s3:signing: the seqnum should only be decremented by 1 for ntcancel requests

[MS-SMB] 3.3.5.1 Receiving Any Message says that the seqnum
is incremented by only for ntcancel requests for any other
request it's by incremented by 2, even if it doesn't expect
a response.

metze

diff --git a/source3/include/proto.h b/source3/include/proto.h
index ffdef43d192522da7ee33bbb5044c571ad96e1e4..6376d8af8a4f3e659c0c1b8425d2eed93ad67bb8 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -3209,7 +3209,7 @@ bool srv_oplock_set_signing(bool onoff);
 bool srv_check_sign_mac(const char *inbuf, bool must_be_ok);
 void srv_calculate_sign_mac(char *outbuf);
 void srv_defer_sign_response(uint16 mid);
-void srv_cancel_sign_response(uint16 mid);
+void srv_cancel_sign_response(uint16 mid, bool cancel);
 void srv_set_signing_negotiated(void);
 bool srv_is_signing_active(void);
 bool srv_is_signing_negotiated(void);

diff --git a/source3/libsmb/smb_signing.c b/source3/libsmb/smb_signing.c
index ea1eb05cfb1324d705e33b6e56ebc1b62ced3d91..55b30d476f0e4bc837210e3ae2d497f4593cf5ef 100644 (file)
--- a/source3/libsmb/smb_signing.c
+++ b/source3/libsmb/smb_signing.c
@@ -865,7 +865,7 @@ void srv_defer_sign_response(uint16 mid)
  cancelled by mid. This should never find one....
 ************************************************************/
 
-void srv_cancel_sign_response(uint16 mid)
+void srv_cancel_sign_response(uint16 mid, bool cancel)
 {
        struct smb_basic_signing_context *data;
        uint32 dummy_seq;
@@ -884,7 +884,9 @@ void srv_cancel_sign_response(uint16 mid)
                ;
 
        /* cancel doesn't send a reply so doesn't burn a sequence number. */
-       data->send_seq_num -= 1;
+       if (cancel) {
+               data->send_seq_num -= 1;
+       }
 }
 
 /***********************************************************

diff --git a/source3/smbd/aio.c b/source3/smbd/aio.c
index 6b19e098e5cf0e45fc6bb1d0b0ed1cb721a79c28..cfa4b430ebf271aafd654004c541f4bdc766ecc2 100644 (file)
--- a/source3/smbd/aio.c
+++ b/source3/smbd/aio.c
@@ -347,7 +347,7 @@ static int handle_aio_read_complete(struct aio_extra *aio_ex)
                /* If errno is ECANCELED then don't return anything to the
                 * client. */
                if (errno == ECANCELED) {
-                       srv_cancel_sign_response(aio_ex->req->mid);
+                       srv_cancel_sign_response(aio_ex->req->mid, false);
                        return 0;
                }
 
@@ -441,7 +441,7 @@ static int handle_aio_write_complete(struct aio_extra *aio_ex)
                /* If errno is ECANCELED then don't return anything to the
                 * client. */
                if (errno == ECANCELED) {
-                       srv_cancel_sign_response(aio_ex->req->mid);
+                       srv_cancel_sign_response(aio_ex->req->mid, false);
                        return 0;
                }
 
@@ -534,7 +534,7 @@ void smbd_aio_complete_mid(unsigned int mid)
        if (!aio_ex) {
                DEBUG(3,("smbd_aio_complete_mid: Can't find record to "
                         "match mid %u.\n", mid));
-               srv_cancel_sign_response(mid);
+               srv_cancel_sign_response(mid, false);
                return;
        }
 
@@ -544,7 +544,7 @@ void smbd_aio_complete_mid(unsigned int mid)
                 * ignore. */
                DEBUG( 3,( "smbd_aio_complete_mid: file closed whilst "
                           "aio outstanding (mid[%u]).\n", mid));
-               srv_cancel_sign_response(mid);
+               srv_cancel_sign_response(mid, false);
                return;
        }
 

diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 86a46505a2f1e4ba228a856179fbdf0c15791a41..9c7fb1914e8716c6f27b90d1f2dd1878871fea26 100644 (file)
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -1131,7 +1131,7 @@ void reply_ntcancel(struct smb_request *req)
        START_PROFILE(SMBntcancel);
        remove_pending_change_notify_requests_by_mid(req->mid);
        remove_pending_lock_requests_by_mid(req->mid);
-       srv_cancel_sign_response(req->mid);
+       srv_cancel_sign_response(req->mid, true);
 
        DEBUG(3,("reply_ntcancel: cancel called on mid = %d.\n", req->mid));