s4-smb2: sequence numbers are not checked in SMB2_OP_CANCEL

diff --git a/source4/smb_server/smb2/receive.c b/source4/smb_server/smb2/receive.c
index abcf172738bfd09969c2b59033d885a43a649356..d26be41e6f7f854045100002743512715b971428 100644 (file)
--- a/source4/smb_server/smb2/receive.c
+++ b/source4/smb_server/smb2/receive.c
@@ -322,7 +322,8 @@ static NTSTATUS smb2srv_reply(struct smb2srv_request *req)
        uid                     = BVAL(req->in.hdr, SMB2_HDR_SESSION_ID);
        flags                   = IVAL(req->in.hdr, SMB2_HDR_FLAGS);
 
-       if (req->smb_conn->highest_smb2_seqnum != 0 &&
+       if (opcode != SMB2_OP_CANCEL &&
+           req->smb_conn->highest_smb2_seqnum != 0 &&
            req->seqnum <= req->smb_conn->highest_smb2_seqnum) {
                smbsrv_terminate_connection(req->smb_conn, "Invalid SMB2 sequence number");
                return NT_STATUS_INVALID_PARAMETER;