smbXcli: call tevent_queue_stop() for the outgoing queue on disconnect
[gd/samba-autobuild/.git] / libcli / smb / smbXcli_base.c
index 2cb5d449d94ea15dd47f24eb0ca7b50959da121a..43fbbf4e4d20e78612c4bb3e9fe957d2d6205de2 100644 (file)
@@ -37,7 +37,8 @@ struct smbXcli_req;
 struct smbXcli_session;
 
 struct smbXcli_conn {
-       int fd;
+       int read_fd;
+       int write_fd;
        struct sockaddr_storage local_ss;
        struct sockaddr_storage remote_ss;
        const char *remote_name;
@@ -133,12 +134,14 @@ struct smbXcli_session {
                DATA_BLOB signing_key;
                DATA_BLOB session_key;
                bool should_sign;
+               bool channel_setup;
        } smb2;
 };
 
 struct smbXcli_req_state {
        struct tevent_context *ev;
        struct smbXcli_conn *conn;
+       struct smbXcli_session *session; /* maybe NULL */
 
        uint8_t length_hdr[4];
 
@@ -166,6 +169,7 @@ struct smbXcli_req_state {
                struct iovec iov[1 + 3 + MAX_SMB_IOV];
                int iov_count;
 
+               bool one_way_seqnum;
                uint32_t seqnum;
                struct tevent_req **chained_requests;
 
@@ -188,6 +192,10 @@ struct smbXcli_req_state {
                struct iovec *recv_iov;
 
                uint16_t credit_charge;
+
+               bool signing_skipped;
+               bool notify_async;
+               bool got_async;
        } smb2;
 };
 
@@ -228,12 +236,17 @@ struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
                return NULL;
        }
 
+       conn->read_fd = fd;
+       conn->write_fd = dup(fd);
+       if (conn->write_fd == -1) {
+               goto error;
+       }
+
        conn->remote_name = talloc_strdup(conn, remote_name);
        if (conn->remote_name == NULL) {
                goto error;
        }
 
-       conn->fd = fd;
 
        ss = (void *)&conn->local_ss;
        sa = (struct sockaddr *)ss;
@@ -312,6 +325,9 @@ struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
        return conn;
 
  error:
+       if (conn->write_fd != -1) {
+               close(conn->write_fd);
+       }
        TALLOC_FREE(conn);
        return NULL;
 }
@@ -322,7 +338,7 @@ bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
                return false;
        }
 
-       if (conn->fd == -1) {
+       if (conn->read_fd == -1) {
                return false;
        }
 
@@ -349,7 +365,7 @@ bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 
 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 {
-       set_socket_options(conn->fd, options);
+       set_socket_options(conn->read_fd, options);
 }
 
 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
@@ -613,6 +629,30 @@ static int smbXcli_req_destructor(struct tevent_req *req)
        return 0;
 }
 
+static bool smb1cli_req_cancel(struct tevent_req *req);
+static bool smb2cli_req_cancel(struct tevent_req *req);
+
+static bool smbXcli_req_cancel(struct tevent_req *req)
+{
+       struct smbXcli_req_state *state =
+               tevent_req_data(req,
+               struct smbXcli_req_state);
+
+       if (!smbXcli_conn_is_connected(state->conn)) {
+               return false;
+       }
+
+       if (state->conn->protocol == PROTOCOL_NONE) {
+               return false;
+       }
+
+       if (state->conn->protocol >= PROTOCOL_SMB2_02) {
+               return smb2cli_req_cancel(req);
+       }
+
+       return smb1cli_req_cancel(req);
+}
+
 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
 
 bool smbXcli_req_set_pending(struct tevent_req *req)
@@ -640,6 +680,7 @@ bool smbXcli_req_set_pending(struct tevent_req *req)
        pending[num_pending] = req;
        conn->pending = pending;
        talloc_set_destructor(req, smbXcli_req_destructor);
+       tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
 
        if (!smbXcli_conn_receive_next(conn)) {
                /*
@@ -690,7 +731,9 @@ static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
         * We're the first ones, add the read_smb request that waits for the
         * answer from the server
         */
-       conn->read_smb_req = read_smb_send(conn->pending, state->ev, conn->fd);
+       conn->read_smb_req = read_smb_send(conn->pending,
+                                          state->ev,
+                                          conn->read_fd);
        if (conn->read_smb_req == NULL) {
                return false;
        }
@@ -700,10 +743,16 @@ static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
 
 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
 {
-       if (conn->fd != -1) {
-               close(conn->fd);
+       tevent_queue_stop(conn->outgoing);
+
+       if (conn->read_fd != -1) {
+               close(conn->read_fd);
+       }
+       if (conn->write_fd != -1) {
+               close(conn->write_fd);
        }
-       conn->fd = -1;
+       conn->read_fd = -1;
+       conn->write_fd = -1;
 
        /*
         * Cancel all pending requests. We do not do a for-loop walking
@@ -765,7 +814,7 @@ void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
 
                        /*
                         * we need to defer the callback, because we may notify
-                        * more then one caller.
+                        * more than one caller.
                         */
                        tevent_req_defer_callback(req, state->ev);
                        tevent_req_nterror(req, status);
@@ -895,6 +944,62 @@ static void smb1cli_req_flags(enum protocol_types protocol,
        *_flags2 = flags2;
 }
 
+static void smb1cli_req_cancel_done(struct tevent_req *subreq);
+
+static bool smb1cli_req_cancel(struct tevent_req *req)
+{
+       struct smbXcli_req_state *state =
+               tevent_req_data(req,
+               struct smbXcli_req_state);
+       uint8_t flags;
+       uint16_t flags2;
+       uint32_t pid;
+       uint16_t tid;
+       uint16_t uid;
+       uint16_t mid;
+       struct tevent_req *subreq;
+       NTSTATUS status;
+
+       flags = CVAL(state->smb1.hdr, HDR_FLG);
+       flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
+       pid  = SVAL(state->smb1.hdr, HDR_PID);
+       pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
+       tid = SVAL(state->smb1.hdr, HDR_TID);
+       uid = SVAL(state->smb1.hdr, HDR_UID);
+       mid = SVAL(state->smb1.hdr, HDR_MID);
+
+       subreq = smb1cli_req_create(state, state->ev,
+                                   state->conn,
+                                   SMBntcancel,
+                                   flags, 0,
+                                   flags2, 0,
+                                   0, /* timeout */
+                                   pid, tid, uid,
+                                   0, NULL, /* vwv */
+                                   0, NULL); /* bytes */
+       if (subreq == NULL) {
+               return false;
+       }
+       smb1cli_req_set_mid(subreq, mid);
+
+       status = smb1cli_req_chain_submit(&subreq, 1);
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(subreq);
+               return false;
+       }
+       smb1cli_req_set_mid(subreq, 0);
+
+       tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
+
+       return true;
+}
+
+static void smb1cli_req_cancel_done(struct tevent_req *subreq)
+{
+       /* we do not care about the result */
+       TALLOC_FREE(subreq);
+}
+
 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
                                      struct tevent_context *ev,
                                      struct smbXcli_conn *conn,
@@ -959,7 +1064,7 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
        SSVAL(state->smb1.hdr, HDR_PID,     pid);
        SSVAL(state->smb1.hdr, HDR_UID,     uid);
        SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
-       SSVAL(state->smb1.hdr, HDR_WCT,     wct);
+       SCVAL(state->smb1.hdr, HDR_WCT,     wct);
 
        state->smb1.vwv = vwv;
 
@@ -993,8 +1098,11 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
        case SMBtranss:
        case SMBtranss2:
        case SMBnttranss:
+               state->one_way = true;
+               break;
        case SMBntcancel:
                state->one_way = true;
+               state->smb1.one_way_seqnum = true;
                break;
        case SMBlockingX:
                if ((wct == 8) &&
@@ -1009,8 +1117,10 @@ struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
                                   struct iovec *iov, int iov_count,
-                                  uint32_t *seqnum)
+                                  uint32_t *seqnum,
+                                  bool one_way_seqnum)
 {
+       TALLOC_CTX *frame = NULL;
        uint8_t *buf;
 
        /*
@@ -1034,16 +1144,19 @@ static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
                return NT_STATUS_INVALID_PARAMETER_MIX;
        }
 
-       buf = smbXcli_iov_concat(talloc_tos(), iov, iov_count);
+       frame = talloc_stackframe();
+
+       buf = smbXcli_iov_concat(frame, iov, iov_count);
        if (buf == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       *seqnum = smb_signing_next_seqnum(conn->smb1.signing, false);
+       *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
+                                         one_way_seqnum);
        smb_signing_sign_pdu(conn->smb1.signing, buf, *seqnum);
        memcpy(iov[1].iov_base, buf+4, iov[1].iov_len);
 
-       TALLOC_FREE(buf);
+       TALLOC_FREE(frame);
        return NT_STATUS_OK;
 }
 
@@ -1094,7 +1207,8 @@ static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
        _smb_setlen_nbt(iov[0].iov_base, smbXcli_iov_len(&iov[1], iov_count-1));
 
        status = smb1cli_conn_signv(state->conn, iov, iov_count,
-                                   &state->smb1.seqnum);
+                                   &state->smb1.seqnum,
+                                   state->smb1.one_way_seqnum);
 
        if (!NT_STATUS_IS_OK(status)) {
                return status;
@@ -1134,8 +1248,10 @@ static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
                state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
        }
 
+       tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
+
        subreq = writev_send(state, state->ev, state->conn->outgoing,
-                            state->conn->fd, false, iov, iov_count);
+                            state->conn->write_fd, false, iov, iov_count);
        if (subreq == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -1996,6 +2112,68 @@ void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
        conn->smb2.max_credits = max_credits;
 }
 
+static void smb2cli_req_cancel_done(struct tevent_req *subreq);
+
+static bool smb2cli_req_cancel(struct tevent_req *req)
+{
+       struct smbXcli_req_state *state =
+               tevent_req_data(req,
+               struct smbXcli_req_state);
+       uint32_t flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
+       uint32_t pid = IVAL(state->smb2.hdr, SMB2_HDR_PID);
+       uint32_t tid = IVAL(state->smb2.hdr, SMB2_HDR_TID);
+       uint64_t mid = BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID);
+       uint64_t aid = BVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID);
+       struct smbXcli_session *session = state->session;
+       uint8_t *fixed = state->smb2.pad;
+       uint16_t fixed_len = 4;
+       struct tevent_req *subreq;
+       struct smbXcli_req_state *substate;
+       NTSTATUS status;
+
+       SSVAL(fixed, 0, 0x04);
+       SSVAL(fixed, 2, 0);
+
+       subreq = smb2cli_req_create(state, state->ev,
+                                   state->conn,
+                                   SMB2_OP_CANCEL,
+                                   flags, 0,
+                                   0, /* timeout */
+                                   pid, tid, session,
+                                   fixed, fixed_len,
+                                   NULL, 0);
+       if (subreq == NULL) {
+               return false;
+       }
+       substate = tevent_req_data(subreq, struct smbXcli_req_state);
+
+       if (flags & SMB2_HDR_FLAG_ASYNC) {
+               mid = 0;
+       }
+
+       SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, flags);
+       SIVAL(substate->smb2.hdr, SMB2_HDR_PID, pid);
+       SIVAL(substate->smb2.hdr, SMB2_HDR_TID, tid);
+       SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
+       SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, aid);
+
+       status = smb2cli_req_compound_submit(&subreq, 1);
+       if (!NT_STATUS_IS_OK(status)) {
+               TALLOC_FREE(subreq);
+               return false;
+       }
+
+       tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
+
+       return true;
+}
+
+static void smb2cli_req_cancel_done(struct tevent_req *subreq)
+{
+       /* we do not care about the result */
+       TALLOC_FREE(subreq);
+}
+
 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
                                      struct tevent_context *ev,
                                      struct smbXcli_conn *conn,
@@ -2005,7 +2183,7 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
                                      uint32_t timeout_msec,
                                      uint32_t pid,
                                      uint32_t tid,
-                                     uint64_t uid,
+                                     struct smbXcli_session *session,
                                      const uint8_t *fixed,
                                      uint16_t fixed_len,
                                      const uint8_t *dyn,
@@ -2014,6 +2192,7 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
        struct tevent_req *req;
        struct smbXcli_req_state *state;
        uint32_t flags = 0;
+       uint64_t uid = 0;
 
        req = tevent_req_create(mem_ctx, &state,
                                struct smbXcli_req_state);
@@ -2023,6 +2202,11 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
 
        state->ev = ev;
        state->conn = conn;
+       state->session = session;
+
+       if (session) {
+               uid = session->smb2.session_id;
+       }
 
        state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
        if (state->smb2.recv_iov == NULL) {
@@ -2073,6 +2257,15 @@ struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
        return req;
 }
 
+void smb2cli_req_set_notify_async(struct tevent_req *req)
+{
+       struct smbXcli_req_state *state =
+               tevent_req_data(req,
+               struct smbXcli_req_state);
+
+       state->smb2.notify_async = true;
+}
+
 static void smb2cli_writev_done(struct tevent_req *subreq);
 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                                               TALLOC_CTX *tmp_mem,
@@ -2101,12 +2294,15 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
        nbt_len = 0;
 
        for (i=0; i<num_reqs; i++) {
+               int hdr_iov;
                size_t reqlen;
                bool ret;
+               uint16_t opcode;
                uint64_t avail;
                uint16_t charge;
                uint16_t credits;
                uint64_t mid;
+               bool should_sign = false;
 
                if (!tevent_req_is_in_progress(reqs[i])) {
                        return NT_STATUS_INTERNAL_ERROR;
@@ -2123,6 +2319,11 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
                        return NT_STATUS_REVISION_MISMATCH;
                }
 
+               opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
+               if (opcode == SMB2_OP_CANCEL) {
+                       goto skip_credits;
+               }
+
                avail = UINT64_MAX - state->conn->smb2.mid;
                if (avail < 1) {
                        return NT_STATUS_CONNECTION_ABORTED;
@@ -2160,6 +2361,8 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
                SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
                SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
 
+skip_credits:
+               hdr_iov = num_iov;
                iov[num_iov].iov_base = state->smb2.hdr;
                iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
                num_iov += 1;
@@ -2190,16 +2393,29 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
                }
                nbt_len += reqlen;
 
+               if (state->session) {
+                       should_sign = state->session->smb2.should_sign;
+                       if (state->session->smb2.channel_setup) {
+                               should_sign = true;
+                       }
+               }
+
+               if (should_sign) {
+                       NTSTATUS status;
+
+                       status = smb2_signing_sign_pdu(state->session->smb2.signing_key,
+                                                      &iov[hdr_iov], num_iov - hdr_iov);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               return status;
+                       }
+               }
+
                ret = smbXcli_req_set_pending(reqs[i]);
                if (!ret) {
                        return NT_STATUS_NO_MEMORY;
                }
        }
 
-       /*
-        * TODO: Do signing here
-        */
-
        state = tevent_req_data(reqs[0], struct smbXcli_req_state);
        _smb_setlen_tcp(state->length_hdr, nbt_len);
        iov[0].iov_base = state->length_hdr;
@@ -2210,7 +2426,7 @@ NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
        }
 
        subreq = writev_send(state, state->ev, state->conn->outgoing,
-                            state->conn->fd, false, iov, num_iov);
+                            state->conn->write_fd, false, iov, num_iov);
        if (subreq == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
@@ -2236,7 +2452,7 @@ struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
                                    uint32_t timeout_msec,
                                    uint32_t pid,
                                    uint32_t tid,
-                                   uint64_t uid,
+                                   struct smbXcli_session *session,
                                    const uint8_t *fixed,
                                    uint16_t fixed_len,
                                    const uint8_t *dyn,
@@ -2248,7 +2464,7 @@ struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
        req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
                                 additional_flags, clear_flags,
                                 timeout_msec,
-                                pid, tid, uid,
+                                pid, tid, session,
                                 fixed, fixed_len, dyn, dyn_len);
        if (req == NULL) {
                return NULL;
@@ -2413,6 +2629,7 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
        int i, num_iov;
        NTSTATUS status;
        bool defer = true;
+       struct smbXcli_session *last_session = NULL;
 
        status = smb2cli_inbuf_parse_compound(inbuf, tmp_mem,
                                              &iov, &num_iov);
@@ -2428,8 +2645,12 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
                uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
                uint16_t req_opcode;
+               uint32_t req_flags;
                uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
                uint32_t new_credits;
+               struct smbXcli_session *session = NULL;
+               const DATA_BLOB *signing_key = NULL;
+               bool should_sign = false;
 
                new_credits = conn->smb2.cur_credits;
                new_credits += credits;
@@ -2444,10 +2665,13 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                }
                state = tevent_req_data(req, struct smbXcli_req_state);
 
+               state->smb2.got_async = false;
+
                req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
                if (opcode != req_opcode) {
                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
                }
+               req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
 
                if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
                        return NT_STATUS_INVALID_NETWORK_RESPONSE;
@@ -2456,15 +2680,142 @@ static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
                status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
                if ((flags & SMB2_HDR_FLAG_ASYNC) &&
                    NT_STATUS_EQUAL(status, STATUS_PENDING)) {
-                       uint32_t req_flags = IVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
                        uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
 
+                       /*
+                        * async interim responses are not signed,
+                        * even if the SMB2_HDR_FLAG_SIGNED flag
+                        * is set.
+                        */
                        req_flags |= SMB2_HDR_FLAG_ASYNC;
                        SBVAL(state->smb2.hdr, SMB2_HDR_FLAGS, req_flags);
                        SBVAL(state->smb2.hdr, SMB2_HDR_ASYNC_ID, async_id);
+
+                       if (state->smb2.notify_async) {
+                               state->smb2.got_async = true;
+                               tevent_req_defer_callback(req, state->ev);
+                               tevent_req_notify_callback(req);
+                       }
                        continue;
                }
 
+               session = state->session;
+               if (req_flags & SMB2_HDR_FLAG_CHAINED) {
+                       session = last_session;
+               }
+               last_session = session;
+
+               if (session) {
+                       should_sign = session->smb2.should_sign;
+                       if (session->smb2.channel_setup) {
+                               should_sign = true;
+                       }
+               }
+
+               if (should_sign) {
+                       if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
+                               return NT_STATUS_ACCESS_DENIED;
+                       }
+               }
+
+               if (flags & SMB2_HDR_FLAG_SIGNED) {
+                       uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
+
+                       if (session == NULL) {
+                               struct smbXcli_session *s;
+
+                               s = state->conn->sessions;
+                               for (; s; s = s->next) {
+                                       if (s->smb2.session_id != uid) {
+                                               continue;
+                                       }
+
+                                       session = s;
+                                       break;
+                               }
+                       }
+
+                       if (session == NULL) {
+                               return NT_STATUS_INVALID_NETWORK_RESPONSE;
+                       }
+
+                       last_session = session;
+                       signing_key = &session->smb2.signing_key;
+               }
+
+               if ((opcode == SMB2_OP_SESSSETUP) &&
+                    NT_STATUS_IS_OK(status)) {
+                       /*
+                        * the caller has to check the signing
+                        * as only the caller knows the correct
+                        * session key
+                        */
+                       signing_key = NULL;
+               }
+
+               if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
+                       /*
+                        * if the server returns NT_STATUS_USER_SESSION_DELETED
+                        * the response is not signed and we should
+                        * propagate the NT_STATUS_USER_SESSION_DELETED
+                        * status to the caller.
+                        */
+                       if (signing_key) {
+                               signing_key = NULL;
+                       }
+               }
+
+               if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
+                   NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
+                   NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
+                       /*
+                        * if the server returns
+                        * NT_STATUS_NETWORK_NAME_DELETED
+                        * NT_STATUS_FILE_CLOSED
+                        * NT_STATUS_INVALID_PARAMETER
+                        * the response might not be signed
+                        * as this happens before the signing checks.
+                        *
+                        * If server echos the signature (or all zeros)
+                        * we should report the status from the server
+                        * to the caller.
+                        */
+                       if (signing_key) {
+                               int cmp;
+
+                               cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
+                                            state->smb2.hdr+SMB2_HDR_SIGNATURE,
+                                            16);
+                               if (cmp == 0) {
+                                       state->smb2.signing_skipped = true;
+                                       signing_key = NULL;
+                               }
+                       }
+                       if (signing_key) {
+                               int cmp;
+                               static const uint8_t zeros[16];
+
+                               cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
+                                            zeros,
+                                            16);
+                               if (cmp == 0) {
+                                       state->smb2.signing_skipped = true;
+                                       signing_key = NULL;
+                               }
+                       }
+               }
+
+               if (signing_key) {
+                       status = smb2_signing_check_pdu(*signing_key, cur, 3);
+                       if (!NT_STATUS_IS_OK(status)) {
+                               /*
+                                * If the signing check fails, we disconnect
+                                * the connection.
+                                */
+                               return status;
+                       }
+               }
+
                smbXcli_req_unset_pending(req);
 
                /*
@@ -2521,6 +2872,10 @@ NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                *piov = NULL;
        }
 
+       if (state->smb2.got_async) {
+               return STATUS_PENDING;
+       }
+
        if (tevent_req_is_nterror(req, &status)) {
                for (i=0; i < num_expected; i++) {
                        if (NT_STATUS_EQUAL(status, expected[i].status)) {
@@ -2565,6 +2920,15 @@ NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
                return status;
        }
 
+       if (state->smb2.signing_skipped) {
+               if (num_expected > 0) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               if (!NT_STATUS_IS_ERR(status)) {
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+       }
+
        if (!found_size) {
                return NT_STATUS_INVALID_NETWORK_RESPONSE;
        }
@@ -3208,7 +3572,7 @@ static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_sta
                                state->conn, SMB2_OP_NEGPROT,
                                0, 0, /* flags */
                                state->timeout_msec,
-                               0xFEFF, 0, 0, /* pid, tid, uid */
+                               0xFEFF, 0, NULL, /* pid, tid, session */
                                state->smb2.fixed, sizeof(state->smb2.fixed),
                                state->smb2.dyn, dialect_count*2);
 }
@@ -3338,7 +3702,6 @@ static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
        struct tevent_req *subreq;
        struct smbXcli_req_state *substate;
        struct tevent_req *req;
-       struct smbXcli_negprot_state *state;
        uint32_t protocol_magic = IVAL(inbuf, 4);
 
        if (num_pending != 1) {
@@ -3348,7 +3711,6 @@ static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
        subreq = conn->pending[0];
        substate = tevent_req_data(subreq, struct smbXcli_req_state);
        req = tevent_req_callback_data(subreq, struct tevent_req);
-       state = tevent_req_data(req, struct smbXcli_negprot_state);
 
        switch (protocol_magic) {
        case SMB_MAGIC:
@@ -3499,15 +3861,26 @@ NTSTATUS smb2cli_session_update_session_key(struct smbXcli_session *session,
        } else {
                signing_key = session_key;
        }
+       if (session->smb2.channel_setup) {
+               signing_key = session_key;
+       }
 
        status = smb2_signing_check_pdu(signing_key, recv_iov, 3);
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
-       session->smb2.session_key = data_blob_dup_talloc(session, session_key);
-       if (session->smb2.session_key.data == NULL) {
-               return NT_STATUS_NO_MEMORY;
+       if (!session->smb2.channel_setup) {
+               session->smb2.session_key = data_blob_dup_talloc(session,
+                                                                session_key);
+               if (session->smb2.session_key.data == NULL) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+       }
+
+       if (session->smb2.channel_setup) {
+               data_blob_free(&session->smb2.signing_key);
+               session->smb2.channel_setup = false;
        }
 
        if (session->smb2.signing_key.length > 0) {
@@ -3531,3 +3904,59 @@ NTSTATUS smb2cli_session_update_session_key(struct smbXcli_session *session,
 
        return NT_STATUS_OK;
 }
+
+NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
+                                       struct smbXcli_session *session1,
+                                       struct smbXcli_conn *conn,
+                                       struct smbXcli_session **_session2)
+{
+       struct smbXcli_session *session2;
+       uint16_t no_sign_flags;
+
+       no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST | SMB2_SESSION_FLAG_IS_NULL;
+
+       if (session1->smb2.session_flags & no_sign_flags) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
+       if (session1->smb2.session_key.length == 0) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
+       if (session1->smb2.signing_key.length == 0) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
+       if (conn == NULL) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
+       session2 = talloc_zero(mem_ctx, struct smbXcli_session);
+       if (session2 == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       session2->smb2.session_id = session1->smb2.session_id;
+       session2->smb2.session_flags = session1->smb2.session_flags;
+
+       session2->smb2.session_key = data_blob_dup_talloc(session2,
+                                               session1->smb2.session_key);
+       if (session2->smb2.session_key.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       session2->smb2.signing_key = data_blob_dup_talloc(session2,
+                                               session1->smb2.signing_key);
+       if (session2->smb2.signing_key.data == NULL) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       session2->smb2.should_sign = session1->smb2.should_sign;
+       session2->smb2.channel_setup = true;
+
+       talloc_set_destructor(session2, smbXcli_session_destructor);
+       DLIST_ADD_END(conn->sessions, session2, struct smbXcli_session *);
+       session2->conn = conn;
+
+       *_session2 = session2;
+       return NT_STATUS_OK;
+}