struct tevent_req *req, uint8_t min_wct,
        if (pbytes != NULL) {
                *pbytes = (uint8_t *)state->inbuf + bytes_offset + 2;
        }
+       if ((mem_ctx != NULL) && (pinbuf != NULL)) {
+               if (state->chain_num == state->chain_length-1) {
+                       *pinbuf = talloc_move(mem_ctx, &state->inbuf);
+               } else {
+                       *pinbuf = state->inbuf;
+               }
+       }
 
-       return NT_STATUS_OK;
+       return status;
 }
 
 size_t cli_smb_wct_ofs(struct tevent_req **reqs, int num_reqs)
@@ -941,7 +848,7 @@ size_t cli_smb_wct_ofs(struct tevent_req **reqs, int num_reqs)
        return wct_ofs;
 }
 
-bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
+NTSTATUS cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
 {
        struct cli_smb_state *first_state = tevent_req_data(
                reqs[0], struct cli_smb_state);
@@ -953,6 +860,7 @@ bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
        int i, iovlen;
        struct iovec *iov = NULL;
        struct iovec *this_iov;
+       NTSTATUS status;
 
        iovlen = 0;
        for (i=0; i<num_reqs; i++) {
@@ -962,13 +870,14 @@ bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
 
        iov = talloc_array(last_state, struct iovec, iovlen);
        if (iov == NULL) {
-               goto fail;
+               return NT_STATUS_NO_MEMORY;
        }
 
        first_state->chained_requests = (struct tevent_req **)talloc_memdup(
                last_state, reqs, sizeof(*reqs) * num_reqs);
        if (first_state->chained_requests == NULL) {
-               goto fail;
+               TALLOC_FREE(iov);
+               return NT_STATUS_NO_MEMORY;
        }
 
        wct_offset = smb_wct - 4;
@@ -983,7 +892,9 @@ bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
                if (i < num_reqs-1) {
                        if (!is_andx_req(CVAL(state->header, smb_com))
                            || CVAL(state->header, smb_wct) < 2) {
-                               goto fail;
+                               TALLOC_FREE(iov);
+                               TALLOC_FREE(first_state->chained_requests);
+                               return NT_STATUS_INVALID_PARAMETER;
                        }
                }
 
@@ -1019,7 +930,7 @@ bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
                         * last byte.
                         */
                        this_iov[0].iov_len = chain_padding+1;
-                       this_iov[0].iov_base = &state->header[
+                       this_iov[0].iov_base = (void *)&state->header[
                                sizeof(state->header) - this_iov[0].iov_len];
                        memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
                }
@@ -1029,20 +940,14 @@ bool cli_smb_chain_send(struct tevent_req **reqs, int num_reqs)
                chain_padding = next_padding;
        }
 
-       if (!cli_smb_req_iov_send(reqs[0], last_state, iov, iovlen)) {
-               goto fail;
+       status = cli_smb_req_iov_send(reqs[0], last_state, iov, iovlen);
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(iov);
+               TALLOC_FREE(first_state->chained_requests);
+               return status;
        }
-       return true;
- fail:
-       TALLOC_FREE(iov);
-       return false;
-}
 
-uint8_t *cli_smb_inbuf(struct tevent_req *req)
-{
-       struct cli_smb_state *state = tevent_req_data(
-               req, struct cli_smb_state);
-       return state->inbuf;
+       return NT_STATUS_OK;
 }
 
 bool cli_has_async_calls(struct cli_state *cli)
@@ -1101,11 +1006,13 @@ static void cli_smb_oplock_break_waiter_done(struct tevent_req *subreq)
        uint16_t *vwv;
        uint32_t num_bytes;
        uint8_t *bytes;
+       uint8_t *inbuf;
        NTSTATUS status;
 
-       status = cli_smb_recv(subreq, 8, &wct, &vwv, &num_bytes, &bytes);
+       status = cli_smb_recv(subreq, state, &inbuf, 8, &wct, &vwv,
+                             &num_bytes, &bytes);
+       TALLOC_FREE(subreq);
        if (!NT_STATUS_IS_OK(status)) {
-               TALLOC_FREE(subreq);
                tevent_req_nterror(req, status);
                return;
        }
@@ -1129,3 +1036,130 @@ NTSTATUS cli_smb_oplock_break_waiter_recv(struct tevent_req *req,
        *plevel = state->level;
        return NT_STATUS_OK;
 }
+
+
+struct cli_session_request_state {
+       struct tevent_context *ev;
+       int sock;
+       uint32 len_hdr;
+       struct iovec iov[3];
+       uint8_t nb_session_response;
+};
+
+static void cli_session_request_sent(struct tevent_req *subreq);
+static void cli_session_request_recvd(struct tevent_req *subreq);
+
+struct tevent_req *cli_session_request_send(TALLOC_CTX *mem_ctx,
+                                           struct tevent_context *ev,
+                                           int sock,
+                                           const struct nmb_name *called,
+                                           const struct nmb_name *calling)
+{
+       struct tevent_req *req, *subreq;
+       struct cli_session_request_state *state;
+
+       req = tevent_req_create(mem_ctx, &state,
+                               struct cli_session_request_state);
+       if (req == NULL) {
+               return NULL;
+       }
+       state->ev = ev;
+       state->sock = sock;
+
+       state->iov[1].iov_base = name_mangle(
+               state, called->name, called->name_type);
+       if (tevent_req_nomem(state->iov[1].iov_base, req)) {
+               return tevent_req_post(req, ev);
+       }
+       state->iov[1].iov_len = name_len(
+               (unsigned char *)state->iov[1].iov_base,
+               talloc_get_size(state->iov[1].iov_base));
+
+       state->iov[2].iov_base = name_mangle(
+               state, calling->name, calling->name_type);
+       if (tevent_req_nomem(state->iov[2].iov_base, req)) {
+               return tevent_req_post(req, ev);
+       }
+       state->iov[2].iov_len = name_len(
+               (unsigned char *)state->iov[2].iov_base,
+               talloc_get_size(state->iov[2].iov_base));
+
+       _smb_setlen(((char *)&state->len_hdr),
+                   state->iov[1].iov_len + state->iov[2].iov_len);
+       SCVAL((char *)&state->len_hdr, 0, 0x81);
+
+       state->iov[0].iov_base = &state->len_hdr;
+       state->iov[0].iov_len = sizeof(state->len_hdr);
+
+       subreq = writev_send(state, ev, NULL, sock, true, state->iov, 3);
+       if (tevent_req_nomem(subreq, req)) {
+               return tevent_req_post(req, ev);
+       }
+       tevent_req_set_callback(subreq, cli_session_request_sent, req);
+       return req;
+}
+
+static void cli_session_request_sent(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct cli_session_request_state *state = tevent_req_data(
+               req, struct cli_session_request_state);
+       ssize_t ret;
+       int err;
+
+       ret = writev_recv(subreq, &err);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               tevent_req_error(req, err);
+               return;
+       }
+       subreq = read_smb_send(state, state->ev, state->sock);
+       if (tevent_req_nomem(subreq, req)) {
+               return;
+       }
+       tevent_req_set_callback(subreq, cli_session_request_recvd, req);
+}
+
+static void cli_session_request_recvd(struct tevent_req *subreq)
+{
+       struct tevent_req *req = tevent_req_callback_data(
+               subreq, struct tevent_req);
+       struct cli_session_request_state *state = tevent_req_data(
+               req, struct cli_session_request_state);
+       uint8_t *buf;
+       ssize_t ret;
+       int err;
+
+       ret = read_smb_recv(subreq, talloc_tos(), &buf, &err);
+       TALLOC_FREE(subreq);
+
+       if (ret < 4) {
+               ret = -1;
+               err = EIO;
+       }
+       if (ret == -1) {
+               tevent_req_error(req, err);
+               return;
+       }
+       /*
+        * In case of an error there is more information in the data
+        * portion according to RFC1002. We're not subtle enough to
+        * respond to the different error conditions, so drop the
+        * error info here.
+        */
+       state->nb_session_response = CVAL(buf, 0);
+       tevent_req_done(req);
+}
+
+bool cli_session_request_recv(struct tevent_req *req, int *err, uint8_t *resp)
+{
+       struct cli_session_request_state *state = tevent_req_data(
+               req, struct cli_session_request_state);
+
+       if (tevent_req_is_unix_error(req, err)) {
+               return false;
+       }
+       *resp = state->nb_session_response;
+       return true;
+}