libcli/smb: add smbXcli_tcon structure
[obnox/samba/samba-obnox.git] / libcli / smb / smbXcli_base.c
index aad999d737a065ff18667e61c88dae4313c5862f..e9592e78a2db4ac8b5bcb54e7b92d32591d497be 100644 (file)
@@ -35,6 +35,7 @@
 struct smbXcli_conn;
 struct smbXcli_req;
 struct smbXcli_session;
+struct smbXcli_tcon;
 
 struct smbXcli_conn {
        int read_fd;
@@ -131,16 +132,44 @@ struct smbXcli_session {
        struct smbXcli_session *prev, *next;
        struct smbXcli_conn *conn;
 
+       struct {
+               uint16_t session_id;
+       } smb1;
+
        struct {
                uint64_t session_id;
                uint16_t session_flags;
                DATA_BLOB application_key;
                DATA_BLOB signing_key;
                bool should_sign;
+               bool should_encrypt;
+               DATA_BLOB encryption_key;
+               DATA_BLOB decryption_key;
+               uint64_t channel_nonce;
+               uint64_t channel_next;
                DATA_BLOB channel_signing_key;
        } smb2;
 };
 
+struct smbXcli_tcon {
+       struct {
+               uint16_t tcon_id;
+               uint16_t optional_support;
+               uint32_t maximal_access;
+               uint32_t guest_maximal_access;
+               char *service;
+               char *fs_type;
+       } smb1;
+
+       struct {
+               uint32_t tcon_id;
+               uint8_t type;
+               uint32_t flags;
+               uint32_t capabilities;
+               uint32_t maximal_access;
+       } smb2;
+};
+
 struct smbXcli_req_state {
        struct tevent_context *ev;
        struct smbXcli_conn *conn;
@@ -188,14 +217,23 @@ struct smbXcli_req_state {
                const uint8_t *dyn;
                uint32_t dyn_len;
 
-               uint8_t hdr[64];
+               uint8_t transform[SMB2_TF_HDR_SIZE];
+               uint8_t hdr[SMB2_HDR_BODY];
                uint8_t pad[7]; /* padding space for compounding */
 
-               /* always an array of 3 talloc elements */
+               /*
+                * always an array of 3 talloc elements
+                * (without a SMB2_TRANSFORM header!)
+                *
+                * HDR, BODY, DYN
+                */
                struct iovec *recv_iov;
 
                uint16_t credit_charge;
 
+               bool should_sign;
+               bool should_encrypt;
+
                bool signing_skipped;
                bool notify_async;
                bool got_async;
@@ -1077,7 +1115,6 @@ static bool smb1cli_req_cancel(struct tevent_req *req)
        uint16_t flags2;
        uint32_t pid;
        uint16_t tid;
-       uint16_t uid;
        uint16_t mid;
        struct tevent_req *subreq;
        NTSTATUS status;
@@ -1087,7 +1124,6 @@ static bool smb1cli_req_cancel(struct tevent_req *req)
        pid  = SVAL(state->smb1.hdr, HDR_PID);
        pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
        tid = SVAL(state->smb1.hdr, HDR_TID);
-       uid = SVAL(state->smb1.hdr, HDR_UID);
        mid = SVAL(state->smb1.hdr, HDR_MID);
 
        subreq = smb1cli_req_create(state, state->ev,
@@ -1096,7 +1132,8 @@ static bool smb1cli_req_cancel(struct tevent_req *req)
                                    flags, 0,
                                    flags2, 0,
                                    0, /* timeout */
-                                   pid, tid, uid,
+                                   pid, tid,
+                                   state->session,
                                    0, NULL, /* vwv */
                                    0, NULL); /* bytes */
        if (subreq == NULL) {
@@ -1133,7 +1170,7 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
                                      uint32_t timeout_msec,
                                      uint32_t pid,
                                      uint16_t tid,
-                                     uint16_t uid,
+                                     struct smbXcli_session *session,
                                      uint8_t wct, uint16_t *vwv,
                                      int iov_count,
                                      struct iovec *bytes_iov)
@@ -1142,6 +1179,7 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
        struct smbXcli_req_state *state;
        uint8_t flags = 0;
        uint16_t flags2 = 0;
+       uint16_t uid = 0;
 
        if (iov_count > MAX_SMB_IOV) {
                /*
@@ -1157,6 +1195,11 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
        }
        state->ev = ev;
        state->conn = conn;
+       state->session = session;
+
+       if (session) {
+               uid = session->smb1.session_id;
+       }
 
        state->smb1.recv_cmd = 0xFF;
        state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
@@ -1401,7 +1444,7 @@ struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
                                    uint32_t timeout_msec,
                                    uint32_t pid,
                                    uint16_t tid,
-                                   uint16_t uid,
+                                   struct smbXcli_session *session,
                                    uint8_t wct, uint16_t *vwv,
                                    uint32_t num_bytes,
                                    const uint8_t *bytes)
@@ -1417,7 +1460,7 @@ struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
                                 additional_flags, clear_flags,
                                 additional_flags2, clear_flags2,
                                 timeout_msec,
-                                pid, tid, uid,
+                                pid, tid, session,
                                 wct, vwv, 1, &iov);
        if (req == NULL) {
                return NULL;
@@ -2402,6 +2445,25 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
 
        if (session) {
                uid = session->smb2.session_id;
+
+               state->smb2.should_sign = session->smb2.should_sign;
+               state->smb2.should_encrypt = session->smb2.should_encrypt;
+
+               /* TODO: turn on encryption based on the tree connect. */
+
+               if (cmd == SMB2_OP_SESSSETUP &&
+                   session->smb2.signing_key.length != 0) {
+                       state->smb2.should_sign = true;
+               }
+
+               if (cmd == SMB2_OP_SESSSETUP &&
+                   session->smb2.channel_signing_key.length == 0) {
+                       state->smb2.should_encrypt = false;
+               }
+
+               if (state->smb2.should_encrypt) {
+                       state->smb2.should_sign = false;
+               }
        }
 
        state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
@@ -2418,6 +2480,11 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
        state->smb2.dyn = dyn;
        state->smb2.dyn_len = dyn_len;
 
+       if (state->smb2.should_encrypt) {
+               SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
+               SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
+       }
+
        SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
        SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
        SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
@@ -2477,11 +2544,11 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
 
        /*
         * 1 for the nbt length
-        * per request: HDR, fixed, dyn, padding
+        * per request: TRANSFORM, HDR, fixed, dyn, padding
         * -1 because the last one does not need padding
         */
 
-       iov = talloc_array(reqs[0], struct iovec, 1 + 4*num_reqs - 1);
+       iov = talloc_array(reqs[0], struct iovec, 1 + 5*num_reqs - 1);
        if (iov == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -2490,6 +2557,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
        nbt_len = 0;
 
        for (i=0; i<num_reqs; i++) {
+               int tf_iov;
                int hdr_iov;
                size_t reqlen;
                bool ret;
@@ -2499,6 +2567,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
                uint16_t credits;
                uint64_t mid;
                const DATA_BLOB *signing_key = NULL;
+               const DATA_BLOB *encryption_key = NULL;
 
                if (!tevent_req_is_in_progress(reqs[i])) {
                        return NT_STATUS_INTERNAL_ERROR;
@@ -2558,6 +2627,43 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
                SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
 
 skip_credits:
+               if (state->session) {
+                       /*
+                        * We prefer the channel signing key if it is
+                        * already there.
+                        */
+                       if (state->smb2.should_sign) {
+                               signing_key = &state->session->smb2.channel_signing_key;
+                       }
+
+                       /*
+                        * If it is a channel binding, we already have the main
+                        * signing key and try that one.
+                        */
+                       if (signing_key && signing_key->length == 0) {
+                               signing_key = &state->session->smb2.signing_key;
+                       }
+
+                       /*
+                        * If we do not have any session key yet, we skip the
+                        * signing of SMB2_OP_SESSSETUP requests.
+                        */
+                       if (signing_key && signing_key->length == 0) {
+                               signing_key = NULL;
+                       }
+
+                       if (state->smb2.should_encrypt) {
+                               encryption_key = &state->session->smb2.encryption_key;
+                       }
+               }
+
+               if (encryption_key) {
+                       tf_iov = num_iov;
+                       iov[num_iov].iov_base = state->smb2.transform;
+                       iov[num_iov].iov_len  = sizeof(state->smb2.transform);
+                       num_iov += 1;
+               }
+
                hdr_iov = num_iov;
                iov[num_iov].iov_base = state->smb2.hdr;
                iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
@@ -2587,42 +2693,49 @@ skip_credits:
                        }
                        SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
                }
-               nbt_len += reqlen;
-
-               if (state->session) {
-                       bool should_sign = state->session->smb2.should_sign;
 
-                       if (opcode == SMB2_OP_SESSSETUP &&
-                           state->session->smb2.signing_key.length != 0) {
-                               should_sign = true;
+               if (encryption_key) {
+                       NTSTATUS status;
+                       uint8_t *buf;
+                       int vi;
+
+                       SBVAL(state->smb2.transform, SMB2_TF_NONCE, mid);
+                       SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
+                             state->session->smb2.channel_nonce);
+                       SBVAL(state->smb2.transform, SMB2_TF_MSG_SIZE,
+                             reqlen);
+
+                       buf = talloc_array(iov, uint8_t, reqlen);
+                       if (buf == NULL) {
+                               return NT_STATUS_NO_MEMORY;
                        }
 
-                       /*
-                        * We prefer the channel signing key if it is
-                        * already there.
-                        */
-                       if (should_sign) {
-                               signing_key = &state->session->smb2.channel_signing_key;
-                       }
+                       reqlen += SMB2_TF_HDR_SIZE;
 
                        /*
-                        * If it is a channel binding, we already have the main
-                        * signing key and try that one.
+                        * We copy the buffers before encrypting them,
+                        * this is at least currently needed for the
+                        * to keep state->smb2.hdr.
+                        *
+                        * Also the callers may expect there buffers
+                        * to be const.
                         */
-                       if (signing_key && signing_key->length == 0) {
-                               signing_key = &state->session->smb2.signing_key;
-                       }
+                       for (vi = hdr_iov; vi < num_iov; vi++) {
+                               struct iovec *v = &iov[vi];
+                               const uint8_t *o = (const uint8_t *)v->iov_base;
 
-                       /*
-                        * If we do not have any session key yet, we skip the
-                        * signing of SMB2_OP_SESSSETUP requests.
-                        */
-                       if (signing_key && signing_key->length == 0) {
-                               signing_key = NULL;
+                               memcpy(buf, o, v->iov_len);
+                               v->iov_base = (void *)buf;
+                               buf += v->iov_len;
                        }
-               }
 
-               if (signing_key) {
+                       status = smb2_signing_encrypt_pdu(*encryption_key,
+                                               state->session->conn->protocol,
+                                               &iov[tf_iov], num_iov - tf_iov);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               return status;
+                       }
+               } else if (signing_key) {
                        NTSTATUS status;
 
                        status = smb2_signing_sign_pdu(*signing_key,
@@ -2633,6 +2746,8 @@ skip_credits:
                        }
                }
 
+               nbt_len += reqlen;
+
                ret = smbXcli_req_set_pending(reqs[i]);
                if (!ret) {
                        return NT_STATUS_NO_MEMORY;
@@ -2723,27 +2838,25 @@ static void smb2cli_req_writev_done(struct tevent_req *subreq)
        }
 }
 
-static NTSTATUS smb2cli_inbuf_parse_compound(uint8_t *buf, TALLOC_CTX *mem_ctx,
+static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
+                                            uint8_t *buf,
+                                            size_t buflen,
+                                            TALLOC_CTX *mem_ctx,
                                             struct iovec **piov, int *pnum_iov)
 {
        struct iovec *iov;
-       int num_iov;
-       size_t buflen;
-       size_t taken;
-       uint8_t *first_hdr;
-
-       num_iov = 0;
+       int num_iov = 0;
+       size_t taken = 0;
+       uint8_t *first_hdr = buf;
 
        iov = talloc_array(mem_ctx, struct iovec, num_iov);
        if (iov == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       buflen = smb_len_tcp(buf);
-       taken = 0;
-       first_hdr = buf + NBT_HDR_SIZE;
-
        while (taken < buflen) {
+               uint8_t *tf = NULL;
+               size_t tf_len = 0;
                size_t len = buflen - taken;
                uint8_t *hdr = first_hdr + taken;
                struct iovec *cur;
@@ -2752,6 +2865,58 @@ static NTSTATUS smb2cli_inbuf_parse_compound(uint8_t *buf, TALLOC_CTX *mem_ctx,
                uint16_t body_size;
                struct iovec *iov_tmp;
 
+               if (len < 4) {
+                       DEBUG(10, ("%d bytes left, expected at least %d\n",
+                                  (int)len, 4));
+                       goto inval;
+               }
+               if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
+                       struct smbXcli_session *s;
+                       uint64_t uid;
+                       struct iovec tf_iov[2];
+                       NTSTATUS status;
+
+                       if (len < SMB2_TF_HDR_SIZE) {
+                               DEBUG(10, ("%d bytes left, expected at least %d\n",
+                                          (int)len, SMB2_TF_HDR_SIZE));
+                               goto inval;
+                       }
+                       tf = hdr;
+                       tf_len = SMB2_TF_HDR_SIZE;
+                       taken += tf_len;
+
+                       hdr = first_hdr + taken;
+                       len = IVAL(tf, SMB2_TF_MSG_SIZE);
+                       uid = BVAL(tf, SMB2_TF_SESSION_ID);
+
+                       s = conn->sessions;
+                       for (; s; s = s->next) {
+                               if (s->smb2.session_id != uid) {
+                                       continue;
+                               }
+                               break;
+                       }
+
+                       if (s == NULL) {
+                               DEBUG(10, ("unknown session_id %llu\n",
+                                          (unsigned long long)uid));
+                               goto inval;
+                       }
+
+                       tf_iov[0].iov_base = (void *)tf;
+                       tf_iov[0].iov_len = tf_len;
+                       tf_iov[1].iov_base = (void *)hdr;
+                       tf_iov[1].iov_len = len;
+
+                       status = smb2_signing_decrypt_pdu(s->smb2.decryption_key,
+                                                         conn->protocol,
+                                                         tf_iov, 2);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               TALLOC_FREE(iov);
+                               return status;
+                       }
+               }
+
                /*
                 * We need the header plus the body length field
                 */
@@ -2783,6 +2948,9 @@ static NTSTATUS smb2cli_inbuf_parse_compound(uint8_t *buf, TALLOC_CTX *mem_ctx,
                        if (next_command_ofs > full_size) {
                                goto inval;
                        }
+                       if (tf && next_command_ofs < len) {
+                               goto inval;
+                       }
                        full_size = next_command_ofs;
                }
                if (body_size < 2) {
@@ -2795,21 +2963,23 @@ static NTSTATUS smb2cli_inbuf_parse_compound(uint8_t *buf, TALLOC_CTX *mem_ctx,
                }
 
                iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
-                                        num_iov + 3);
+                                        num_iov + 4);
                if (iov_tmp == NULL) {
                        TALLOC_FREE(iov);
                        return NT_STATUS_NO_MEMORY;
                }
                iov = iov_tmp;
                cur = &iov[num_iov];
-               num_iov += 3;
+               num_iov += 4;
 
-               cur[0].iov_base = hdr;
-               cur[0].iov_len  = SMB2_HDR_BODY;
-               cur[1].iov_base = hdr + SMB2_HDR_BODY;
-               cur[1].iov_len  = body_size;
-               cur[2].iov_base = hdr + SMB2_HDR_BODY + body_size;
-               cur[2].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
+               cur[0].iov_base = tf;
+               cur[0].iov_len  = tf_len;
+               cur[1].iov_base = hdr;
+               cur[1].iov_len  = SMB2_HDR_BODY;
+               cur[2].iov_base = hdr + SMB2_HDR_BODY;
+               cur[2].iov_len  = body_size;
+               cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
+               cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
 
                taken += full_size;
        }
@@ -2853,17 +3023,21 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
        NTSTATUS status;
        bool defer = true;
        struct smbXcli_session *last_session = NULL;
+       size_t inbuf_len = smb_len_tcp(inbuf);
 
-       status = smb2cli_inbuf_parse_compound(inbuf, tmp_mem,
+       status = smb2cli_inbuf_parse_compound(conn,
+                                             inbuf + NBT_HDR_SIZE,
+                                             inbuf_len,
+                                             tmp_mem,
                                              &iov, &num_iov);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
-       for (i=0; i<num_iov; i+=3) {
+       for (i=0; i<num_iov; i+=4) {
                uint8_t *inbuf_ref = NULL;
                struct iovec *cur = &iov[i];
-               uint8_t *inhdr = (uint8_t *)cur[0].iov_base;
+               uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
                uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
                uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
                uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
@@ -2873,7 +3047,6 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                uint32_t new_credits;
                struct smbXcli_session *session = NULL;
                const DATA_BLOB *signing_key = NULL;
-               bool should_sign = false;
 
                new_credits = conn->smb2.cur_credits;
                new_credits += credits;
@@ -2928,15 +3101,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                }
                last_session = session;
 
-               if (session) {
-                       should_sign = session->smb2.should_sign;
-                       if (opcode == SMB2_OP_SESSSETUP &&
-                           session->smb2.signing_key.length != 0) {
-                               should_sign = true;
-                       }
-               }
-
-               if (should_sign) {
+               if (state->smb2.should_sign) {
                        if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
                                return NT_STATUS_ACCESS_DENIED;
                        }
@@ -3007,6 +3172,10 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                         * status to the caller.
                         */
                        signing_key = NULL;
+               } else if (state->smb2.should_encrypt) {
+                       if (cur[0].iov_len != SMB2_TF_HDR_SIZE) {
+                               return NT_STATUS_ACCESS_DENIED;
+                       }
                }
 
                if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
@@ -3052,7 +3221,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                if (signing_key) {
                        status = smb2_signing_check_pdu(*signing_key,
                                                        state->conn->protocol,
-                                                       cur, 3);
+                                                       &cur[1], 3);
                        if (!NT_STATUS_IS_OK(status)) {
                                /*
                                 * If the signing check fails, we disconnect
@@ -3068,7 +3237,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                 * There might be more than one response
                 * we need to defer the notifications
                 */
-               if ((num_iov == 4) && (talloc_array_length(conn->pending) == 0)) {
+               if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
                        defer = false;
                }
 
@@ -3086,9 +3255,9 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                }
 
                /* copy the related buffers */
-               state->smb2.recv_iov[0] = cur[0];
-               state->smb2.recv_iov[1] = cur[1];
-               state->smb2.recv_iov[2] = cur[2];
+               state->smb2.recv_iov[0] = cur[1];
+               state->smb2.recv_iov[1] = cur[2];
+               state->smb2.recv_iov[2] = cur[3];
 
                tevent_req_done(req);
        }
@@ -3212,6 +3381,7 @@ static const struct {
        {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
        {PROTOCOL_SMB2_22,      SMB2_DIALECT_REVISION_222},
        {PROTOCOL_SMB2_24,      SMB2_DIALECT_REVISION_224},
+       {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
 };
 
 struct smbXcli_negprot_state {
@@ -3387,7 +3557,7 @@ static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_sta
                                flags, ~flags,
                                flags2, ~flags2,
                                state->timeout_msec,
-                               0xFFFE, 0, 0, /* pid, tid, uid */
+                               0xFFFE, 0, NULL, /* pid, tid, session */
                                0, NULL, /* wct, vwv */
                                bytes.length, bytes.data);
 }
@@ -3951,16 +4121,23 @@ static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
        struct tevent_req *subreq;
        struct smbXcli_req_state *substate;
        struct tevent_req *req;
-       uint32_t protocol_magic = IVAL(inbuf, 4);
+       uint32_t protocol_magic;
+       size_t inbuf_len = smb_len_nbt(inbuf);
 
        if (num_pending != 1) {
                return NT_STATUS_INTERNAL_ERROR;
        }
 
+       if (inbuf_len < 4) {
+               return NT_STATUS_INVALID_NETWORK_RESPONSE;
+       }
+
        subreq = conn->pending[0];
        substate = tevent_req_data(subreq, struct smbXcli_req_state);
        req = tevent_req_callback_data(subreq, struct tevent_req);
 
+       protocol_magic = IVAL(inbuf, 4);
+
        switch (protocol_magic) {
        case SMB_MAGIC:
                tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
@@ -4060,6 +4237,17 @@ struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
        return session;
 }
 
+uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
+{
+       return session->smb1.session_id;
+}
+
+void smb1cli_session_set_id(struct smbXcli_session *session,
+                           uint16_t session_id)
+{
+       session->smb1.session_id = session_id;
+}
+
 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
 {
        struct smbXcli_conn *conn = session->conn;
@@ -4159,6 +4347,40 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
                                    session->smb2.signing_key.data);
        }
 
+       session->smb2.encryption_key = data_blob_dup_talloc(session,
+                                               session->smb2.signing_key);
+       if (session->smb2.encryption_key.data == NULL) {
+               ZERO_STRUCT(session_key);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (conn->protocol >= PROTOCOL_SMB2_24) {
+               const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
+               const DATA_BLOB context = data_blob_string_const_null("ServerIn ");
+
+               smb2_key_derivation(session_key, sizeof(session_key),
+                                   label.data, label.length,
+                                   context.data, context.length,
+                                   session->smb2.encryption_key.data);
+       }
+
+       session->smb2.decryption_key = data_blob_dup_talloc(session,
+                                               session->smb2.signing_key);
+       if (session->smb2.decryption_key.data == NULL) {
+               ZERO_STRUCT(session_key);
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (conn->protocol >= PROTOCOL_SMB2_24) {
+               const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
+               const DATA_BLOB context = data_blob_string_const_null("ServerOut");
+
+               smb2_key_derivation(session_key, sizeof(session_key),
+                                   label.data, label.length,
+                                   context.data, context.length,
+                                   session->smb2.decryption_key.data);
+       }
+
        session->smb2.application_key = data_blob_dup_talloc(session,
                                                session->smb2.signing_key);
        if (session->smb2.application_key.data == NULL) {
@@ -4191,6 +4413,7 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
        }
 
        session->smb2.should_sign = false;
+       session->smb2.should_encrypt = false;
 
        if (conn->desire_signing) {
                session->smb2.should_sign = true;
@@ -4200,6 +4423,22 @@ NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
                session->smb2.should_sign = true;
        }
 
+       if (session->smb2.session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
+               session->smb2.should_encrypt = true;
+       }
+
+       if (conn->protocol < PROTOCOL_SMB2_24) {
+               session->smb2.should_encrypt = false;
+       }
+
+       if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
+               session->smb2.should_encrypt = false;
+       }
+
+       generate_random_buffer((uint8_t *)&session->smb2.channel_nonce,
+                              sizeof(session->smb2.channel_nonce));
+       session->smb2.channel_next = 1;
+
        return NT_STATUS_OK;
 }
 
@@ -4214,6 +4453,10 @@ NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
                return NT_STATUS_INVALID_PARAMETER_MIX;
        }
 
+       if (session1->smb2.channel_next == 0) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
        if (conn == NULL) {
                return NT_STATUS_INVALID_PARAMETER_MIX;
        }
@@ -4231,7 +4474,30 @@ NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
                return NT_STATUS_NO_MEMORY;
        }
 
+       session2->smb2.application_key = data_blob_dup_talloc(session2,
+                                               session1->smb2.application_key);
+       if (session2->smb2.application_key.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        session2->smb2.should_sign = session1->smb2.should_sign;
+       session2->smb2.should_encrypt = session1->smb2.should_encrypt;
+
+       session2->smb2.channel_nonce = session1->smb2.channel_nonce;
+       session2->smb2.channel_nonce += session1->smb2.channel_next;
+       session1->smb2.channel_next++;
+
+       session2->smb2.encryption_key = data_blob_dup_talloc(session2,
+                                               session1->smb2.encryption_key);
+       if (session2->smb2.encryption_key.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       session2->smb2.decryption_key = data_blob_dup_talloc(session2,
+                                               session1->smb2.decryption_key);
+       if (session2->smb2.decryption_key.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        talloc_set_destructor(session2, smbXcli_session_destructor);
        DLIST_ADD_END(conn->sessions, session2, struct smbXcli_session *);
@@ -4289,3 +4555,72 @@ NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
 
        return NT_STATUS_OK;
 }
+
+struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
+{
+       struct smbXcli_tcon *tcon;
+
+       tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
+       if (tcon == NULL) {
+               return NULL;
+       }
+
+       return tcon;
+}
+
+uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
+{
+       return tcon->smb1.tcon_id;
+}
+
+void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
+{
+       tcon->smb1.tcon_id = tcon_id;
+}
+
+bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
+                            uint16_t tcon_id,
+                            uint16_t optional_support,
+                            uint32_t maximal_access,
+                            uint32_t guest_maximal_access,
+                            const char *service,
+                            const char *fs_type)
+{
+       tcon->smb1.tcon_id = tcon_id;
+       tcon->smb1.optional_support = optional_support;
+       tcon->smb1.maximal_access = maximal_access;
+       tcon->smb1.guest_maximal_access = guest_maximal_access;
+
+       TALLOC_FREE(tcon->smb1.service);
+       tcon->smb1.service = talloc_strdup(tcon, service);
+       if (service != NULL && tcon->smb1.service == NULL) {
+               return false;
+       }
+
+       TALLOC_FREE(tcon->smb1.fs_type);
+       tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
+       if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
+               return false;
+       }
+
+       return true;
+}
+
+uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
+{
+       return tcon->smb2.tcon_id;
+}
+
+void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
+                            uint32_t tcon_id,
+                            uint8_t type,
+                            uint32_t flags,
+                            uint32_t capabilities,
+                            uint32_t maximal_access)
+{
+       tcon->smb2.tcon_id = tcon_id;
+       tcon->smb2.type = type;
+       tcon->smb2.flags = flags;
+       tcon->smb2.capabilities = capabilities;
+       tcon->smb2.maximal_access = maximal_access;
+}