libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "../libcli/smb/smb_common.h"
  29 #include "../libcli/smb/smb_seal.h"
  30 #include "../libcli/smb/smb_signing.h"
  31 #include "../libcli/smb/read_smb.h"
  32 #include "smbXcli_base.h"
  33 #include "librpc/ndr/libndr.h"
  34 #include "libcli/smb/smb2_negotiate_context.h"
  35 #include <hcrypto/sha.h>
  36
  37 struct smbXcli_conn;
  38 struct smbXcli_req;
  39 struct smbXcli_session;
  40 struct smbXcli_tcon;
  41
  42 struct smbXcli_conn {
  43         int read_fd;
  44         int write_fd;
  45         struct sockaddr_storage local_ss;
  46         struct sockaddr_storage remote_ss;
  47         const char *remote_name;
  48
  49         struct tevent_queue *outgoing;
  50         struct tevent_req **pending;
  51         struct tevent_req *read_smb_req;
  52
  53         enum protocol_types min_protocol;
  54         enum protocol_types max_protocol;
  55         enum protocol_types protocol;
  56         bool allow_signing;
  57         bool desire_signing;
  58         bool mandatory_signing;
  59
  60         /*
  61          * The incoming dispatch function should return:
  62          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  63          * - NT_STATUS_OK, if no more processing is desired, e.g.
  64          *                 the dispatch function called
  65          *                 tevent_req_done().
  66          * - All other return values disconnect the connection.
  67          */
  68         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  69                                       TALLOC_CTX *tmp_mem,
  70                                       uint8_t *inbuf);
  71
  72         struct {
  73                 struct {
  74                         uint32_t capabilities;
  75                         uint32_t max_xmit;
  76                 } client;
  77
  78                 struct {
  79                         uint32_t capabilities;
  80                         uint32_t max_xmit;
  81                         uint16_t max_mux;
  82                         uint16_t security_mode;
  83                         bool readbraw;
  84                         bool writebraw;
  85                         bool lockread;
  86                         bool writeunlock;
  87                         uint32_t session_key;
  88                         struct GUID guid;
  89                         DATA_BLOB gss_blob;
  90                         uint8_t challenge[8];
  91                         const char *workgroup;
  92                         const char *name;
  93                         int time_zone;
  94                         NTTIME system_time;
  95                 } server;
  96
  97                 uint32_t capabilities;
  98                 uint32_t max_xmit;
  99
 100                 uint16_t mid;
 101
 102                 struct smb_signing_state *signing;
 103                 struct smb_trans_enc_state *trans_enc;
 104
 105                 struct tevent_req *read_braw_req;
 106         } smb1;
 107
 108         struct {
 109                 struct {
 110                         uint32_t capabilities;
 111                         uint16_t security_mode;
 112                         struct GUID guid;
 113                 } client;
 114
 115                 struct {
 116                         uint32_t capabilities;
 117                         uint16_t security_mode;
 118                         struct GUID guid;
 119                         uint32_t max_trans_size;
 120                         uint32_t max_read_size;
 121                         uint32_t max_write_size;
 122                         NTTIME system_time;
 123                         NTTIME start_time;
 124                         DATA_BLOB gss_blob;
 125                         uint16_t cipher;
 126                 } server;
 127
 128                 uint64_t mid;
 129                 uint16_t cur_credits;
 130                 uint16_t max_credits;
 131
 132                 uint8_t preauth_sha512[64];
 133         } smb2;
 134
 135         struct smbXcli_session *sessions;
 136 };
 137
 138 struct smb2cli_session {
 139         uint64_t session_id;
 140         uint16_t session_flags;
 141         DATA_BLOB application_key;
 142         DATA_BLOB signing_key;
 143         bool should_sign;
 144         bool should_encrypt;
 145         DATA_BLOB encryption_key;
 146         DATA_BLOB decryption_key;
 147         uint64_t nonce_high;
 148         uint64_t nonce_low;
 149         uint16_t channel_sequence;
 150         bool replay_active;
 151 };
 152
 153 struct smbXcli_session {
 154         struct smbXcli_session *prev, *next;
 155         struct smbXcli_conn *conn;
 156
 157         struct {
 158                 uint16_t session_id;
 159                 DATA_BLOB application_key;
 160                 bool protected_key;
 161         } smb1;
 162
 163         struct smb2cli_session *smb2;
 164
 165         struct {
 166                 DATA_BLOB signing_key;
 167         } smb2_channel;
 168
 169         /*
 170          * this should be a short term hack
 171          * until the upper layers have implemented
 172          * re-authentication.
 173          */
 174         bool disconnect_expired;
 175 };
 176
 177 struct smbXcli_tcon {
 178         bool is_smb1;
 179         uint32_t fs_attributes;
 180
 181         struct {
 182                 uint16_t tcon_id;
 183                 uint16_t optional_support;
 184                 uint32_t maximal_access;
 185                 uint32_t guest_maximal_access;
 186                 char *service;
 187                 char *fs_type;
 188         } smb1;
 189
 190         struct {
 191                 uint32_t tcon_id;
 192                 uint8_t type;
 193                 uint32_t flags;
 194                 uint32_t capabilities;
 195                 uint32_t maximal_access;
 196                 bool should_sign;
 197                 bool should_encrypt;
 198         } smb2;
 199 };
 200
 201 struct smbXcli_req_state {
 202         struct tevent_context *ev;
 203         struct smbXcli_conn *conn;
 204         struct smbXcli_session *session; /* maybe NULL */
 205         struct smbXcli_tcon *tcon; /* maybe NULL */
 206
 207         uint8_t length_hdr[4];
 208
 209         bool one_way;
 210
 211         uint8_t *inbuf;
 212
 213         struct {
 214                 /* Space for the header including the wct */
 215                 uint8_t hdr[HDR_VWV];
 216
 217                 /*
 218                  * For normal requests, smb1cli_req_send chooses a mid.
 219                  * SecondaryV trans requests need to use the mid of the primary
 220                  * request, so we need a place to store it.
 221                  * Assume it is set if != 0.
 222                  */
 223                 uint16_t mid;
 224
 225                 uint16_t *vwv;
 226                 uint8_t bytecount_buf[2];
 227
 228 #define MAX_SMB_IOV 10
 229                 /* length_hdr, hdr, words, byte_count, buffers */
 230                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 231                 int iov_count;
 232
 233                 bool one_way_seqnum;
 234                 uint32_t seqnum;
 235                 struct tevent_req **chained_requests;
 236
 237                 uint8_t recv_cmd;
 238                 NTSTATUS recv_status;
 239                 /* always an array of 3 talloc elements */
 240                 struct iovec *recv_iov;
 241         } smb1;
 242
 243         struct {
 244                 const uint8_t *fixed;
 245                 uint16_t fixed_len;
 246                 const uint8_t *dyn;
 247                 uint32_t dyn_len;
 248
 249                 uint8_t transform[SMB2_TF_HDR_SIZE];
 250                 uint8_t hdr[SMB2_HDR_BODY];
 251                 uint8_t pad[7]; /* padding space for compounding */
 252
 253                 /*
 254                  * always an array of 3 talloc elements
 255                  * (without a SMB2_TRANSFORM header!)
 256                  *
 257                  * HDR, BODY, DYN
 258                  */
 259                 struct iovec *recv_iov;
 260
 261                 /*
 262                  * the expected max for the response dyn_len
 263                  */
 264                 uint32_t max_dyn_len;
 265
 266                 uint16_t credit_charge;
 267
 268                 bool should_sign;
 269                 bool should_encrypt;
 270                 uint64_t encryption_session_id;
 271
 272                 bool signing_skipped;
 273                 bool notify_async;
 274                 bool got_async;
 275         } smb2;
 276 };
 277
 278 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 279 {
 280         /*
 281          * NT_STATUS_OK, means we do not notify the callers
 282          */
 283         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 284
 285         while (conn->sessions) {
 286                 conn->sessions->conn = NULL;
 287                 DLIST_REMOVE(conn->sessions, conn->sessions);
 288         }
 289
 290         if (conn->smb1.trans_enc) {
 291                 TALLOC_FREE(conn->smb1.trans_enc);
 292         }
 293
 294         return 0;
 295 }
 296
 297 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 298                                          int fd,
 299                                          const char *remote_name,
 300                                          enum smb_signing_setting signing_state,
 301                                          uint32_t smb1_capabilities,
 302                                          struct GUID *client_guid,
 303                                          uint32_t smb2_capabilities)
 304 {
 305         struct smbXcli_conn *conn = NULL;
 306         void *ss = NULL;
 307         struct sockaddr *sa = NULL;
 308         socklen_t sa_length;
 309         int ret;
 310
 311         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 312         if (!conn) {
 313                 return NULL;
 314         }
 315
 316         conn->read_fd = fd;
 317         conn->write_fd = dup(fd);
 318         if (conn->write_fd == -1) {
 319                 goto error;
 320         }
 321
 322         conn->remote_name = talloc_strdup(conn, remote_name);
 323         if (conn->remote_name == NULL) {
 324                 goto error;
 325         }
 326
 327
 328         ss = (void *)&conn->local_ss;
 329         sa = (struct sockaddr *)ss;
 330         sa_length = sizeof(conn->local_ss);
 331         ret = getsockname(fd, sa, &sa_length);
 332         if (ret == -1) {
 333                 goto error;
 334         }
 335         ss = (void *)&conn->remote_ss;
 336         sa = (struct sockaddr *)ss;
 337         sa_length = sizeof(conn->remote_ss);
 338         ret = getpeername(fd, sa, &sa_length);
 339         if (ret == -1) {
 340                 goto error;
 341         }
 342
 343         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 344         if (conn->outgoing == NULL) {
 345                 goto error;
 346         }
 347         conn->pending = NULL;
 348
 349         conn->min_protocol = PROTOCOL_NONE;
 350         conn->max_protocol = PROTOCOL_NONE;
 351         conn->protocol = PROTOCOL_NONE;
 352
 353         switch (signing_state) {
 354         case SMB_SIGNING_OFF:
 355                 /* never */
 356                 conn->allow_signing = false;
 357                 conn->desire_signing = false;
 358                 conn->mandatory_signing = false;
 359                 break;
 360         case SMB_SIGNING_DEFAULT:
 361         case SMB_SIGNING_IF_REQUIRED:
 362                 /* if the server requires it */
 363                 conn->allow_signing = true;
 364                 conn->desire_signing = false;
 365                 conn->mandatory_signing = false;
 366                 break;
 367         case SMB_SIGNING_REQUIRED:
 368                 /* always */
 369                 conn->allow_signing = true;
 370                 conn->desire_signing = true;
 371                 conn->mandatory_signing = true;
 372                 break;
 373         }
 374
 375         conn->smb1.client.capabilities = smb1_capabilities;
 376         conn->smb1.client.max_xmit = UINT16_MAX;
 377
 378         conn->smb1.capabilities = conn->smb1.client.capabilities;
 379         conn->smb1.max_xmit = 1024;
 380
 381         conn->smb1.mid = 1;
 382
 383         /* initialise signing */
 384         conn->smb1.signing = smb_signing_init(conn,
 385                                               conn->allow_signing,
 386                                               conn->desire_signing,
 387                                               conn->mandatory_signing);
 388         if (!conn->smb1.signing) {
 389                 goto error;
 390         }
 391
 392         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 393         if (conn->mandatory_signing) {
 394                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 395         }
 396         if (client_guid) {
 397                 conn->smb2.client.guid = *client_guid;
 398         }
 399         conn->smb2.client.capabilities = smb2_capabilities;
 400
 401         conn->smb2.cur_credits = 1;
 402         conn->smb2.max_credits = 0;
 403
 404         talloc_set_destructor(conn, smbXcli_conn_destructor);
 405         return conn;
 406
 407  error:
 408         if (conn->write_fd != -1) {
 409                 close(conn->write_fd);
 410         }
 411         TALLOC_FREE(conn);
 412         return NULL;
 413 }
 414
 415 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 416 {
 417         if (conn == NULL) {
 418                 return false;
 419         }
 420
 421         if (conn->read_fd == -1) {
 422                 return false;
 423         }
 424
 425         return true;
 426 }
 427
 428 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 429 {
 430         return conn->protocol;
 431 }
 432
 433 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 434 {
 435         if (conn->protocol >= PROTOCOL_SMB2_02) {
 436                 return true;
 437         }
 438
 439         if (conn->smb1.capabilities & CAP_UNICODE) {
 440                 return true;
 441         }
 442
 443         return false;
 444 }
 445
 446 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 447 {
 448         set_socket_options(conn->read_fd, options);
 449 }
 450
 451 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 452 {
 453         return &conn->local_ss;
 454 }
 455
 456 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 457 {
 458         return &conn->remote_ss;
 459 }
 460
 461 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 462 {
 463         return conn->remote_name;
 464 }
 465
 466 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 467 {
 468         if (conn->protocol >= PROTOCOL_SMB2_02) {
 469                 /*
 470                  * TODO...
 471                  */
 472                 return 1;
 473         }
 474
 475         return conn->smb1.server.max_mux;
 476 }
 477
 478 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 479 {
 480         if (conn->protocol >= PROTOCOL_SMB2_02) {
 481                 return conn->smb2.server.system_time;
 482         }
 483
 484         return conn->smb1.server.system_time;
 485 }
 486
 487 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 488 {
 489         if (conn->protocol >= PROTOCOL_SMB2_02) {
 490                 return &conn->smb2.server.gss_blob;
 491         }
 492
 493         return &conn->smb1.server.gss_blob;
 494 }
 495
 496 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 497 {
 498         if (conn->protocol >= PROTOCOL_SMB2_02) {
 499                 return &conn->smb2.server.guid;
 500         }
 501
 502         return &conn->smb1.server.guid;
 503 }
 504
 505 struct smbXcli_conn_samba_suicide_state {
 506         struct smbXcli_conn *conn;
 507         struct iovec iov;
 508         uint8_t buf[9];
 509 };
 510
 511 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 512
 513 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 514                                                    struct tevent_context *ev,
 515                                                    struct smbXcli_conn *conn,
 516                                                    uint8_t exitcode)
 517 {
 518         struct tevent_req *req, *subreq;
 519         struct smbXcli_conn_samba_suicide_state *state;
 520
 521         req = tevent_req_create(mem_ctx, &state,
 522                                 struct smbXcli_conn_samba_suicide_state);
 523         if (req == NULL) {
 524                 return NULL;
 525         }
 526         state->conn = conn;
 527         SIVAL(state->buf, 4, 0x74697865);
 528         SCVAL(state->buf, 8, exitcode);
 529         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 530
 531         state->iov.iov_base = state->buf;
 532         state->iov.iov_len = sizeof(state->buf);
 533
 534         subreq = writev_send(state, ev, conn->outgoing, conn->write_fd,
 535                              false, &state->iov, 1);
 536         if (tevent_req_nomem(subreq, req)) {
 537                 return tevent_req_post(req, ev);
 538         }
 539         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 540         return req;
 541 }
 542
 543 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 544 {
 545         struct tevent_req *req = tevent_req_callback_data(
 546                 subreq, struct tevent_req);
 547         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 548                 req, struct smbXcli_conn_samba_suicide_state);
 549         ssize_t nwritten;
 550         int err;
 551
 552         nwritten = writev_recv(subreq, &err);
 553         TALLOC_FREE(subreq);
 554         if (nwritten == -1) {
 555                 NTSTATUS status = map_nt_error_from_unix_common(err);
 556                 smbXcli_conn_disconnect(state->conn, status);
 557                 return;
 558         }
 559         tevent_req_done(req);
 560 }
 561
 562 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 563 {
 564         return tevent_req_simple_recv_ntstatus(req);
 565 }
 566
 567 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 568                                     uint8_t exitcode)
 569 {
 570         TALLOC_CTX *frame = talloc_stackframe();
 571         struct tevent_context *ev;
 572         struct tevent_req *req;
 573         NTSTATUS status = NT_STATUS_NO_MEMORY;
 574         bool ok;
 575
 576         if (smbXcli_conn_has_async_calls(conn)) {
 577                 /*
 578                  * Can't use sync call while an async call is in flight
 579                  */
 580                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 581                 goto fail;
 582         }
 583         ev = samba_tevent_context_init(frame);
 584         if (ev == NULL) {
 585                 goto fail;
 586         }
 587         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 588         if (req == NULL) {
 589                 goto fail;
 590         }
 591         ok = tevent_req_poll(req, ev);
 592         if (!ok) {
 593                 status = map_nt_error_from_unix_common(errno);
 594                 goto fail;
 595         }
 596         status = smbXcli_conn_samba_suicide_recv(req);
 597  fail:
 598         TALLOC_FREE(frame);
 599         return status;
 600 }
 601
 602 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 603 {
 604         return conn->smb1.capabilities;
 605 }
 606
 607 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 608 {
 609         return conn->smb1.max_xmit;
 610 }
 611
 612 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
 613 {
 614         size_t pending;
 615         uint16_t possible = conn->smb1.server.max_mux;
 616
 617         pending = tevent_queue_length(conn->outgoing);
 618         if (pending >= possible) {
 619                 return false;
 620         }
 621         pending += talloc_array_length(conn->pending);
 622         if (pending >= possible) {
 623                 return false;
 624         }
 625
 626         return true;
 627 }
 628
 629 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 630 {
 631         return conn->smb1.server.session_key;
 632 }
 633
 634 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 635 {
 636         return conn->smb1.server.challenge;
 637 }
 638
 639 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 640 {
 641         return conn->smb1.server.security_mode;
 642 }
 643
 644 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 645 {
 646         return conn->smb1.server.readbraw;
 647 }
 648
 649 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 650 {
 651         return conn->smb1.server.writebraw;
 652 }
 653
 654 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 655 {
 656         return conn->smb1.server.lockread;
 657 }
 658
 659 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 660 {
 661         return conn->smb1.server.writeunlock;
 662 }
 663
 664 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 665 {
 666         return conn->smb1.server.time_zone;
 667 }
 668
 669 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 670                                    const DATA_BLOB user_session_key,
 671                                    const DATA_BLOB response)
 672 {
 673         return smb_signing_activate(conn->smb1.signing,
 674                                     user_session_key,
 675                                     response);
 676 }
 677
 678 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 679                                 const uint8_t *buf, uint32_t seqnum)
 680 {
 681         const uint8_t *hdr = buf + NBT_HDR_SIZE;
 682         size_t len = smb_len_nbt(buf);
 683
 684         return smb_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
 685 }
 686
 687 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 688 {
 689         return smb_signing_is_active(conn->smb1.signing);
 690 }
 691
 692 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 693                                  struct smb_trans_enc_state *es)
 694 {
 695         /* Replace the old state, if any. */
 696         if (conn->smb1.trans_enc) {
 697                 TALLOC_FREE(conn->smb1.trans_enc);
 698         }
 699         conn->smb1.trans_enc = es;
 700 }
 701
 702 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 703 {
 704         return common_encryption_on(conn->smb1.trans_enc);
 705 }
 706
 707
 708 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 709 {
 710         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 711         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 712
 713         if (NT_STATUS_IS_OK(status)) {
 714                 return NT_STATUS_OK;
 715         }
 716
 717         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 718                 return status;
 719         }
 720
 721         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 722 }
 723
 724 /**
 725  * Is the SMB command able to hold an AND_X successor
 726  * @param[in] cmd       The SMB command in question
 727  * @retval Can we add a chained request after "cmd"?
 728  */
 729 bool smb1cli_is_andx_req(uint8_t cmd)
 730 {
 731         switch (cmd) {
 732         case SMBtconX:
 733         case SMBlockingX:
 734         case SMBopenX:
 735         case SMBreadX:
 736         case SMBwriteX:
 737         case SMBsesssetupX:
 738         case SMBulogoffX:
 739         case SMBntcreateX:
 740                 return true;
 741                 break;
 742         default:
 743                 break;
 744         }
 745
 746         return false;
 747 }
 748
 749 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 750 {
 751         size_t num_pending = talloc_array_length(conn->pending);
 752         uint16_t result;
 753
 754         if (conn->protocol == PROTOCOL_NONE) {
 755                 /*
 756                  * This is what windows sends on the SMB1 Negprot request
 757                  * and some vendors reuse the SMB1 MID as SMB2 sequence number.
 758                  */
 759                 return 0;
 760         }
 761
 762         while (true) {
 763                 size_t i;
 764
 765                 result = conn->smb1.mid++;
 766                 if ((result == 0) || (result == 0xffff)) {
 767                         continue;
 768                 }
 769
 770                 for (i=0; i<num_pending; i++) {
 771                         if (result == smb1cli_req_mid(conn->pending[i])) {
 772                                 break;
 773                         }
 774                 }
 775
 776                 if (i == num_pending) {
 777                         return result;
 778                 }
 779         }
 780 }
 781
 782 void smbXcli_req_unset_pending(struct tevent_req *req)
 783 {
 784         struct smbXcli_req_state *state =
 785                 tevent_req_data(req,
 786                 struct smbXcli_req_state);
 787         struct smbXcli_conn *conn = state->conn;
 788         size_t num_pending = talloc_array_length(conn->pending);
 789         size_t i;
 790
 791         if (state->smb1.mid != 0) {
 792                 /*
 793                  * This is a [nt]trans[2] request which waits
 794                  * for more than one reply.
 795                  */
 796                 return;
 797         }
 798
 799         tevent_req_set_cleanup_fn(req, NULL);
 800
 801         if (num_pending == 1) {
 802                 /*
 803                  * The pending read_smb tevent_req is a child of
 804                  * conn->pending. So if nothing is pending anymore, we need to
 805                  * delete the socket read fde.
 806                  */
 807                 TALLOC_FREE(conn->pending);
 808                 conn->read_smb_req = NULL;
 809                 return;
 810         }
 811
 812         for (i=0; i<num_pending; i++) {
 813                 if (req == conn->pending[i]) {
 814                         break;
 815                 }
 816         }
 817         if (i == num_pending) {
 818                 /*
 819                  * Something's seriously broken. Just returning here is the
 820                  * right thing nevertheless, the point of this routine is to
 821                  * remove ourselves from conn->pending.
 822                  */
 823                 return;
 824         }
 825
 826         /*
 827          * Remove ourselves from the conn->pending array
 828          */
 829         for (; i < (num_pending - 1); i++) {
 830                 conn->pending[i] = conn->pending[i+1];
 831         }
 832
 833         /*
 834          * No NULL check here, we're shrinking by sizeof(void *), and
 835          * talloc_realloc just adjusts the size for this.
 836          */
 837         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
 838                                        num_pending - 1);
 839         return;
 840 }
 841
 842 static void smbXcli_req_cleanup(struct tevent_req *req,
 843                                 enum tevent_req_state req_state)
 844 {
 845         struct smbXcli_req_state *state =
 846                 tevent_req_data(req,
 847                 struct smbXcli_req_state);
 848
 849         switch (req_state) {
 850         case TEVENT_REQ_RECEIVED:
 851                 /*
 852                  * Make sure we really remove it from
 853                  * the pending array on destruction.
 854                  */
 855                 state->smb1.mid = 0;
 856                 smbXcli_req_unset_pending(req);
 857                 return;
 858         default:
 859                 return;
 860         }
 861 }
 862
 863 static bool smb1cli_req_cancel(struct tevent_req *req);
 864 static bool smb2cli_req_cancel(struct tevent_req *req);
 865
 866 static bool smbXcli_req_cancel(struct tevent_req *req)
 867 {
 868         struct smbXcli_req_state *state =
 869                 tevent_req_data(req,
 870                 struct smbXcli_req_state);
 871
 872         if (!smbXcli_conn_is_connected(state->conn)) {
 873                 return false;
 874         }
 875
 876         if (state->conn->protocol == PROTOCOL_NONE) {
 877                 return false;
 878         }
 879
 880         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
 881                 return smb2cli_req_cancel(req);
 882         }
 883
 884         return smb1cli_req_cancel(req);
 885 }
 886
 887 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
 888
 889 bool smbXcli_req_set_pending(struct tevent_req *req)
 890 {
 891         struct smbXcli_req_state *state =
 892                 tevent_req_data(req,
 893                 struct smbXcli_req_state);
 894         struct smbXcli_conn *conn;
 895         struct tevent_req **pending;
 896         size_t num_pending;
 897
 898         conn = state->conn;
 899
 900         if (!smbXcli_conn_is_connected(conn)) {
 901                 return false;
 902         }
 903
 904         num_pending = talloc_array_length(conn->pending);
 905
 906         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
 907                                  num_pending+1);
 908         if (pending == NULL) {
 909                 return false;
 910         }
 911         pending[num_pending] = req;
 912         conn->pending = pending;
 913         tevent_req_set_cleanup_fn(req, smbXcli_req_cleanup);
 914         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
 915
 916         if (!smbXcli_conn_receive_next(conn)) {
 917                 /*
 918                  * the caller should notify the current request
 919                  *
 920                  * And all other pending requests get notified
 921                  * by smbXcli_conn_disconnect().
 922                  */
 923                 smbXcli_req_unset_pending(req);
 924                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
 925                 return false;
 926         }
 927
 928         return true;
 929 }
 930
 931 static void smbXcli_conn_received(struct tevent_req *subreq);
 932
 933 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
 934 {
 935         size_t num_pending = talloc_array_length(conn->pending);
 936         struct tevent_req *req;
 937         struct smbXcli_req_state *state;
 938
 939         if (conn->read_smb_req != NULL) {
 940                 return true;
 941         }
 942
 943         if (num_pending == 0) {
 944                 if (conn->smb2.mid < UINT64_MAX) {
 945                         /* no more pending requests, so we are done for now */
 946                         return true;
 947                 }
 948
 949                 /*
 950                  * If there are no more SMB2 requests possible,
 951                  * because we are out of message ids,
 952                  * we need to disconnect.
 953                  */
 954                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
 955                 return true;
 956         }
 957
 958         req = conn->pending[0];
 959         state = tevent_req_data(req, struct smbXcli_req_state);
 960
 961         /*
 962          * We're the first ones, add the read_smb request that waits for the
 963          * answer from the server
 964          */
 965         conn->read_smb_req = read_smb_send(conn->pending,
 966                                            state->ev,
 967                                            conn->read_fd);
 968         if (conn->read_smb_req == NULL) {
 969                 return false;
 970         }
 971         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
 972         return true;
 973 }
 974
 975 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
 976 {
 977         struct smbXcli_session *session;
 978
 979         tevent_queue_stop(conn->outgoing);
 980
 981         if (conn->read_fd != -1) {
 982                 close(conn->read_fd);
 983         }
 984         if (conn->write_fd != -1) {
 985                 close(conn->write_fd);
 986         }
 987         conn->read_fd = -1;
 988         conn->write_fd = -1;
 989
 990         session = conn->sessions;
 991         if (talloc_array_length(conn->pending) == 0) {
 992                 /*
 993                  * if we do not have pending requests
 994                  * there is no need to update the channel_sequence
 995                  */
 996                 session = NULL;
 997         }
 998         for (; session; session = session->next) {
 999                 smb2cli_session_increment_channel_sequence(session);
1000         }
1001
1002         /*
1003          * Cancel all pending requests. We do not do a for-loop walking
1004          * conn->pending because that array changes in
1005          * smbXcli_req_unset_pending.
1006          */
1007         while (talloc_array_length(conn->pending) > 0) {
1008                 struct tevent_req *req;
1009                 struct smbXcli_req_state *state;
1010                 struct tevent_req **chain;
1011                 size_t num_chained;
1012                 size_t i;
1013
1014                 req = conn->pending[0];
1015                 state = tevent_req_data(req, struct smbXcli_req_state);
1016
1017                 if (state->smb1.chained_requests == NULL) {
1018                         /*
1019                          * We're dead. No point waiting for trans2
1020                          * replies.
1021                          */
1022                         state->smb1.mid = 0;
1023
1024                         smbXcli_req_unset_pending(req);
1025
1026                         if (NT_STATUS_IS_OK(status)) {
1027                                 /* do not notify the callers */
1028                                 continue;
1029                         }
1030
1031                         /*
1032                          * we need to defer the callback, because we may notify
1033                          * more then one caller.
1034                          */
1035                         tevent_req_defer_callback(req, state->ev);
1036                         tevent_req_nterror(req, status);
1037                         continue;
1038                 }
1039
1040                 chain = talloc_move(conn, &state->smb1.chained_requests);
1041                 num_chained = talloc_array_length(chain);
1042
1043                 for (i=0; i<num_chained; i++) {
1044                         req = chain[i];
1045                         state = tevent_req_data(req, struct smbXcli_req_state);
1046
1047                         /*
1048                          * We're dead. No point waiting for trans2
1049                          * replies.
1050                          */
1051                         state->smb1.mid = 0;
1052
1053                         smbXcli_req_unset_pending(req);
1054
1055                         if (NT_STATUS_IS_OK(status)) {
1056                                 /* do not notify the callers */
1057                                 continue;
1058                         }
1059
1060                         /*
1061                          * we need to defer the callback, because we may notify
1062                          * more than one caller.
1063                          */
1064                         tevent_req_defer_callback(req, state->ev);
1065                         tevent_req_nterror(req, status);
1066                 }
1067                 TALLOC_FREE(chain);
1068         }
1069 }
1070
1071 /*
1072  * Fetch a smb request's mid. Only valid after the request has been sent by
1073  * smb1cli_req_send().
1074  */
1075 uint16_t smb1cli_req_mid(struct tevent_req *req)
1076 {
1077         struct smbXcli_req_state *state =
1078                 tevent_req_data(req,
1079                 struct smbXcli_req_state);
1080
1081         if (state->smb1.mid != 0) {
1082                 return state->smb1.mid;
1083         }
1084
1085         return SVAL(state->smb1.hdr, HDR_MID);
1086 }
1087
1088 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1089 {
1090         struct smbXcli_req_state *state =
1091                 tevent_req_data(req,
1092                 struct smbXcli_req_state);
1093
1094         state->smb1.mid = mid;
1095 }
1096
1097 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1098 {
1099         struct smbXcli_req_state *state =
1100                 tevent_req_data(req,
1101                 struct smbXcli_req_state);
1102
1103         return state->smb1.seqnum;
1104 }
1105
1106 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1107 {
1108         struct smbXcli_req_state *state =
1109                 tevent_req_data(req,
1110                 struct smbXcli_req_state);
1111
1112         state->smb1.seqnum = seqnum;
1113 }
1114
1115 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1116 {
1117         size_t result = 0;
1118         int i;
1119         for (i=0; i<count; i++) {
1120                 result += iov[i].iov_len;
1121         }
1122         return result;
1123 }
1124
1125 static uint8_t *smbXcli_iov_concat(TALLOC_CTX *mem_ctx,
1126                                    const struct iovec *iov,
1127                                    int count)
1128 {
1129         size_t len = smbXcli_iov_len(iov, count);
1130         size_t copied;
1131         uint8_t *buf;
1132         int i;
1133
1134         buf = talloc_array(mem_ctx, uint8_t, len);
1135         if (buf == NULL) {
1136                 return NULL;
1137         }
1138         copied = 0;
1139         for (i=0; i<count; i++) {
1140                 memcpy(buf+copied, iov[i].iov_base, iov[i].iov_len);
1141                 copied += iov[i].iov_len;
1142         }
1143         return buf;
1144 }
1145
1146 static void smb1cli_req_flags(enum protocol_types protocol,
1147                               uint32_t smb1_capabilities,
1148                               uint8_t smb_command,
1149                               uint8_t additional_flags,
1150                               uint8_t clear_flags,
1151                               uint8_t *_flags,
1152                               uint16_t additional_flags2,
1153                               uint16_t clear_flags2,
1154                               uint16_t *_flags2)
1155 {
1156         uint8_t flags = 0;
1157         uint16_t flags2 = 0;
1158
1159         if (protocol >= PROTOCOL_LANMAN1) {
1160                 flags |= FLAG_CASELESS_PATHNAMES;
1161                 flags |= FLAG_CANONICAL_PATHNAMES;
1162         }
1163
1164         if (protocol >= PROTOCOL_LANMAN2) {
1165                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1166                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1167         }
1168
1169         if (protocol >= PROTOCOL_NT1) {
1170                 flags2 |= FLAGS2_IS_LONG_NAME;
1171
1172                 if (smb1_capabilities & CAP_UNICODE) {
1173                         flags2 |= FLAGS2_UNICODE_STRINGS;
1174                 }
1175                 if (smb1_capabilities & CAP_STATUS32) {
1176                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1177                 }
1178                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1179                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1180                 }
1181         }
1182
1183         flags |= additional_flags;
1184         flags &= ~clear_flags;
1185         flags2 |= additional_flags2;
1186         flags2 &= ~clear_flags2;
1187
1188         *_flags = flags;
1189         *_flags2 = flags2;
1190 }
1191
1192 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1193
1194 static bool smb1cli_req_cancel(struct tevent_req *req)
1195 {
1196         struct smbXcli_req_state *state =
1197                 tevent_req_data(req,
1198                 struct smbXcli_req_state);
1199         uint8_t flags;
1200         uint16_t flags2;
1201         uint32_t pid;
1202         uint16_t mid;
1203         struct tevent_req *subreq;
1204         NTSTATUS status;
1205
1206         flags = CVAL(state->smb1.hdr, HDR_FLG);
1207         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1208         pid  = SVAL(state->smb1.hdr, HDR_PID);
1209         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1210         mid = SVAL(state->smb1.hdr, HDR_MID);
1211
1212         subreq = smb1cli_req_create(state, state->ev,
1213                                     state->conn,
1214                                     SMBntcancel,
1215                                     flags, 0,
1216                                     flags2, 0,
1217                                     0, /* timeout */
1218                                     pid,
1219                                     state->tcon,
1220                                     state->session,
1221                                     0, NULL, /* vwv */
1222                                     0, NULL); /* bytes */
1223         if (subreq == NULL) {
1224                 return false;
1225         }
1226         smb1cli_req_set_mid(subreq, mid);
1227
1228         status = smb1cli_req_chain_submit(&subreq, 1);
1229         if (!NT_STATUS_IS_OK(status)) {
1230                 TALLOC_FREE(subreq);
1231                 return false;
1232         }
1233         smb1cli_req_set_mid(subreq, 0);
1234
1235         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1236
1237         return true;
1238 }
1239
1240 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1241 {
1242         /* we do not care about the result */
1243         TALLOC_FREE(subreq);
1244 }
1245
1246 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1247                                       struct tevent_context *ev,
1248                                       struct smbXcli_conn *conn,
1249                                       uint8_t smb_command,
1250                                       uint8_t additional_flags,
1251                                       uint8_t clear_flags,
1252                                       uint16_t additional_flags2,
1253                                       uint16_t clear_flags2,
1254                                       uint32_t timeout_msec,
1255                                       uint32_t pid,
1256                                       struct smbXcli_tcon *tcon,
1257                                       struct smbXcli_session *session,
1258                                       uint8_t wct, uint16_t *vwv,
1259                                       int iov_count,
1260                                       struct iovec *bytes_iov)
1261 {
1262         struct tevent_req *req;
1263         struct smbXcli_req_state *state;
1264         uint8_t flags = 0;
1265         uint16_t flags2 = 0;
1266         uint16_t uid = 0;
1267         uint16_t tid = 0;
1268
1269         if (iov_count > MAX_SMB_IOV) {
1270                 /*
1271                  * Should not happen :-)
1272                  */
1273                 return NULL;
1274         }
1275
1276         req = tevent_req_create(mem_ctx, &state,
1277                                 struct smbXcli_req_state);
1278         if (req == NULL) {
1279                 return NULL;
1280         }
1281         state->ev = ev;
1282         state->conn = conn;
1283         state->session = session;
1284         state->tcon = tcon;
1285
1286         if (session) {
1287                 uid = session->smb1.session_id;
1288         }
1289
1290         if (tcon) {
1291                 tid = tcon->smb1.tcon_id;
1292
1293                 if (tcon->fs_attributes & FILE_CASE_SENSITIVE_SEARCH) {
1294                         clear_flags |= FLAG_CASELESS_PATHNAMES;
1295                 } else {
1296                         /* Default setting, case insensitive. */
1297                         additional_flags |= FLAG_CASELESS_PATHNAMES;
1298                 }
1299
1300                 if (smbXcli_conn_dfs_supported(conn) &&
1301                     smbXcli_tcon_is_dfs_share(tcon))
1302                 {
1303                         additional_flags2 |= FLAGS2_DFS_PATHNAMES;
1304                 }
1305         }
1306
1307         state->smb1.recv_cmd = 0xFF;
1308         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1309         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1310         if (state->smb1.recv_iov == NULL) {
1311                 TALLOC_FREE(req);
1312                 return NULL;
1313         }
1314
1315         smb1cli_req_flags(conn->protocol,
1316                           conn->smb1.capabilities,
1317                           smb_command,
1318                           additional_flags,
1319                           clear_flags,
1320                           &flags,
1321                           additional_flags2,
1322                           clear_flags2,
1323                           &flags2);
1324
1325         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1326         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1327         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1328         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1329         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1330         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1331         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1332         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1333         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1334         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1335         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1336
1337         state->smb1.vwv = vwv;
1338
1339         SSVAL(state->smb1.bytecount_buf, 0, smbXcli_iov_len(bytes_iov, iov_count));
1340
1341         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1342         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1343         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1344         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1345         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1346         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1347         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1348         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1349
1350         if (iov_count != 0) {
1351                 memcpy(&state->smb1.iov[4], bytes_iov,
1352                        iov_count * sizeof(*bytes_iov));
1353         }
1354         state->smb1.iov_count = iov_count + 4;
1355
1356         if (timeout_msec > 0) {
1357                 struct timeval endtime;
1358
1359                 endtime = timeval_current_ofs_msec(timeout_msec);
1360                 if (!tevent_req_set_endtime(req, ev, endtime)) {
1361                         return req;
1362                 }
1363         }
1364
1365         switch (smb_command) {
1366         case SMBtranss:
1367         case SMBtranss2:
1368         case SMBnttranss:
1369                 state->one_way = true;
1370                 break;
1371         case SMBntcancel:
1372                 state->one_way = true;
1373                 state->smb1.one_way_seqnum = true;
1374                 break;
1375         case SMBlockingX:
1376                 if ((wct == 8) &&
1377                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1378                         state->one_way = true;
1379                 }
1380                 break;
1381         }
1382
1383         return req;
1384 }
1385
1386 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1387                                    struct iovec *iov, int iov_count,
1388                                    uint32_t *seqnum,
1389                                    bool one_way_seqnum)
1390 {
1391         TALLOC_CTX *frame = NULL;
1392         uint8_t *buf;
1393
1394         /*
1395          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1396          * iovec directly. MD5Update would do that just fine.
1397          */
1398
1399         if (iov_count < 4) {
1400                 return NT_STATUS_INVALID_PARAMETER_MIX;
1401         }
1402         if (iov[0].iov_len != NBT_HDR_SIZE) {
1403                 return NT_STATUS_INVALID_PARAMETER_MIX;
1404         }
1405         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1406                 return NT_STATUS_INVALID_PARAMETER_MIX;
1407         }
1408         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1409                 return NT_STATUS_INVALID_PARAMETER_MIX;
1410         }
1411         if (iov[3].iov_len != sizeof(uint16_t)) {
1412                 return NT_STATUS_INVALID_PARAMETER_MIX;
1413         }
1414
1415         frame = talloc_stackframe();
1416
1417         buf = smbXcli_iov_concat(frame, &iov[1], iov_count - 1);
1418         if (buf == NULL) {
1419                 return NT_STATUS_NO_MEMORY;
1420         }
1421
1422         *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1423                                           one_way_seqnum);
1424         smb_signing_sign_pdu(conn->smb1.signing,
1425                              buf, talloc_get_size(buf),
1426                              *seqnum);
1427         memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1428
1429         TALLOC_FREE(frame);
1430         return NT_STATUS_OK;
1431 }
1432
1433 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1434 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1435                                                TALLOC_CTX *tmp_mem,
1436                                                uint8_t *inbuf);
1437
1438 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1439                                           struct smbXcli_req_state *state,
1440                                           struct iovec *iov, int iov_count)
1441 {
1442         struct tevent_req *subreq;
1443         NTSTATUS status;
1444         uint8_t cmd;
1445         uint16_t mid;
1446
1447         if (!smbXcli_conn_is_connected(state->conn)) {
1448                 return NT_STATUS_CONNECTION_DISCONNECTED;
1449         }
1450
1451         if (state->conn->protocol > PROTOCOL_NT1) {
1452                 return NT_STATUS_REVISION_MISMATCH;
1453         }
1454
1455         if (iov_count < 4) {
1456                 return NT_STATUS_INVALID_PARAMETER_MIX;
1457         }
1458         if (iov[0].iov_len != NBT_HDR_SIZE) {
1459                 return NT_STATUS_INVALID_PARAMETER_MIX;
1460         }
1461         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1462                 return NT_STATUS_INVALID_PARAMETER_MIX;
1463         }
1464         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1465                 return NT_STATUS_INVALID_PARAMETER_MIX;
1466         }
1467         if (iov[3].iov_len != sizeof(uint16_t)) {
1468                 return NT_STATUS_INVALID_PARAMETER_MIX;
1469         }
1470
1471         cmd = CVAL(iov[1].iov_base, HDR_COM);
1472         if (cmd == SMBreadBraw) {
1473                 if (smbXcli_conn_has_async_calls(state->conn)) {
1474                         return NT_STATUS_INVALID_PARAMETER_MIX;
1475                 }
1476                 state->conn->smb1.read_braw_req = req;
1477         }
1478
1479         if (state->smb1.mid != 0) {
1480                 mid = state->smb1.mid;
1481         } else {
1482                 mid = smb1cli_alloc_mid(state->conn);
1483         }
1484         SSVAL(iov[1].iov_base, HDR_MID, mid);
1485
1486         _smb_setlen_nbt(iov[0].iov_base, smbXcli_iov_len(&iov[1], iov_count-1));
1487
1488         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1489                                     &state->smb1.seqnum,
1490                                     state->smb1.one_way_seqnum);
1491
1492         if (!NT_STATUS_IS_OK(status)) {
1493                 return status;
1494         }
1495
1496         /*
1497          * If we supported multiple encrytion contexts
1498          * here we'd look up based on tid.
1499          */
1500         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1501                 char *buf, *enc_buf;
1502
1503                 buf = (char *)smbXcli_iov_concat(talloc_tos(), iov, iov_count);
1504                 if (buf == NULL) {
1505                         return NT_STATUS_NO_MEMORY;
1506                 }
1507                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1508                                                (char *)buf, &enc_buf);
1509                 TALLOC_FREE(buf);
1510                 if (!NT_STATUS_IS_OK(status)) {
1511                         DEBUG(0, ("Error in encrypting client message: %s\n",
1512                                   nt_errstr(status)));
1513                         return status;
1514                 }
1515                 buf = (char *)talloc_memdup(state, enc_buf,
1516                                             smb_len_nbt(enc_buf)+4);
1517                 SAFE_FREE(enc_buf);
1518                 if (buf == NULL) {
1519                         return NT_STATUS_NO_MEMORY;
1520                 }
1521                 iov[0].iov_base = (void *)buf;
1522                 iov[0].iov_len = talloc_get_size(buf);
1523                 iov_count = 1;
1524         }
1525
1526         if (state->conn->dispatch_incoming == NULL) {
1527                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1528         }
1529
1530         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1531
1532         subreq = writev_send(state, state->ev, state->conn->outgoing,
1533                              state->conn->write_fd, false, iov, iov_count);
1534         if (subreq == NULL) {
1535                 return NT_STATUS_NO_MEMORY;
1536         }
1537         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1538         return NT_STATUS_OK;
1539 }
1540
1541 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1542                                     struct tevent_context *ev,
1543                                     struct smbXcli_conn *conn,
1544                                     uint8_t smb_command,
1545                                     uint8_t additional_flags,
1546                                     uint8_t clear_flags,
1547                                     uint16_t additional_flags2,
1548                                     uint16_t clear_flags2,
1549                                     uint32_t timeout_msec,
1550                                     uint32_t pid,
1551                                     struct smbXcli_tcon *tcon,
1552                                     struct smbXcli_session *session,
1553                                     uint8_t wct, uint16_t *vwv,
1554                                     uint32_t num_bytes,
1555                                     const uint8_t *bytes)
1556 {
1557         struct tevent_req *req;
1558         struct iovec iov;
1559         NTSTATUS status;
1560
1561         iov.iov_base = discard_const_p(void, bytes);
1562         iov.iov_len = num_bytes;
1563
1564         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1565                                  additional_flags, clear_flags,
1566                                  additional_flags2, clear_flags2,
1567                                  timeout_msec,
1568                                  pid, tcon, session,
1569                                  wct, vwv, 1, &iov);
1570         if (req == NULL) {
1571                 return NULL;
1572         }
1573         if (!tevent_req_is_in_progress(req)) {
1574                 return tevent_req_post(req, ev);
1575         }
1576         status = smb1cli_req_chain_submit(&req, 1);
1577         if (tevent_req_nterror(req, status)) {
1578                 return tevent_req_post(req, ev);
1579         }
1580         return req;
1581 }
1582
1583 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1584 {
1585         struct tevent_req *req =
1586                 tevent_req_callback_data(subreq,
1587                 struct tevent_req);
1588         struct smbXcli_req_state *state =
1589                 tevent_req_data(req,
1590                 struct smbXcli_req_state);
1591         ssize_t nwritten;
1592         int err;
1593
1594         nwritten = writev_recv(subreq, &err);
1595         TALLOC_FREE(subreq);
1596         if (nwritten == -1) {
1597                 NTSTATUS status = map_nt_error_from_unix_common(err);
1598                 smbXcli_conn_disconnect(state->conn, status);
1599                 return;
1600         }
1601
1602         if (state->one_way) {
1603                 state->inbuf = NULL;
1604                 tevent_req_done(req);
1605                 return;
1606         }
1607
1608         if (!smbXcli_req_set_pending(req)) {
1609                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1610                 return;
1611         }
1612 }
1613
1614 static void smbXcli_conn_received(struct tevent_req *subreq)
1615 {
1616         struct smbXcli_conn *conn =
1617                 tevent_req_callback_data(subreq,
1618                 struct smbXcli_conn);
1619         TALLOC_CTX *frame = talloc_stackframe();
1620         NTSTATUS status;
1621         uint8_t *inbuf;
1622         ssize_t received;
1623         int err;
1624
1625         if (subreq != conn->read_smb_req) {
1626                 DEBUG(1, ("Internal error: cli_smb_received called with "
1627                           "unexpected subreq\n"));
1628                 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1629                 TALLOC_FREE(frame);
1630                 return;
1631         }
1632         conn->read_smb_req = NULL;
1633
1634         received = read_smb_recv(subreq, frame, &inbuf, &err);
1635         TALLOC_FREE(subreq);
1636         if (received == -1) {
1637                 status = map_nt_error_from_unix_common(err);
1638                 smbXcli_conn_disconnect(conn, status);
1639                 TALLOC_FREE(frame);
1640                 return;
1641         }
1642
1643         status = conn->dispatch_incoming(conn, frame, inbuf);
1644         TALLOC_FREE(frame);
1645         if (NT_STATUS_IS_OK(status)) {
1646                 /*
1647                  * We should not do any more processing
1648                  * as the dispatch function called
1649                  * tevent_req_done().
1650                  */
1651                 return;
1652         }
1653
1654         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1655                 /*
1656                  * We got an error, so notify all pending requests
1657                  */
1658                 smbXcli_conn_disconnect(conn, status);
1659                 return;
1660         }
1661
1662         /*
1663          * We got NT_STATUS_RETRY, so we may ask for a
1664          * next incoming pdu.
1665          */
1666         if (!smbXcli_conn_receive_next(conn)) {
1667                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1668         }
1669 }
1670
1671 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1672                                           struct iovec **piov, int *pnum_iov)
1673 {
1674         struct iovec *iov;
1675         int num_iov;
1676         size_t buflen;
1677         size_t taken;
1678         size_t remaining;
1679         uint8_t *hdr;
1680         uint8_t cmd;
1681         uint32_t wct_ofs;
1682         NTSTATUS status;
1683         size_t min_size = MIN_SMB_SIZE;
1684
1685         buflen = smb_len_tcp(buf);
1686         taken = 0;
1687
1688         hdr = buf + NBT_HDR_SIZE;
1689
1690         status = smb1cli_pull_raw_error(hdr);
1691         if (NT_STATUS_IS_ERR(status)) {
1692                 /*
1693                  * This is an ugly hack to support OS/2
1694                  * which skips the byte_count in the DATA block
1695                  * on some error responses.
1696                  *
1697                  * See bug #9096
1698                  */
1699                 min_size -= sizeof(uint16_t);
1700         }
1701
1702         if (buflen < min_size) {
1703                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1704         }
1705
1706         /*
1707          * This returns iovec elements in the following order:
1708          *
1709          * - SMB header
1710          *
1711          * - Parameter Block
1712          * - Data Block
1713          *
1714          * - Parameter Block
1715          * - Data Block
1716          *
1717          * - Parameter Block
1718          * - Data Block
1719          */
1720         num_iov = 1;
1721
1722         iov = talloc_array(mem_ctx, struct iovec, num_iov);
1723         if (iov == NULL) {
1724                 return NT_STATUS_NO_MEMORY;
1725         }
1726         iov[0].iov_base = hdr;
1727         iov[0].iov_len = HDR_WCT;
1728         taken += HDR_WCT;
1729
1730         cmd = CVAL(hdr, HDR_COM);
1731         wct_ofs = HDR_WCT;
1732
1733         while (true) {
1734                 size_t len = buflen - taken;
1735                 struct iovec *cur;
1736                 struct iovec *iov_tmp;
1737                 uint8_t wct;
1738                 uint32_t bcc_ofs;
1739                 uint16_t bcc;
1740                 size_t needed;
1741
1742                 /*
1743                  * we need at least WCT
1744                  */
1745                 needed = sizeof(uint8_t);
1746                 if (len < needed) {
1747                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1748                                    __location__, (int)len, (int)needed));
1749                         goto inval;
1750                 }
1751
1752                 /*
1753                  * Now we check if the specified words are there
1754                  */
1755                 wct = CVAL(hdr, wct_ofs);
1756                 needed += wct * sizeof(uint16_t);
1757                 if (len < needed) {
1758                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1759                                    __location__, (int)len, (int)needed));
1760                         goto inval;
1761                 }
1762
1763                 if ((num_iov == 1) &&
1764                     (len == needed) &&
1765                     NT_STATUS_IS_ERR(status))
1766                 {
1767                         /*
1768                          * This is an ugly hack to support OS/2
1769                          * which skips the byte_count in the DATA block
1770                          * on some error responses.
1771                          *
1772                          * See bug #9096
1773                          */
1774                         iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
1775                                                  num_iov + 2);
1776                         if (iov_tmp == NULL) {
1777                                 TALLOC_FREE(iov);
1778                                 return NT_STATUS_NO_MEMORY;
1779                         }
1780                         iov = iov_tmp;
1781                         cur = &iov[num_iov];
1782                         num_iov += 2;
1783
1784                         cur[0].iov_len = 0;
1785                         cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
1786                         cur[1].iov_len = 0;
1787                         cur[1].iov_base = cur[0].iov_base;
1788
1789                         taken += needed;
1790                         break;
1791                 }
1792
1793                 /*
1794                  * we need at least BCC
1795                  */
1796                 needed += sizeof(uint16_t);
1797                 if (len < needed) {
1798                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1799                                    __location__, (int)len, (int)needed));
1800                         goto inval;
1801                 }
1802
1803                 /*
1804                  * Now we check if the specified bytes are there
1805                  */
1806                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
1807                 bcc = SVAL(hdr, bcc_ofs);
1808                 needed += bcc * sizeof(uint8_t);
1809                 if (len < needed) {
1810                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1811                                    __location__, (int)len, (int)needed));
1812                         goto inval;
1813                 }
1814
1815                 /*
1816                  * we allocate 2 iovec structures for words and bytes
1817                  */
1818                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
1819                                          num_iov + 2);
1820                 if (iov_tmp == NULL) {
1821                         TALLOC_FREE(iov);
1822                         return NT_STATUS_NO_MEMORY;
1823                 }
1824                 iov = iov_tmp;
1825                 cur = &iov[num_iov];
1826                 num_iov += 2;
1827
1828                 cur[0].iov_len = wct * sizeof(uint16_t);
1829                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
1830                 cur[1].iov_len = bcc * sizeof(uint8_t);
1831                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
1832
1833                 taken += needed;
1834
1835                 if (!smb1cli_is_andx_req(cmd)) {
1836                         /*
1837                          * If the current command does not have AndX chanining
1838                          * we are done.
1839                          */
1840                         break;
1841                 }
1842
1843                 if (wct == 0 && bcc == 0) {
1844                         /*
1845                          * An empty response also ends the chain,
1846                          * most likely with an error.
1847                          */
1848                         break;
1849                 }
1850
1851                 if (wct < 2) {
1852                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
1853                                    __location__, (int)wct, (int)cmd));
1854                         goto inval;
1855                 }
1856                 cmd = CVAL(cur[0].iov_base, 0);
1857                 if (cmd == 0xFF) {
1858                         /*
1859                          * If it is the end of the chain we are also done.
1860                          */
1861                         break;
1862                 }
1863                 wct_ofs = SVAL(cur[0].iov_base, 2);
1864
1865                 if (wct_ofs < taken) {
1866                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1867                 }
1868                 if (wct_ofs > buflen) {
1869                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1870                 }
1871
1872                 /*
1873                  * we consumed everything up to the start of the next
1874                  * parameter block.
1875                  */
1876                 taken = wct_ofs;
1877         }
1878
1879         remaining = buflen - taken;
1880
1881         if (remaining > 0 && num_iov >= 3) {
1882                 /*
1883                  * The last DATA block gets the remaining
1884                  * bytes, this is needed to support
1885                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
1886                  */
1887                 iov[num_iov-1].iov_len += remaining;
1888         }
1889
1890         *piov = iov;
1891         *pnum_iov = num_iov;
1892         return NT_STATUS_OK;
1893
1894 inval:
1895         TALLOC_FREE(iov);
1896         return NT_STATUS_INVALID_NETWORK_RESPONSE;
1897 }
1898
1899 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1900                                                TALLOC_CTX *tmp_mem,
1901                                                uint8_t *inbuf)
1902 {
1903         struct tevent_req *req;
1904         struct smbXcli_req_state *state;
1905         NTSTATUS status;
1906         size_t num_pending;
1907         size_t i;
1908         uint8_t cmd;
1909         uint16_t mid;
1910         bool oplock_break;
1911         uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
1912         size_t len = smb_len_tcp(inbuf);
1913         struct iovec *iov = NULL;
1914         int num_iov = 0;
1915         struct tevent_req **chain = NULL;
1916         size_t num_chained = 0;
1917         size_t num_responses = 0;
1918
1919         if (conn->smb1.read_braw_req != NULL) {
1920                 req = conn->smb1.read_braw_req;
1921                 conn->smb1.read_braw_req = NULL;
1922                 state = tevent_req_data(req, struct smbXcli_req_state);
1923
1924                 smbXcli_req_unset_pending(req);
1925
1926                 if (state->smb1.recv_iov == NULL) {
1927                         /*
1928                          * For requests with more than
1929                          * one response, we have to readd the
1930                          * recv_iov array.
1931                          */
1932                         state->smb1.recv_iov = talloc_zero_array(state,
1933                                                                  struct iovec,
1934                                                                  3);
1935                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
1936                                 return NT_STATUS_OK;
1937                         }
1938                 }
1939
1940                 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
1941                 state->smb1.recv_iov[0].iov_len = len;
1942                 ZERO_STRUCT(state->smb1.recv_iov[1]);
1943                 ZERO_STRUCT(state->smb1.recv_iov[2]);
1944
1945                 state->smb1.recv_cmd = SMBreadBraw;
1946                 state->smb1.recv_status = NT_STATUS_OK;
1947                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
1948
1949                 tevent_req_done(req);
1950                 return NT_STATUS_OK;
1951         }
1952
1953         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
1954             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
1955                 DEBUG(10, ("Got non-SMB PDU\n"));
1956                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1957         }
1958
1959         /*
1960          * If we supported multiple encrytion contexts
1961          * here we'd look up based on tid.
1962          */
1963         if (common_encryption_on(conn->smb1.trans_enc)
1964             && (CVAL(inbuf, 0) == 0)) {
1965                 uint16_t enc_ctx_num;
1966
1967                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
1968                 if (!NT_STATUS_IS_OK(status)) {
1969                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
1970                                    nt_errstr(status)));
1971                         return status;
1972                 }
1973
1974                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
1975                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
1976                                    enc_ctx_num,
1977                                    conn->smb1.trans_enc->enc_ctx_num));
1978                         return NT_STATUS_INVALID_HANDLE;
1979                 }
1980
1981                 status = common_decrypt_buffer(conn->smb1.trans_enc,
1982                                                (char *)inbuf);
1983                 if (!NT_STATUS_IS_OK(status)) {
1984                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
1985                                    nt_errstr(status)));
1986                         return status;
1987                 }
1988                 inhdr = inbuf + NBT_HDR_SIZE;
1989                 len = smb_len_nbt(inbuf);
1990         }
1991
1992         mid = SVAL(inhdr, HDR_MID);
1993         num_pending = talloc_array_length(conn->pending);
1994
1995         for (i=0; i<num_pending; i++) {
1996                 if (mid == smb1cli_req_mid(conn->pending[i])) {
1997                         break;
1998                 }
1999         }
2000         if (i == num_pending) {
2001                 /* Dump unexpected reply */
2002                 return NT_STATUS_RETRY;
2003         }
2004
2005         oplock_break = false;
2006
2007         if (mid == 0xffff) {
2008                 /*
2009                  * Paranoia checks that this is really an oplock break request.
2010                  */
2011                 oplock_break = (len == 51); /* hdr + 8 words */
2012                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
2013                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
2014                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
2015                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
2016
2017                 if (!oplock_break) {
2018                         /* Dump unexpected reply */
2019                         return NT_STATUS_RETRY;
2020                 }
2021         }
2022
2023         req = conn->pending[i];
2024         state = tevent_req_data(req, struct smbXcli_req_state);
2025
2026         if (!oplock_break /* oplock breaks are not signed */
2027             && !smb_signing_check_pdu(conn->smb1.signing,
2028                                       inhdr, len, state->smb1.seqnum+1)) {
2029                 DEBUG(10, ("cli_check_sign_mac failed\n"));
2030                 return NT_STATUS_ACCESS_DENIED;
2031         }
2032
2033         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
2034                                            &iov, &num_iov);
2035         if (!NT_STATUS_IS_OK(status)) {
2036                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
2037                           nt_errstr(status)));
2038                 return status;
2039         }
2040
2041         cmd = CVAL(inhdr, HDR_COM);
2042         status = smb1cli_pull_raw_error(inhdr);
2043
2044         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2045             (state->session != NULL) && state->session->disconnect_expired)
2046         {
2047                 /*
2048                  * this should be a short term hack
2049                  * until the upper layers have implemented
2050                  * re-authentication.
2051                  */
2052                 return status;
2053         }
2054
2055         if (state->smb1.chained_requests == NULL) {
2056                 if (num_iov != 3) {
2057                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2058                 }
2059
2060                 smbXcli_req_unset_pending(req);
2061
2062                 if (state->smb1.recv_iov == NULL) {
2063                         /*
2064                          * For requests with more than
2065                          * one response, we have to readd the
2066                          * recv_iov array.
2067                          */
2068                         state->smb1.recv_iov = talloc_zero_array(state,
2069                                                                  struct iovec,
2070                                                                  3);
2071                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2072                                 return NT_STATUS_OK;
2073                         }
2074                 }
2075
2076                 state->smb1.recv_cmd = cmd;
2077                 state->smb1.recv_status = status;
2078                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2079
2080                 state->smb1.recv_iov[0] = iov[0];
2081                 state->smb1.recv_iov[1] = iov[1];
2082                 state->smb1.recv_iov[2] = iov[2];
2083
2084                 if (talloc_array_length(conn->pending) == 0) {
2085                         tevent_req_done(req);
2086                         return NT_STATUS_OK;
2087                 }
2088
2089                 tevent_req_defer_callback(req, state->ev);
2090                 tevent_req_done(req);
2091                 return NT_STATUS_RETRY;
2092         }
2093
2094         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2095         num_chained = talloc_array_length(chain);
2096         num_responses = (num_iov - 1)/2;
2097
2098         if (num_responses > num_chained) {
2099                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2100         }
2101
2102         for (i=0; i<num_chained; i++) {
2103                 size_t iov_idx = 1 + (i*2);
2104                 struct iovec *cur = &iov[iov_idx];
2105                 uint8_t *inbuf_ref;
2106
2107                 req = chain[i];
2108                 state = tevent_req_data(req, struct smbXcli_req_state);
2109
2110                 smbXcli_req_unset_pending(req);
2111
2112                 /*
2113                  * as we finish multiple requests here
2114                  * we need to defer the callbacks as
2115                  * they could destroy our current stack state.
2116                  */
2117                 tevent_req_defer_callback(req, state->ev);
2118
2119                 if (i >= num_responses) {
2120                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2121                         continue;
2122                 }
2123
2124                 if (state->smb1.recv_iov == NULL) {
2125                         /*
2126                          * For requests with more than
2127                          * one response, we have to readd the
2128                          * recv_iov array.
2129                          */
2130                         state->smb1.recv_iov = talloc_zero_array(state,
2131                                                                  struct iovec,
2132                                                                  3);
2133                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2134                                 continue;
2135                         }
2136                 }
2137
2138                 state->smb1.recv_cmd = cmd;
2139
2140                 if (i == (num_responses - 1)) {
2141                         /*
2142                          * The last request in the chain gets the status
2143                          */
2144                         state->smb1.recv_status = status;
2145                 } else {
2146                         cmd = CVAL(cur[0].iov_base, 0);
2147                         state->smb1.recv_status = NT_STATUS_OK;
2148                 }
2149
2150                 state->inbuf = inbuf;
2151
2152                 /*
2153                  * Note: here we use talloc_reference() in a way
2154                  *       that does not expose it to the caller.
2155                  */
2156                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2157                 if (tevent_req_nomem(inbuf_ref, req)) {
2158                         continue;
2159                 }
2160
2161                 /* copy the related buffers */
2162                 state->smb1.recv_iov[0] = iov[0];
2163                 state->smb1.recv_iov[1] = cur[0];
2164                 state->smb1.recv_iov[2] = cur[1];
2165
2166                 tevent_req_done(req);
2167         }
2168
2169         return NT_STATUS_RETRY;
2170 }
2171
2172 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2173                           TALLOC_CTX *mem_ctx,
2174                           struct iovec **piov,
2175                           uint8_t **phdr,
2176                           uint8_t *pwct,
2177                           uint16_t **pvwv,
2178                           uint32_t *pvwv_offset,
2179                           uint32_t *pnum_bytes,
2180                           uint8_t **pbytes,
2181                           uint32_t *pbytes_offset,
2182                           uint8_t **pinbuf,
2183                           const struct smb1cli_req_expected_response *expected,
2184                           size_t num_expected)
2185 {
2186         struct smbXcli_req_state *state =
2187                 tevent_req_data(req,
2188                 struct smbXcli_req_state);
2189         NTSTATUS status = NT_STATUS_OK;
2190         struct iovec *recv_iov = NULL;
2191         uint8_t *hdr = NULL;
2192         uint8_t wct = 0;
2193         uint32_t vwv_offset = 0;
2194         uint16_t *vwv = NULL;
2195         uint32_t num_bytes = 0;
2196         uint32_t bytes_offset = 0;
2197         uint8_t *bytes = NULL;
2198         size_t i;
2199         bool found_status = false;
2200         bool found_size = false;
2201
2202         if (piov != NULL) {
2203                 *piov = NULL;
2204         }
2205         if (phdr != NULL) {
2206                 *phdr = 0;
2207         }
2208         if (pwct != NULL) {
2209                 *pwct = 0;
2210         }
2211         if (pvwv != NULL) {
2212                 *pvwv = NULL;
2213         }
2214         if (pvwv_offset != NULL) {
2215                 *pvwv_offset = 0;
2216         }
2217         if (pnum_bytes != NULL) {
2218                 *pnum_bytes = 0;
2219         }
2220         if (pbytes != NULL) {
2221                 *pbytes = NULL;
2222         }
2223         if (pbytes_offset != NULL) {
2224                 *pbytes_offset = 0;
2225         }
2226         if (pinbuf != NULL) {
2227                 *pinbuf = NULL;
2228         }
2229
2230         if (state->inbuf != NULL) {
2231                 recv_iov = state->smb1.recv_iov;
2232                 state->smb1.recv_iov = NULL;
2233                 if (state->smb1.recv_cmd != SMBreadBraw) {
2234                         hdr = (uint8_t *)recv_iov[0].iov_base;
2235                         wct = recv_iov[1].iov_len/2;
2236                         vwv = (uint16_t *)recv_iov[1].iov_base;
2237                         vwv_offset = PTR_DIFF(vwv, hdr);
2238                         num_bytes = recv_iov[2].iov_len;
2239                         bytes = (uint8_t *)recv_iov[2].iov_base;
2240                         bytes_offset = PTR_DIFF(bytes, hdr);
2241                 }
2242         }
2243
2244         if (tevent_req_is_nterror(req, &status)) {
2245                 for (i=0; i < num_expected; i++) {
2246                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2247                                 found_status = true;
2248                                 break;
2249                         }
2250                 }
2251
2252                 if (found_status) {
2253                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2254                 }
2255
2256                 return status;
2257         }
2258
2259         if (num_expected == 0) {
2260                 found_status = true;
2261                 found_size = true;
2262         }
2263
2264         status = state->smb1.recv_status;
2265
2266         for (i=0; i < num_expected; i++) {
2267                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2268                         continue;
2269                 }
2270
2271                 found_status = true;
2272                 if (expected[i].wct == 0) {
2273                         found_size = true;
2274                         break;
2275                 }
2276
2277                 if (expected[i].wct == wct) {
2278                         found_size = true;
2279                         break;
2280                 }
2281         }
2282
2283         if (!found_status) {
2284                 return status;
2285         }
2286
2287         if (!found_size) {
2288                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2289         }
2290
2291         if (piov != NULL) {
2292                 *piov = talloc_move(mem_ctx, &recv_iov);
2293         }
2294
2295         if (phdr != NULL) {
2296                 *phdr = hdr;
2297         }
2298         if (pwct != NULL) {
2299                 *pwct = wct;
2300         }
2301         if (pvwv != NULL) {
2302                 *pvwv = vwv;
2303         }
2304         if (pvwv_offset != NULL) {
2305                 *pvwv_offset = vwv_offset;
2306         }
2307         if (pnum_bytes != NULL) {
2308                 *pnum_bytes = num_bytes;
2309         }
2310         if (pbytes != NULL) {
2311                 *pbytes = bytes;
2312         }
2313         if (pbytes_offset != NULL) {
2314                 *pbytes_offset = bytes_offset;
2315         }
2316         if (pinbuf != NULL) {
2317                 *pinbuf = state->inbuf;
2318         }
2319
2320         return status;
2321 }
2322
2323 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2324 {
2325         size_t wct_ofs;
2326         int i;
2327
2328         wct_ofs = HDR_WCT;
2329
2330         for (i=0; i<num_reqs; i++) {
2331                 struct smbXcli_req_state *state;
2332                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2333                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2334                                            state->smb1.iov_count-2);
2335                 wct_ofs = (wct_ofs + 3) & ~3;
2336         }
2337         return wct_ofs;
2338 }
2339
2340 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2341 {
2342         struct smbXcli_req_state *first_state =
2343                 tevent_req_data(reqs[0],
2344                 struct smbXcli_req_state);
2345         struct smbXcli_req_state *state;
2346         size_t wct_offset;
2347         size_t chain_padding = 0;
2348         int i, iovlen;
2349         struct iovec *iov = NULL;
2350         struct iovec *this_iov;
2351         NTSTATUS status;
2352         size_t nbt_len;
2353
2354         if (num_reqs == 1) {
2355                 return smb1cli_req_writev_submit(reqs[0], first_state,
2356                                                  first_state->smb1.iov,
2357                                                  first_state->smb1.iov_count);
2358         }
2359
2360         iovlen = 0;
2361         for (i=0; i<num_reqs; i++) {
2362                 if (!tevent_req_is_in_progress(reqs[i])) {
2363                         return NT_STATUS_INTERNAL_ERROR;
2364                 }
2365
2366                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2367
2368                 if (state->smb1.iov_count < 4) {
2369                         return NT_STATUS_INVALID_PARAMETER_MIX;
2370                 }
2371
2372                 if (i == 0) {
2373                         /*
2374                          * The NBT and SMB header
2375                          */
2376                         iovlen += 2;
2377                 } else {
2378                         /*
2379                          * Chain padding
2380                          */
2381                         iovlen += 1;
2382                 }
2383
2384                 /*
2385                  * words and bytes
2386                  */
2387                 iovlen += state->smb1.iov_count - 2;
2388         }
2389
2390         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2391         if (iov == NULL) {
2392                 return NT_STATUS_NO_MEMORY;
2393         }
2394
2395         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2396                 first_state, reqs, sizeof(*reqs) * num_reqs);
2397         if (first_state->smb1.chained_requests == NULL) {
2398                 TALLOC_FREE(iov);
2399                 return NT_STATUS_NO_MEMORY;
2400         }
2401
2402         wct_offset = HDR_WCT;
2403         this_iov = iov;
2404
2405         for (i=0; i<num_reqs; i++) {
2406                 size_t next_padding = 0;
2407                 uint16_t *vwv;
2408
2409                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2410
2411                 if (i < num_reqs-1) {
2412                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2413                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2414                                 TALLOC_FREE(iov);
2415                                 TALLOC_FREE(first_state->smb1.chained_requests);
2416                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2417                         }
2418                 }
2419
2420                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2421                                               state->smb1.iov_count-2) + 1;
2422                 if ((wct_offset % 4) != 0) {
2423                         next_padding = 4 - (wct_offset % 4);
2424                 }
2425                 wct_offset += next_padding;
2426                 vwv = state->smb1.vwv;
2427
2428                 if (i < num_reqs-1) {
2429                         struct smbXcli_req_state *next_state =
2430                                 tevent_req_data(reqs[i+1],
2431                                 struct smbXcli_req_state);
2432                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2433                         SCVAL(vwv+0, 1, 0);
2434                         SSVAL(vwv+1, 0, wct_offset);
2435                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2436                         /* properly end the chain */
2437                         SCVAL(vwv+0, 0, 0xff);
2438                         SCVAL(vwv+0, 1, 0xff);
2439                         SSVAL(vwv+1, 0, 0);
2440                 }
2441
2442                 if (i == 0) {
2443                         /*
2444                          * The NBT and SMB header
2445                          */
2446                         this_iov[0] = state->smb1.iov[0];
2447                         this_iov[1] = state->smb1.iov[1];
2448                         this_iov += 2;
2449                 } else {
2450                         /*
2451                          * This one is a bit subtle. We have to add
2452                          * chain_padding bytes between the requests, and we
2453                          * have to also include the wct field of the
2454                          * subsequent requests. We use the subsequent header
2455                          * for the padding, it contains the wct field in its
2456                          * last byte.
2457                          */
2458                         this_iov[0].iov_len = chain_padding+1;
2459                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2460                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2461                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2462                         this_iov += 1;
2463                 }
2464
2465                 /*
2466                  * copy the words and bytes
2467                  */
2468                 memcpy(this_iov, state->smb1.iov+2,
2469                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2470                 this_iov += state->smb1.iov_count - 2;
2471                 chain_padding = next_padding;
2472         }
2473
2474         nbt_len = smbXcli_iov_len(&iov[1], iovlen-1);
2475         if (nbt_len > first_state->conn->smb1.max_xmit) {
2476                 TALLOC_FREE(iov);
2477                 TALLOC_FREE(first_state->smb1.chained_requests);
2478                 return NT_STATUS_INVALID_PARAMETER_MIX;
2479         }
2480
2481         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2482         if (!NT_STATUS_IS_OK(status)) {
2483                 TALLOC_FREE(iov);
2484                 TALLOC_FREE(first_state->smb1.chained_requests);
2485                 return status;
2486         }
2487
2488         return NT_STATUS_OK;
2489 }
2490
2491 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2492 {
2493         return ((tevent_queue_length(conn->outgoing) != 0)
2494                 || (talloc_array_length(conn->pending) != 0));
2495 }
2496
2497 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn)
2498 {
2499         if (conn->protocol >= PROTOCOL_SMB2_02) {
2500                 return (smb2cli_conn_server_capabilities(conn) & SMB2_CAP_DFS);
2501         }
2502
2503         return (smb1cli_conn_capabilities(conn) & CAP_DFS);
2504 }
2505
2506 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2507 {
2508         uint16_t credits = 1;
2509
2510         if (conn->smb2.cur_credits == 0) {
2511                 if (max_dyn_len != NULL) {
2512                         *max_dyn_len = 0;
2513                 }
2514                 return false;
2515         }
2516
2517         if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2518                 credits = conn->smb2.cur_credits;
2519         }
2520
2521         if (max_dyn_len != NULL) {
2522                 *max_dyn_len = credits * 65536;
2523         }
2524
2525         return true;
2526 }
2527
2528 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2529 {
2530         return conn->smb2.server.capabilities;
2531 }
2532
2533 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2534 {
2535         return conn->smb2.server.security_mode;
2536 }
2537
2538 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2539 {
2540         return conn->smb2.server.max_trans_size;
2541 }
2542
2543 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2544 {
2545         return conn->smb2.server.max_read_size;
2546 }
2547
2548 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2549 {
2550         return conn->smb2.server.max_write_size;
2551 }
2552
2553 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2554                                   uint16_t max_credits)
2555 {
2556         conn->smb2.max_credits = max_credits;
2557 }
2558
2559 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2560
2561 static bool smb2cli_req_cancel(struct tevent_req *req)
2562 {
2563         struct smbXcli_req_state *state =
2564                 tevent_req_data(req,
2565                 struct smbXcli_req_state);
2566         uint32_t flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
2567         uint64_t mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
2568         uint64_t aid = BVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID);
2569         struct smbXcli_tcon *tcon = state->tcon;
2570         struct smbXcli_session *session = state->session;
2571         uint8_t *fixed = state->smb2.pad;
2572         uint16_t fixed_len = 4;
2573         struct tevent_req *subreq;
2574         struct smbXcli_req_state *substate;
2575         NTSTATUS status;
2576
2577         SSVAL(fixed, 0, 0x04);
2578         SSVAL(fixed, 2, 0);
2579
2580         subreq = smb2cli_req_create(state, state->ev,
2581                                     state->conn,
2582                                     SMB2_OP_CANCEL,
2583                                     flags, 0,
2584                                     0, /* timeout */
2585                                     tcon, session,
2586                                     fixed, fixed_len,
2587                                     NULL, 0, 0);
2588         if (subreq == NULL) {
2589                 return false;
2590         }
2591         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2592
2593         /*
2594          * clear everything but the SMB2_HDR_FLAG_ASYNC flag
2595          * e.g. if SMB2_HDR_FLAG_CHAINED is set we get INVALID_PARAMETER back
2596          */
2597         flags &= SMB2_HDR_FLAG_ASYNC;
2598
2599         if (flags & SMB2_HDR_FLAG_ASYNC) {
2600                 mid = 0;
2601         }
2602
2603         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, flags);
2604         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2605         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, aid);
2606
2607         status = smb2cli_req_compound_submit(&subreq, 1);
2608         if (!NT_STATUS_IS_OK(status)) {
2609                 TALLOC_FREE(subreq);
2610                 return false;
2611         }
2612
2613         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2614
2615         return true;
2616 }
2617
2618 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2619 {
2620         /* we do not care about the result */
2621         TALLOC_FREE(subreq);
2622 }
2623
2624 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2625                                       struct tevent_context *ev,
2626                                       struct smbXcli_conn *conn,
2627                                       uint16_t cmd,
2628                                       uint32_t additional_flags,
2629                                       uint32_t clear_flags,
2630                                       uint32_t timeout_msec,
2631                                       struct smbXcli_tcon *tcon,
2632                                       struct smbXcli_session *session,
2633                                       const uint8_t *fixed,
2634                                       uint16_t fixed_len,
2635                                       const uint8_t *dyn,
2636                                       uint32_t dyn_len,
2637                                       uint32_t max_dyn_len)
2638 {
2639         struct tevent_req *req;
2640         struct smbXcli_req_state *state;
2641         uint32_t flags = 0;
2642         uint32_t tid = 0;
2643         uint64_t uid = 0;
2644         bool use_channel_sequence = false;
2645         uint16_t channel_sequence = 0;
2646         bool use_replay_flag = false;
2647
2648         req = tevent_req_create(mem_ctx, &state,
2649                                 struct smbXcli_req_state);
2650         if (req == NULL) {
2651                 return NULL;
2652         }
2653
2654         state->ev = ev;
2655         state->conn = conn;
2656         state->session = session;
2657         state->tcon = tcon;
2658
2659         if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
2660                 use_channel_sequence = true;
2661         } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
2662                 use_channel_sequence = true;
2663         }
2664
2665         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_00) {
2666                 use_replay_flag = true;
2667         }
2668
2669         if (session) {
2670                 uid = session->smb2->session_id;
2671
2672                 if (use_channel_sequence) {
2673                         channel_sequence = session->smb2->channel_sequence;
2674                 }
2675
2676                 if (use_replay_flag && session->smb2->replay_active) {
2677                         additional_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
2678                 }
2679
2680                 state->smb2.should_sign = session->smb2->should_sign;
2681                 state->smb2.should_encrypt = session->smb2->should_encrypt;
2682
2683                 if (cmd == SMB2_OP_SESSSETUP &&
2684                     session->smb2->signing_key.length != 0) {
2685                         state->smb2.should_sign = true;
2686                 }
2687
2688                 if (cmd == SMB2_OP_SESSSETUP &&
2689                     session->smb2_channel.signing_key.length == 0) {
2690                         state->smb2.should_encrypt = false;
2691                 }
2692
2693                 if (additional_flags & SMB2_HDR_FLAG_SIGNED) {
2694                         if (session->smb2_channel.signing_key.length == 0) {
2695                                 tevent_req_nterror(req, NT_STATUS_NO_USER_SESSION_KEY);
2696                                 return req;
2697                         }
2698
2699                         additional_flags &= ~SMB2_HDR_FLAG_SIGNED;
2700                         state->smb2.should_sign = true;
2701                 }
2702         }
2703
2704         if (tcon) {
2705                 tid = tcon->smb2.tcon_id;
2706
2707                 if (tcon->smb2.should_sign) {
2708                         state->smb2.should_sign = true;
2709                 }
2710                 if (tcon->smb2.should_encrypt) {
2711                         state->smb2.should_encrypt = true;
2712                 }
2713         }
2714
2715         if (state->smb2.should_encrypt) {
2716                 state->smb2.should_sign = false;
2717         }
2718
2719         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
2720         if (state->smb2.recv_iov == NULL) {
2721                 TALLOC_FREE(req);
2722                 return NULL;
2723         }
2724
2725         flags |= additional_flags;
2726         flags &= ~clear_flags;
2727
2728         state->smb2.fixed = fixed;
2729         state->smb2.fixed_len = fixed_len;
2730         state->smb2.dyn = dyn;
2731         state->smb2.dyn_len = dyn_len;
2732         state->smb2.max_dyn_len = max_dyn_len;
2733
2734         if (state->smb2.should_encrypt) {
2735                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2736                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
2737         }
2738
2739         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
2740         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
2741         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
2742         SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
2743         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
2744         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            0); /* reserved */
2745         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
2746         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
2747
2748         switch (cmd) {
2749         case SMB2_OP_CANCEL:
2750                 state->one_way = true;
2751                 break;
2752         case SMB2_OP_BREAK:
2753                 /*
2754                  * If this is a dummy request, it will have
2755                  * UINT64_MAX as message id.
2756                  * If we send on break acknowledgement,
2757                  * this gets overwritten later.
2758                  */
2759                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
2760                 break;
2761         }
2762
2763         if (timeout_msec > 0) {
2764                 struct timeval endtime;
2765
2766                 endtime = timeval_current_ofs_msec(timeout_msec);
2767                 if (!tevent_req_set_endtime(req, ev, endtime)) {
2768                         return req;
2769                 }
2770         }
2771
2772         return req;
2773 }
2774
2775 void smb2cli_req_set_notify_async(struct tevent_req *req)
2776 {
2777         struct smbXcli_req_state *state =
2778                 tevent_req_data(req,
2779                 struct smbXcli_req_state);
2780
2781         state->smb2.notify_async = true;
2782 }
2783
2784 static void smb2cli_req_writev_done(struct tevent_req *subreq);
2785 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2786                                                TALLOC_CTX *tmp_mem,
2787                                                uint8_t *inbuf);
2788
2789 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
2790                                      int num_reqs)
2791 {
2792         struct smbXcli_req_state *state;
2793         struct tevent_req *subreq;
2794         struct iovec *iov;
2795         int i, num_iov, nbt_len;
2796         int tf_iov = -1;
2797         const DATA_BLOB *encryption_key = NULL;
2798         uint64_t encryption_session_id = 0;
2799
2800         /*
2801          * 1 for the nbt length, optional TRANSFORM
2802          * per request: HDR, fixed, dyn, padding
2803          * -1 because the last one does not need padding
2804          */
2805
2806         iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
2807         if (iov == NULL) {
2808                 return NT_STATUS_NO_MEMORY;
2809         }
2810
2811         num_iov = 1;
2812         nbt_len = 0;
2813
2814         /*
2815          * the session of the first request that requires encryption
2816          * specifies the encryption key.
2817          */
2818         for (i=0; i<num_reqs; i++) {
2819                 if (!tevent_req_is_in_progress(reqs[i])) {
2820                         return NT_STATUS_INTERNAL_ERROR;
2821                 }
2822
2823                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2824
2825                 if (!smbXcli_conn_is_connected(state->conn)) {
2826                         return NT_STATUS_CONNECTION_DISCONNECTED;
2827                 }
2828
2829                 if ((state->conn->protocol != PROTOCOL_NONE) &&
2830                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
2831                         return NT_STATUS_REVISION_MISMATCH;
2832                 }
2833
2834                 if (state->session == NULL) {
2835                         continue;
2836                 }
2837
2838                 if (!state->smb2.should_encrypt) {
2839                         continue;
2840                 }
2841
2842                 encryption_key = &state->session->smb2->encryption_key;
2843                 if (encryption_key->length == 0) {
2844                         return NT_STATUS_INVALID_PARAMETER_MIX;
2845                 }
2846
2847                 encryption_session_id = state->session->smb2->session_id;
2848
2849                 tf_iov = num_iov;
2850                 iov[num_iov].iov_base = state->smb2.transform;
2851                 iov[num_iov].iov_len  = sizeof(state->smb2.transform);
2852                 num_iov += 1;
2853
2854                 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
2855                 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
2856                       state->session->smb2->nonce_low);
2857                 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
2858                       state->session->smb2->nonce_high);
2859                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
2860                       encryption_session_id);
2861
2862                 state->session->smb2->nonce_low += 1;
2863                 if (state->session->smb2->nonce_low == 0) {
2864                         state->session->smb2->nonce_high += 1;
2865                         state->session->smb2->nonce_low += 1;
2866                 }
2867
2868                 nbt_len += SMB2_TF_HDR_SIZE;
2869                 break;
2870         }
2871
2872         for (i=0; i<num_reqs; i++) {
2873                 int hdr_iov;
2874                 size_t reqlen;
2875                 bool ret;
2876                 uint16_t opcode;
2877                 uint64_t avail;
2878                 uint16_t charge;
2879                 uint16_t credits;
2880                 uint64_t mid;
2881                 const DATA_BLOB *signing_key = NULL;
2882
2883                 if (!tevent_req_is_in_progress(reqs[i])) {
2884                         return NT_STATUS_INTERNAL_ERROR;
2885                 }
2886
2887                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2888
2889                 if (!smbXcli_conn_is_connected(state->conn)) {
2890                         return NT_STATUS_CONNECTION_DISCONNECTED;
2891                 }
2892
2893                 if ((state->conn->protocol != PROTOCOL_NONE) &&
2894                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
2895                         return NT_STATUS_REVISION_MISMATCH;
2896                 }
2897
2898                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
2899                 if (opcode == SMB2_OP_CANCEL) {
2900                         goto skip_credits;
2901                 }
2902
2903                 avail = UINT64_MAX - state->conn->smb2.mid;
2904                 if (avail < 1) {
2905                         return NT_STATUS_CONNECTION_ABORTED;
2906                 }
2907
2908                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2909                         uint32_t max_dyn_len = 1;
2910
2911                         max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
2912                         max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
2913
2914                         charge = (max_dyn_len - 1)/ 65536 + 1;
2915                 } else {
2916                         charge = 1;
2917                 }
2918
2919                 charge = MAX(state->smb2.credit_charge, charge);
2920
2921                 avail = MIN(avail, state->conn->smb2.cur_credits);
2922                 if (avail < charge) {
2923                         return NT_STATUS_INTERNAL_ERROR;
2924                 }
2925
2926                 credits = 0;
2927                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
2928                         credits = state->conn->smb2.max_credits -
2929                                   state->conn->smb2.cur_credits;
2930                 }
2931                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
2932                         credits += 1;
2933                 }
2934
2935                 mid = state->conn->smb2.mid;
2936                 state->conn->smb2.mid += charge;
2937                 state->conn->smb2.cur_credits -= charge;
2938
2939                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2940                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
2941                 }
2942                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
2943                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
2944
2945 skip_credits:
2946                 if (state->session && encryption_key == NULL) {
2947                         /*
2948                          * We prefer the channel signing key if it is
2949                          * already there.
2950                          */
2951                         if (state->smb2.should_sign) {
2952                                 signing_key = &state->session->smb2_channel.signing_key;
2953                         }
2954
2955                         /*
2956                          * If it is a channel binding, we already have the main
2957                          * signing key and try that one.
2958                          */
2959                         if (signing_key && signing_key->length == 0) {
2960                                 signing_key = &state->session->smb2->signing_key;
2961                         }
2962
2963                         /*
2964                          * If we do not have any session key yet, we skip the
2965                          * signing of SMB2_OP_SESSSETUP requests.
2966                          */
2967                         if (signing_key && signing_key->length == 0) {
2968                                 signing_key = NULL;
2969                         }
2970                 }
2971
2972                 hdr_iov = num_iov;
2973                 iov[num_iov].iov_base = state->smb2.hdr;
2974                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
2975                 num_iov += 1;
2976
2977                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
2978                 iov[num_iov].iov_len  = state->smb2.fixed_len;
2979                 num_iov += 1;
2980
2981                 if (state->smb2.dyn != NULL) {
2982                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
2983                         iov[num_iov].iov_len  = state->smb2.dyn_len;
2984                         num_iov += 1;
2985                 }
2986
2987                 reqlen  = sizeof(state->smb2.hdr);
2988                 reqlen += state->smb2.fixed_len;
2989                 reqlen += state->smb2.dyn_len;
2990
2991                 if (i < num_reqs-1) {
2992                         if ((reqlen % 8) > 0) {
2993                                 uint8_t pad = 8 - (reqlen % 8);
2994                                 iov[num_iov].iov_base = state->smb2.pad;
2995                                 iov[num_iov].iov_len = pad;
2996                                 num_iov += 1;
2997                                 reqlen += pad;
2998                         }
2999                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
3000                 }
3001
3002                 state->smb2.encryption_session_id = encryption_session_id;
3003
3004                 if (signing_key != NULL) {
3005                         NTSTATUS status;
3006
3007                         status = smb2_signing_sign_pdu(*signing_key,
3008                                                        state->session->conn->protocol,
3009                                                        &iov[hdr_iov], num_iov - hdr_iov);
3010                         if (!NT_STATUS_IS_OK(status)) {
3011                                 return status;
3012                         }
3013                 }
3014
3015                 nbt_len += reqlen;
3016
3017                 ret = smbXcli_req_set_pending(reqs[i]);
3018                 if (!ret) {
3019                         return NT_STATUS_NO_MEMORY;
3020                 }
3021         }
3022
3023         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
3024         _smb_setlen_tcp(state->length_hdr, nbt_len);
3025         iov[0].iov_base = state->length_hdr;
3026         iov[0].iov_len  = sizeof(state->length_hdr);
3027
3028         if (encryption_key != NULL) {
3029                 NTSTATUS status;
3030                 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
3031                 uint8_t *buf;
3032                 int vi;
3033
3034                 buf = talloc_array(iov, uint8_t, buflen);
3035                 if (buf == NULL) {
3036                         return NT_STATUS_NO_MEMORY;
3037                 }
3038
3039                 /*
3040                  * We copy the buffers before encrypting them,
3041                  * this is at least currently needed for the
3042                  * to keep state->smb2.hdr.
3043                  *
3044                  * Also the callers may expect there buffers
3045                  * to be const.
3046                  */
3047                 for (vi = tf_iov + 1; vi < num_iov; vi++) {
3048                         struct iovec *v = &iov[vi];
3049                         const uint8_t *o = (const uint8_t *)v->iov_base;
3050
3051                         memcpy(buf, o, v->iov_len);
3052                         v->iov_base = (void *)buf;
3053                         buf += v->iov_len;
3054                 }
3055
3056                 status = smb2_signing_encrypt_pdu(*encryption_key,
3057                                         state->conn->protocol,
3058                                         &iov[tf_iov], num_iov - tf_iov);
3059                 if (!NT_STATUS_IS_OK(status)) {
3060                         return status;
3061                 }
3062         }
3063
3064         if (state->conn->dispatch_incoming == NULL) {
3065                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3066         }
3067
3068         subreq = writev_send(state, state->ev, state->conn->outgoing,
3069                              state->conn->write_fd, false, iov, num_iov);
3070         if (subreq == NULL) {
3071                 return NT_STATUS_NO_MEMORY;
3072         }
3073         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3074         return NT_STATUS_OK;
3075 }
3076
3077 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3078 {
3079         struct smbXcli_req_state *state =
3080                 tevent_req_data(req,
3081                 struct smbXcli_req_state);
3082
3083         state->smb2.credit_charge = charge;
3084 }
3085
3086 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3087                                     struct tevent_context *ev,
3088                                     struct smbXcli_conn *conn,
3089                                     uint16_t cmd,
3090                                     uint32_t additional_flags,
3091                                     uint32_t clear_flags,
3092                                     uint32_t timeout_msec,
3093                                     struct smbXcli_tcon *tcon,
3094                                     struct smbXcli_session *session,
3095                                     const uint8_t *fixed,
3096                                     uint16_t fixed_len,
3097                                     const uint8_t *dyn,
3098                                     uint32_t dyn_len,
3099                                     uint32_t max_dyn_len)
3100 {
3101         struct tevent_req *req;
3102         NTSTATUS status;
3103
3104         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3105                                  additional_flags, clear_flags,
3106                                  timeout_msec,
3107                                  tcon, session,
3108                                  fixed, fixed_len,
3109                                  dyn, dyn_len,
3110                                  max_dyn_len);
3111         if (req == NULL) {
3112                 return NULL;
3113         }
3114         if (!tevent_req_is_in_progress(req)) {
3115                 return tevent_req_post(req, ev);
3116         }
3117         status = smb2cli_req_compound_submit(&req, 1);
3118         if (tevent_req_nterror(req, status)) {
3119                 return tevent_req_post(req, ev);
3120         }
3121         return req;
3122 }
3123
3124 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3125 {
3126         struct tevent_req *req =
3127                 tevent_req_callback_data(subreq,
3128                 struct tevent_req);
3129         struct smbXcli_req_state *state =
3130                 tevent_req_data(req,
3131                 struct smbXcli_req_state);
3132         ssize_t nwritten;
3133         int err;
3134
3135         nwritten = writev_recv(subreq, &err);
3136         TALLOC_FREE(subreq);
3137         if (nwritten == -1) {
3138                 /* here, we need to notify all pending requests */
3139                 NTSTATUS status = map_nt_error_from_unix_common(err);
3140                 smbXcli_conn_disconnect(state->conn, status);
3141                 return;
3142         }
3143 }
3144
3145 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3146                                              uint8_t *buf,
3147                                              size_t buflen,
3148                                              TALLOC_CTX *mem_ctx,
3149                                              struct iovec **piov, int *pnum_iov)
3150 {
3151         struct iovec *iov;
3152         int num_iov = 0;
3153         size_t taken = 0;
3154         uint8_t *first_hdr = buf;
3155         size_t verified_buflen = 0;
3156         uint8_t *tf = NULL;
3157         size_t tf_len = 0;
3158
3159         iov = talloc_array(mem_ctx, struct iovec, num_iov);
3160         if (iov == NULL) {
3161                 return NT_STATUS_NO_MEMORY;
3162         }
3163
3164         while (taken < buflen) {
3165                 size_t len = buflen - taken;
3166                 uint8_t *hdr = first_hdr + taken;
3167                 struct iovec *cur;
3168                 size_t full_size;
3169                 size_t next_command_ofs;
3170                 uint16_t body_size;
3171                 struct iovec *iov_tmp;
3172
3173                 if (verified_buflen > taken) {
3174                         len = verified_buflen - taken;
3175                 } else {
3176                         tf = NULL;
3177                         tf_len = 0;
3178                 }
3179
3180                 if (len < 4) {
3181                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3182                                    (int)len, 4));
3183                         goto inval;
3184                 }
3185                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3186                         struct smbXcli_session *s;
3187                         uint64_t uid;
3188                         struct iovec tf_iov[2];
3189                         size_t enc_len;
3190                         NTSTATUS status;
3191
3192                         if (len < SMB2_TF_HDR_SIZE) {
3193                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3194                                            (int)len, SMB2_TF_HDR_SIZE));
3195                                 goto inval;
3196                         }
3197                         tf = hdr;
3198                         tf_len = SMB2_TF_HDR_SIZE;
3199                         taken += tf_len;
3200
3201                         hdr = first_hdr + taken;
3202                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3203                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
3204
3205                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
3206                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3207                                            (int)len,
3208                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
3209                                 goto inval;
3210                         }
3211
3212                         s = conn->sessions;
3213                         for (; s; s = s->next) {
3214                                 if (s->smb2->session_id != uid) {
3215                                         continue;
3216                                 }
3217                                 break;
3218                         }
3219
3220                         if (s == NULL) {
3221                                 DEBUG(10, ("unknown session_id %llu\n",
3222                                            (unsigned long long)uid));
3223                                 goto inval;
3224                         }
3225
3226                         tf_iov[0].iov_base = (void *)tf;
3227                         tf_iov[0].iov_len = tf_len;
3228                         tf_iov[1].iov_base = (void *)hdr;
3229                         tf_iov[1].iov_len = enc_len;
3230
3231                         status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3232                                                           conn->protocol,
3233                                                           tf_iov, 2);
3234                         if (!NT_STATUS_IS_OK(status)) {
3235                                 TALLOC_FREE(iov);
3236                                 return status;
3237                         }
3238
3239                         verified_buflen = taken + enc_len;
3240                         len = enc_len;
3241                 }
3242
3243                 /*
3244                  * We need the header plus the body length field
3245                  */
3246
3247                 if (len < SMB2_HDR_BODY + 2) {
3248                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3249                                    (int)len, SMB2_HDR_BODY));
3250                         goto inval;
3251                 }
3252                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3253                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3254                                    IVAL(hdr, 0)));
3255                         goto inval;
3256                 }
3257                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3258                         DEBUG(10, ("Got HDR len %d, expected %d\n",
3259                                    SVAL(hdr, 4), SMB2_HDR_BODY));
3260                         goto inval;
3261                 }
3262
3263                 full_size = len;
3264                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3265                 body_size = SVAL(hdr, SMB2_HDR_BODY);
3266
3267                 if (next_command_ofs != 0) {
3268                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3269                                 goto inval;
3270                         }
3271                         if (next_command_ofs > full_size) {
3272                                 goto inval;
3273                         }
3274                         full_size = next_command_ofs;
3275                 }
3276                 if (body_size < 2) {
3277                         goto inval;
3278                 }
3279                 body_size &= 0xfffe;
3280
3281                 if (body_size > (full_size - SMB2_HDR_BODY)) {
3282                         goto inval;
3283                 }
3284
3285                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3286                                          num_iov + 4);
3287                 if (iov_tmp == NULL) {
3288                         TALLOC_FREE(iov);
3289                         return NT_STATUS_NO_MEMORY;
3290                 }
3291                 iov = iov_tmp;
3292                 cur = &iov[num_iov];
3293                 num_iov += 4;
3294
3295                 cur[0].iov_base = tf;
3296                 cur[0].iov_len  = tf_len;
3297                 cur[1].iov_base = hdr;
3298                 cur[1].iov_len  = SMB2_HDR_BODY;
3299                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3300                 cur[2].iov_len  = body_size;
3301                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3302                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
3303
3304                 taken += full_size;
3305         }
3306
3307         *piov = iov;
3308         *pnum_iov = num_iov;
3309         return NT_STATUS_OK;
3310
3311 inval:
3312         TALLOC_FREE(iov);
3313         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3314 }
3315
3316 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3317                                                     uint64_t mid)
3318 {
3319         size_t num_pending = talloc_array_length(conn->pending);
3320         size_t i;
3321
3322         for (i=0; i<num_pending; i++) {
3323                 struct tevent_req *req = conn->pending[i];
3324                 struct smbXcli_req_state *state =
3325                         tevent_req_data(req,
3326                         struct smbXcli_req_state);
3327
3328                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3329                         return req;
3330                 }
3331         }
3332         return NULL;
3333 }
3334
3335 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3336                                                TALLOC_CTX *tmp_mem,
3337                                                uint8_t *inbuf)
3338 {
3339         struct tevent_req *req;
3340         struct smbXcli_req_state *state = NULL;
3341         struct iovec *iov;
3342         int i, num_iov;
3343         NTSTATUS status;
3344         bool defer = true;
3345         struct smbXcli_session *last_session = NULL;
3346         size_t inbuf_len = smb_len_tcp(inbuf);
3347
3348         status = smb2cli_inbuf_parse_compound(conn,
3349                                               inbuf + NBT_HDR_SIZE,
3350                                               inbuf_len,
3351                                               tmp_mem,
3352                                               &iov, &num_iov);
3353         if (!NT_STATUS_IS_OK(status)) {
3354                 return status;
3355         }
3356
3357         for (i=0; i<num_iov; i+=4) {
3358                 uint8_t *inbuf_ref = NULL;
3359                 struct iovec *cur = &iov[i];
3360                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3361                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3362                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3363                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3364                 uint16_t req_opcode;
3365                 uint32_t req_flags;
3366                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3367                 uint32_t new_credits;
3368                 struct smbXcli_session *session = NULL;
3369                 const DATA_BLOB *signing_key = NULL;
3370                 bool was_encrypted = false;
3371
3372                 new_credits = conn->smb2.cur_credits;
3373                 new_credits += credits;
3374                 if (new_credits > UINT16_MAX) {
3375                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3376                 }
3377                 conn->smb2.cur_credits += credits;
3378
3379                 req = smb2cli_conn_find_pending(conn, mid);
3380                 if (req == NULL) {
3381                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3382                 }
3383                 state = tevent_req_data(req, struct smbXcli_req_state);
3384
3385                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3386                 if (opcode != req_opcode) {
3387                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3388                 }
3389                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3390
3391                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3392                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3393                 }
3394
3395                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3396                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3397                     NT_STATUS_EQUAL(status, STATUS_PENDING)) {
3398                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3399
3400                         if (state->smb2.got_async) {
3401                                 /* We only expect one STATUS_PENDING response */
3402                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3403                         }
3404                         state->smb2.got_async = true;
3405
3406                         /*
3407                          * async interim responses are not signed,
3408                          * even if the SMB2_HDR_FLAG_SIGNED flag
3409                          * is set.
3410                          */
3411                         req_flags |= SMB2_HDR_FLAG_ASYNC;
3412                         SBVAL(state->smb2.hdr, SMB2_HDR_FLAGS, req_flags);
3413                         SBVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID, async_id);
3414
3415                         if (state->smb2.notify_async) {
3416                                 tevent_req_defer_callback(req, state->ev);
3417                                 tevent_req_notify_callback(req);
3418                         }
3419                         continue;
3420                 }
3421
3422                 session = state->session;
3423                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3424                         session = last_session;
3425                 }
3426                 last_session = session;
3427
3428                 if (state->smb2.should_sign) {
3429                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3430                                 return NT_STATUS_ACCESS_DENIED;
3431                         }
3432                 }
3433
3434                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3435                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3436
3437                         if (session == NULL) {
3438                                 struct smbXcli_session *s;
3439
3440                                 s = state->conn->sessions;
3441                                 for (; s; s = s->next) {
3442                                         if (s->smb2->session_id != uid) {
3443                                                 continue;
3444                                         }
3445
3446                                         session = s;
3447                                         break;
3448                                 }
3449                         }
3450
3451                         if (session == NULL) {
3452                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3453                         }
3454
3455                         last_session = session;
3456                         signing_key = &session->smb2_channel.signing_key;
3457                 }
3458
3459                 if (opcode == SMB2_OP_SESSSETUP) {
3460                         /*
3461                          * We prefer the channel signing key, if it is
3462                          * already there.
3463                          *
3464                          * If we do not have a channel signing key yet,
3465                          * we try the main signing key, if it is not
3466                          * the final response.
3467                          */
3468                         if (signing_key && signing_key->length == 0 &&
3469                             !NT_STATUS_IS_OK(status)) {
3470                                 signing_key = &session->smb2->signing_key;
3471                         }
3472
3473                         if (signing_key && signing_key->length == 0) {
3474                                 /*
3475                                  * If we do not have a session key to
3476                                  * verify the signature, we defer the
3477                                  * signing check to the caller.
3478                                  *
3479                                  * The caller gets NT_STATUS_OK, it
3480                                  * has to call
3481                                  * smb2cli_session_set_session_key()
3482                                  * or
3483                                  * smb2cli_session_set_channel_key()
3484                                  * which will check the signature
3485                                  * with the channel signing key.
3486                                  */
3487                                 signing_key = NULL;
3488                         }
3489                 }
3490
3491                 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3492                         const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3493                         uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3494
3495                         /*
3496                          * If the response was encrypted in a SMB2_TRANSFORM
3497                          * pdu, which belongs to the correct session,
3498                          * we do not need to do signing checks
3499                          *
3500                          * It could be the session the response belongs to
3501                          * or the session that was used to encrypt the
3502                          * SMB2_TRANSFORM request.
3503                          */
3504                         if ((session && session->smb2->session_id == uid) ||
3505                             (state->smb2.encryption_session_id == uid)) {
3506                                 signing_key = NULL;
3507                                 was_encrypted = true;
3508                         }
3509                 }
3510
3511                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3512                         /*
3513                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3514                          * the response is not signed and we should
3515                          * propagate the NT_STATUS_USER_SESSION_DELETED
3516                          * status to the caller.
3517                          */
3518                         state->smb2.signing_skipped = true;
3519                         signing_key = NULL;
3520                 }
3521
3522                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3523                         /*
3524                          * if the server returns
3525                          * NT_STATUS_INVALID_PARAMETER
3526                          * the response might not be encrypted.
3527                          */
3528                         if (state->smb2.should_encrypt && !was_encrypted) {
3529                                 state->smb2.signing_skipped = true;
3530                                 signing_key = NULL;
3531                         }
3532                 }
3533
3534                 if (state->smb2.should_encrypt && !was_encrypted) {
3535                         if (!state->smb2.signing_skipped) {
3536                                 return NT_STATUS_ACCESS_DENIED;
3537                         }
3538                 }
3539
3540                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3541                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3542                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3543                         /*
3544                          * if the server returns
3545                          * NT_STATUS_NETWORK_NAME_DELETED
3546                          * NT_STATUS_FILE_CLOSED
3547                          * NT_STATUS_INVALID_PARAMETER
3548                          * the response might not be signed
3549                          * as this happens before the signing checks.
3550                          *
3551                          * If server echos the signature (or all zeros)
3552                          * we should report the status from the server
3553                          * to the caller.
3554                          */
3555                         if (signing_key) {
3556                                 int cmp;
3557
3558                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3559                                              state->smb2.hdr+SMB2_HDR_SIGNATURE,
3560                                              16);
3561                                 if (cmp == 0) {
3562                                         state->smb2.signing_skipped = true;
3563                                         signing_key = NULL;
3564                                 }
3565                         }
3566                         if (signing_key) {
3567                                 int cmp;
3568                                 static const uint8_t zeros[16];
3569
3570                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3571                                              zeros,
3572                                              16);
3573                                 if (cmp == 0) {
3574                                         state->smb2.signing_skipped = true;
3575                                         signing_key = NULL;
3576                                 }
3577                         }
3578                 }
3579
3580                 if (signing_key) {
3581                         status = smb2_signing_check_pdu(*signing_key,
3582                                                         state->conn->protocol,
3583                                                         &cur[1], 3);
3584                         if (!NT_STATUS_IS_OK(status)) {
3585                                 /*
3586                                  * If the signing check fails, we disconnect
3587                                  * the connection.
3588                                  */
3589                                 return status;
3590                         }
3591                 }
3592
3593                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
3594                     (session != NULL) && session->disconnect_expired)
3595                 {
3596                         /*
3597                          * this should be a short term hack
3598                          * until the upper layers have implemented
3599                          * re-authentication.
3600                          */
3601                         return status;
3602                 }
3603
3604                 smbXcli_req_unset_pending(req);
3605
3606                 /*
3607                  * There might be more than one response
3608                  * we need to defer the notifications
3609                  */
3610                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
3611                         defer = false;
3612                 }
3613
3614                 if (defer) {
3615                         tevent_req_defer_callback(req, state->ev);
3616                 }
3617
3618                 /*
3619                  * Note: here we use talloc_reference() in a way
3620                  *       that does not expose it to the caller.
3621                  */
3622                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
3623                 if (tevent_req_nomem(inbuf_ref, req)) {
3624                         continue;
3625                 }
3626
3627                 /* copy the related buffers */
3628                 state->smb2.recv_iov[0] = cur[1];
3629                 state->smb2.recv_iov[1] = cur[2];
3630                 state->smb2.recv_iov[2] = cur[3];
3631
3632                 tevent_req_done(req);
3633         }
3634
3635         if (defer) {
3636                 return NT_STATUS_RETRY;
3637         }
3638
3639         return NT_STATUS_OK;
3640 }
3641
3642 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3643                           struct iovec **piov,
3644                           const struct smb2cli_req_expected_response *expected,
3645                           size_t num_expected)
3646 {
3647         struct smbXcli_req_state *state =
3648                 tevent_req_data(req,
3649                 struct smbXcli_req_state);
3650         NTSTATUS status;
3651         size_t body_size;
3652         bool found_status = false;
3653         bool found_size = false;
3654         size_t i;
3655
3656         if (piov != NULL) {
3657                 *piov = NULL;
3658         }
3659
3660         if (tevent_req_is_in_progress(req) && state->smb2.got_async) {
3661                 return STATUS_PENDING;
3662         }
3663
3664         if (tevent_req_is_nterror(req, &status)) {
3665                 for (i=0; i < num_expected; i++) {
3666                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
3667                                 found_status = true;
3668                                 break;
3669                         }
3670                 }
3671
3672                 if (found_status) {
3673                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
3674                 }
3675
3676                 return status;
3677         }
3678
3679         if (num_expected == 0) {
3680                 found_status = true;
3681                 found_size = true;
3682         }
3683
3684         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
3685         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
3686
3687         for (i=0; i < num_expected; i++) {
3688                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
3689                         continue;
3690                 }
3691
3692                 found_status = true;
3693                 if (expected[i].body_size == 0) {
3694                         found_size = true;
3695                         break;
3696                 }
3697
3698                 if (expected[i].body_size == body_size) {
3699                         found_size = true;
3700                         break;
3701                 }
3702         }
3703
3704         if (!found_status) {
3705                 return status;
3706         }
3707
3708         if (state->smb2.signing_skipped) {
3709                 if (num_expected > 0) {
3710                         return NT_STATUS_ACCESS_DENIED;
3711                 }
3712                 if (!NT_STATUS_IS_ERR(status)) {
3713                         return NT_STATUS_ACCESS_DENIED;
3714                 }
3715         }
3716
3717         if (!found_size) {
3718                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3719         }
3720
3721         if (piov != NULL) {
3722                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
3723         }
3724
3725         return status;
3726 }
3727
3728 NTSTATUS smb2cli_req_get_sent_iov(struct tevent_req *req,
3729                                   struct iovec *sent_iov)
3730 {
3731         struct smbXcli_req_state *state =
3732                 tevent_req_data(req,
3733                 struct smbXcli_req_state);
3734
3735         if (tevent_req_is_in_progress(req)) {
3736                 return STATUS_PENDING;
3737         }
3738
3739         sent_iov[0].iov_base = state->smb2.hdr;
3740         sent_iov[0].iov_len  = sizeof(state->smb2.hdr);
3741
3742         sent_iov[1].iov_base = discard_const(state->smb2.fixed);
3743         sent_iov[1].iov_len  = state->smb2.fixed_len;
3744
3745         if (state->smb2.dyn != NULL) {
3746                 sent_iov[2].iov_base = discard_const(state->smb2.dyn);
3747                 sent_iov[2].iov_len  = state->smb2.dyn_len;
3748         } else {
3749                 sent_iov[2].iov_base = NULL;
3750                 sent_iov[2].iov_len  = 0;
3751         }
3752
3753         return NT_STATUS_OK;
3754 }
3755
3756 static const struct {
3757         enum protocol_types proto;
3758         const char *smb1_name;
3759 } smb1cli_prots[] = {
3760         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
3761         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
3762         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
3763         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
3764         {PROTOCOL_LANMAN2,      "LM1.2X002"},
3765         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
3766         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
3767         {PROTOCOL_LANMAN2,      "Samba"},
3768         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
3769         {PROTOCOL_NT1,          "NT LM 0.12"},
3770         {PROTOCOL_SMB2_02,      "SMB 2.002"},
3771         {PROTOCOL_SMB2_10,      "SMB 2.???"},
3772 };
3773
3774 static const struct {
3775         enum protocol_types proto;
3776         uint16_t smb2_dialect;
3777 } smb2cli_prots[] = {
3778         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
3779         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
3780         {PROTOCOL_SMB2_22,      SMB2_DIALECT_REVISION_222},
3781         {PROTOCOL_SMB2_24,      SMB2_DIALECT_REVISION_224},
3782         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
3783         {PROTOCOL_SMB3_02,      SMB3_DIALECT_REVISION_302},
3784         {PROTOCOL_SMB3_10,      SMB3_DIALECT_REVISION_310},
3785 };
3786
3787 struct smbXcli_negprot_state {
3788         struct smbXcli_conn *conn;
3789         struct tevent_context *ev;
3790         uint32_t timeout_msec;
3791
3792         struct {
3793                 uint8_t fixed[36];
3794         } smb2;
3795 };
3796
3797 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
3798 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
3799 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
3800 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
3801 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
3802 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
3803                                                   TALLOC_CTX *frame,
3804                                                   uint8_t *inbuf);
3805
3806 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
3807                                         struct tevent_context *ev,
3808                                         struct smbXcli_conn *conn,
3809                                         uint32_t timeout_msec,
3810                                         enum protocol_types min_protocol,
3811                                         enum protocol_types max_protocol)
3812 {
3813         struct tevent_req *req, *subreq;
3814         struct smbXcli_negprot_state *state;
3815
3816         req = tevent_req_create(mem_ctx, &state,
3817                                 struct smbXcli_negprot_state);
3818         if (req == NULL) {
3819                 return NULL;
3820         }
3821         state->conn = conn;
3822         state->ev = ev;
3823         state->timeout_msec = timeout_msec;
3824
3825         if (min_protocol == PROTOCOL_NONE) {
3826                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3827                 return tevent_req_post(req, ev);
3828         }
3829
3830         if (max_protocol == PROTOCOL_NONE) {
3831                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3832                 return tevent_req_post(req, ev);
3833         }
3834
3835         if (min_protocol > max_protocol) {
3836                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
3837                 return tevent_req_post(req, ev);
3838         }
3839
3840         conn->min_protocol = min_protocol;
3841         conn->max_protocol = max_protocol;
3842         conn->protocol = PROTOCOL_NONE;
3843
3844         if ((min_protocol < PROTOCOL_SMB2_02) &&
3845             (max_protocol < PROTOCOL_SMB2_02)) {
3846                 /*
3847                  * SMB1 only...
3848                  */
3849                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
3850
3851                 subreq = smbXcli_negprot_smb1_subreq(state);
3852                 if (tevent_req_nomem(subreq, req)) {
3853                         return tevent_req_post(req, ev);
3854                 }
3855                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
3856                 return req;
3857         }
3858
3859         if ((min_protocol >= PROTOCOL_SMB2_02) &&
3860             (max_protocol >= PROTOCOL_SMB2_02)) {
3861                 /*
3862                  * SMB2 only...
3863                  */
3864                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3865
3866                 subreq = smbXcli_negprot_smb2_subreq(state);
3867                 if (tevent_req_nomem(subreq, req)) {
3868                         return tevent_req_post(req, ev);
3869                 }
3870                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
3871                 return req;
3872         }
3873
3874         /*
3875          * We send an SMB1 negprot with the SMB2 dialects
3876          * and expect a SMB1 or a SMB2 response.
3877          *
3878          * smbXcli_negprot_dispatch_incoming() will fix the
3879          * callback to match protocol of the response.
3880          */
3881         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
3882
3883         subreq = smbXcli_negprot_smb1_subreq(state);
3884         if (tevent_req_nomem(subreq, req)) {
3885                 return tevent_req_post(req, ev);
3886         }
3887         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
3888         return req;
3889 }
3890
3891 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
3892 {
3893         struct tevent_req *req =
3894                 tevent_req_callback_data(subreq,
3895                 struct tevent_req);
3896         NTSTATUS status;
3897
3898         /*
3899          * we just want the low level error
3900          */
3901         status = tevent_req_simple_recv_ntstatus(subreq);
3902         TALLOC_FREE(subreq);
3903         if (tevent_req_nterror(req, status)) {
3904                 return;
3905         }
3906
3907         /* this should never happen */
3908         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
3909 }
3910
3911 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
3912 {
3913         size_t i;
3914         DATA_BLOB bytes = data_blob_null;
3915         uint8_t flags;
3916         uint16_t flags2;
3917
3918         /* setup the protocol strings */
3919         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
3920                 uint8_t c = 2;
3921                 bool ok;
3922
3923                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
3924                         continue;
3925                 }
3926
3927                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
3928                         continue;
3929                 }
3930
3931                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
3932                 if (!ok) {
3933                         return NULL;
3934                 }
3935
3936                 /*
3937                  * We now it is already ascii and
3938                  * we want NULL termination.
3939                  */
3940                 ok = data_blob_append(state, &bytes,
3941                                       smb1cli_prots[i].smb1_name,
3942                                       strlen(smb1cli_prots[i].smb1_name)+1);
3943                 if (!ok) {
3944                         return NULL;
3945                 }
3946         }
3947
3948         smb1cli_req_flags(state->conn->max_protocol,
3949                           state->conn->smb1.client.capabilities,
3950                           SMBnegprot,
3951                           0, 0, &flags,
3952                           0, 0, &flags2);
3953
3954         return smb1cli_req_send(state, state->ev, state->conn,
3955                                 SMBnegprot,
3956                                 flags, ~flags,
3957                                 flags2, ~flags2,
3958                                 state->timeout_msec,
3959                                 0xFFFE, 0, NULL, /* pid, tid, session */
3960                                 0, NULL, /* wct, vwv */
3961                                 bytes.length, bytes.data);
3962 }
3963
3964 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
3965 {
3966         struct tevent_req *req =
3967                 tevent_req_callback_data(subreq,
3968                 struct tevent_req);
3969         struct smbXcli_negprot_state *state =
3970                 tevent_req_data(req,
3971                 struct smbXcli_negprot_state);
3972         struct smbXcli_conn *conn = state->conn;
3973         struct iovec *recv_iov = NULL;
3974         uint8_t *inhdr;
3975         uint8_t wct;
3976         uint16_t *vwv;
3977         uint32_t num_bytes;
3978         uint8_t *bytes;
3979         NTSTATUS status;
3980         uint16_t protnum;
3981         size_t i;
3982         size_t num_prots = 0;
3983         uint8_t flags;
3984         uint32_t client_capabilities = conn->smb1.client.capabilities;
3985         uint32_t both_capabilities;
3986         uint32_t server_capabilities = 0;
3987         uint32_t capabilities;
3988         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
3989         uint32_t server_max_xmit = 0;
3990         uint32_t max_xmit;
3991         uint32_t server_max_mux = 0;
3992         uint16_t server_security_mode = 0;
3993         uint32_t server_session_key = 0;
3994         bool server_readbraw = false;
3995         bool server_writebraw = false;
3996         bool server_lockread = false;
3997         bool server_writeunlock = false;
3998         struct GUID server_guid = GUID_zero();
3999         DATA_BLOB server_gss_blob = data_blob_null;
4000         uint8_t server_challenge[8];
4001         char *server_workgroup = NULL;
4002         char *server_name = NULL;
4003         int server_time_zone = 0;
4004         NTTIME server_system_time = 0;
4005         static const struct smb1cli_req_expected_response expected[] = {
4006         {
4007                 .status = NT_STATUS_OK,
4008                 .wct = 0x11, /* NT1 */
4009         },
4010         {
4011                 .status = NT_STATUS_OK,
4012                 .wct = 0x0D, /* LM */
4013         },
4014         {
4015                 .status = NT_STATUS_OK,
4016                 .wct = 0x01, /* CORE */
4017         }
4018         };
4019
4020         ZERO_STRUCT(server_challenge);
4021
4022         status = smb1cli_req_recv(subreq, state,
4023                                   &recv_iov,
4024                                   &inhdr,
4025                                   &wct,
4026                                   &vwv,
4027                                   NULL, /* pvwv_offset */
4028                                   &num_bytes,
4029                                   &bytes,
4030                                   NULL, /* pbytes_offset */
4031                                   NULL, /* pinbuf */
4032                                   expected, ARRAY_SIZE(expected));
4033         TALLOC_FREE(subreq);
4034         if (tevent_req_nterror(req, status)) {
4035                 return;
4036         }
4037
4038         flags = CVAL(inhdr, HDR_FLG);
4039
4040         protnum = SVAL(vwv, 0);
4041
4042         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4043                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4044                         continue;
4045                 }
4046
4047                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4048                         continue;
4049                 }
4050
4051                 if (protnum != num_prots) {
4052                         num_prots++;
4053                         continue;
4054                 }
4055
4056                 conn->protocol = smb1cli_prots[i].proto;
4057                 break;
4058         }
4059
4060         if (conn->protocol == PROTOCOL_NONE) {
4061                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4062                 return;
4063         }
4064
4065         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
4066                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
4067                          "and the selected protocol level doesn't support it.\n"));
4068                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4069                 return;
4070         }
4071
4072         if (flags & FLAG_SUPPORT_LOCKREAD) {
4073                 server_lockread = true;
4074                 server_writeunlock = true;
4075         }
4076
4077         if (conn->protocol >= PROTOCOL_NT1) {
4078                 const char *client_signing = NULL;
4079                 bool server_mandatory = false;
4080                 bool server_allowed = false;
4081                 const char *server_signing = NULL;
4082                 bool ok;
4083                 uint8_t key_len;
4084
4085                 if (wct != 0x11) {
4086                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4087                         return;
4088                 }
4089
4090                 /* NT protocol */
4091                 server_security_mode = CVAL(vwv + 1, 0);
4092                 server_max_mux = SVAL(vwv + 1, 1);
4093                 server_max_xmit = IVAL(vwv + 3, 1);
4094                 server_session_key = IVAL(vwv + 7, 1);
4095                 server_time_zone = SVALS(vwv + 15, 1);
4096                 server_time_zone *= 60;
4097                 /* this time arrives in real GMT */
4098                 server_system_time = BVAL(vwv + 11, 1);
4099                 server_capabilities = IVAL(vwv + 9, 1);
4100
4101                 key_len = CVAL(vwv + 16, 1);
4102
4103                 if (server_capabilities & CAP_RAW_MODE) {
4104                         server_readbraw = true;
4105                         server_writebraw = true;
4106                 }
4107                 if (server_capabilities & CAP_LOCK_AND_READ) {
4108                         server_lockread = true;
4109                 }
4110
4111                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4112                         DATA_BLOB blob1, blob2;
4113
4114                         if (num_bytes < 16) {
4115                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4116                                 return;
4117                         }
4118
4119                         blob1 = data_blob_const(bytes, 16);
4120                         status = GUID_from_data_blob(&blob1, &server_guid);
4121                         if (tevent_req_nterror(req, status)) {
4122                                 return;
4123                         }
4124
4125                         blob1 = data_blob_const(bytes+16, num_bytes-16);
4126                         blob2 = data_blob_dup_talloc(state, blob1);
4127                         if (blob1.length > 0 &&
4128                             tevent_req_nomem(blob2.data, req)) {
4129                                 return;
4130                         }
4131                         server_gss_blob = blob2;
4132                 } else {
4133                         DATA_BLOB blob1, blob2;
4134
4135                         if (num_bytes < key_len) {
4136                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4137                                 return;
4138                         }
4139
4140                         if (key_len != 0 && key_len != 8) {
4141                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4142                                 return;
4143                         }
4144
4145                         if (key_len == 8) {
4146                                 memcpy(server_challenge, bytes, 8);
4147                         }
4148
4149                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4150                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4151                         if (blob1.length > 0) {
4152                                 size_t len;
4153
4154                                 len = utf16_len_n(blob1.data,
4155                                                   blob1.length);
4156                                 blob1.length = len;
4157
4158                                 ok = convert_string_talloc(state,
4159                                                            CH_UTF16LE,
4160                                                            CH_UNIX,
4161                                                            blob1.data,
4162                                                            blob1.length,
4163                                                            &server_workgroup,
4164                                                            &len);
4165                                 if (!ok) {
4166                                         status = map_nt_error_from_unix_common(errno);
4167                                         tevent_req_nterror(req, status);
4168                                         return;
4169                                 }
4170                         }
4171
4172                         blob2.data += blob1.length;
4173                         blob2.length -= blob1.length;
4174                         if (blob2.length > 0) {
4175                                 size_t len;
4176
4177                                 len = utf16_len_n(blob1.data,
4178                                                   blob1.length);
4179                                 blob1.length = len;
4180
4181                                 ok = convert_string_talloc(state,
4182                                                            CH_UTF16LE,
4183                                                            CH_UNIX,
4184                                                            blob2.data,
4185                                                            blob2.length,
4186                                                            &server_name,
4187                                                            &len);
4188                                 if (!ok) {
4189                                         status = map_nt_error_from_unix_common(errno);
4190                                         tevent_req_nterror(req, status);
4191                                         return;
4192                                 }
4193                         }
4194                 }
4195
4196                 client_signing = "disabled";
4197                 if (conn->allow_signing) {
4198                         client_signing = "allowed";
4199                 }
4200                 if (conn->mandatory_signing) {
4201                         client_signing = "required";
4202                 }
4203
4204                 server_signing = "not supported";
4205                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4206                         server_signing = "supported";
4207                         server_allowed = true;
4208                 } else if (conn->mandatory_signing) {
4209                         /*
4210                          * We have mandatory signing as client
4211                          * lets assume the server will look at our
4212                          * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4213                          * flag in the session setup
4214                          */
4215                         server_signing = "not announced";
4216                         server_allowed = true;
4217                 }
4218                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4219                         server_signing = "required";
4220                         server_mandatory = true;
4221                 }
4222
4223                 ok = smb_signing_set_negotiated(conn->smb1.signing,
4224                                                 server_allowed,
4225                                                 server_mandatory);
4226                 if (!ok) {
4227                         DEBUG(1,("cli_negprot: SMB signing is required, "
4228                                  "but client[%s] and server[%s] mismatch\n",
4229                                  client_signing, server_signing));
4230                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4231                         return;
4232                 }
4233
4234         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4235                 DATA_BLOB blob1;
4236                 uint8_t key_len;
4237                 time_t t;
4238
4239                 if (wct != 0x0D) {
4240                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4241                         return;
4242                 }
4243
4244                 server_security_mode = SVAL(vwv + 1, 0);
4245                 server_max_xmit = SVAL(vwv + 2, 0);
4246                 server_max_mux = SVAL(vwv + 3, 0);
4247                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4248                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4249                 server_session_key = IVAL(vwv + 6, 0);
4250                 server_time_zone = SVALS(vwv + 10, 0);
4251                 server_time_zone *= 60;
4252                 /* this time is converted to GMT by make_unix_date */
4253                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4254                 unix_to_nt_time(&server_system_time, t);
4255                 key_len = SVAL(vwv + 11, 0);
4256
4257                 if (num_bytes < key_len) {
4258                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4259                         return;
4260                 }
4261
4262                 if (key_len != 0 && key_len != 8) {
4263                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4264                         return;
4265                 }
4266
4267                 if (key_len == 8) {
4268                         memcpy(server_challenge, bytes, 8);
4269                 }
4270
4271                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4272                 if (blob1.length > 0) {
4273                         size_t len;
4274                         bool ok;
4275
4276                         len = utf16_len_n(blob1.data,
4277                                           blob1.length);
4278                         blob1.length = len;
4279
4280                         ok = convert_string_talloc(state,
4281                                                    CH_DOS,
4282                                                    CH_UNIX,
4283                                                    blob1.data,
4284                                                    blob1.length,
4285                                                    &server_workgroup,
4286                                                    &len);
4287                         if (!ok) {
4288                                 status = map_nt_error_from_unix_common(errno);
4289                                 tevent_req_nterror(req, status);
4290                                 return;
4291                         }
4292                 }
4293
4294         } else {
4295                 /* the old core protocol */
4296                 server_time_zone = get_time_zone(time(NULL));
4297                 server_max_xmit = 1024;
4298                 server_max_mux = 1;
4299         }
4300
4301         if (server_max_xmit < 1024) {
4302                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4303                 return;
4304         }
4305
4306         if (server_max_mux < 1) {
4307                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4308                 return;
4309         }
4310
4311         /*
4312          * Now calculate the negotiated capabilities
4313          * based on the mask for:
4314          * - client only flags
4315          * - flags used in both directions
4316          * - server only flags
4317          */
4318         both_capabilities = client_capabilities & server_capabilities;
4319         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4320         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4321         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4322
4323         max_xmit = MIN(client_max_xmit, server_max_xmit);
4324
4325         conn->smb1.server.capabilities = server_capabilities;
4326         conn->smb1.capabilities = capabilities;
4327
4328         conn->smb1.server.max_xmit = server_max_xmit;
4329         conn->smb1.max_xmit = max_xmit;
4330
4331         conn->smb1.server.max_mux = server_max_mux;
4332
4333         conn->smb1.server.security_mode = server_security_mode;
4334
4335         conn->smb1.server.readbraw = server_readbraw;
4336         conn->smb1.server.writebraw = server_writebraw;
4337         conn->smb1.server.lockread = server_lockread;
4338         conn->smb1.server.writeunlock = server_writeunlock;
4339
4340         conn->smb1.server.session_key = server_session_key;
4341
4342         talloc_steal(conn, server_gss_blob.data);
4343         conn->smb1.server.gss_blob = server_gss_blob;
4344         conn->smb1.server.guid = server_guid;
4345         memcpy(conn->smb1.server.challenge, server_challenge, 8);
4346         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4347         conn->smb1.server.name = talloc_move(conn, &server_name);
4348
4349         conn->smb1.server.time_zone = server_time_zone;
4350         conn->smb1.server.system_time = server_system_time;
4351
4352         tevent_req_done(req);
4353 }
4354
4355 static size_t smbXcli_padding_helper(uint32_t offset, size_t n)
4356 {
4357         if ((offset & (n-1)) == 0) return 0;
4358         return n - (offset & (n-1));
4359 }
4360
4361 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4362 {
4363         size_t i;
4364         uint8_t *buf;
4365         uint16_t dialect_count = 0;
4366         DATA_BLOB dyn = data_blob_null;
4367
4368         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4369                 bool ok;
4370                 uint8_t val[2];
4371
4372                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4373                         continue;
4374                 }
4375
4376                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4377                         continue;
4378                 }
4379
4380                 SSVAL(val, 0, smb2cli_prots[i].smb2_dialect);
4381
4382                 ok = data_blob_append(state, &dyn, val, sizeof(val));
4383                 if (!ok) {
4384                         return NULL;
4385                 }
4386
4387                 dialect_count++;
4388         }
4389
4390         buf = state->smb2.fixed;
4391         SSVAL(buf, 0, 36);
4392         SSVAL(buf, 2, dialect_count);
4393         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4394         SSVAL(buf, 6, 0);       /* Reserved */
4395         if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
4396                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4397         } else {
4398                 SIVAL(buf, 8, 0);       /* Capabilities */
4399         }
4400         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4401                 NTSTATUS status;
4402                 DATA_BLOB blob;
4403
4404                 status = GUID_to_ndr_blob(&state->conn->smb2.client.guid,
4405                                           state, &blob);
4406                 if (!NT_STATUS_IS_OK(status)) {
4407                         return NULL;
4408                 }
4409                 memcpy(buf+12, blob.data, 16); /* ClientGuid */
4410         } else {
4411                 memset(buf+12, 0, 16);  /* ClientGuid */
4412         }
4413
4414         if (state->conn->max_protocol >= PROTOCOL_SMB3_10) {
4415                 NTSTATUS status;
4416                 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4417                 uint32_t offset;
4418                 DATA_BLOB b;
4419                 uint8_t p[38];
4420                 const uint8_t zeros[8] = {0, };
4421                 size_t pad;
4422                 bool ok;
4423
4424                 SSVAL(p, 0,  1); /* HashAlgorithmCount */
4425                 SSVAL(p, 2, 32); /* SaltLength */
4426                 SSVAL(p, 4, SMB2_PREAUTH_INTEGRITY_SHA512);
4427                 generate_random_buffer(p + 6, 32);
4428
4429                 b = data_blob_const(p, 38);
4430                 status = smb2_negotiate_context_add(state, &c,
4431                                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES, b);
4432                 if (!NT_STATUS_IS_OK(status)) {
4433                         return NULL;
4434                 }
4435
4436                 SSVAL(p, 0, 1); /* ChiperCount */
4437                 SSVAL(p, 2, SMB2_ENCRYPTION_AES128_CCM);
4438
4439                 b = data_blob_const(p, 4);
4440                 status = smb2_negotiate_context_add(state, &c,
4441                                         SMB2_ENCRYPTION_CAPABILITIES, b);
4442                 if (!NT_STATUS_IS_OK(status)) {
4443                         return NULL;
4444                 }
4445
4446                 status = smb2_negotiate_context_push(state, &b, c);
4447                 if (!NT_STATUS_IS_OK(status)) {
4448                         return NULL;
4449                 }
4450
4451                 offset = SMB2_HDR_BODY + sizeof(state->smb2.fixed) + dyn.length;
4452                 pad = smbXcli_padding_helper(offset, 8);
4453
4454                 ok = data_blob_append(state, &dyn, zeros, pad);
4455                 if (!ok) {
4456                         return NULL;
4457                 }
4458                 offset += pad;
4459
4460                 ok = data_blob_append(state, &dyn, b.data, b.length);
4461                 if (!ok) {
4462                         return NULL;
4463                 }
4464
4465                 SIVAL(buf, 28, offset);   /* NegotiateContextOffset */
4466                 SSVAL(buf, 32, c.num_contexts); /* NegotiateContextCount */
4467                 SSVAL(buf, 34, 0);        /* Reserved */
4468         } else {
4469                 SBVAL(buf, 28, 0);      /* Reserved/ClientStartTime */
4470         }
4471
4472         return smb2cli_req_send(state, state->ev,
4473                                 state->conn, SMB2_OP_NEGPROT,
4474                                 0, 0, /* flags */
4475                                 state->timeout_msec,
4476                                 NULL, NULL, /* tcon, session */
4477                                 state->smb2.fixed, sizeof(state->smb2.fixed),
4478                                 dyn.data, dyn.length,
4479                                 UINT16_MAX); /* max_dyn_len */
4480 }
4481
4482 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
4483 {
4484         struct tevent_req *req =
4485                 tevent_req_callback_data(subreq,
4486                 struct tevent_req);
4487         struct smbXcli_negprot_state *state =
4488                 tevent_req_data(req,
4489                 struct smbXcli_negprot_state);
4490         struct smbXcli_conn *conn = state->conn;
4491         size_t security_offset, security_length;
4492         DATA_BLOB blob;
4493         NTSTATUS status;
4494         struct iovec *iov;
4495         uint8_t *body;
4496         size_t i;
4497         uint16_t dialect_revision;
4498         struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4499         uint32_t negotiate_context_offset = 0;
4500         uint16_t negotiate_context_count = 0;
4501         DATA_BLOB negotiate_context_blob = data_blob_null;
4502         size_t avail;
4503         size_t ctx_ofs;
4504         size_t needed;
4505         struct smb2_negotiate_context *preauth = NULL;
4506         uint16_t hash_count;
4507         uint16_t salt_length;
4508         uint16_t hash_selected;
4509         struct hc_sha512state sctx;
4510         struct smb2_negotiate_context *cipher = NULL;
4511         struct iovec sent_iov[3];
4512         static const struct smb2cli_req_expected_response expected[] = {
4513         {
4514                 .status = NT_STATUS_OK,
4515                 .body_size = 0x41
4516         }
4517         };
4518
4519         status = smb2cli_req_recv(subreq, state, &iov,
4520                                   expected, ARRAY_SIZE(expected));
4521         if (tevent_req_nterror(req, status)) {
4522                 return;
4523         }
4524
4525         body = (uint8_t *)iov[1].iov_base;
4526
4527         dialect_revision = SVAL(body, 4);
4528
4529         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4530                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4531                         continue;
4532                 }
4533
4534                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4535                         continue;
4536                 }
4537
4538                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
4539                         continue;
4540                 }
4541
4542                 conn->protocol = smb2cli_prots[i].proto;
4543                 break;
4544         }
4545
4546         if (conn->protocol == PROTOCOL_NONE) {
4547                 TALLOC_FREE(subreq);
4548
4549                 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
4550                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4551                         return;
4552                 }
4553
4554                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
4555                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4556                         return;
4557                 }
4558
4559                 /* make sure we do not loop forever */
4560                 state->conn->min_protocol = PROTOCOL_SMB2_02;
4561
4562                 /*
4563                  * send a SMB2 negprot, in order to negotiate
4564                  * the SMB2 dialect.
4565                  */
4566                 subreq = smbXcli_negprot_smb2_subreq(state);
4567                 if (tevent_req_nomem(subreq, req)) {
4568                         return;
4569                 }
4570                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4571                 return;
4572         }
4573
4574         conn->smb2.server.security_mode = SVAL(body, 2);
4575         if (conn->protocol >= PROTOCOL_SMB3_10) {
4576                 negotiate_context_count = SVAL(body, 6);
4577         }
4578
4579         blob = data_blob_const(body + 8, 16);
4580         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
4581         if (tevent_req_nterror(req, status)) {
4582                 return;
4583         }
4584
4585         conn->smb2.server.capabilities  = IVAL(body, 24);
4586         conn->smb2.server.max_trans_size= IVAL(body, 28);
4587         conn->smb2.server.max_read_size = IVAL(body, 32);
4588         conn->smb2.server.max_write_size= IVAL(body, 36);
4589         conn->smb2.server.system_time   = BVAL(body, 40);
4590         conn->smb2.server.start_time    = BVAL(body, 48);
4591
4592         security_offset = SVAL(body, 56);
4593         security_length = SVAL(body, 58);
4594
4595         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
4596                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4597                 return;
4598         }
4599
4600         if (security_length > iov[2].iov_len) {
4601                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4602                 return;
4603         }
4604
4605         conn->smb2.server.gss_blob = data_blob_talloc(conn,
4606                                                 iov[2].iov_base,
4607                                                 security_length);
4608         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
4609                 return;
4610         }
4611
4612         if (conn->protocol < PROTOCOL_SMB3_10) {
4613                 TALLOC_FREE(subreq);
4614
4615                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4616                         conn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
4617                 }
4618                 tevent_req_done(req);
4619                 return;
4620         }
4621
4622         negotiate_context_offset = IVAL(body, 60);
4623         if (negotiate_context_offset < security_offset) {
4624                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4625                 return;
4626         }
4627
4628         ctx_ofs = negotiate_context_offset - security_offset;
4629         if (ctx_ofs > iov[2].iov_len) {
4630                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4631                 return;
4632         }
4633         avail = iov[2].iov_len - security_length;
4634         needed = iov[2].iov_len - ctx_ofs;
4635         if (needed > avail) {
4636                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4637                 return;
4638         }
4639
4640         negotiate_context_blob.data = (uint8_t *)iov[2].iov_base;
4641         negotiate_context_blob.length = iov[2].iov_len;
4642
4643         negotiate_context_blob.data += ctx_ofs;
4644         negotiate_context_blob.length -= ctx_ofs;
4645
4646         status = smb2_negotiate_context_parse(state, negotiate_context_blob, &c);
4647         if (tevent_req_nterror(req, status)) {
4648                 return;
4649         }
4650
4651         if (negotiate_context_count != c.num_contexts) {
4652                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4653                 return;
4654         }
4655
4656         preauth = smb2_negotiate_context_find(&c,
4657                                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
4658         if (preauth == NULL) {
4659                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4660                 return;
4661         }
4662
4663         if (preauth->data.length < 6) {
4664                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4665                 return;
4666         }
4667
4668         hash_count = SVAL(preauth->data.data, 0);
4669         salt_length = SVAL(preauth->data.data, 2);
4670         hash_selected = SVAL(preauth->data.data, 4);
4671
4672         if (hash_count != 1) {
4673                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4674                 return;
4675         }
4676
4677         if (preauth->data.length != (6 + salt_length)) {
4678                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4679                 return;
4680         }
4681
4682         if (hash_selected != SMB2_PREAUTH_INTEGRITY_SHA512) {
4683                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4684                 return;
4685         }
4686
4687         cipher = smb2_negotiate_context_find(&c, SMB2_ENCRYPTION_CAPABILITIES);
4688         if (cipher != NULL) {
4689                 uint16_t cipher_count;
4690
4691                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4692                         tevent_req_nterror(req,
4693                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
4694                         return;
4695                 }
4696
4697                 if (cipher->data.length < 2) {
4698                         tevent_req_nterror(req,
4699                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
4700                         return;
4701                 }
4702
4703                 cipher_count = SVAL(cipher->data.data, 0);
4704
4705                 if (cipher_count > 1) {
4706                         tevent_req_nterror(req,
4707                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
4708                         return;
4709                 }
4710
4711                 if (cipher->data.length != (2 + 2 * cipher_count)) {
4712                         tevent_req_nterror(req,
4713                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
4714                         return;
4715                 }
4716
4717                 if (cipher_count == 1) {
4718                         uint16_t cipher_selected;
4719
4720                         cipher_selected = SVAL(cipher->data.data, 2);
4721
4722                         if (cipher_selected == SMB2_ENCRYPTION_AES128_CCM) {
4723                                 conn->smb2.server.cipher = cipher_selected;
4724                                 conn->smb2.server.capabilities |= SMB2_CAP_ENCRYPTION;
4725                         }
4726                 }
4727         } else {
4728                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4729                         tevent_req_nterror(req,
4730                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
4731                         return;
4732                 }
4733         }
4734
4735         if (conn->smb2.server.cipher == 0) {
4736                 /*
4737                  * We didn't manage to negotiate a common encryption
4738                  * algorithm.
4739                  */
4740                 conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION;
4741         }
4742
4743         /* First we hash the request */
4744         smb2cli_req_get_sent_iov(subreq, sent_iov);
4745         SHA512_Init(&sctx);
4746         SHA512_Update(&sctx, conn->smb2.preauth_sha512,
4747                       sizeof(conn->smb2.preauth_sha512));
4748         for (i = 0; i < 3; i++) {
4749                 SHA512_Update(&sctx, sent_iov[i].iov_base, sent_iov[i].iov_len);
4750         }
4751         SHA512_Final(conn->smb2.preauth_sha512, &sctx);
4752         TALLOC_FREE(subreq);
4753
4754         /* And now we hash the response */
4755         SHA512_Init(&sctx);
4756         SHA512_Update(&sctx, conn->smb2.preauth_sha512,
4757                       sizeof(conn->smb2.preauth_sha512));
4758         for (i = 0; i < 3; i++) {
4759                 SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
4760         }
4761         SHA512_Final(conn->smb2.preauth_sha512, &sctx);
4762
4763         tevent_req_done(req);
4764 }
4765
4766 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4767                                                   TALLOC_CTX *tmp_mem,
4768                                                   uint8_t *inbuf)
4769 {
4770         size_t num_pending = talloc_array_length(conn->pending);
4771         struct tevent_req *subreq;
4772         struct smbXcli_req_state *substate;
4773         struct tevent_req *req;
4774         uint32_t protocol_magic;
4775         size_t inbuf_len = smb_len_nbt(inbuf);
4776
4777         if (num_pending != 1) {
4778                 return NT_STATUS_INTERNAL_ERROR;
4779         }
4780
4781         if (inbuf_len < 4) {
4782                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4783         }
4784
4785         subreq = conn->pending[0];
4786         substate = tevent_req_data(subreq, struct smbXcli_req_state);
4787         req = tevent_req_callback_data(subreq, struct tevent_req);
4788
4789         protocol_magic = IVAL(inbuf, 4);
4790
4791         switch (protocol_magic) {
4792         case SMB_MAGIC:
4793                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4794                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4795                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4796
4797         case SMB2_MAGIC:
4798                 if (substate->smb2.recv_iov == NULL) {
4799                         /*
4800                          * For the SMB1 negprot we have move it.
4801                          */
4802                         substate->smb2.recv_iov = substate->smb1.recv_iov;
4803                         substate->smb1.recv_iov = NULL;
4804                 }
4805
4806                 /*
4807                  * we got an SMB2 answer, which consumed sequence number 0
4808                  * so we need to use 1 as the next one.
4809                  *
4810                  * we also need to set the current credits to 0
4811                  * as we consumed the initial one. The SMB2 answer
4812                  * hopefully grant us a new credit.
4813                  */
4814                 conn->smb2.mid = 1;
4815                 conn->smb2.cur_credits = 0;
4816                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4817                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4818                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
4819         }
4820
4821         DEBUG(10, ("Got non-SMB PDU\n"));
4822         return NT_STATUS_INVALID_NETWORK_RESPONSE;
4823 }
4824
4825 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
4826 {
4827         return tevent_req_simple_recv_ntstatus(req);
4828 }
4829
4830 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
4831                          uint32_t timeout_msec,
4832                          enum protocol_types min_protocol,
4833                          enum protocol_types max_protocol)
4834 {
4835         TALLOC_CTX *frame = talloc_stackframe();
4836         struct tevent_context *ev;
4837         struct tevent_req *req;
4838         NTSTATUS status = NT_STATUS_NO_MEMORY;
4839         bool ok;
4840
4841         if (smbXcli_conn_has_async_calls(conn)) {
4842                 /*
4843                  * Can't use sync call while an async call is in flight
4844                  */
4845                 status = NT_STATUS_INVALID_PARAMETER_MIX;
4846                 goto fail;
4847         }
4848         ev = samba_tevent_context_init(frame);
4849         if (ev == NULL) {
4850                 goto fail;
4851         }
4852         req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
4853                                    min_protocol, max_protocol);
4854         if (req == NULL) {
4855                 goto fail;
4856         }
4857         ok = tevent_req_poll(req, ev);
4858         if (!ok) {
4859                 status = map_nt_error_from_unix_common(errno);
4860                 goto fail;
4861         }
4862         status = smbXcli_negprot_recv(req);
4863  fail:
4864         TALLOC_FREE(frame);
4865         return status;
4866 }
4867
4868 struct smb2cli_validate_negotiate_info_state {
4869         struct smbXcli_conn *conn;
4870         DATA_BLOB in_input_buffer;
4871         DATA_BLOB in_output_buffer;
4872         DATA_BLOB out_input_buffer;
4873         DATA_BLOB out_output_buffer;
4874         uint16_t dialect;
4875 };
4876
4877 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq);
4878
4879 struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx,
4880                                                 struct tevent_context *ev,
4881                                                 struct smbXcli_conn *conn,
4882                                                 uint32_t timeout_msec,
4883                                                 struct smbXcli_session *session,
4884                                                 struct smbXcli_tcon *tcon)
4885 {
4886         struct tevent_req *req;
4887         struct smb2cli_validate_negotiate_info_state *state;
4888         uint8_t *buf;
4889         uint16_t dialect_count = 0;
4890         struct tevent_req *subreq;
4891         bool _save_should_sign;
4892         size_t i;
4893
4894         req = tevent_req_create(mem_ctx, &state,
4895                                 struct smb2cli_validate_negotiate_info_state);
4896         if (req == NULL) {
4897                 return NULL;
4898         }
4899         state->conn = conn;
4900
4901         state->in_input_buffer = data_blob_talloc_zero(state,
4902                                         4 + 16 + 1 + 1 + 2);
4903         if (tevent_req_nomem(state->in_input_buffer.data, req)) {
4904                 return tevent_req_post(req, ev);
4905         }
4906         buf = state->in_input_buffer.data;
4907
4908         if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
4909                 SIVAL(buf, 0, conn->smb2.client.capabilities);
4910         } else {
4911                 SIVAL(buf, 0, 0); /* Capabilities */
4912         }
4913         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4914                 NTSTATUS status;
4915                 DATA_BLOB blob;
4916
4917                 status = GUID_to_ndr_blob(&conn->smb2.client.guid,
4918                                           state, &blob);
4919                 if (!NT_STATUS_IS_OK(status)) {
4920                         return NULL;
4921                 }
4922                 memcpy(buf+4, blob.data, 16); /* ClientGuid */
4923         } else {
4924                 memset(buf+4, 0, 16);   /* ClientGuid */
4925         }
4926         if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
4927                 SCVAL(buf, 20, conn->smb2.client.security_mode);
4928         } else {
4929                 SCVAL(buf, 20, 0);
4930         }
4931         SCVAL(buf, 21, 0); /* reserved */
4932
4933         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4934                 bool ok;
4935                 size_t ofs;
4936
4937                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4938                         continue;
4939                 }
4940
4941                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4942                         continue;
4943                 }
4944
4945                 if (smb2cli_prots[i].proto == state->conn->protocol) {
4946                         state->dialect = smb2cli_prots[i].smb2_dialect;
4947                 }
4948
4949                 ofs = state->in_input_buffer.length;
4950                 ok = data_blob_realloc(state, &state->in_input_buffer,
4951                                        ofs + 2);
4952                 if (!ok) {
4953                         tevent_req_oom(req);
4954                         return tevent_req_post(req, ev);
4955                 }
4956
4957                 buf = state->in_input_buffer.data;
4958                 SSVAL(buf, ofs, smb2cli_prots[i].smb2_dialect);
4959
4960                 dialect_count++;
4961         }
4962         buf = state->in_input_buffer.data;
4963         SSVAL(buf, 22, dialect_count);
4964
4965         _save_should_sign = smb2cli_tcon_is_signing_on(tcon);
4966         smb2cli_tcon_should_sign(tcon, true);
4967         subreq = smb2cli_ioctl_send(state, ev, conn,
4968                                     timeout_msec, session, tcon,
4969                                     UINT64_MAX, /* in_fid_persistent */
4970                                     UINT64_MAX, /* in_fid_volatile */
4971                                     FSCTL_VALIDATE_NEGOTIATE_INFO,
4972                                     0, /* in_max_input_length */
4973                                     &state->in_input_buffer,
4974                                     24, /* in_max_output_length */
4975                                     &state->in_output_buffer,
4976                                     SMB2_IOCTL_FLAG_IS_FSCTL);
4977         smb2cli_tcon_should_sign(tcon, _save_should_sign);
4978         if (tevent_req_nomem(subreq, req)) {
4979                 return tevent_req_post(req, ev);
4980         }
4981         tevent_req_set_callback(subreq,
4982                                 smb2cli_validate_negotiate_info_done,
4983                                 req);
4984
4985         return req;
4986 }
4987
4988 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq)
4989 {
4990         struct tevent_req *req =
4991                 tevent_req_callback_data(subreq,
4992                 struct tevent_req);
4993         struct smb2cli_validate_negotiate_info_state *state =
4994                 tevent_req_data(req,
4995                 struct smb2cli_validate_negotiate_info_state);
4996         NTSTATUS status;
4997         const uint8_t *buf;
4998         uint32_t capabilities;
4999         DATA_BLOB guid_blob;
5000         struct GUID server_guid;
5001         uint16_t security_mode;
5002         uint16_t dialect;
5003
5004         status = smb2cli_ioctl_recv(subreq, state,
5005                                     &state->out_input_buffer,
5006                                     &state->out_output_buffer);
5007         TALLOC_FREE(subreq);
5008         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED)) {
5009                 /*
5010                  * The response was signed, but not supported
5011                  *
5012                  * Older Windows and Samba releases return
5013                  * NT_STATUS_FILE_CLOSED.
5014                  */
5015                 tevent_req_done(req);
5016                 return;
5017         }
5018         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST)) {
5019                 /*
5020                  * The response was signed, but not supported
5021                  *
5022                  * This is returned by the NTVFS based Samba 4.x file server
5023                  * for file shares.
5024                  */
5025                 tevent_req_done(req);
5026                 return;
5027         }
5028         if (NT_STATUS_EQUAL(status, NT_STATUS_FS_DRIVER_REQUIRED)) {
5029                 /*
5030                  * The response was signed, but not supported
5031                  *
5032                  * This is returned by the NTVFS based Samba 4.x file server
5033                  * for ipc shares.
5034                  */
5035                 tevent_req_done(req);
5036                 return;
5037         }
5038         if (tevent_req_nterror(req, status)) {
5039                 return;
5040         }
5041
5042         if (state->out_output_buffer.length != 24) {
5043                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5044                 return;
5045         }
5046
5047         buf = state->out_output_buffer.data;
5048
5049         capabilities = IVAL(buf, 0);
5050         guid_blob = data_blob_const(buf + 4, 16);
5051         status = GUID_from_data_blob(&guid_blob, &server_guid);
5052         if (tevent_req_nterror(req, status)) {
5053                 return;
5054         }
5055         security_mode = CVAL(buf, 20);
5056         dialect = SVAL(buf, 22);
5057
5058         if (capabilities != state->conn->smb2.server.capabilities) {
5059                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5060                 return;
5061         }
5062
5063         if (!GUID_equal(&server_guid, &state->conn->smb2.server.guid)) {
5064                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5065                 return;
5066         }
5067
5068         if (security_mode != state->conn->smb2.server.security_mode) {
5069                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5070                 return;
5071         }
5072
5073         if (dialect != state->dialect) {
5074                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5075                 return;
5076         }
5077
5078         tevent_req_done(req);
5079 }
5080
5081 NTSTATUS smb2cli_validate_negotiate_info_recv(struct tevent_req *req)
5082 {
5083         return tevent_req_simple_recv_ntstatus(req);
5084 }
5085
5086 static int smbXcli_session_destructor(struct smbXcli_session *session)
5087 {
5088         if (session->conn == NULL) {
5089                 return 0;
5090         }
5091
5092         DLIST_REMOVE(session->conn->sessions, session);
5093         return 0;
5094 }
5095
5096 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
5097                                                struct smbXcli_conn *conn)
5098 {
5099         struct smbXcli_session *session;
5100
5101         session = talloc_zero(mem_ctx, struct smbXcli_session);
5102         if (session == NULL) {
5103                 return NULL;
5104         }
5105         session->smb2 = talloc_zero(session, struct smb2cli_session);
5106         if (session->smb2 == NULL) {
5107                 talloc_free(session);
5108                 return NULL;
5109         }
5110         talloc_set_destructor(session, smbXcli_session_destructor);
5111
5112         DLIST_ADD_END(conn->sessions, session, struct smbXcli_session *);
5113         session->conn = conn;
5114
5115         return session;
5116 }
5117
5118 struct smbXcli_session *smbXcli_session_copy(TALLOC_CTX *mem_ctx,
5119                                                 struct smbXcli_session *src)
5120 {
5121         struct smbXcli_session *session;
5122
5123         session = talloc_zero(mem_ctx, struct smbXcli_session);
5124         if (session == NULL) {
5125                 return NULL;
5126         }
5127         session->smb2 = talloc_zero(session, struct smb2cli_session);
5128         if (session->smb2 == NULL) {
5129                 talloc_free(session);
5130                 return NULL;
5131         }
5132
5133         session->conn = src->conn;
5134         *session->smb2 = *src->smb2;
5135         session->smb2_channel = src->smb2_channel;
5136         session->disconnect_expired = src->disconnect_expired;
5137
5138         DLIST_ADD_END(src->conn->sessions, session, struct smbXcli_session *);
5139         talloc_set_destructor(session, smbXcli_session_destructor);
5140
5141         return session;
5142 }
5143
5144 bool smbXcli_session_is_authenticated(struct smbXcli_session *session)
5145 {
5146         const DATA_BLOB *application_key;
5147
5148         if (session->conn == NULL) {
5149                 return false;
5150         }
5151
5152         /*
5153          * If we have an application key we had a session key negotiated
5154          * at auth time.
5155          */
5156         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5157                 application_key = &session->smb2->application_key;
5158         } else {
5159                 application_key = &session->smb1.application_key;
5160         }
5161
5162         if (application_key->length == 0) {
5163                 return false;
5164         }
5165
5166         return true;
5167 }
5168
5169 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
5170                                          TALLOC_CTX *mem_ctx,
5171                                          DATA_BLOB *key)
5172 {
5173         const DATA_BLOB *application_key;
5174
5175         *key = data_blob_null;
5176
5177         if (session->conn == NULL) {
5178                 return NT_STATUS_NO_USER_SESSION_KEY;
5179         }
5180
5181         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5182                 application_key = &session->smb2->application_key;
5183         } else {
5184                 application_key = &session->smb1.application_key;
5185         }
5186
5187         if (application_key->length == 0) {
5188                 return NT_STATUS_NO_USER_SESSION_KEY;
5189         }
5190
5191         *key = data_blob_dup_talloc(mem_ctx, *application_key);
5192         if (key->data == NULL) {
5193                 return NT_STATUS_NO_MEMORY;
5194         }
5195
5196         return NT_STATUS_OK;
5197 }
5198
5199 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
5200 {
5201         session->disconnect_expired = true;
5202 }
5203
5204 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
5205 {
5206         return session->smb1.session_id;
5207 }
5208
5209 void smb1cli_session_set_id(struct smbXcli_session *session,
5210                             uint16_t session_id)
5211 {
5212         session->smb1.session_id = session_id;
5213 }
5214
5215 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
5216                                          const DATA_BLOB _session_key)
5217 {
5218         struct smbXcli_conn *conn = session->conn;
5219         uint8_t session_key[16];
5220
5221         if (conn == NULL) {
5222                 return NT_STATUS_INVALID_PARAMETER_MIX;
5223         }
5224
5225         if (session->smb1.application_key.length != 0) {
5226                 /*
5227                  * TODO: do not allow this...
5228                  *
5229                  * return NT_STATUS_INVALID_PARAMETER_MIX;
5230                  */
5231                 data_blob_clear_free(&session->smb1.application_key);
5232                 session->smb1.protected_key = false;
5233         }
5234
5235         if (_session_key.length == 0) {
5236                 return NT_STATUS_OK;
5237         }
5238
5239         ZERO_STRUCT(session_key);
5240         memcpy(session_key, _session_key.data,
5241                MIN(_session_key.length, sizeof(session_key)));
5242
5243         session->smb1.application_key = data_blob_talloc(session,
5244                                                          session_key,
5245                                                          sizeof(session_key));
5246         ZERO_STRUCT(session_key);
5247         if (session->smb1.application_key.data == NULL) {
5248                 return NT_STATUS_NO_MEMORY;
5249         }
5250
5251         session->smb1.protected_key = false;
5252
5253         return NT_STATUS_OK;
5254 }
5255
5256 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
5257 {
5258         if (session->smb1.protected_key) {
5259                 /* already protected */
5260                 return NT_STATUS_OK;
5261         }
5262
5263         if (session->smb1.application_key.length != 16) {
5264                 return NT_STATUS_INVALID_PARAMETER_MIX;
5265         }
5266
5267         smb_key_derivation(session->smb1.application_key.data,
5268                            session->smb1.application_key.length,
5269                            session->smb1.application_key.data);
5270
5271         session->smb1.protected_key = true;
5272
5273         return NT_STATUS_OK;
5274 }
5275
5276 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
5277 {
5278         struct smbXcli_conn *conn = session->conn;
5279         uint8_t security_mode = 0;
5280
5281         if (conn == NULL) {
5282                 return security_mode;
5283         }
5284
5285         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
5286         if (conn->mandatory_signing) {
5287                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
5288         }
5289
5290         return security_mode;
5291 }
5292
5293 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
5294 {
5295         return session->smb2->session_id;
5296 }
5297
5298 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
5299 {
5300         return session->smb2->session_flags;
5301 }
5302
5303 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
5304                                       uint64_t session_id,
5305                                       uint16_t session_flags)
5306 {
5307         session->smb2->session_id = session_id;
5308         session->smb2->session_flags = session_flags;
5309 }
5310
5311 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
5312 {
5313         session->smb2->channel_sequence += 1;
5314 }
5315
5316 uint16_t smb2cli_session_reset_channel_sequence(struct smbXcli_session *session,
5317                                                 uint16_t channel_sequence)
5318 {
5319         uint16_t prev_cs;
5320
5321         prev_cs = session->smb2->channel_sequence;
5322         session->smb2->channel_sequence = channel_sequence;
5323
5324         return prev_cs;
5325 }
5326
5327 void smb2cli_session_start_replay(struct smbXcli_session *session)
5328 {
5329         session->smb2->replay_active = true;
5330 }
5331
5332 void smb2cli_session_stop_replay(struct smbXcli_session *session)
5333 {
5334         session->smb2->replay_active = false;
5335 }
5336
5337 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
5338                                          const DATA_BLOB _session_key,
5339                                          const struct iovec *recv_iov)
5340 {
5341         struct smbXcli_conn *conn = session->conn;
5342         uint16_t no_sign_flags;
5343         uint8_t session_key[16];
5344         bool check_signature = true;
5345         uint32_t hdr_flags;
5346         NTSTATUS status;
5347
5348         if (conn == NULL) {
5349                 return NT_STATUS_INVALID_PARAMETER_MIX;
5350         }
5351
5352         if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
5353                 return NT_STATUS_INVALID_PARAMETER_MIX;
5354         }
5355
5356         no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
5357
5358         if (session->smb2->session_flags & no_sign_flags) {
5359                 session->smb2->should_sign = false;
5360                 return NT_STATUS_OK;
5361         }
5362
5363         if (session->smb2->signing_key.length != 0) {
5364                 return NT_STATUS_INVALID_PARAMETER_MIX;
5365         }
5366
5367         ZERO_STRUCT(session_key);
5368         memcpy(session_key, _session_key.data,
5369                MIN(_session_key.length, sizeof(session_key)));
5370
5371         session->smb2->signing_key = data_blob_talloc(session,
5372                                                      session_key,
5373                                                      sizeof(session_key));
5374         if (session->smb2->signing_key.data == NULL) {
5375                 ZERO_STRUCT(session_key);
5376                 return NT_STATUS_NO_MEMORY;
5377         }
5378
5379         if (conn->protocol >= PROTOCOL_SMB2_24) {
5380                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
5381                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
5382
5383                 smb2_key_derivation(session_key, sizeof(session_key),
5384                                     label.data, label.length,
5385                                     context.data, context.length,
5386                                     session->smb2->signing_key.data);
5387         }
5388
5389         session->smb2->encryption_key = data_blob_dup_talloc(session,
5390                                                 session->smb2->signing_key);
5391         if (session->smb2->encryption_key.data == NULL) {
5392                 ZERO_STRUCT(session_key);
5393                 return NT_STATUS_NO_MEMORY;
5394         }
5395
5396         if (conn->protocol >= PROTOCOL_SMB2_24) {
5397                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
5398                 const DATA_BLOB context = data_blob_string_const_null("ServerIn ");
5399
5400                 smb2_key_derivation(session_key, sizeof(session_key),
5401                                     label.data, label.length,
5402                                     context.data, context.length,
5403                                     session->smb2->encryption_key.data);
5404         }
5405
5406         session->smb2->decryption_key = data_blob_dup_talloc(session,
5407                                                 session->smb2->signing_key);
5408         if (session->smb2->decryption_key.data == NULL) {
5409                 ZERO_STRUCT(session_key);
5410                 return NT_STATUS_NO_MEMORY;
5411         }
5412
5413         if (conn->protocol >= PROTOCOL_SMB2_24) {
5414                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCCM");
5415                 const DATA_BLOB context = data_blob_string_const_null("ServerOut");
5416
5417                 smb2_key_derivation(session_key, sizeof(session_key),
5418                                     label.data, label.length,
5419                                     context.data, context.length,
5420                                     session->smb2->decryption_key.data);
5421         }
5422
5423         session->smb2->application_key = data_blob_dup_talloc(session,
5424                                                 session->smb2->signing_key);
5425         if (session->smb2->application_key.data == NULL) {
5426                 ZERO_STRUCT(session_key);
5427                 return NT_STATUS_NO_MEMORY;
5428         }
5429
5430         if (conn->protocol >= PROTOCOL_SMB2_24) {
5431                 const DATA_BLOB label = data_blob_string_const_null("SMB2APP");
5432                 const DATA_BLOB context = data_blob_string_const_null("SmbRpc");
5433
5434                 smb2_key_derivation(session_key, sizeof(session_key),
5435                                     label.data, label.length,
5436                                     context.data, context.length,
5437                                     session->smb2->application_key.data);
5438         }
5439         ZERO_STRUCT(session_key);
5440
5441         session->smb2_channel.signing_key = data_blob_dup_talloc(session,
5442                                                 session->smb2->signing_key);
5443         if (session->smb2_channel.signing_key.data == NULL) {
5444                 return NT_STATUS_NO_MEMORY;
5445         }
5446
5447         check_signature = conn->mandatory_signing;
5448
5449         hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
5450         if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
5451                 /*
5452                  * Sadly some vendors don't sign the
5453                  * final SMB2 session setup response
5454                  *
5455                  * At least Windows and Samba are always doing this
5456                  * if there's a session key available.
5457                  *
5458                  * We only check the signature if it's mandatory
5459                  * or SMB2_HDR_FLAG_SIGNED is provided.
5460                  */
5461                 check_signature = true;
5462         }
5463
5464         if (check_signature) {
5465                 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
5466                                                 session->conn->protocol,
5467                                                 recv_iov, 3);
5468                 if (!NT_STATUS_IS_OK(status)) {
5469                         return status;
5470                 }
5471         }
5472
5473         session->smb2->should_sign = false;
5474         session->smb2->should_encrypt = false;
5475
5476         if (conn->desire_signing) {
5477                 session->smb2->should_sign = true;
5478         }
5479
5480         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
5481                 session->smb2->should_sign = true;
5482         }
5483
5484         if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
5485                 session->smb2->should_encrypt = true;
5486         }
5487
5488         if (conn->protocol < PROTOCOL_SMB2_24) {
5489                 session->smb2->should_encrypt = false;
5490         }
5491
5492         if (!(conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
5493                 session->smb2->should_encrypt = false;
5494         }
5495
5496         generate_random_buffer((uint8_t *)&session->smb2->nonce_high,
5497                                sizeof(session->smb2->nonce_high));
5498         session->smb2->nonce_low = 1;
5499
5500         return NT_STATUS_OK;
5501 }
5502
5503 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
5504                                         struct smbXcli_session *session1,
5505                                         struct smbXcli_conn *conn,
5506                                         struct smbXcli_session **_session2)
5507 {
5508         struct smbXcli_session *session2;
5509
5510         if (session1->smb2->signing_key.length == 0) {
5511                 return NT_STATUS_INVALID_PARAMETER_MIX;
5512         }
5513
5514         if (conn == NULL) {
5515                 return NT_STATUS_INVALID_PARAMETER_MIX;
5516         }
5517
5518         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
5519         if (session2 == NULL) {
5520                 return NT_STATUS_NO_MEMORY;
5521         }
5522         session2->smb2 = talloc_reference(session2, session1->smb2);
5523         if (session2->smb2 == NULL) {
5524                 talloc_free(session2);
5525                 return NT_STATUS_NO_MEMORY;
5526         }
5527
5528         talloc_set_destructor(session2, smbXcli_session_destructor);
5529         DLIST_ADD_END(conn->sessions, session2, struct smbXcli_session *);
5530         session2->conn = conn;
5531
5532         *_session2 = session2;
5533         return NT_STATUS_OK;
5534 }
5535
5536 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
5537                                          const DATA_BLOB _channel_key,
5538                                          const struct iovec *recv_iov)
5539 {
5540         struct smbXcli_conn *conn = session->conn;
5541         uint8_t channel_key[16];
5542         NTSTATUS status;
5543
5544         if (conn == NULL) {
5545                 return NT_STATUS_INVALID_PARAMETER_MIX;
5546         }
5547
5548         if (session->smb2_channel.signing_key.length != 0) {
5549                 return NT_STATUS_INVALID_PARAMETER_MIX;
5550         }
5551
5552         ZERO_STRUCT(channel_key);
5553         memcpy(channel_key, _channel_key.data,
5554                MIN(_channel_key.length, sizeof(channel_key)));
5555
5556         session->smb2_channel.signing_key = data_blob_talloc(session,
5557                                                 channel_key,
5558                                                 sizeof(channel_key));
5559         if (session->smb2_channel.signing_key.data == NULL) {
5560                 ZERO_STRUCT(channel_key);
5561                 return NT_STATUS_NO_MEMORY;
5562         }
5563
5564         if (conn->protocol >= PROTOCOL_SMB2_24) {
5565                 const DATA_BLOB label = data_blob_string_const_null("SMB2AESCMAC");
5566                 const DATA_BLOB context = data_blob_string_const_null("SmbSign");
5567
5568                 smb2_key_derivation(channel_key, sizeof(channel_key),
5569                                     label.data, label.length,
5570                                     context.data, context.length,
5571                                     session->smb2_channel.signing_key.data);
5572         }
5573         ZERO_STRUCT(channel_key);
5574
5575         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
5576                                         session->conn->protocol,
5577                                         recv_iov, 3);
5578         if (!NT_STATUS_IS_OK(status)) {
5579                 return status;
5580         }
5581
5582         return NT_STATUS_OK;
5583 }
5584
5585 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
5586 {
5587         if (session->smb2->should_encrypt) {
5588                 return NT_STATUS_OK;
5589         }
5590
5591         if (session->conn->protocol < PROTOCOL_SMB2_24) {
5592                 return NT_STATUS_NOT_SUPPORTED;
5593         }
5594
5595         if (!(session->conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION)) {
5596                 return NT_STATUS_NOT_SUPPORTED;
5597         }
5598
5599         if (session->smb2->signing_key.data == NULL) {
5600                 return NT_STATUS_NOT_SUPPORTED;
5601         }
5602         session->smb2->should_encrypt = true;
5603         return NT_STATUS_OK;
5604 }
5605
5606 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
5607 {
5608         struct smbXcli_tcon *tcon;
5609
5610         tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
5611         if (tcon == NULL) {
5612                 return NULL;
5613         }
5614
5615         return tcon;
5616 }
5617
5618 void smbXcli_tcon_set_fs_attributes(struct smbXcli_tcon *tcon,
5619                                     uint32_t fs_attributes)
5620 {
5621         tcon->fs_attributes = fs_attributes;
5622 }
5623
5624 uint32_t smbXcli_tcon_get_fs_attributes(struct smbXcli_tcon *tcon)
5625 {
5626         return tcon->fs_attributes;
5627 }
5628
5629 bool smbXcli_tcon_is_dfs_share(struct smbXcli_tcon *tcon)
5630 {
5631         if (tcon == NULL) {
5632                 return false;
5633         }
5634
5635         if (tcon->is_smb1) {
5636                 if (tcon->smb1.optional_support & SMB_SHARE_IN_DFS) {
5637                         return true;
5638                 }
5639
5640                 return false;
5641         }
5642
5643         if (tcon->smb2.capabilities & SMB2_SHARE_CAP_DFS) {
5644                 return true;
5645         }
5646
5647         return false;
5648 }
5649
5650 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
5651 {
5652         return tcon->smb1.tcon_id;
5653 }
5654
5655 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
5656 {
5657         tcon->is_smb1 = true;
5658         tcon->smb1.tcon_id = tcon_id;
5659 }
5660
5661 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
5662                              uint16_t tcon_id,
5663                              uint16_t optional_support,
5664                              uint32_t maximal_access,
5665                              uint32_t guest_maximal_access,
5666                              const char *service,
5667                              const char *fs_type)
5668 {
5669         tcon->is_smb1 = true;
5670         tcon->fs_attributes = 0;
5671         tcon->smb1.tcon_id = tcon_id;
5672         tcon->smb1.optional_support = optional_support;
5673         tcon->smb1.maximal_access = maximal_access;
5674         tcon->smb1.guest_maximal_access = guest_maximal_access;
5675
5676         TALLOC_FREE(tcon->smb1.service);
5677         tcon->smb1.service = talloc_strdup(tcon, service);
5678         if (service != NULL && tcon->smb1.service == NULL) {
5679                 return false;
5680         }
5681
5682         TALLOC_FREE(tcon->smb1.fs_type);
5683         tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
5684         if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
5685                 return false;
5686         }
5687
5688         return true;
5689 }
5690
5691 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
5692 {
5693         return tcon->smb2.tcon_id;
5694 }
5695
5696 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
5697 {
5698         return tcon->smb2.capabilities;
5699 }
5700
5701 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
5702                              struct smbXcli_session *session,
5703                              uint32_t tcon_id,
5704                              uint8_t type,
5705                              uint32_t flags,
5706                              uint32_t capabilities,
5707                              uint32_t maximal_access)
5708 {
5709         tcon->is_smb1 = false;
5710         tcon->fs_attributes = 0;
5711         tcon->smb2.tcon_id = tcon_id;
5712         tcon->smb2.type = type;
5713         tcon->smb2.flags = flags;
5714         tcon->smb2.capabilities = capabilities;
5715         tcon->smb2.maximal_access = maximal_access;
5716
5717         tcon->smb2.should_sign = false;
5718         tcon->smb2.should_encrypt = false;
5719
5720         if (session == NULL) {
5721                 return;
5722         }
5723
5724         tcon->smb2.should_sign = session->smb2->should_sign;
5725         tcon->smb2.should_encrypt = session->smb2->should_encrypt;
5726
5727         if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
5728                 tcon->smb2.should_encrypt = true;
5729         }
5730 }
5731
5732 void smb2cli_tcon_should_sign(struct smbXcli_tcon *tcon,
5733                               bool should_sign)
5734 {
5735         tcon->smb2.should_sign = should_sign;
5736 }
5737
5738 bool smb2cli_tcon_is_signing_on(struct smbXcli_tcon *tcon)
5739 {
5740         if (tcon->smb2.should_encrypt) {
5741                 return true;
5742         }
5743
5744         return tcon->smb2.should_sign;
5745 }
5746
5747 void smb2cli_tcon_should_encrypt(struct smbXcli_tcon *tcon,
5748                                  bool should_encrypt)
5749 {
5750         tcon->smb2.should_encrypt = should_encrypt;
5751 }
5752
5753 bool smb2cli_tcon_is_encryption_on(struct smbXcli_tcon *tcon)
5754 {
5755         return tcon->smb2.should_encrypt;
5756 }