libcli/smb/smbXcli_base.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async SMB client requests
   4    Copyright (C) Volker Lendecke 2008
   5    Copyright (C) Stefan Metzmacher 2011
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "system/network.h"
  23 #include "../lib/async_req/async_sock.h"
  24 #include "../lib/util/tevent_ntstatus.h"
  25 #include "../lib/util/tevent_unix.h"
  26 #include "lib/util/util_net.h"
  27 #include "lib/util/dlinklist.h"
  28 #include "lib/util/iov_buf.h"
  29 #include "../libcli/smb/smb_common.h"
  30 #include "../libcli/smb/smb_seal.h"
  31 #include "../libcli/smb/smb_signing.h"
  32 #include "../libcli/smb/read_smb.h"
  33 #include "smbXcli_base.h"
  34 #include "librpc/ndr/libndr.h"
  35 #include "libcli/smb/smb2_negotiate_context.h"
  36 #include "lib/crypto/sha512.h"
  37 #include "lib/crypto/aes.h"
  38 #include "lib/crypto/aes_ccm_128.h"
  39 #include "lib/crypto/aes_gcm_128.h"
  40
  41 struct smbXcli_conn;
  42 struct smbXcli_req;
  43 struct smbXcli_session;
  44 struct smbXcli_tcon;
  45
  46 struct smbXcli_conn {
  47         int sock_fd;
  48         struct sockaddr_storage local_ss;
  49         struct sockaddr_storage remote_ss;
  50         const char *remote_name;
  51
  52         struct tevent_queue *outgoing;
  53         struct tevent_req **pending;
  54         struct tevent_req *read_smb_req;
  55         struct tevent_req *suicide_req;
  56
  57         enum protocol_types min_protocol;
  58         enum protocol_types max_protocol;
  59         enum protocol_types protocol;
  60         bool allow_signing;
  61         bool desire_signing;
  62         bool mandatory_signing;
  63
  64         /*
  65          * The incoming dispatch function should return:
  66          * - NT_STATUS_RETRY, if more incoming PDUs are expected.
  67          * - NT_STATUS_OK, if no more processing is desired, e.g.
  68          *                 the dispatch function called
  69          *                 tevent_req_done().
  70          * - All other return values disconnect the connection.
  71          */
  72         NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
  73                                       TALLOC_CTX *tmp_mem,
  74                                       uint8_t *inbuf);
  75
  76         struct {
  77                 struct {
  78                         uint32_t capabilities;
  79                         uint32_t max_xmit;
  80                 } client;
  81
  82                 struct {
  83                         uint32_t capabilities;
  84                         uint32_t max_xmit;
  85                         uint16_t max_mux;
  86                         uint16_t security_mode;
  87                         bool readbraw;
  88                         bool writebraw;
  89                         bool lockread;
  90                         bool writeunlock;
  91                         uint32_t session_key;
  92                         struct GUID guid;
  93                         DATA_BLOB gss_blob;
  94                         uint8_t challenge[8];
  95                         const char *workgroup;
  96                         const char *name;
  97                         int time_zone;
  98                         NTTIME system_time;
  99                 } server;
 100
 101                 uint32_t capabilities;
 102                 uint32_t max_xmit;
 103
 104                 uint16_t mid;
 105
 106                 struct smb_signing_state *signing;
 107                 struct smb_trans_enc_state *trans_enc;
 108
 109                 struct tevent_req *read_braw_req;
 110         } smb1;
 111
 112         struct {
 113                 struct {
 114                         uint32_t capabilities;
 115                         uint16_t security_mode;
 116                         struct GUID guid;
 117                 } client;
 118
 119                 struct {
 120                         uint32_t capabilities;
 121                         uint16_t security_mode;
 122                         struct GUID guid;
 123                         uint32_t max_trans_size;
 124                         uint32_t max_read_size;
 125                         uint32_t max_write_size;
 126                         NTTIME system_time;
 127                         NTTIME start_time;
 128                         DATA_BLOB gss_blob;
 129                         uint16_t cipher;
 130                 } server;
 131
 132                 uint64_t mid;
 133                 uint16_t cur_credits;
 134                 uint16_t max_credits;
 135
 136                 uint32_t cc_chunk_len;
 137                 uint32_t cc_max_chunks;
 138
 139                 uint8_t io_priority;
 140
 141                 bool force_channel_sequence;
 142
 143                 uint8_t preauth_sha512[64];
 144         } smb2;
 145
 146         struct smbXcli_session *sessions;
 147 };
 148
 149 struct smb2cli_session {
 150         uint64_t session_id;
 151         uint16_t session_flags;
 152         DATA_BLOB application_key;
 153         DATA_BLOB signing_key;
 154         bool should_sign;
 155         bool should_encrypt;
 156         DATA_BLOB encryption_key;
 157         DATA_BLOB decryption_key;
 158         uint64_t nonce_high_random;
 159         uint64_t nonce_high_max;
 160         uint64_t nonce_high;
 161         uint64_t nonce_low;
 162         uint16_t channel_sequence;
 163         bool replay_active;
 164         bool require_signed_response;
 165 };
 166
 167 struct smbXcli_session {
 168         struct smbXcli_session *prev, *next;
 169         struct smbXcli_conn *conn;
 170
 171         struct {
 172                 uint16_t session_id;
 173                 uint16_t action;
 174                 DATA_BLOB application_key;
 175                 bool protected_key;
 176         } smb1;
 177
 178         struct smb2cli_session *smb2;
 179
 180         struct {
 181                 DATA_BLOB signing_key;
 182                 uint8_t preauth_sha512[64];
 183         } smb2_channel;
 184
 185         /*
 186          * this should be a short term hack
 187          * until the upper layers have implemented
 188          * re-authentication.
 189          */
 190         bool disconnect_expired;
 191 };
 192
 193 struct smbXcli_tcon {
 194         bool is_smb1;
 195         uint32_t fs_attributes;
 196
 197         struct {
 198                 uint16_t tcon_id;
 199                 uint16_t optional_support;
 200                 uint32_t maximal_access;
 201                 uint32_t guest_maximal_access;
 202                 char *service;
 203                 char *fs_type;
 204         } smb1;
 205
 206         struct {
 207                 uint32_t tcon_id;
 208                 uint8_t type;
 209                 uint32_t flags;
 210                 uint32_t capabilities;
 211                 uint32_t maximal_access;
 212                 bool should_sign;
 213                 bool should_encrypt;
 214         } smb2;
 215 };
 216
 217 struct smbXcli_req_state {
 218         struct tevent_context *ev;
 219         struct smbXcli_conn *conn;
 220         struct smbXcli_session *session; /* maybe NULL */
 221         struct smbXcli_tcon *tcon; /* maybe NULL */
 222
 223         uint8_t length_hdr[4];
 224
 225         bool one_way;
 226
 227         uint8_t *inbuf;
 228
 229         struct tevent_req *write_req;
 230
 231         struct timeval endtime;
 232
 233         struct {
 234                 /* Space for the header including the wct */
 235                 uint8_t hdr[HDR_VWV];
 236
 237                 /*
 238                  * For normal requests, smb1cli_req_send chooses a mid.
 239                  * SecondaryV trans requests need to use the mid of the primary
 240                  * request, so we need a place to store it.
 241                  * Assume it is set if != 0.
 242                  */
 243                 uint16_t mid;
 244
 245                 uint16_t *vwv;
 246                 uint8_t bytecount_buf[2];
 247
 248 #define MAX_SMB_IOV 10
 249                 /* length_hdr, hdr, words, byte_count, buffers */
 250                 struct iovec iov[1 + 3 + MAX_SMB_IOV];
 251                 int iov_count;
 252
 253                 bool one_way_seqnum;
 254                 uint32_t seqnum;
 255                 struct tevent_req **chained_requests;
 256
 257                 uint8_t recv_cmd;
 258                 NTSTATUS recv_status;
 259                 /* always an array of 3 talloc elements */
 260                 struct iovec *recv_iov;
 261         } smb1;
 262
 263         struct {
 264                 const uint8_t *fixed;
 265                 uint16_t fixed_len;
 266                 const uint8_t *dyn;
 267                 uint32_t dyn_len;
 268
 269                 uint8_t transform[SMB2_TF_HDR_SIZE];
 270                 uint8_t hdr[SMB2_HDR_BODY];
 271                 uint8_t pad[7]; /* padding space for compounding */
 272
 273                 /*
 274                  * always an array of 3 talloc elements
 275                  * (without a SMB2_TRANSFORM header!)
 276                  *
 277                  * HDR, BODY, DYN
 278                  */
 279                 struct iovec *recv_iov;
 280
 281                 /*
 282                  * the expected max for the response dyn_len
 283                  */
 284                 uint32_t max_dyn_len;
 285
 286                 uint16_t credit_charge;
 287
 288                 bool should_sign;
 289                 bool should_encrypt;
 290                 uint64_t encryption_session_id;
 291
 292                 bool signing_skipped;
 293                 bool require_signed_response;
 294                 bool notify_async;
 295                 bool got_async;
 296                 uint16_t cancel_flags;
 297                 uint64_t cancel_mid;
 298                 uint64_t cancel_aid;
 299         } smb2;
 300 };
 301
 302 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
 303 {
 304         /*
 305          * NT_STATUS_OK, means we do not notify the callers
 306          */
 307         smbXcli_conn_disconnect(conn, NT_STATUS_OK);
 308
 309         while (conn->sessions) {
 310                 conn->sessions->conn = NULL;
 311                 DLIST_REMOVE(conn->sessions, conn->sessions);
 312         }
 313
 314         if (conn->smb1.trans_enc) {
 315                 TALLOC_FREE(conn->smb1.trans_enc);
 316         }
 317
 318         return 0;
 319 }
 320
 321 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
 322                                          int fd,
 323                                          const char *remote_name,
 324                                          enum smb_signing_setting signing_state,
 325                                          uint32_t smb1_capabilities,
 326                                          struct GUID *client_guid,
 327                                          uint32_t smb2_capabilities)
 328 {
 329         struct smbXcli_conn *conn = NULL;
 330         void *ss = NULL;
 331         struct sockaddr *sa = NULL;
 332         socklen_t sa_length;
 333         int ret;
 334
 335         conn = talloc_zero(mem_ctx, struct smbXcli_conn);
 336         if (!conn) {
 337                 return NULL;
 338         }
 339
 340         conn->sock_fd = fd;
 341
 342         conn->remote_name = talloc_strdup(conn, remote_name);
 343         if (conn->remote_name == NULL) {
 344                 goto error;
 345         }
 346
 347         ss = (void *)&conn->local_ss;
 348         sa = (struct sockaddr *)ss;
 349         sa_length = sizeof(conn->local_ss);
 350         ret = getsockname(fd, sa, &sa_length);
 351         if (ret == -1) {
 352                 goto error;
 353         }
 354         ss = (void *)&conn->remote_ss;
 355         sa = (struct sockaddr *)ss;
 356         sa_length = sizeof(conn->remote_ss);
 357         ret = getpeername(fd, sa, &sa_length);
 358         if (ret == -1) {
 359                 goto error;
 360         }
 361
 362         conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
 363         if (conn->outgoing == NULL) {
 364                 goto error;
 365         }
 366         conn->pending = NULL;
 367
 368         conn->min_protocol = PROTOCOL_NONE;
 369         conn->max_protocol = PROTOCOL_NONE;
 370         conn->protocol = PROTOCOL_NONE;
 371
 372         switch (signing_state) {
 373         case SMB_SIGNING_OFF:
 374                 /* never */
 375                 conn->allow_signing = false;
 376                 conn->desire_signing = false;
 377                 conn->mandatory_signing = false;
 378                 break;
 379         case SMB_SIGNING_DEFAULT:
 380         case SMB_SIGNING_IF_REQUIRED:
 381                 /* if the server requires it */
 382                 conn->allow_signing = true;
 383                 conn->desire_signing = false;
 384                 conn->mandatory_signing = false;
 385                 break;
 386         case SMB_SIGNING_DESIRED:
 387                 /* if the server desires it */
 388                 conn->allow_signing = true;
 389                 conn->desire_signing = true;
 390                 conn->mandatory_signing = false;
 391                 break;
 392         case SMB_SIGNING_IPC_DEFAULT:
 393         case SMB_SIGNING_REQUIRED:
 394                 /* always */
 395                 conn->allow_signing = true;
 396                 conn->desire_signing = true;
 397                 conn->mandatory_signing = true;
 398                 break;
 399         }
 400
 401         conn->smb1.client.capabilities = smb1_capabilities;
 402         conn->smb1.client.max_xmit = UINT16_MAX;
 403
 404         conn->smb1.capabilities = conn->smb1.client.capabilities;
 405         conn->smb1.max_xmit = 1024;
 406
 407         conn->smb1.mid = 1;
 408
 409         /* initialise signing */
 410         conn->smb1.signing = smb_signing_init(conn,
 411                                               conn->allow_signing,
 412                                               conn->desire_signing,
 413                                               conn->mandatory_signing);
 414         if (!conn->smb1.signing) {
 415                 goto error;
 416         }
 417
 418         conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 419         if (conn->mandatory_signing) {
 420                 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 421         }
 422         if (client_guid) {
 423                 conn->smb2.client.guid = *client_guid;
 424         }
 425         conn->smb2.client.capabilities = smb2_capabilities;
 426
 427         conn->smb2.cur_credits = 1;
 428         conn->smb2.max_credits = 0;
 429         conn->smb2.io_priority = 1;
 430
 431         /*
 432          * Samba and Windows servers accept a maximum of 16 MiB with a maximum
 433          * chunk length of 1 MiB.
 434          */
 435         conn->smb2.cc_chunk_len = 1024 * 1024;
 436         conn->smb2.cc_max_chunks = 16;
 437
 438         talloc_set_destructor(conn, smbXcli_conn_destructor);
 439         return conn;
 440
 441  error:
 442         TALLOC_FREE(conn);
 443         return NULL;
 444 }
 445
 446 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
 447 {
 448         if (conn == NULL) {
 449                 return false;
 450         }
 451
 452         if (conn->sock_fd == -1) {
 453                 return false;
 454         }
 455
 456         return true;
 457 }
 458
 459 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
 460 {
 461         return conn->protocol;
 462 }
 463
 464 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
 465 {
 466         if (conn->protocol >= PROTOCOL_SMB2_02) {
 467                 return true;
 468         }
 469
 470         if (conn->smb1.capabilities & CAP_UNICODE) {
 471                 return true;
 472         }
 473
 474         return false;
 475 }
 476
 477 bool smbXcli_conn_signing_mandatory(struct smbXcli_conn *conn)
 478 {
 479         return conn->mandatory_signing;
 480 }
 481
 482 /*
 483  * [MS-SMB] 2.2.2.3.5 - SMB1 support for passing through
 484  * query/set commands to the file system
 485  */
 486 bool smbXcli_conn_support_passthrough(struct smbXcli_conn *conn)
 487 {
 488         if (conn->protocol >= PROTOCOL_SMB2_02) {
 489                 return true;
 490         }
 491
 492         if (conn->smb1.capabilities & CAP_W2K_SMBS) {
 493                 return true;
 494         }
 495
 496         return false;
 497 }
 498
 499 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
 500 {
 501         set_socket_options(conn->sock_fd, options);
 502 }
 503
 504 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
 505 {
 506         return &conn->local_ss;
 507 }
 508
 509 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
 510 {
 511         return &conn->remote_ss;
 512 }
 513
 514 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
 515 {
 516         return conn->remote_name;
 517 }
 518
 519 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
 520 {
 521         if (conn->protocol >= PROTOCOL_SMB2_02) {
 522                 /*
 523                  * TODO...
 524                  */
 525                 return 1;
 526         }
 527
 528         return conn->smb1.server.max_mux;
 529 }
 530
 531 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
 532 {
 533         if (conn->protocol >= PROTOCOL_SMB2_02) {
 534                 return conn->smb2.server.system_time;
 535         }
 536
 537         return conn->smb1.server.system_time;
 538 }
 539
 540 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
 541 {
 542         if (conn->protocol >= PROTOCOL_SMB2_02) {
 543                 return &conn->smb2.server.gss_blob;
 544         }
 545
 546         return &conn->smb1.server.gss_blob;
 547 }
 548
 549 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
 550 {
 551         if (conn->protocol >= PROTOCOL_SMB2_02) {
 552                 return &conn->smb2.server.guid;
 553         }
 554
 555         return &conn->smb1.server.guid;
 556 }
 557
 558 bool smbXcli_conn_get_force_channel_sequence(struct smbXcli_conn *conn)
 559 {
 560         return conn->smb2.force_channel_sequence;
 561 }
 562
 563 void smbXcli_conn_set_force_channel_sequence(struct smbXcli_conn *conn,
 564                                              bool v)
 565 {
 566         conn->smb2.force_channel_sequence = v;
 567 }
 568
 569 struct smbXcli_conn_samba_suicide_state {
 570         struct smbXcli_conn *conn;
 571         struct iovec iov;
 572         uint8_t buf[9];
 573         struct tevent_req *write_req;
 574 };
 575
 576 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 577                                                enum tevent_req_state req_state);
 578 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
 579
 580 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
 581                                                    struct tevent_context *ev,
 582                                                    struct smbXcli_conn *conn,
 583                                                    uint8_t exitcode)
 584 {
 585         struct tevent_req *req, *subreq;
 586         struct smbXcli_conn_samba_suicide_state *state;
 587
 588         req = tevent_req_create(mem_ctx, &state,
 589                                 struct smbXcli_conn_samba_suicide_state);
 590         if (req == NULL) {
 591                 return NULL;
 592         }
 593         state->conn = conn;
 594         SIVAL(state->buf, 4, SMB_SUICIDE_PACKET);
 595         SCVAL(state->buf, 8, exitcode);
 596         _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
 597
 598         if (conn->suicide_req != NULL) {
 599                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
 600                 return tevent_req_post(req, ev);
 601         }
 602
 603         state->iov.iov_base = state->buf;
 604         state->iov.iov_len = sizeof(state->buf);
 605
 606         subreq = writev_send(state, ev, conn->outgoing, conn->sock_fd,
 607                              false, &state->iov, 1);
 608         if (tevent_req_nomem(subreq, req)) {
 609                 return tevent_req_post(req, ev);
 610         }
 611         tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
 612         state->write_req = subreq;
 613
 614         tevent_req_set_cleanup_fn(req, smbXcli_conn_samba_suicide_cleanup);
 615
 616         /*
 617          * We need to use tevent_req_defer_callback()
 618          * in order to allow smbXcli_conn_disconnect()
 619          * to do a safe cleanup.
 620          */
 621         tevent_req_defer_callback(req, ev);
 622         conn->suicide_req = req;
 623
 624         return req;
 625 }
 626
 627 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
 628                                                enum tevent_req_state req_state)
 629 {
 630         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 631                 req, struct smbXcli_conn_samba_suicide_state);
 632
 633         TALLOC_FREE(state->write_req);
 634
 635         if (state->conn == NULL) {
 636                 return;
 637         }
 638
 639         if (state->conn->suicide_req == req) {
 640                 state->conn->suicide_req = NULL;
 641         }
 642         state->conn = NULL;
 643 }
 644
 645 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
 646 {
 647         struct tevent_req *req = tevent_req_callback_data(
 648                 subreq, struct tevent_req);
 649         struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
 650                 req, struct smbXcli_conn_samba_suicide_state);
 651         ssize_t nwritten;
 652         int err;
 653
 654         state->write_req = NULL;
 655
 656         nwritten = writev_recv(subreq, &err);
 657         TALLOC_FREE(subreq);
 658         if (nwritten == -1) {
 659                 /* here, we need to notify all pending requests */
 660                 NTSTATUS status = map_nt_error_from_unix_common(err);
 661                 smbXcli_conn_disconnect(state->conn, status);
 662                 return;
 663         }
 664         tevent_req_done(req);
 665 }
 666
 667 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
 668 {
 669         return tevent_req_simple_recv_ntstatus(req);
 670 }
 671
 672 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
 673                                     uint8_t exitcode)
 674 {
 675         TALLOC_CTX *frame = talloc_stackframe();
 676         struct tevent_context *ev;
 677         struct tevent_req *req;
 678         NTSTATUS status = NT_STATUS_NO_MEMORY;
 679         bool ok;
 680
 681         if (smbXcli_conn_has_async_calls(conn)) {
 682                 /*
 683                  * Can't use sync call while an async call is in flight
 684                  */
 685                 status = NT_STATUS_INVALID_PARAMETER_MIX;
 686                 goto fail;
 687         }
 688         ev = samba_tevent_context_init(frame);
 689         if (ev == NULL) {
 690                 goto fail;
 691         }
 692         req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
 693         if (req == NULL) {
 694                 goto fail;
 695         }
 696         ok = tevent_req_poll_ntstatus(req, ev, &status);
 697         if (!ok) {
 698                 goto fail;
 699         }
 700         status = smbXcli_conn_samba_suicide_recv(req);
 701  fail:
 702         TALLOC_FREE(frame);
 703         return status;
 704 }
 705
 706 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
 707 {
 708         return conn->smb1.capabilities;
 709 }
 710
 711 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
 712 {
 713         return conn->smb1.max_xmit;
 714 }
 715
 716 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
 717 {
 718         size_t pending = talloc_array_length(conn->pending);
 719         uint16_t possible = conn->smb1.server.max_mux;
 720
 721         if (pending >= possible) {
 722                 return false;
 723         }
 724
 725         return true;
 726 }
 727
 728 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
 729 {
 730         return conn->smb1.server.session_key;
 731 }
 732
 733 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
 734 {
 735         return conn->smb1.server.challenge;
 736 }
 737
 738 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
 739 {
 740         return conn->smb1.server.security_mode;
 741 }
 742
 743 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
 744 {
 745         return conn->smb1.server.readbraw;
 746 }
 747
 748 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
 749 {
 750         return conn->smb1.server.writebraw;
 751 }
 752
 753 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
 754 {
 755         return conn->smb1.server.lockread;
 756 }
 757
 758 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
 759 {
 760         return conn->smb1.server.writeunlock;
 761 }
 762
 763 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
 764 {
 765         return conn->smb1.server.time_zone;
 766 }
 767
 768 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
 769                                    const DATA_BLOB user_session_key,
 770                                    const DATA_BLOB response)
 771 {
 772         return smb_signing_activate(conn->smb1.signing,
 773                                     user_session_key,
 774                                     response);
 775 }
 776
 777 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
 778                                 const uint8_t *buf, uint32_t seqnum)
 779 {
 780         const uint8_t *hdr = buf + NBT_HDR_SIZE;
 781         size_t len = smb_len_nbt(buf);
 782
 783         return smb_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
 784 }
 785
 786 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
 787 {
 788         return smb_signing_is_active(conn->smb1.signing);
 789 }
 790
 791 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
 792                                  struct smb_trans_enc_state *es)
 793 {
 794         /* Replace the old state, if any. */
 795         if (conn->smb1.trans_enc) {
 796                 TALLOC_FREE(conn->smb1.trans_enc);
 797         }
 798         conn->smb1.trans_enc = es;
 799 }
 800
 801 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
 802 {
 803         return common_encryption_on(conn->smb1.trans_enc);
 804 }
 805
 806
 807 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
 808 {
 809         uint32_t flags2 = SVAL(hdr, HDR_FLG2);
 810         NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
 811
 812         if (NT_STATUS_IS_OK(status)) {
 813                 return NT_STATUS_OK;
 814         }
 815
 816         if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
 817                 return status;
 818         }
 819
 820         return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
 821 }
 822
 823 /**
 824  * Is the SMB command able to hold an AND_X successor
 825  * @param[in] cmd       The SMB command in question
 826  * @retval Can we add a chained request after "cmd"?
 827  */
 828 bool smb1cli_is_andx_req(uint8_t cmd)
 829 {
 830         switch (cmd) {
 831         case SMBtconX:
 832         case SMBlockingX:
 833         case SMBopenX:
 834         case SMBreadX:
 835         case SMBwriteX:
 836         case SMBsesssetupX:
 837         case SMBulogoffX:
 838         case SMBntcreateX:
 839                 return true;
 840                 break;
 841         default:
 842                 break;
 843         }
 844
 845         return false;
 846 }
 847
 848 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
 849 {
 850         size_t num_pending = talloc_array_length(conn->pending);
 851         uint16_t result;
 852
 853         if (conn->protocol == PROTOCOL_NONE) {
 854                 /*
 855                  * This is what windows sends on the SMB1 Negprot request
 856                  * and some vendors reuse the SMB1 MID as SMB2 sequence number.
 857                  */
 858                 return 0;
 859         }
 860
 861         while (true) {
 862                 size_t i;
 863
 864                 result = conn->smb1.mid++;
 865                 if ((result == 0) || (result == 0xffff)) {
 866                         continue;
 867                 }
 868
 869                 for (i=0; i<num_pending; i++) {
 870                         if (result == smb1cli_req_mid(conn->pending[i])) {
 871                                 break;
 872                         }
 873                 }
 874
 875                 if (i == num_pending) {
 876                         return result;
 877                 }
 878         }
 879 }
 880
 881 static NTSTATUS smbXcli_req_cancel_write_req(struct tevent_req *req)
 882 {
 883         struct smbXcli_req_state *state =
 884                 tevent_req_data(req,
 885                 struct smbXcli_req_state);
 886         struct smbXcli_conn *conn = state->conn;
 887         size_t num_pending = talloc_array_length(conn->pending);
 888         ssize_t ret;
 889         int err;
 890         bool ok;
 891
 892         if (state->write_req == NULL) {
 893                 return NT_STATUS_OK;
 894         }
 895
 896         /*
 897          * Check if it's possible to cancel the request.
 898          * If the result is true it's not too late.
 899          * See writev_cancel().
 900          */
 901         ok = tevent_req_cancel(state->write_req);
 902         if (ok) {
 903                 TALLOC_FREE(state->write_req);
 904
 905                 if (conn->protocol >= PROTOCOL_SMB2_02) {
 906                         /*
 907                          * SMB2 has a sane signing state.
 908                          */
 909                         return NT_STATUS_OK;
 910                 }
 911
 912                 if (num_pending > 1) {
 913                         /*
 914                          * We have more pending requests following us.  This
 915                          * means the signing state will be broken for them.
 916                          *
 917                          * As a solution we could add the requests directly to
 918                          * our outgoing queue and do the signing in the trigger
 919                          * function and then use writev_send() without passing a
 920                          * queue.  That way we'll only sign packets we're most
 921                          * likely send to the wire.
 922                          */
 923                         return NT_STATUS_REQUEST_OUT_OF_SEQUENCE;
 924                 }
 925
 926                 /*
 927                  * If we're the only request that's
 928                  * pending, we're able to recover the signing
 929                  * state.
 930                  */
 931                 smb_signing_cancel_reply(conn->smb1.signing,
 932                                          state->smb1.one_way_seqnum);
 933                 return NT_STATUS_OK;
 934         }
 935
 936         ret = writev_recv(state->write_req, &err);
 937         TALLOC_FREE(state->write_req);
 938         if (ret == -1) {
 939                 return map_nt_error_from_unix_common(err);
 940         }
 941
 942         return NT_STATUS_OK;
 943 }
 944
 945 void smbXcli_req_unset_pending(struct tevent_req *req)
 946 {
 947         struct smbXcli_req_state *state =
 948                 tevent_req_data(req,
 949                 struct smbXcli_req_state);
 950         struct smbXcli_conn *conn = state->conn;
 951         size_t num_pending = talloc_array_length(conn->pending);
 952         size_t i;
 953         NTSTATUS cancel_status;
 954
 955         cancel_status = smbXcli_req_cancel_write_req(req);
 956
 957         if (state->smb1.mid != 0) {
 958                 /*
 959                  * This is a [nt]trans[2] request which waits
 960                  * for more than one reply.
 961                  */
 962                 if (!NT_STATUS_IS_OK(cancel_status)) {
 963                         /*
 964                          * If the write_req cancel didn't work
 965                          * we can't use the connection anymore.
 966                          */
 967                         smbXcli_conn_disconnect(conn, cancel_status);
 968                         return;
 969                 }
 970                 return;
 971         }
 972
 973         tevent_req_set_cleanup_fn(req, NULL);
 974
 975         if (num_pending == 1) {
 976                 /*
 977                  * The pending read_smb tevent_req is a child of
 978                  * conn->pending. So if nothing is pending anymore, we need to
 979                  * delete the socket read fde.
 980                  */
 981                 /* TODO: smbXcli_conn_cancel_read_req */
 982                 TALLOC_FREE(conn->pending);
 983                 conn->read_smb_req = NULL;
 984
 985                 if (!NT_STATUS_IS_OK(cancel_status)) {
 986                         /*
 987                          * If the write_req cancel didn't work
 988                          * we can't use the connection anymore.
 989                          */
 990                         smbXcli_conn_disconnect(conn, cancel_status);
 991                         return;
 992                 }
 993                 return;
 994         }
 995
 996         for (i=0; i<num_pending; i++) {
 997                 if (req == conn->pending[i]) {
 998                         break;
 999                 }
1000         }
1001         if (i == num_pending) {
1002                 /*
1003                  * Something's seriously broken. Just returning here is the
1004                  * right thing nevertheless, the point of this routine is to
1005                  * remove ourselves from conn->pending.
1006                  */
1007
1008                 if (!NT_STATUS_IS_OK(cancel_status)) {
1009                         /*
1010                          * If the write_req cancel didn't work
1011                          * we can't use the connection anymore.
1012                          */
1013                         smbXcli_conn_disconnect(conn, cancel_status);
1014                         return;
1015                 }
1016                 return;
1017         }
1018
1019         /*
1020          * Remove ourselves from the conn->pending array
1021          */
1022         for (; i < (num_pending - 1); i++) {
1023                 conn->pending[i] = conn->pending[i+1];
1024         }
1025
1026         /*
1027          * No NULL check here, we're shrinking by sizeof(void *), and
1028          * talloc_realloc just adjusts the size for this.
1029          */
1030         conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
1031                                        num_pending - 1);
1032
1033         if (!NT_STATUS_IS_OK(cancel_status)) {
1034                 /*
1035                  * If the write_req cancel didn't work
1036                  * we can't use the connection anymore.
1037                  */
1038                 smbXcli_conn_disconnect(conn, cancel_status);
1039                 return;
1040         }
1041         return;
1042 }
1043
1044 static void smbXcli_req_cleanup(struct tevent_req *req,
1045                                 enum tevent_req_state req_state)
1046 {
1047         struct smbXcli_req_state *state =
1048                 tevent_req_data(req,
1049                 struct smbXcli_req_state);
1050         struct smbXcli_conn *conn = state->conn;
1051         NTSTATUS cancel_status;
1052
1053         switch (req_state) {
1054         case TEVENT_REQ_RECEIVED:
1055                 /*
1056                  * Make sure we really remove it from
1057                  * the pending array on destruction.
1058                  *
1059                  * smbXcli_req_unset_pending() calls
1060                  * smbXcli_req_cancel_write_req() internal
1061                  */
1062                 state->smb1.mid = 0;
1063                 smbXcli_req_unset_pending(req);
1064                 return;
1065         default:
1066                 cancel_status = smbXcli_req_cancel_write_req(req);
1067                 if (!NT_STATUS_IS_OK(cancel_status)) {
1068                         /*
1069                          * If the write_req cancel didn't work
1070                          * we can't use the connection anymore.
1071                          */
1072                         smbXcli_conn_disconnect(conn, cancel_status);
1073                         return;
1074                 }
1075                 return;
1076         }
1077 }
1078
1079 static bool smb1cli_req_cancel(struct tevent_req *req);
1080 static bool smb2cli_req_cancel(struct tevent_req *req);
1081
1082 static bool smbXcli_req_cancel(struct tevent_req *req)
1083 {
1084         struct smbXcli_req_state *state =
1085                 tevent_req_data(req,
1086                 struct smbXcli_req_state);
1087
1088         if (!smbXcli_conn_is_connected(state->conn)) {
1089                 return false;
1090         }
1091
1092         if (state->conn->protocol == PROTOCOL_NONE) {
1093                 return false;
1094         }
1095
1096         if (state->conn->protocol >= PROTOCOL_SMB2_02) {
1097                 return smb2cli_req_cancel(req);
1098         }
1099
1100         return smb1cli_req_cancel(req);
1101 }
1102
1103 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
1104
1105 bool smbXcli_req_set_pending(struct tevent_req *req)
1106 {
1107         struct smbXcli_req_state *state =
1108                 tevent_req_data(req,
1109                 struct smbXcli_req_state);
1110         struct smbXcli_conn *conn;
1111         struct tevent_req **pending;
1112         size_t num_pending;
1113
1114         conn = state->conn;
1115
1116         if (!smbXcli_conn_is_connected(conn)) {
1117                 return false;
1118         }
1119
1120         num_pending = talloc_array_length(conn->pending);
1121
1122         pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
1123                                  num_pending+1);
1124         if (pending == NULL) {
1125                 return false;
1126         }
1127         pending[num_pending] = req;
1128         conn->pending = pending;
1129         tevent_req_set_cleanup_fn(req, smbXcli_req_cleanup);
1130         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1131
1132         if (!smbXcli_conn_receive_next(conn)) {
1133                 /*
1134                  * the caller should notify the current request
1135                  *
1136                  * And all other pending requests get notified
1137                  * by smbXcli_conn_disconnect().
1138                  */
1139                 smbXcli_req_unset_pending(req);
1140                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1141                 return false;
1142         }
1143
1144         return true;
1145 }
1146
1147 static void smbXcli_conn_received(struct tevent_req *subreq);
1148
1149 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
1150 {
1151         size_t num_pending = talloc_array_length(conn->pending);
1152         struct tevent_req *req;
1153         struct smbXcli_req_state *state;
1154
1155         if (conn->read_smb_req != NULL) {
1156                 return true;
1157         }
1158
1159         if (num_pending == 0) {
1160                 if (conn->smb2.mid < UINT64_MAX) {
1161                         /* no more pending requests, so we are done for now */
1162                         return true;
1163                 }
1164
1165                 /*
1166                  * If there are no more SMB2 requests possible,
1167                  * because we are out of message ids,
1168                  * we need to disconnect.
1169                  */
1170                 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
1171                 return true;
1172         }
1173
1174         req = conn->pending[0];
1175         state = tevent_req_data(req, struct smbXcli_req_state);
1176
1177         /*
1178          * We're the first ones, add the read_smb request that waits for the
1179          * answer from the server
1180          */
1181         conn->read_smb_req = read_smb_send(conn->pending,
1182                                            state->ev,
1183                                            conn->sock_fd);
1184         if (conn->read_smb_req == NULL) {
1185                 return false;
1186         }
1187         tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
1188         return true;
1189 }
1190
1191 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
1192 {
1193         struct smbXcli_session *session;
1194         int sock_fd = conn->sock_fd;
1195
1196         tevent_queue_stop(conn->outgoing);
1197
1198         conn->sock_fd = -1;
1199
1200         session = conn->sessions;
1201         if (talloc_array_length(conn->pending) == 0) {
1202                 /*
1203                  * if we do not have pending requests
1204                  * there is no need to update the channel_sequence
1205                  */
1206                 session = NULL;
1207         }
1208         for (; session; session = session->next) {
1209                 smb2cli_session_increment_channel_sequence(session);
1210         }
1211
1212         if (conn->suicide_req != NULL) {
1213                 /*
1214                  * smbXcli_conn_samba_suicide_send()
1215                  * used tevent_req_defer_callback() already.
1216                  */
1217                 if (!NT_STATUS_IS_OK(status)) {
1218                         tevent_req_nterror(conn->suicide_req, status);
1219                 }
1220                 conn->suicide_req = NULL;
1221         }
1222
1223         /*
1224          * Cancel all pending requests. We do not do a for-loop walking
1225          * conn->pending because that array changes in
1226          * smbXcli_req_unset_pending.
1227          */
1228         while (talloc_array_length(conn->pending) > 0) {
1229                 struct tevent_req *req;
1230                 struct smbXcli_req_state *state;
1231                 struct tevent_req **chain;
1232                 size_t num_chained;
1233                 size_t i;
1234
1235                 req = conn->pending[0];
1236                 state = tevent_req_data(req, struct smbXcli_req_state);
1237
1238                 if (state->smb1.chained_requests == NULL) {
1239                         bool in_progress;
1240
1241                         /*
1242                          * We're dead. No point waiting for trans2
1243                          * replies.
1244                          */
1245                         state->smb1.mid = 0;
1246
1247                         smbXcli_req_unset_pending(req);
1248
1249                         if (NT_STATUS_IS_OK(status)) {
1250                                 /* do not notify the callers */
1251                                 continue;
1252                         }
1253
1254                         in_progress = tevent_req_is_in_progress(req);
1255                         if (!in_progress) {
1256                                 /*
1257                                  * already finished
1258                                  */
1259                                 continue;
1260                         }
1261
1262                         /*
1263                          * we need to defer the callback, because we may notify
1264                          * more then one caller.
1265                          */
1266                         tevent_req_defer_callback(req, state->ev);
1267                         tevent_req_nterror(req, status);
1268                         continue;
1269                 }
1270
1271                 chain = talloc_move(conn, &state->smb1.chained_requests);
1272                 num_chained = talloc_array_length(chain);
1273
1274                 for (i=0; i<num_chained; i++) {
1275                         bool in_progress;
1276
1277                         req = chain[i];
1278                         state = tevent_req_data(req, struct smbXcli_req_state);
1279
1280                         /*
1281                          * We're dead. No point waiting for trans2
1282                          * replies.
1283                          */
1284                         state->smb1.mid = 0;
1285
1286                         smbXcli_req_unset_pending(req);
1287
1288                         if (NT_STATUS_IS_OK(status)) {
1289                                 /* do not notify the callers */
1290                                 continue;
1291                         }
1292
1293                         in_progress = tevent_req_is_in_progress(req);
1294                         if (!in_progress) {
1295                                 /*
1296                                  * already finished
1297                                  */
1298                                 continue;
1299                         }
1300
1301                         /*
1302                          * we need to defer the callback, because we may notify
1303                          * more than one caller.
1304                          */
1305                         tevent_req_defer_callback(req, state->ev);
1306                         tevent_req_nterror(req, status);
1307                 }
1308                 TALLOC_FREE(chain);
1309         }
1310
1311         if (sock_fd != -1) {
1312                 close(sock_fd);
1313         }
1314 }
1315
1316 /*
1317  * Fetch a smb request's mid. Only valid after the request has been sent by
1318  * smb1cli_req_send().
1319  */
1320 uint16_t smb1cli_req_mid(struct tevent_req *req)
1321 {
1322         struct smbXcli_req_state *state =
1323                 tevent_req_data(req,
1324                 struct smbXcli_req_state);
1325
1326         if (state->smb1.mid != 0) {
1327                 return state->smb1.mid;
1328         }
1329
1330         return SVAL(state->smb1.hdr, HDR_MID);
1331 }
1332
1333 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1334 {
1335         struct smbXcli_req_state *state =
1336                 tevent_req_data(req,
1337                 struct smbXcli_req_state);
1338
1339         state->smb1.mid = mid;
1340 }
1341
1342 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1343 {
1344         struct smbXcli_req_state *state =
1345                 tevent_req_data(req,
1346                 struct smbXcli_req_state);
1347
1348         return state->smb1.seqnum;
1349 }
1350
1351 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1352 {
1353         struct smbXcli_req_state *state =
1354                 tevent_req_data(req,
1355                 struct smbXcli_req_state);
1356
1357         state->smb1.seqnum = seqnum;
1358 }
1359
1360 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1361 {
1362         ssize_t ret = iov_buflen(iov, count);
1363
1364         /* Ignore the overflow case for now ... */
1365         return ret;
1366 }
1367
1368 static void smb1cli_req_flags(enum protocol_types protocol,
1369                               uint32_t smb1_capabilities,
1370                               uint8_t smb_command,
1371                               uint8_t additional_flags,
1372                               uint8_t clear_flags,
1373                               uint8_t *_flags,
1374                               uint16_t additional_flags2,
1375                               uint16_t clear_flags2,
1376                               uint16_t *_flags2)
1377 {
1378         uint8_t flags = 0;
1379         uint16_t flags2 = 0;
1380
1381         if (protocol >= PROTOCOL_LANMAN1) {
1382                 flags |= FLAG_CASELESS_PATHNAMES;
1383                 flags |= FLAG_CANONICAL_PATHNAMES;
1384         }
1385
1386         if (protocol >= PROTOCOL_LANMAN2) {
1387                 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1388                 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1389         }
1390
1391         if (protocol >= PROTOCOL_NT1) {
1392                 flags2 |= FLAGS2_IS_LONG_NAME;
1393
1394                 if (smb1_capabilities & CAP_UNICODE) {
1395                         flags2 |= FLAGS2_UNICODE_STRINGS;
1396                 }
1397                 if (smb1_capabilities & CAP_STATUS32) {
1398                         flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1399                 }
1400                 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1401                         flags2 |= FLAGS2_EXTENDED_SECURITY;
1402                 }
1403         }
1404
1405         flags |= additional_flags;
1406         flags &= ~clear_flags;
1407         flags2 |= additional_flags2;
1408         flags2 &= ~clear_flags2;
1409
1410         *_flags = flags;
1411         *_flags2 = flags2;
1412 }
1413
1414 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1415
1416 static bool smb1cli_req_cancel(struct tevent_req *req)
1417 {
1418         struct smbXcli_req_state *state =
1419                 tevent_req_data(req,
1420                 struct smbXcli_req_state);
1421         uint8_t flags;
1422         uint16_t flags2;
1423         uint32_t pid;
1424         uint16_t mid;
1425         struct tevent_req *subreq;
1426         NTSTATUS status;
1427
1428         flags = CVAL(state->smb1.hdr, HDR_FLG);
1429         flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1430         pid  = SVAL(state->smb1.hdr, HDR_PID);
1431         pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1432         mid = SVAL(state->smb1.hdr, HDR_MID);
1433
1434         subreq = smb1cli_req_create(state, state->ev,
1435                                     state->conn,
1436                                     SMBntcancel,
1437                                     flags, 0,
1438                                     flags2, 0,
1439                                     0, /* timeout */
1440                                     pid,
1441                                     state->tcon,
1442                                     state->session,
1443                                     0, NULL, /* vwv */
1444                                     0, NULL); /* bytes */
1445         if (subreq == NULL) {
1446                 return false;
1447         }
1448         smb1cli_req_set_mid(subreq, mid);
1449
1450         status = smb1cli_req_chain_submit(&subreq, 1);
1451         if (!NT_STATUS_IS_OK(status)) {
1452                 TALLOC_FREE(subreq);
1453                 return false;
1454         }
1455         smb1cli_req_set_mid(subreq, 0);
1456
1457         tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1458
1459         return true;
1460 }
1461
1462 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1463 {
1464         /* we do not care about the result */
1465         TALLOC_FREE(subreq);
1466 }
1467
1468 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1469                                       struct tevent_context *ev,
1470                                       struct smbXcli_conn *conn,
1471                                       uint8_t smb_command,
1472                                       uint8_t additional_flags,
1473                                       uint8_t clear_flags,
1474                                       uint16_t additional_flags2,
1475                                       uint16_t clear_flags2,
1476                                       uint32_t timeout_msec,
1477                                       uint32_t pid,
1478                                       struct smbXcli_tcon *tcon,
1479                                       struct smbXcli_session *session,
1480                                       uint8_t wct, uint16_t *vwv,
1481                                       int iov_count,
1482                                       struct iovec *bytes_iov)
1483 {
1484         struct tevent_req *req;
1485         struct smbXcli_req_state *state;
1486         uint8_t flags = 0;
1487         uint16_t flags2 = 0;
1488         uint16_t uid = 0;
1489         uint16_t tid = 0;
1490         ssize_t num_bytes;
1491
1492         if (iov_count > MAX_SMB_IOV) {
1493                 /*
1494                  * Should not happen :-)
1495                  */
1496                 return NULL;
1497         }
1498
1499         req = tevent_req_create(mem_ctx, &state,
1500                                 struct smbXcli_req_state);
1501         if (req == NULL) {
1502                 return NULL;
1503         }
1504         state->ev = ev;
1505         state->conn = conn;
1506         state->session = session;
1507         state->tcon = tcon;
1508
1509         if (session) {
1510                 uid = session->smb1.session_id;
1511         }
1512
1513         if (tcon) {
1514                 tid = tcon->smb1.tcon_id;
1515
1516                 if (tcon->fs_attributes & FILE_CASE_SENSITIVE_SEARCH) {
1517                         clear_flags |= FLAG_CASELESS_PATHNAMES;
1518                 } else {
1519                         /* Default setting, case insensitive. */
1520                         additional_flags |= FLAG_CASELESS_PATHNAMES;
1521                 }
1522
1523                 if (smbXcli_conn_dfs_supported(conn) &&
1524                     smbXcli_tcon_is_dfs_share(tcon))
1525                 {
1526                         additional_flags2 |= FLAGS2_DFS_PATHNAMES;
1527                 }
1528         }
1529
1530         state->smb1.recv_cmd = 0xFF;
1531         state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1532         state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1533         if (state->smb1.recv_iov == NULL) {
1534                 TALLOC_FREE(req);
1535                 return NULL;
1536         }
1537
1538         smb1cli_req_flags(conn->protocol,
1539                           conn->smb1.capabilities,
1540                           smb_command,
1541                           additional_flags,
1542                           clear_flags,
1543                           &flags,
1544                           additional_flags2,
1545                           clear_flags2,
1546                           &flags2);
1547
1548         SIVAL(state->smb1.hdr, 0,           SMB_MAGIC);
1549         SCVAL(state->smb1.hdr, HDR_COM,     smb_command);
1550         SIVAL(state->smb1.hdr, HDR_RCLS,    NT_STATUS_V(NT_STATUS_OK));
1551         SCVAL(state->smb1.hdr, HDR_FLG,     flags);
1552         SSVAL(state->smb1.hdr, HDR_FLG2,    flags2);
1553         SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1554         SSVAL(state->smb1.hdr, HDR_TID,     tid);
1555         SSVAL(state->smb1.hdr, HDR_PID,     pid);
1556         SSVAL(state->smb1.hdr, HDR_UID,     uid);
1557         SSVAL(state->smb1.hdr, HDR_MID,     0); /* this comes later */
1558         SCVAL(state->smb1.hdr, HDR_WCT,     wct);
1559
1560         state->smb1.vwv = vwv;
1561
1562         num_bytes = iov_buflen(bytes_iov, iov_count);
1563         if (num_bytes == -1) {
1564                 /*
1565                  * I'd love to add a check for num_bytes<=UINT16_MAX here, but
1566                  * the smbclient->samba connections can lie and transfer more.
1567                  */
1568                 TALLOC_FREE(req);
1569                 return NULL;
1570         }
1571
1572         SSVAL(state->smb1.bytecount_buf, 0, num_bytes);
1573
1574         state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1575         state->smb1.iov[0].iov_len  = sizeof(state->length_hdr);
1576         state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1577         state->smb1.iov[1].iov_len  = sizeof(state->smb1.hdr);
1578         state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1579         state->smb1.iov[2].iov_len  = wct * sizeof(uint16_t);
1580         state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1581         state->smb1.iov[3].iov_len  = sizeof(uint16_t);
1582
1583         if (iov_count != 0) {
1584                 memcpy(&state->smb1.iov[4], bytes_iov,
1585                        iov_count * sizeof(*bytes_iov));
1586         }
1587         state->smb1.iov_count = iov_count + 4;
1588
1589         if (timeout_msec > 0) {
1590                 state->endtime = timeval_current_ofs_msec(timeout_msec);
1591                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
1592                         return req;
1593                 }
1594         }
1595
1596         switch (smb_command) {
1597         case SMBtranss:
1598         case SMBtranss2:
1599         case SMBnttranss:
1600                 state->one_way = true;
1601                 break;
1602         case SMBntcancel:
1603                 state->one_way = true;
1604                 state->smb1.one_way_seqnum = true;
1605                 break;
1606         case SMBlockingX:
1607                 if ((wct == 8) &&
1608                     (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1609                         state->one_way = true;
1610                 }
1611                 break;
1612         }
1613
1614         return req;
1615 }
1616
1617 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1618                                    struct iovec *iov, int iov_count,
1619                                    uint32_t *seqnum,
1620                                    bool one_way_seqnum)
1621 {
1622         TALLOC_CTX *frame = NULL;
1623         uint8_t *buf;
1624
1625         /*
1626          * Obvious optimization: Make cli_calculate_sign_mac work with struct
1627          * iovec directly. MD5Update would do that just fine.
1628          */
1629
1630         if (iov_count < 4) {
1631                 return NT_STATUS_INVALID_PARAMETER_MIX;
1632         }
1633         if (iov[0].iov_len != NBT_HDR_SIZE) {
1634                 return NT_STATUS_INVALID_PARAMETER_MIX;
1635         }
1636         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1637                 return NT_STATUS_INVALID_PARAMETER_MIX;
1638         }
1639         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1640                 return NT_STATUS_INVALID_PARAMETER_MIX;
1641         }
1642         if (iov[3].iov_len != sizeof(uint16_t)) {
1643                 return NT_STATUS_INVALID_PARAMETER_MIX;
1644         }
1645
1646         frame = talloc_stackframe();
1647
1648         buf = iov_concat(frame, &iov[1], iov_count - 1);
1649         if (buf == NULL) {
1650                 return NT_STATUS_NO_MEMORY;
1651         }
1652
1653         *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1654                                           one_way_seqnum);
1655         smb_signing_sign_pdu(conn->smb1.signing,
1656                              buf, talloc_get_size(buf),
1657                              *seqnum);
1658         memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1659
1660         TALLOC_FREE(frame);
1661         return NT_STATUS_OK;
1662 }
1663
1664 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1665 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1666                                                TALLOC_CTX *tmp_mem,
1667                                                uint8_t *inbuf);
1668
1669 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1670                                           struct smbXcli_req_state *state,
1671                                           struct iovec *iov, int iov_count)
1672 {
1673         struct tevent_req *subreq;
1674         NTSTATUS status;
1675         uint8_t cmd;
1676         uint16_t mid;
1677         ssize_t nbtlen;
1678
1679         if (!smbXcli_conn_is_connected(state->conn)) {
1680                 return NT_STATUS_CONNECTION_DISCONNECTED;
1681         }
1682
1683         if (state->conn->protocol > PROTOCOL_NT1) {
1684                 DBG_ERR("called for dialect[%s] server[%s]\n",
1685                         smb_protocol_types_string(state->conn->protocol),
1686                         smbXcli_conn_remote_name(state->conn));
1687                 return NT_STATUS_REVISION_MISMATCH;
1688         }
1689
1690         if (iov_count < 4) {
1691                 return NT_STATUS_INVALID_PARAMETER_MIX;
1692         }
1693         if (iov[0].iov_len != NBT_HDR_SIZE) {
1694                 return NT_STATUS_INVALID_PARAMETER_MIX;
1695         }
1696         if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1697                 return NT_STATUS_INVALID_PARAMETER_MIX;
1698         }
1699         if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1700                 return NT_STATUS_INVALID_PARAMETER_MIX;
1701         }
1702         if (iov[3].iov_len != sizeof(uint16_t)) {
1703                 return NT_STATUS_INVALID_PARAMETER_MIX;
1704         }
1705
1706         cmd = CVAL(iov[1].iov_base, HDR_COM);
1707         if (cmd == SMBreadBraw) {
1708                 if (smbXcli_conn_has_async_calls(state->conn)) {
1709                         return NT_STATUS_INVALID_PARAMETER_MIX;
1710                 }
1711                 state->conn->smb1.read_braw_req = req;
1712         }
1713
1714         if (state->smb1.mid != 0) {
1715                 mid = state->smb1.mid;
1716         } else {
1717                 mid = smb1cli_alloc_mid(state->conn);
1718         }
1719         SSVAL(iov[1].iov_base, HDR_MID, mid);
1720
1721         nbtlen = iov_buflen(&iov[1], iov_count-1);
1722         if ((nbtlen == -1) || (nbtlen > 0x1FFFF)) {
1723                 return NT_STATUS_INVALID_PARAMETER_MIX;
1724         }
1725
1726         _smb_setlen_nbt(iov[0].iov_base, nbtlen);
1727
1728         status = smb1cli_conn_signv(state->conn, iov, iov_count,
1729                                     &state->smb1.seqnum,
1730                                     state->smb1.one_way_seqnum);
1731
1732         if (!NT_STATUS_IS_OK(status)) {
1733                 return status;
1734         }
1735
1736         /*
1737          * If we supported multiple encrytion contexts
1738          * here we'd look up based on tid.
1739          */
1740         if (common_encryption_on(state->conn->smb1.trans_enc)) {
1741                 char *buf, *enc_buf;
1742
1743                 buf = (char *)iov_concat(talloc_tos(), iov, iov_count);
1744                 if (buf == NULL) {
1745                         return NT_STATUS_NO_MEMORY;
1746                 }
1747                 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1748                                                (char *)buf, &enc_buf);
1749                 TALLOC_FREE(buf);
1750                 if (!NT_STATUS_IS_OK(status)) {
1751                         DEBUG(0, ("Error in encrypting client message: %s\n",
1752                                   nt_errstr(status)));
1753                         return status;
1754                 }
1755                 buf = (char *)talloc_memdup(state, enc_buf,
1756                                             smb_len_nbt(enc_buf)+4);
1757                 SAFE_FREE(enc_buf);
1758                 if (buf == NULL) {
1759                         return NT_STATUS_NO_MEMORY;
1760                 }
1761                 iov[0].iov_base = (void *)buf;
1762                 iov[0].iov_len = talloc_get_size(buf);
1763                 iov_count = 1;
1764         }
1765
1766         if (state->conn->dispatch_incoming == NULL) {
1767                 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1768         }
1769
1770         if (!smbXcli_req_set_pending(req)) {
1771                 return NT_STATUS_NO_MEMORY;
1772         }
1773
1774         tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1775
1776         subreq = writev_send(state, state->ev, state->conn->outgoing,
1777                              state->conn->sock_fd, false, iov, iov_count);
1778         if (subreq == NULL) {
1779                 return NT_STATUS_NO_MEMORY;
1780         }
1781         tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1782         state->write_req = subreq;
1783
1784         return NT_STATUS_OK;
1785 }
1786
1787 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1788                                     struct tevent_context *ev,
1789                                     struct smbXcli_conn *conn,
1790                                     uint8_t smb_command,
1791                                     uint8_t additional_flags,
1792                                     uint8_t clear_flags,
1793                                     uint16_t additional_flags2,
1794                                     uint16_t clear_flags2,
1795                                     uint32_t timeout_msec,
1796                                     uint32_t pid,
1797                                     struct smbXcli_tcon *tcon,
1798                                     struct smbXcli_session *session,
1799                                     uint8_t wct, uint16_t *vwv,
1800                                     uint32_t num_bytes,
1801                                     const uint8_t *bytes)
1802 {
1803         struct tevent_req *req;
1804         struct iovec iov;
1805         NTSTATUS status;
1806
1807         iov.iov_base = discard_const_p(void, bytes);
1808         iov.iov_len = num_bytes;
1809
1810         req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1811                                  additional_flags, clear_flags,
1812                                  additional_flags2, clear_flags2,
1813                                  timeout_msec,
1814                                  pid, tcon, session,
1815                                  wct, vwv, 1, &iov);
1816         if (req == NULL) {
1817                 return NULL;
1818         }
1819         if (!tevent_req_is_in_progress(req)) {
1820                 return tevent_req_post(req, ev);
1821         }
1822         status = smb1cli_req_chain_submit(&req, 1);
1823         if (tevent_req_nterror(req, status)) {
1824                 return tevent_req_post(req, ev);
1825         }
1826         return req;
1827 }
1828
1829 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1830 {
1831         struct tevent_req *req =
1832                 tevent_req_callback_data(subreq,
1833                 struct tevent_req);
1834         struct smbXcli_req_state *state =
1835                 tevent_req_data(req,
1836                 struct smbXcli_req_state);
1837         ssize_t nwritten;
1838         int err;
1839
1840         state->write_req = NULL;
1841
1842         nwritten = writev_recv(subreq, &err);
1843         TALLOC_FREE(subreq);
1844         if (nwritten == -1) {
1845                 /* here, we need to notify all pending requests */
1846                 NTSTATUS status = map_nt_error_from_unix_common(err);
1847                 smbXcli_conn_disconnect(state->conn, status);
1848                 return;
1849         }
1850
1851         if (state->one_way) {
1852                 state->inbuf = NULL;
1853                 tevent_req_done(req);
1854                 return;
1855         }
1856 }
1857
1858 static void smbXcli_conn_received(struct tevent_req *subreq)
1859 {
1860         struct smbXcli_conn *conn =
1861                 tevent_req_callback_data(subreq,
1862                 struct smbXcli_conn);
1863         TALLOC_CTX *frame = talloc_stackframe();
1864         NTSTATUS status;
1865         uint8_t *inbuf;
1866         ssize_t received;
1867         int err;
1868
1869         if (subreq != conn->read_smb_req) {
1870                 DEBUG(1, ("Internal error: cli_smb_received called with "
1871                           "unexpected subreq\n"));
1872                 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1873                 TALLOC_FREE(frame);
1874                 return;
1875         }
1876         conn->read_smb_req = NULL;
1877
1878         received = read_smb_recv(subreq, frame, &inbuf, &err);
1879         TALLOC_FREE(subreq);
1880         if (received == -1) {
1881                 status = map_nt_error_from_unix_common(err);
1882                 smbXcli_conn_disconnect(conn, status);
1883                 TALLOC_FREE(frame);
1884                 return;
1885         }
1886
1887         status = conn->dispatch_incoming(conn, frame, inbuf);
1888         TALLOC_FREE(frame);
1889         if (NT_STATUS_IS_OK(status)) {
1890                 /*
1891                  * We should not do any more processing
1892                  * as the dispatch function called
1893                  * tevent_req_done().
1894                  */
1895                 return;
1896         }
1897
1898         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1899                 /*
1900                  * We got an error, so notify all pending requests
1901                  */
1902                 smbXcli_conn_disconnect(conn, status);
1903                 return;
1904         }
1905
1906         /*
1907          * We got NT_STATUS_RETRY, so we may ask for a
1908          * next incoming pdu.
1909          */
1910         if (!smbXcli_conn_receive_next(conn)) {
1911                 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1912         }
1913 }
1914
1915 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1916                                           struct iovec **piov, int *pnum_iov)
1917 {
1918         struct iovec *iov;
1919         size_t num_iov;
1920         size_t buflen;
1921         size_t taken;
1922         size_t remaining;
1923         uint8_t *hdr;
1924         uint8_t cmd;
1925         uint32_t wct_ofs;
1926         NTSTATUS status;
1927         size_t min_size = MIN_SMB_SIZE;
1928
1929         buflen = smb_len_tcp(buf);
1930         taken = 0;
1931
1932         hdr = buf + NBT_HDR_SIZE;
1933
1934         status = smb1cli_pull_raw_error(hdr);
1935         if (NT_STATUS_IS_ERR(status)) {
1936                 /*
1937                  * This is an ugly hack to support OS/2
1938                  * which skips the byte_count in the DATA block
1939                  * on some error responses.
1940                  *
1941                  * See bug #9096
1942                  */
1943                 min_size -= sizeof(uint16_t);
1944         }
1945
1946         if (buflen < min_size) {
1947                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1948         }
1949
1950         /*
1951          * This returns iovec elements in the following order:
1952          *
1953          * - SMB header
1954          *
1955          * - Parameter Block
1956          * - Data Block
1957          *
1958          * - Parameter Block
1959          * - Data Block
1960          *
1961          * - Parameter Block
1962          * - Data Block
1963          */
1964         num_iov = 1;
1965
1966         iov = talloc_array(mem_ctx, struct iovec, num_iov);
1967         if (iov == NULL) {
1968                 return NT_STATUS_NO_MEMORY;
1969         }
1970         iov[0].iov_base = hdr;
1971         iov[0].iov_len = HDR_WCT;
1972         taken += HDR_WCT;
1973
1974         cmd = CVAL(hdr, HDR_COM);
1975         wct_ofs = HDR_WCT;
1976
1977         while (true) {
1978                 size_t len = buflen - taken;
1979                 struct iovec *cur;
1980                 struct iovec *iov_tmp;
1981                 uint8_t wct;
1982                 uint32_t bcc_ofs;
1983                 uint16_t bcc;
1984                 size_t needed;
1985
1986                 /*
1987                  * we need at least WCT
1988                  */
1989                 needed = sizeof(uint8_t);
1990                 if (len < needed) {
1991                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1992                                    __location__, (int)len, (int)needed));
1993                         goto inval;
1994                 }
1995
1996                 /*
1997                  * Now we check if the specified words are there
1998                  */
1999                 wct = CVAL(hdr, wct_ofs);
2000                 needed += wct * sizeof(uint16_t);
2001                 if (len < needed) {
2002                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2003                                    __location__, (int)len, (int)needed));
2004                         goto inval;
2005                 }
2006
2007                 if ((num_iov == 1) &&
2008                     (len == needed) &&
2009                     NT_STATUS_IS_ERR(status))
2010                 {
2011                         /*
2012                          * This is an ugly hack to support OS/2
2013                          * which skips the byte_count in the DATA block
2014                          * on some error responses.
2015                          *
2016                          * See bug #9096
2017                          */
2018                         iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2019                                                  num_iov + 2);
2020                         if (iov_tmp == NULL) {
2021                                 TALLOC_FREE(iov);
2022                                 return NT_STATUS_NO_MEMORY;
2023                         }
2024                         iov = iov_tmp;
2025                         cur = &iov[num_iov];
2026                         num_iov += 2;
2027
2028                         cur[0].iov_len = 0;
2029                         cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2030                         cur[1].iov_len = 0;
2031                         cur[1].iov_base = cur[0].iov_base;
2032
2033                         taken += needed;
2034                         break;
2035                 }
2036
2037                 /*
2038                  * we need at least BCC
2039                  */
2040                 needed += sizeof(uint16_t);
2041                 if (len < needed) {
2042                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2043                                    __location__, (int)len, (int)needed));
2044                         goto inval;
2045                 }
2046
2047                 /*
2048                  * Now we check if the specified bytes are there
2049                  */
2050                 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
2051                 bcc = SVAL(hdr, bcc_ofs);
2052                 needed += bcc * sizeof(uint8_t);
2053                 if (len < needed) {
2054                         DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2055                                    __location__, (int)len, (int)needed));
2056                         goto inval;
2057                 }
2058
2059                 /*
2060                  * we allocate 2 iovec structures for words and bytes
2061                  */
2062                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2063                                          num_iov + 2);
2064                 if (iov_tmp == NULL) {
2065                         TALLOC_FREE(iov);
2066                         return NT_STATUS_NO_MEMORY;
2067                 }
2068                 iov = iov_tmp;
2069                 cur = &iov[num_iov];
2070                 num_iov += 2;
2071
2072                 cur[0].iov_len = wct * sizeof(uint16_t);
2073                 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2074                 cur[1].iov_len = bcc * sizeof(uint8_t);
2075                 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
2076
2077                 taken += needed;
2078
2079                 if (!smb1cli_is_andx_req(cmd)) {
2080                         /*
2081                          * If the current command does not have AndX chanining
2082                          * we are done.
2083                          */
2084                         break;
2085                 }
2086
2087                 if (wct == 0 && bcc == 0) {
2088                         /*
2089                          * An empty response also ends the chain,
2090                          * most likely with an error.
2091                          */
2092                         break;
2093                 }
2094
2095                 if (wct < 2) {
2096                         DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
2097                                    __location__, (int)wct, (int)cmd));
2098                         goto inval;
2099                 }
2100                 cmd = CVAL(cur[0].iov_base, 0);
2101                 if (cmd == 0xFF) {
2102                         /*
2103                          * If it is the end of the chain we are also done.
2104                          */
2105                         break;
2106                 }
2107                 wct_ofs = SVAL(cur[0].iov_base, 2);
2108
2109                 if (wct_ofs < taken) {
2110                         goto inval;
2111                 }
2112                 if (wct_ofs > buflen) {
2113                         goto inval;
2114                 }
2115
2116                 /*
2117                  * we consumed everything up to the start of the next
2118                  * parameter block.
2119                  */
2120                 taken = wct_ofs;
2121         }
2122
2123         remaining = buflen - taken;
2124
2125         if (remaining > 0 && num_iov >= 3) {
2126                 /*
2127                  * The last DATA block gets the remaining
2128                  * bytes, this is needed to support
2129                  * CAP_LARGE_WRITEX and CAP_LARGE_READX.
2130                  */
2131                 iov[num_iov-1].iov_len += remaining;
2132         }
2133
2134         *piov = iov;
2135         *pnum_iov = num_iov;
2136         return NT_STATUS_OK;
2137
2138 inval:
2139         TALLOC_FREE(iov);
2140         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2141 }
2142
2143 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2144                                                TALLOC_CTX *tmp_mem,
2145                                                uint8_t *inbuf)
2146 {
2147         struct tevent_req *req;
2148         struct smbXcli_req_state *state;
2149         NTSTATUS status;
2150         size_t num_pending;
2151         size_t i;
2152         uint8_t cmd;
2153         uint16_t mid;
2154         bool oplock_break;
2155         uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
2156         size_t len = smb_len_tcp(inbuf);
2157         struct iovec *iov = NULL;
2158         int num_iov = 0;
2159         struct tevent_req **chain = NULL;
2160         size_t num_chained = 0;
2161         size_t num_responses = 0;
2162
2163         if (conn->smb1.read_braw_req != NULL) {
2164                 req = conn->smb1.read_braw_req;
2165                 conn->smb1.read_braw_req = NULL;
2166                 state = tevent_req_data(req, struct smbXcli_req_state);
2167
2168                 smbXcli_req_unset_pending(req);
2169
2170                 if (state->smb1.recv_iov == NULL) {
2171                         /*
2172                          * For requests with more than
2173                          * one response, we have to readd the
2174                          * recv_iov array.
2175                          */
2176                         state->smb1.recv_iov = talloc_zero_array(state,
2177                                                                  struct iovec,
2178                                                                  3);
2179                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2180                                 return NT_STATUS_OK;
2181                         }
2182                 }
2183
2184                 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
2185                 state->smb1.recv_iov[0].iov_len = len;
2186                 ZERO_STRUCT(state->smb1.recv_iov[1]);
2187                 ZERO_STRUCT(state->smb1.recv_iov[2]);
2188
2189                 state->smb1.recv_cmd = SMBreadBraw;
2190                 state->smb1.recv_status = NT_STATUS_OK;
2191                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2192
2193                 tevent_req_done(req);
2194                 return NT_STATUS_OK;
2195         }
2196
2197         if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
2198             && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
2199                 DEBUG(10, ("Got non-SMB PDU\n"));
2200                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2201         }
2202
2203         /*
2204          * If we supported multiple encrytion contexts
2205          * here we'd look up based on tid.
2206          */
2207         if (common_encryption_on(conn->smb1.trans_enc)
2208             && (CVAL(inbuf, 0) == 0)) {
2209                 uint16_t enc_ctx_num;
2210
2211                 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
2212                 if (!NT_STATUS_IS_OK(status)) {
2213                         DEBUG(10, ("get_enc_ctx_num returned %s\n",
2214                                    nt_errstr(status)));
2215                         return status;
2216                 }
2217
2218                 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
2219                         DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
2220                                    enc_ctx_num,
2221                                    conn->smb1.trans_enc->enc_ctx_num));
2222                         return NT_STATUS_INVALID_HANDLE;
2223                 }
2224
2225                 status = common_decrypt_buffer(conn->smb1.trans_enc,
2226                                                (char *)inbuf);
2227                 if (!NT_STATUS_IS_OK(status)) {
2228                         DEBUG(10, ("common_decrypt_buffer returned %s\n",
2229                                    nt_errstr(status)));
2230                         return status;
2231                 }
2232                 inhdr = inbuf + NBT_HDR_SIZE;
2233                 len = smb_len_nbt(inbuf);
2234         }
2235
2236         mid = SVAL(inhdr, HDR_MID);
2237         num_pending = talloc_array_length(conn->pending);
2238
2239         for (i=0; i<num_pending; i++) {
2240                 if (mid == smb1cli_req_mid(conn->pending[i])) {
2241                         break;
2242                 }
2243         }
2244         if (i == num_pending) {
2245                 /* Dump unexpected reply */
2246                 return NT_STATUS_RETRY;
2247         }
2248
2249         oplock_break = false;
2250
2251         if (mid == 0xffff) {
2252                 /*
2253                  * Paranoia checks that this is really an oplock break request.
2254                  */
2255                 oplock_break = (len == 51); /* hdr + 8 words */
2256                 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
2257                 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
2258                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
2259                 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
2260
2261                 if (!oplock_break) {
2262                         /* Dump unexpected reply */
2263                         return NT_STATUS_RETRY;
2264                 }
2265         }
2266
2267         req = conn->pending[i];
2268         state = tevent_req_data(req, struct smbXcli_req_state);
2269
2270         if (!oplock_break /* oplock breaks are not signed */
2271             && !smb_signing_check_pdu(conn->smb1.signing,
2272                                       inhdr, len, state->smb1.seqnum+1)) {
2273                 DEBUG(10, ("cli_check_sign_mac failed\n"));
2274                 return NT_STATUS_ACCESS_DENIED;
2275         }
2276
2277         status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
2278                                            &iov, &num_iov);
2279         if (!NT_STATUS_IS_OK(status)) {
2280                 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
2281                           nt_errstr(status)));
2282                 return status;
2283         }
2284
2285         cmd = CVAL(inhdr, HDR_COM);
2286         status = smb1cli_pull_raw_error(inhdr);
2287
2288         if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2289             (state->session != NULL) && state->session->disconnect_expired)
2290         {
2291                 /*
2292                  * this should be a short term hack
2293                  * until the upper layers have implemented
2294                  * re-authentication.
2295                  */
2296                 return status;
2297         }
2298
2299         if (state->smb1.chained_requests == NULL) {
2300                 if (num_iov != 3) {
2301                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
2302                 }
2303
2304                 smbXcli_req_unset_pending(req);
2305
2306                 if (state->smb1.recv_iov == NULL) {
2307                         /*
2308                          * For requests with more than
2309                          * one response, we have to readd the
2310                          * recv_iov array.
2311                          */
2312                         state->smb1.recv_iov = talloc_zero_array(state,
2313                                                                  struct iovec,
2314                                                                  3);
2315                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2316                                 return NT_STATUS_OK;
2317                         }
2318                 }
2319
2320                 state->smb1.recv_cmd = cmd;
2321                 state->smb1.recv_status = status;
2322                 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2323
2324                 state->smb1.recv_iov[0] = iov[0];
2325                 state->smb1.recv_iov[1] = iov[1];
2326                 state->smb1.recv_iov[2] = iov[2];
2327
2328                 if (talloc_array_length(conn->pending) == 0) {
2329                         tevent_req_done(req);
2330                         return NT_STATUS_OK;
2331                 }
2332
2333                 tevent_req_defer_callback(req, state->ev);
2334                 tevent_req_done(req);
2335                 return NT_STATUS_RETRY;
2336         }
2337
2338         chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2339         num_chained = talloc_array_length(chain);
2340         num_responses = (num_iov - 1)/2;
2341
2342         if (num_responses > num_chained) {
2343                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2344         }
2345
2346         for (i=0; i<num_chained; i++) {
2347                 size_t iov_idx = 1 + (i*2);
2348                 struct iovec *cur = &iov[iov_idx];
2349                 uint8_t *inbuf_ref;
2350
2351                 req = chain[i];
2352                 state = tevent_req_data(req, struct smbXcli_req_state);
2353
2354                 smbXcli_req_unset_pending(req);
2355
2356                 /*
2357                  * as we finish multiple requests here
2358                  * we need to defer the callbacks as
2359                  * they could destroy our current stack state.
2360                  */
2361                 tevent_req_defer_callback(req, state->ev);
2362
2363                 if (i >= num_responses) {
2364                         tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2365                         continue;
2366                 }
2367
2368                 if (state->smb1.recv_iov == NULL) {
2369                         /*
2370                          * For requests with more than
2371                          * one response, we have to readd the
2372                          * recv_iov array.
2373                          */
2374                         state->smb1.recv_iov = talloc_zero_array(state,
2375                                                                  struct iovec,
2376                                                                  3);
2377                         if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2378                                 continue;
2379                         }
2380                 }
2381
2382                 state->smb1.recv_cmd = cmd;
2383
2384                 if (i == (num_responses - 1)) {
2385                         /*
2386                          * The last request in the chain gets the status
2387                          */
2388                         state->smb1.recv_status = status;
2389                 } else {
2390                         cmd = CVAL(cur[0].iov_base, 0);
2391                         state->smb1.recv_status = NT_STATUS_OK;
2392                 }
2393
2394                 state->inbuf = inbuf;
2395
2396                 /*
2397                  * Note: here we use talloc_reference() in a way
2398                  *       that does not expose it to the caller.
2399                  */
2400                 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2401                 if (tevent_req_nomem(inbuf_ref, req)) {
2402                         continue;
2403                 }
2404
2405                 /* copy the related buffers */
2406                 state->smb1.recv_iov[0] = iov[0];
2407                 state->smb1.recv_iov[1] = cur[0];
2408                 state->smb1.recv_iov[2] = cur[1];
2409
2410                 tevent_req_done(req);
2411         }
2412
2413         return NT_STATUS_RETRY;
2414 }
2415
2416 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2417                           TALLOC_CTX *mem_ctx,
2418                           struct iovec **piov,
2419                           uint8_t **phdr,
2420                           uint8_t *pwct,
2421                           uint16_t **pvwv,
2422                           uint32_t *pvwv_offset,
2423                           uint32_t *pnum_bytes,
2424                           uint8_t **pbytes,
2425                           uint32_t *pbytes_offset,
2426                           uint8_t **pinbuf,
2427                           const struct smb1cli_req_expected_response *expected,
2428                           size_t num_expected)
2429 {
2430         struct smbXcli_req_state *state =
2431                 tevent_req_data(req,
2432                 struct smbXcli_req_state);
2433         NTSTATUS status = NT_STATUS_OK;
2434         struct iovec *recv_iov = NULL;
2435         uint8_t *hdr = NULL;
2436         uint8_t wct = 0;
2437         uint32_t vwv_offset = 0;
2438         uint16_t *vwv = NULL;
2439         uint32_t num_bytes = 0;
2440         uint32_t bytes_offset = 0;
2441         uint8_t *bytes = NULL;
2442         size_t i;
2443         bool found_status = false;
2444         bool found_size = false;
2445
2446         if (piov != NULL) {
2447                 *piov = NULL;
2448         }
2449         if (phdr != NULL) {
2450                 *phdr = 0;
2451         }
2452         if (pwct != NULL) {
2453                 *pwct = 0;
2454         }
2455         if (pvwv != NULL) {
2456                 *pvwv = NULL;
2457         }
2458         if (pvwv_offset != NULL) {
2459                 *pvwv_offset = 0;
2460         }
2461         if (pnum_bytes != NULL) {
2462                 *pnum_bytes = 0;
2463         }
2464         if (pbytes != NULL) {
2465                 *pbytes = NULL;
2466         }
2467         if (pbytes_offset != NULL) {
2468                 *pbytes_offset = 0;
2469         }
2470         if (pinbuf != NULL) {
2471                 *pinbuf = NULL;
2472         }
2473
2474         if (state->inbuf != NULL) {
2475                 recv_iov = state->smb1.recv_iov;
2476                 state->smb1.recv_iov = NULL;
2477                 if (state->smb1.recv_cmd != SMBreadBraw) {
2478                         hdr = (uint8_t *)recv_iov[0].iov_base;
2479                         wct = recv_iov[1].iov_len/2;
2480                         vwv = (uint16_t *)recv_iov[1].iov_base;
2481                         vwv_offset = PTR_DIFF(vwv, hdr);
2482                         num_bytes = recv_iov[2].iov_len;
2483                         bytes = (uint8_t *)recv_iov[2].iov_base;
2484                         bytes_offset = PTR_DIFF(bytes, hdr);
2485                 }
2486         }
2487
2488         if (tevent_req_is_nterror(req, &status)) {
2489                 for (i=0; i < num_expected; i++) {
2490                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
2491                                 found_status = true;
2492                                 break;
2493                         }
2494                 }
2495
2496                 if (found_status) {
2497                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2498                 }
2499
2500                 return status;
2501         }
2502
2503         if (num_expected == 0) {
2504                 found_status = true;
2505                 found_size = true;
2506         }
2507
2508         status = state->smb1.recv_status;
2509
2510         for (i=0; i < num_expected; i++) {
2511                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2512                         continue;
2513                 }
2514
2515                 found_status = true;
2516                 if (expected[i].wct == 0) {
2517                         found_size = true;
2518                         break;
2519                 }
2520
2521                 if (expected[i].wct == wct) {
2522                         found_size = true;
2523                         break;
2524                 }
2525         }
2526
2527         if (!found_status) {
2528                 return status;
2529         }
2530
2531         if (!found_size) {
2532                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2533         }
2534
2535         if (piov != NULL) {
2536                 *piov = talloc_move(mem_ctx, &recv_iov);
2537         }
2538
2539         if (phdr != NULL) {
2540                 *phdr = hdr;
2541         }
2542         if (pwct != NULL) {
2543                 *pwct = wct;
2544         }
2545         if (pvwv != NULL) {
2546                 *pvwv = vwv;
2547         }
2548         if (pvwv_offset != NULL) {
2549                 *pvwv_offset = vwv_offset;
2550         }
2551         if (pnum_bytes != NULL) {
2552                 *pnum_bytes = num_bytes;
2553         }
2554         if (pbytes != NULL) {
2555                 *pbytes = bytes;
2556         }
2557         if (pbytes_offset != NULL) {
2558                 *pbytes_offset = bytes_offset;
2559         }
2560         if (pinbuf != NULL) {
2561                 *pinbuf = state->inbuf;
2562         }
2563
2564         return status;
2565 }
2566
2567 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2568 {
2569         size_t wct_ofs;
2570         int i;
2571
2572         wct_ofs = HDR_WCT;
2573
2574         for (i=0; i<num_reqs; i++) {
2575                 struct smbXcli_req_state *state;
2576                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2577                 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2578                                            state->smb1.iov_count-2);
2579                 wct_ofs = (wct_ofs + 3) & ~3;
2580         }
2581         return wct_ofs;
2582 }
2583
2584 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2585 {
2586         struct smbXcli_req_state *first_state =
2587                 tevent_req_data(reqs[0],
2588                 struct smbXcli_req_state);
2589         struct smbXcli_req_state *state;
2590         size_t wct_offset;
2591         size_t chain_padding = 0;
2592         int i, iovlen;
2593         struct iovec *iov = NULL;
2594         struct iovec *this_iov;
2595         NTSTATUS status;
2596         ssize_t nbt_len;
2597
2598         if (num_reqs == 1) {
2599                 return smb1cli_req_writev_submit(reqs[0], first_state,
2600                                                  first_state->smb1.iov,
2601                                                  first_state->smb1.iov_count);
2602         }
2603
2604         iovlen = 0;
2605         for (i=0; i<num_reqs; i++) {
2606                 if (!tevent_req_is_in_progress(reqs[i])) {
2607                         return NT_STATUS_INTERNAL_ERROR;
2608                 }
2609
2610                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2611
2612                 if (state->smb1.iov_count < 4) {
2613                         return NT_STATUS_INVALID_PARAMETER_MIX;
2614                 }
2615
2616                 if (i == 0) {
2617                         /*
2618                          * The NBT and SMB header
2619                          */
2620                         iovlen += 2;
2621                 } else {
2622                         /*
2623                          * Chain padding
2624                          */
2625                         iovlen += 1;
2626                 }
2627
2628                 /*
2629                  * words and bytes
2630                  */
2631                 iovlen += state->smb1.iov_count - 2;
2632         }
2633
2634         iov = talloc_zero_array(first_state, struct iovec, iovlen);
2635         if (iov == NULL) {
2636                 return NT_STATUS_NO_MEMORY;
2637         }
2638
2639         first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2640                 first_state, reqs, sizeof(*reqs) * num_reqs);
2641         if (first_state->smb1.chained_requests == NULL) {
2642                 TALLOC_FREE(iov);
2643                 return NT_STATUS_NO_MEMORY;
2644         }
2645
2646         wct_offset = HDR_WCT;
2647         this_iov = iov;
2648
2649         for (i=0; i<num_reqs; i++) {
2650                 size_t next_padding = 0;
2651                 uint16_t *vwv;
2652
2653                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2654
2655                 if (i < num_reqs-1) {
2656                         if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2657                             || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2658                                 TALLOC_FREE(iov);
2659                                 TALLOC_FREE(first_state->smb1.chained_requests);
2660                                 return NT_STATUS_INVALID_PARAMETER_MIX;
2661                         }
2662                 }
2663
2664                 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2665                                               state->smb1.iov_count-2) + 1;
2666                 if ((wct_offset % 4) != 0) {
2667                         next_padding = 4 - (wct_offset % 4);
2668                 }
2669                 wct_offset += next_padding;
2670                 vwv = state->smb1.vwv;
2671
2672                 if (i < num_reqs-1) {
2673                         struct smbXcli_req_state *next_state =
2674                                 tevent_req_data(reqs[i+1],
2675                                 struct smbXcli_req_state);
2676                         SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2677                         SCVAL(vwv+0, 1, 0);
2678                         SSVAL(vwv+1, 0, wct_offset);
2679                 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2680                         /* properly end the chain */
2681                         SCVAL(vwv+0, 0, 0xff);
2682                         SCVAL(vwv+0, 1, 0xff);
2683                         SSVAL(vwv+1, 0, 0);
2684                 }
2685
2686                 if (i == 0) {
2687                         /*
2688                          * The NBT and SMB header
2689                          */
2690                         this_iov[0] = state->smb1.iov[0];
2691                         this_iov[1] = state->smb1.iov[1];
2692                         this_iov += 2;
2693                 } else {
2694                         /*
2695                          * This one is a bit subtle. We have to add
2696                          * chain_padding bytes between the requests, and we
2697                          * have to also include the wct field of the
2698                          * subsequent requests. We use the subsequent header
2699                          * for the padding, it contains the wct field in its
2700                          * last byte.
2701                          */
2702                         this_iov[0].iov_len = chain_padding+1;
2703                         this_iov[0].iov_base = (void *)&state->smb1.hdr[
2704                                 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2705                         memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2706                         this_iov += 1;
2707                 }
2708
2709                 /*
2710                  * copy the words and bytes
2711                  */
2712                 memcpy(this_iov, state->smb1.iov+2,
2713                        sizeof(struct iovec) * (state->smb1.iov_count-2));
2714                 this_iov += state->smb1.iov_count - 2;
2715                 chain_padding = next_padding;
2716         }
2717
2718         nbt_len = iov_buflen(&iov[1], iovlen-1);
2719         if ((nbt_len == -1) || (nbt_len > first_state->conn->smb1.max_xmit)) {
2720                 TALLOC_FREE(iov);
2721                 TALLOC_FREE(first_state->smb1.chained_requests);
2722                 return NT_STATUS_INVALID_PARAMETER_MIX;
2723         }
2724
2725         status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2726         if (!NT_STATUS_IS_OK(status)) {
2727                 TALLOC_FREE(iov);
2728                 TALLOC_FREE(first_state->smb1.chained_requests);
2729                 return status;
2730         }
2731
2732         return NT_STATUS_OK;
2733 }
2734
2735 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2736 {
2737         return ((tevent_queue_length(conn->outgoing) != 0)
2738                 || (talloc_array_length(conn->pending) != 0));
2739 }
2740
2741 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn)
2742 {
2743         if (conn->protocol >= PROTOCOL_SMB2_02) {
2744                 return (smb2cli_conn_server_capabilities(conn) & SMB2_CAP_DFS);
2745         }
2746
2747         return (smb1cli_conn_capabilities(conn) & CAP_DFS);
2748 }
2749
2750 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2751 {
2752         uint16_t credits = 1;
2753
2754         if (conn->smb2.cur_credits == 0) {
2755                 if (max_dyn_len != NULL) {
2756                         *max_dyn_len = 0;
2757                 }
2758                 return false;
2759         }
2760
2761         if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2762                 credits = conn->smb2.cur_credits;
2763         }
2764
2765         if (max_dyn_len != NULL) {
2766                 *max_dyn_len = credits * 65536;
2767         }
2768
2769         return true;
2770 }
2771
2772 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2773 {
2774         return conn->smb2.server.capabilities;
2775 }
2776
2777 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2778 {
2779         return conn->smb2.server.security_mode;
2780 }
2781
2782 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2783 {
2784         return conn->smb2.server.max_trans_size;
2785 }
2786
2787 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2788 {
2789         return conn->smb2.server.max_read_size;
2790 }
2791
2792 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2793 {
2794         return conn->smb2.server.max_write_size;
2795 }
2796
2797 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2798                                   uint16_t max_credits)
2799 {
2800         conn->smb2.max_credits = max_credits;
2801 }
2802
2803 uint16_t smb2cli_conn_get_cur_credits(struct smbXcli_conn *conn)
2804 {
2805         return conn->smb2.cur_credits;
2806 }
2807
2808 uint8_t smb2cli_conn_get_io_priority(struct smbXcli_conn *conn)
2809 {
2810         if (conn->protocol < PROTOCOL_SMB3_11) {
2811                 return 0;
2812         }
2813
2814         return conn->smb2.io_priority;
2815 }
2816
2817 void smb2cli_conn_set_io_priority(struct smbXcli_conn *conn,
2818                                   uint8_t io_priority)
2819 {
2820         conn->smb2.io_priority = io_priority;
2821 }
2822
2823 uint32_t smb2cli_conn_cc_chunk_len(struct smbXcli_conn *conn)
2824 {
2825         return conn->smb2.cc_chunk_len;
2826 }
2827
2828 void smb2cli_conn_set_cc_chunk_len(struct smbXcli_conn *conn,
2829                                     uint32_t chunk_len)
2830 {
2831         conn->smb2.cc_chunk_len = chunk_len;
2832 }
2833
2834 uint32_t smb2cli_conn_cc_max_chunks(struct smbXcli_conn *conn)
2835 {
2836         return conn->smb2.cc_max_chunks;
2837 }
2838
2839 void smb2cli_conn_set_cc_max_chunks(struct smbXcli_conn *conn,
2840                                     uint32_t max_chunks)
2841 {
2842         conn->smb2.cc_max_chunks = max_chunks;
2843 }
2844
2845 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2846
2847 static bool smb2cli_req_cancel(struct tevent_req *req)
2848 {
2849         struct smbXcli_req_state *state =
2850                 tevent_req_data(req,
2851                 struct smbXcli_req_state);
2852         struct smbXcli_tcon *tcon = state->tcon;
2853         struct smbXcli_session *session = state->session;
2854         uint8_t *fixed = state->smb2.pad;
2855         uint16_t fixed_len = 4;
2856         struct tevent_req *subreq;
2857         struct smbXcli_req_state *substate;
2858         NTSTATUS status;
2859
2860         SSVAL(fixed, 0, 0x04);
2861         SSVAL(fixed, 2, 0);
2862
2863         subreq = smb2cli_req_create(state, state->ev,
2864                                     state->conn,
2865                                     SMB2_OP_CANCEL,
2866                                     0, 0, /* flags */
2867                                     0, /* timeout */
2868                                     tcon, session,
2869                                     fixed, fixed_len,
2870                                     NULL, 0, 0);
2871         if (subreq == NULL) {
2872                 return false;
2873         }
2874         substate = tevent_req_data(subreq, struct smbXcli_req_state);
2875
2876         SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, state->smb2.cancel_flags);
2877         SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, state->smb2.cancel_mid);
2878         SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, state->smb2.cancel_aid);
2879
2880         status = smb2cli_req_compound_submit(&subreq, 1);
2881         if (!NT_STATUS_IS_OK(status)) {
2882                 TALLOC_FREE(subreq);
2883                 return false;
2884         }
2885
2886         tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2887
2888         return true;
2889 }
2890
2891 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2892 {
2893         /* we do not care about the result */
2894         TALLOC_FREE(subreq);
2895 }
2896
2897 struct timeval smbXcli_req_endtime(struct tevent_req *req)
2898 {
2899         struct smbXcli_req_state *state = tevent_req_data(
2900                 req, struct smbXcli_req_state);
2901
2902         return state->endtime;
2903 }
2904
2905 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2906                                       struct tevent_context *ev,
2907                                       struct smbXcli_conn *conn,
2908                                       uint16_t cmd,
2909                                       uint32_t additional_flags,
2910                                       uint32_t clear_flags,
2911                                       uint32_t timeout_msec,
2912                                       struct smbXcli_tcon *tcon,
2913                                       struct smbXcli_session *session,
2914                                       const uint8_t *fixed,
2915                                       uint16_t fixed_len,
2916                                       const uint8_t *dyn,
2917                                       uint32_t dyn_len,
2918                                       uint32_t max_dyn_len)
2919 {
2920         struct tevent_req *req;
2921         struct smbXcli_req_state *state;
2922         uint32_t flags = 0;
2923         uint32_t tid = 0;
2924         uint64_t uid = 0;
2925         bool use_channel_sequence = conn->smb2.force_channel_sequence;
2926         uint16_t channel_sequence = 0;
2927         bool use_replay_flag = false;
2928
2929         req = tevent_req_create(mem_ctx, &state,
2930                                 struct smbXcli_req_state);
2931         if (req == NULL) {
2932                 return NULL;
2933         }
2934
2935         state->ev = ev;
2936         state->conn = conn;
2937         state->session = session;
2938         state->tcon = tcon;
2939
2940         if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
2941                 use_channel_sequence = true;
2942         } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
2943                 use_channel_sequence = true;
2944         }
2945
2946         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_00) {
2947                 use_replay_flag = true;
2948         }
2949
2950         if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_11) {
2951                 flags |= SMB2_PRIORITY_VALUE_TO_MASK(conn->smb2.io_priority);
2952         }
2953
2954         if (session) {
2955                 uid = session->smb2->session_id;
2956
2957                 if (use_channel_sequence) {
2958                         channel_sequence = session->smb2->channel_sequence;
2959                 }
2960
2961                 if (use_replay_flag && session->smb2->replay_active) {
2962                         additional_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
2963                 }
2964
2965                 state->smb2.should_sign = session->smb2->should_sign;
2966                 state->smb2.should_encrypt = session->smb2->should_encrypt;
2967                 state->smb2.require_signed_response =
2968                         session->smb2->require_signed_response;
2969
2970                 if (cmd == SMB2_OP_SESSSETUP &&
2971                     session->smb2_channel.signing_key.length == 0 &&
2972                     session->smb2->signing_key.length != 0)
2973                 {
2974                         /*
2975                          * a session bind needs to be signed
2976                          */
2977                         state->smb2.should_sign = true;
2978                 }
2979
2980                 if (cmd == SMB2_OP_SESSSETUP &&
2981                     session->smb2_channel.signing_key.length == 0) {
2982                         state->smb2.should_encrypt = false;
2983                 }
2984
2985                 if (additional_flags & SMB2_HDR_FLAG_SIGNED) {
2986                         if (session->smb2_channel.signing_key.length == 0) {
2987                                 tevent_req_nterror(req, NT_STATUS_NO_USER_SESSION_KEY);
2988                                 return req;
2989                         }
2990
2991                         additional_flags &= ~SMB2_HDR_FLAG_SIGNED;
2992                         state->smb2.should_sign = true;
2993                 }
2994         }
2995
2996         if (tcon) {
2997                 tid = tcon->smb2.tcon_id;
2998
2999                 if (tcon->smb2.should_sign) {
3000                         state->smb2.should_sign = true;
3001                 }
3002                 if (tcon->smb2.should_encrypt) {
3003                         state->smb2.should_encrypt = true;
3004                 }
3005         }
3006
3007         if (state->smb2.should_encrypt) {
3008                 state->smb2.should_sign = false;
3009         }
3010
3011         state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
3012         if (state->smb2.recv_iov == NULL) {
3013                 TALLOC_FREE(req);
3014                 return NULL;
3015         }
3016
3017         flags |= additional_flags;
3018         flags &= ~clear_flags;
3019
3020         state->smb2.fixed = fixed;
3021         state->smb2.fixed_len = fixed_len;
3022         state->smb2.dyn = dyn;
3023         state->smb2.dyn_len = dyn_len;
3024         state->smb2.max_dyn_len = max_dyn_len;
3025
3026         if (state->smb2.should_encrypt) {
3027                 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3028                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
3029         }
3030
3031         SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID,    SMB2_MAGIC);
3032         SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH,         SMB2_HDR_BODY);
3033         SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE,         cmd);
3034         SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
3035         SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS,          flags);
3036         SIVAL(state->smb2.hdr, SMB2_HDR_PID,            0); /* reserved */
3037         SIVAL(state->smb2.hdr, SMB2_HDR_TID,            tid);
3038         SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID,     uid);
3039
3040         switch (cmd) {
3041         case SMB2_OP_CANCEL:
3042                 state->one_way = true;
3043                 break;
3044         case SMB2_OP_BREAK:
3045                 /*
3046                  * If this is a dummy request, it will have
3047                  * UINT64_MAX as message id.
3048                  * If we send on break acknowledgement,
3049                  * this gets overwritten later.
3050                  */
3051                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
3052                 break;
3053         }
3054
3055         if (timeout_msec > 0) {
3056                 state->endtime = timeval_current_ofs_msec(timeout_msec);
3057                 if (!tevent_req_set_endtime(req, ev, state->endtime)) {
3058                         return req;
3059                 }
3060         }
3061
3062         return req;
3063 }
3064
3065 void smb2cli_req_set_notify_async(struct tevent_req *req)
3066 {
3067         struct smbXcli_req_state *state =
3068                 tevent_req_data(req,
3069                 struct smbXcli_req_state);
3070
3071         state->smb2.notify_async = true;
3072 }
3073
3074 static void smb2cli_req_writev_done(struct tevent_req *subreq);
3075 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3076                                                TALLOC_CTX *tmp_mem,
3077                                                uint8_t *inbuf);
3078
3079 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
3080                                      int num_reqs)
3081 {
3082         struct smbXcli_req_state *state;
3083         struct tevent_req *subreq;
3084         struct iovec *iov;
3085         int i, num_iov, nbt_len;
3086         int tf_iov = -1;
3087         const DATA_BLOB *encryption_key = NULL;
3088         uint64_t encryption_session_id = 0;
3089         uint64_t nonce_high = UINT64_MAX;
3090         uint64_t nonce_low = UINT64_MAX;
3091
3092         /*
3093          * 1 for the nbt length, optional TRANSFORM
3094          * per request: HDR, fixed, dyn, padding
3095          * -1 because the last one does not need padding
3096          */
3097
3098         iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
3099         if (iov == NULL) {
3100                 return NT_STATUS_NO_MEMORY;
3101         }
3102
3103         num_iov = 1;
3104         nbt_len = 0;
3105
3106         /*
3107          * the session of the first request that requires encryption
3108          * specifies the encryption key.
3109          */
3110         for (i=0; i<num_reqs; i++) {
3111                 if (!tevent_req_is_in_progress(reqs[i])) {
3112                         return NT_STATUS_INTERNAL_ERROR;
3113                 }
3114
3115                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3116
3117                 if (!smbXcli_conn_is_connected(state->conn)) {
3118                         return NT_STATUS_CONNECTION_DISCONNECTED;
3119                 }
3120
3121                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3122                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3123                         return NT_STATUS_REVISION_MISMATCH;
3124                 }
3125
3126                 if (state->session == NULL) {
3127                         continue;
3128                 }
3129
3130                 if (!state->smb2.should_encrypt) {
3131                         continue;
3132                 }
3133
3134                 encryption_key = &state->session->smb2->encryption_key;
3135                 if (encryption_key->length == 0) {
3136                         return NT_STATUS_INVALID_PARAMETER_MIX;
3137                 }
3138
3139                 encryption_session_id = state->session->smb2->session_id;
3140
3141                 state->session->smb2->nonce_low += 1;
3142                 if (state->session->smb2->nonce_low == 0) {
3143                         state->session->smb2->nonce_high += 1;
3144                         state->session->smb2->nonce_low += 1;
3145                 }
3146
3147                 /*
3148                  * CCM and GCM algorithms must never have their
3149                  * nonce wrap, or the security of the whole
3150                  * communication and the keys is destroyed.
3151                  * We must drop the connection once we have
3152                  * transfered too much data.
3153                  *
3154                  * NOTE: We assume nonces greater than 8 bytes.
3155                  */
3156                 if (state->session->smb2->nonce_high >=
3157                     state->session->smb2->nonce_high_max)
3158                 {
3159                         return NT_STATUS_ENCRYPTION_FAILED;
3160                 }
3161
3162                 nonce_high = state->session->smb2->nonce_high_random;
3163                 nonce_high += state->session->smb2->nonce_high;
3164                 nonce_low = state->session->smb2->nonce_low;
3165
3166                 tf_iov = num_iov;
3167                 iov[num_iov].iov_base = state->smb2.transform;
3168                 iov[num_iov].iov_len  = sizeof(state->smb2.transform);
3169                 num_iov += 1;
3170
3171                 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3172                 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
3173                       nonce_low);
3174                 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
3175                       nonce_high);
3176                 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
3177                       encryption_session_id);
3178
3179                 nbt_len += SMB2_TF_HDR_SIZE;
3180                 break;
3181         }
3182
3183         for (i=0; i<num_reqs; i++) {
3184                 int hdr_iov;
3185                 size_t reqlen;
3186                 bool ret;
3187                 uint16_t opcode;
3188                 uint64_t avail;
3189                 uint16_t charge;
3190                 uint16_t credits;
3191                 uint64_t mid;
3192                 const DATA_BLOB *signing_key = NULL;
3193
3194                 if (!tevent_req_is_in_progress(reqs[i])) {
3195                         return NT_STATUS_INTERNAL_ERROR;
3196                 }
3197
3198                 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3199
3200                 if (!smbXcli_conn_is_connected(state->conn)) {
3201                         return NT_STATUS_CONNECTION_DISCONNECTED;
3202                 }
3203
3204                 if ((state->conn->protocol != PROTOCOL_NONE) &&
3205                     (state->conn->protocol < PROTOCOL_SMB2_02)) {
3206                         return NT_STATUS_REVISION_MISMATCH;
3207                 }
3208
3209                 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3210                 if (opcode == SMB2_OP_CANCEL) {
3211                         goto skip_credits;
3212                 }
3213
3214                 avail = UINT64_MAX - state->conn->smb2.mid;
3215                 if (avail < 1) {
3216                         return NT_STATUS_CONNECTION_ABORTED;
3217                 }
3218
3219                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3220                         uint32_t max_dyn_len = 1;
3221
3222                         max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
3223                         max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
3224
3225                         charge = (max_dyn_len - 1)/ 65536 + 1;
3226                 } else {
3227                         charge = 1;
3228                 }
3229
3230                 charge = MAX(state->smb2.credit_charge, charge);
3231
3232                 avail = MIN(avail, state->conn->smb2.cur_credits);
3233                 if (avail < charge) {
3234                         DBG_ERR("Insufficient credits. "
3235                                 "%"PRIu64" available, %"PRIu16" needed\n",
3236                                 avail, charge);
3237                         return NT_STATUS_INTERNAL_ERROR;
3238                 }
3239
3240                 credits = 0;
3241                 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
3242                         credits = state->conn->smb2.max_credits -
3243                                   state->conn->smb2.cur_credits;
3244                 }
3245                 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
3246                         credits += 1;
3247                 }
3248
3249                 mid = state->conn->smb2.mid;
3250                 state->conn->smb2.mid += charge;
3251                 state->conn->smb2.cur_credits -= charge;
3252
3253                 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3254                         SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
3255                 }
3256                 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
3257                 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
3258
3259                 state->smb2.cancel_flags = 0;
3260                 state->smb2.cancel_mid = mid;
3261                 state->smb2.cancel_aid = 0;
3262
3263 skip_credits:
3264                 if (state->session && encryption_key == NULL) {
3265                         /*
3266                          * We prefer the channel signing key if it is
3267                          * already there.
3268                          */
3269                         if (state->smb2.should_sign) {
3270                                 signing_key = &state->session->smb2_channel.signing_key;
3271                         }
3272
3273                         /*
3274                          * If it is a channel binding, we already have the main
3275                          * signing key and try that one.
3276                          */
3277                         if (signing_key && signing_key->length == 0) {
3278                                 signing_key = &state->session->smb2->signing_key;
3279                         }
3280
3281                         /*
3282                          * If we do not have any session key yet, we skip the
3283                          * signing of SMB2_OP_SESSSETUP requests.
3284                          */
3285                         if (signing_key && signing_key->length == 0) {
3286                                 signing_key = NULL;
3287                         }
3288                 }
3289
3290                 hdr_iov = num_iov;
3291                 iov[num_iov].iov_base = state->smb2.hdr;
3292                 iov[num_iov].iov_len  = sizeof(state->smb2.hdr);
3293                 num_iov += 1;
3294
3295                 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
3296                 iov[num_iov].iov_len  = state->smb2.fixed_len;
3297                 num_iov += 1;
3298
3299                 if (state->smb2.dyn != NULL) {
3300                         iov[num_iov].iov_base = discard_const(state->smb2.dyn);
3301                         iov[num_iov].iov_len  = state->smb2.dyn_len;
3302                         num_iov += 1;
3303                 }
3304
3305                 reqlen  = sizeof(state->smb2.hdr);
3306                 reqlen += state->smb2.fixed_len;
3307                 reqlen += state->smb2.dyn_len;
3308
3309                 if (i < num_reqs-1) {
3310                         if ((reqlen % 8) > 0) {
3311                                 uint8_t pad = 8 - (reqlen % 8);
3312                                 iov[num_iov].iov_base = state->smb2.pad;
3313                                 iov[num_iov].iov_len = pad;
3314                                 num_iov += 1;
3315                                 reqlen += pad;
3316                         }
3317                         SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
3318                 }
3319
3320                 state->smb2.encryption_session_id = encryption_session_id;
3321
3322                 if (signing_key != NULL) {
3323                         NTSTATUS status;
3324
3325                         status = smb2_signing_sign_pdu(*signing_key,
3326                                                        state->session->conn->protocol,
3327                                                        &iov[hdr_iov], num_iov - hdr_iov);
3328                         if (!NT_STATUS_IS_OK(status)) {
3329                                 return status;
3330                         }
3331                 }
3332
3333                 nbt_len += reqlen;
3334
3335                 ret = smbXcli_req_set_pending(reqs[i]);
3336                 if (!ret) {
3337                         return NT_STATUS_NO_MEMORY;
3338                 }
3339         }
3340
3341         state = tevent_req_data(reqs[0], struct smbXcli_req_state);
3342         _smb_setlen_tcp(state->length_hdr, nbt_len);
3343         iov[0].iov_base = state->length_hdr;
3344         iov[0].iov_len  = sizeof(state->length_hdr);
3345
3346         if (encryption_key != NULL) {
3347                 NTSTATUS status;
3348                 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
3349                 uint8_t *buf;
3350                 int vi;
3351
3352                 buf = talloc_array(iov, uint8_t, buflen);
3353                 if (buf == NULL) {
3354                         return NT_STATUS_NO_MEMORY;
3355                 }
3356
3357                 /*
3358                  * We copy the buffers before encrypting them,
3359                  * this is at least currently needed for the
3360                  * to keep state->smb2.hdr.
3361                  *
3362                  * Also the callers may expect there buffers
3363                  * to be const.
3364                  */
3365                 for (vi = tf_iov + 1; vi < num_iov; vi++) {
3366                         struct iovec *v = &iov[vi];
3367                         const uint8_t *o = (const uint8_t *)v->iov_base;
3368
3369                         memcpy(buf, o, v->iov_len);
3370                         v->iov_base = (void *)buf;
3371                         buf += v->iov_len;
3372                 }
3373
3374                 status = smb2_signing_encrypt_pdu(*encryption_key,
3375                                         state->conn->smb2.server.cipher,
3376                                         &iov[tf_iov], num_iov - tf_iov);
3377                 if (!NT_STATUS_IS_OK(status)) {
3378                         return status;
3379                 }
3380         }
3381
3382         if (state->conn->dispatch_incoming == NULL) {
3383                 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3384         }
3385
3386         subreq = writev_send(state, state->ev, state->conn->outgoing,
3387                              state->conn->sock_fd, false, iov, num_iov);
3388         if (subreq == NULL) {
3389                 return NT_STATUS_NO_MEMORY;
3390         }
3391         tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3392         state->write_req = subreq;
3393
3394         return NT_STATUS_OK;
3395 }
3396
3397 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3398 {
3399         struct smbXcli_req_state *state =
3400                 tevent_req_data(req,
3401                 struct smbXcli_req_state);
3402
3403         state->smb2.credit_charge = charge;
3404 }
3405
3406 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3407                                     struct tevent_context *ev,
3408                                     struct smbXcli_conn *conn,
3409                                     uint16_t cmd,
3410                                     uint32_t additional_flags,
3411                                     uint32_t clear_flags,
3412                                     uint32_t timeout_msec,
3413                                     struct smbXcli_tcon *tcon,
3414                                     struct smbXcli_session *session,
3415                                     const uint8_t *fixed,
3416                                     uint16_t fixed_len,
3417                                     const uint8_t *dyn,
3418                                     uint32_t dyn_len,
3419                                     uint32_t max_dyn_len)
3420 {
3421         struct tevent_req *req;
3422         NTSTATUS status;
3423
3424         req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3425                                  additional_flags, clear_flags,
3426                                  timeout_msec,
3427                                  tcon, session,
3428                                  fixed, fixed_len,
3429                                  dyn, dyn_len,
3430                                  max_dyn_len);
3431         if (req == NULL) {
3432                 return NULL;
3433         }
3434         if (!tevent_req_is_in_progress(req)) {
3435                 return tevent_req_post(req, ev);
3436         }
3437         status = smb2cli_req_compound_submit(&req, 1);
3438         if (tevent_req_nterror(req, status)) {
3439                 return tevent_req_post(req, ev);
3440         }
3441         return req;
3442 }
3443
3444 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3445 {
3446         struct tevent_req *req =
3447                 tevent_req_callback_data(subreq,
3448                 struct tevent_req);
3449         struct smbXcli_req_state *state =
3450                 tevent_req_data(req,
3451                 struct smbXcli_req_state);
3452         ssize_t nwritten;
3453         int err;
3454
3455         state->write_req = NULL;
3456
3457         nwritten = writev_recv(subreq, &err);
3458         TALLOC_FREE(subreq);
3459         if (nwritten == -1) {
3460                 /* here, we need to notify all pending requests */
3461                 NTSTATUS status = map_nt_error_from_unix_common(err);
3462                 smbXcli_conn_disconnect(state->conn, status);
3463                 return;
3464         }
3465 }
3466
3467 static struct smbXcli_session* smbXcli_session_by_uid(struct smbXcli_conn *conn,
3468                                                      uint64_t uid)
3469 {
3470         struct smbXcli_session *s = conn->sessions;
3471
3472         for (; s; s = s->next) {
3473                 if (s->smb2->session_id != uid) {
3474                         continue;
3475                 }
3476                 break;
3477         }
3478
3479         return s;
3480 }
3481
3482 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3483                                              uint8_t *buf,
3484                                              size_t buflen,
3485                                              TALLOC_CTX *mem_ctx,
3486                                              struct iovec **piov,
3487                                              size_t *pnum_iov)
3488 {
3489         struct iovec *iov;
3490         int num_iov = 0;
3491         size_t taken = 0;
3492         uint8_t *first_hdr = buf;
3493         size_t verified_buflen = 0;
3494         uint8_t *tf = NULL;
3495         size_t tf_len = 0;
3496
3497         iov = talloc_array(mem_ctx, struct iovec, num_iov);
3498         if (iov == NULL) {
3499                 return NT_STATUS_NO_MEMORY;
3500         }
3501
3502         while (taken < buflen) {
3503                 size_t len = buflen - taken;
3504                 uint8_t *hdr = first_hdr + taken;
3505                 struct iovec *cur;
3506                 size_t full_size;
3507                 size_t next_command_ofs;
3508                 uint16_t body_size;
3509                 struct iovec *iov_tmp;
3510
3511                 if (verified_buflen > taken) {
3512                         len = verified_buflen - taken;
3513                 } else {
3514                         tf = NULL;
3515                         tf_len = 0;
3516                 }
3517
3518                 if (len < 4) {
3519                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3520                                    (int)len, 4));
3521                         goto inval;
3522                 }
3523                 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3524                         struct smbXcli_session *s;
3525                         uint64_t uid;
3526                         struct iovec tf_iov[2];
3527                         size_t enc_len;
3528                         NTSTATUS status;
3529
3530                         if (len < SMB2_TF_HDR_SIZE) {
3531                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3532                                            (int)len, SMB2_TF_HDR_SIZE));
3533                                 goto inval;
3534                         }
3535                         tf = hdr;
3536                         tf_len = SMB2_TF_HDR_SIZE;
3537                         taken += tf_len;
3538
3539                         hdr = first_hdr + taken;
3540                         enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3541                         uid = BVAL(tf, SMB2_TF_SESSION_ID);
3542
3543                         if (len < SMB2_TF_HDR_SIZE + enc_len) {
3544                                 DEBUG(10, ("%d bytes left, expected at least %d\n",
3545                                            (int)len,
3546                                            (int)(SMB2_TF_HDR_SIZE + enc_len)));
3547                                 goto inval;
3548                         }
3549
3550                         s = smbXcli_session_by_uid(conn, uid);
3551                         if (s == NULL) {
3552                                 DEBUG(10, ("unknown session_id %llu\n",
3553                                            (unsigned long long)uid));
3554                                 goto inval;
3555                         }
3556
3557                         tf_iov[0].iov_base = (void *)tf;
3558                         tf_iov[0].iov_len = tf_len;
3559                         tf_iov[1].iov_base = (void *)hdr;
3560                         tf_iov[1].iov_len = enc_len;
3561
3562                         status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3563                                                           conn->smb2.server.cipher,
3564                                                           tf_iov, 2);
3565                         if (!NT_STATUS_IS_OK(status)) {
3566                                 TALLOC_FREE(iov);
3567                                 return status;
3568                         }
3569
3570                         verified_buflen = taken + enc_len;
3571                         len = enc_len;
3572                 }
3573
3574                 /*
3575                  * We need the header plus the body length field
3576                  */
3577
3578                 if (len < SMB2_HDR_BODY + 2) {
3579                         DEBUG(10, ("%d bytes left, expected at least %d\n",
3580                                    (int)len, SMB2_HDR_BODY));
3581                         goto inval;
3582                 }
3583                 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3584                         DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3585                                    IVAL(hdr, 0)));
3586                         goto inval;
3587                 }
3588                 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3589                         DEBUG(10, ("Got HDR len %d, expected %d\n",
3590                                    SVAL(hdr, 4), SMB2_HDR_BODY));
3591                         goto inval;
3592                 }
3593
3594                 full_size = len;
3595                 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3596                 body_size = SVAL(hdr, SMB2_HDR_BODY);
3597
3598                 if (next_command_ofs != 0) {
3599                         if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3600                                 goto inval;
3601                         }
3602                         if (next_command_ofs > full_size) {
3603                                 goto inval;
3604                         }
3605                         full_size = next_command_ofs;
3606                 }
3607                 if (body_size < 2) {
3608                         goto inval;
3609                 }
3610                 body_size &= 0xfffe;
3611
3612                 if (body_size > (full_size - SMB2_HDR_BODY)) {
3613                         goto inval;
3614                 }
3615
3616                 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3617                                          num_iov + 4);
3618                 if (iov_tmp == NULL) {
3619                         TALLOC_FREE(iov);
3620                         return NT_STATUS_NO_MEMORY;
3621                 }
3622                 iov = iov_tmp;
3623                 cur = &iov[num_iov];
3624                 num_iov += 4;
3625
3626                 cur[0].iov_base = tf;
3627                 cur[0].iov_len  = tf_len;
3628                 cur[1].iov_base = hdr;
3629                 cur[1].iov_len  = SMB2_HDR_BODY;
3630                 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3631                 cur[2].iov_len  = body_size;
3632                 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3633                 cur[3].iov_len  = full_size - (SMB2_HDR_BODY + body_size);
3634
3635                 taken += full_size;
3636         }
3637
3638         *piov = iov;
3639         *pnum_iov = num_iov;
3640         return NT_STATUS_OK;
3641
3642 inval:
3643         TALLOC_FREE(iov);
3644         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3645 }
3646
3647 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3648                                                     uint64_t mid)
3649 {
3650         size_t num_pending = talloc_array_length(conn->pending);
3651         size_t i;
3652
3653         for (i=0; i<num_pending; i++) {
3654                 struct tevent_req *req = conn->pending[i];
3655                 struct smbXcli_req_state *state =
3656                         tevent_req_data(req,
3657                         struct smbXcli_req_state);
3658
3659                 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3660                         return req;
3661                 }
3662         }
3663         return NULL;
3664 }
3665
3666 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3667                                                TALLOC_CTX *tmp_mem,
3668                                                uint8_t *inbuf)
3669 {
3670         struct tevent_req *req;
3671         struct smbXcli_req_state *state = NULL;
3672         struct iovec *iov = NULL;
3673         size_t i, num_iov = 0;
3674         NTSTATUS status;
3675         bool defer = true;
3676         struct smbXcli_session *last_session = NULL;
3677         size_t inbuf_len = smb_len_tcp(inbuf);
3678
3679         status = smb2cli_inbuf_parse_compound(conn,
3680                                               inbuf + NBT_HDR_SIZE,
3681                                               inbuf_len,
3682                                               tmp_mem,
3683                                               &iov, &num_iov);
3684         if (!NT_STATUS_IS_OK(status)) {
3685                 return status;
3686         }
3687
3688         for (i=0; i<num_iov; i+=4) {
3689                 uint8_t *inbuf_ref = NULL;
3690                 struct iovec *cur = &iov[i];
3691                 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3692                 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3693                 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3694                 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3695                 uint16_t req_opcode;
3696                 uint32_t req_flags;
3697                 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3698                 uint32_t new_credits;
3699                 struct smbXcli_session *session = NULL;
3700                 const DATA_BLOB *signing_key = NULL;
3701                 bool was_encrypted = false;
3702
3703                 new_credits = conn->smb2.cur_credits;
3704                 new_credits += credits;
3705                 if (new_credits > UINT16_MAX) {
3706                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3707                 }
3708                 conn->smb2.cur_credits += credits;
3709
3710                 req = smb2cli_conn_find_pending(conn, mid);
3711                 if (req == NULL) {
3712                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3713                 }
3714                 state = tevent_req_data(req, struct smbXcli_req_state);
3715
3716                 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3717                 if (opcode != req_opcode) {
3718                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3719                 }
3720                 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3721
3722                 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3723                         return NT_STATUS_INVALID_NETWORK_RESPONSE;
3724                 }
3725
3726                 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3727                 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3728                     NT_STATUS_EQUAL(status, STATUS_PENDING)) {
3729                         uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3730
3731                         if (state->smb2.got_async) {
3732                                 /* We only expect one STATUS_PENDING response */
3733                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3734                         }
3735                         state->smb2.got_async = true;
3736
3737                         /*
3738                          * async interim responses are not signed,
3739                          * even if the SMB2_HDR_FLAG_SIGNED flag
3740                          * is set.
3741                          */
3742                         state->smb2.cancel_flags = SMB2_HDR_FLAG_ASYNC;
3743                         state->smb2.cancel_mid = 0;
3744                         state->smb2.cancel_aid = async_id;
3745
3746                         if (state->smb2.notify_async) {
3747                                 tevent_req_defer_callback(req, state->ev);
3748                                 tevent_req_notify_callback(req);
3749                         }
3750                         continue;
3751                 }
3752
3753                 session = state->session;
3754                 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3755                         session = last_session;
3756                 }
3757                 last_session = session;
3758
3759                 if (flags & SMB2_HDR_FLAG_SIGNED) {
3760                         uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3761
3762                         if (session == NULL) {
3763                                 session = smbXcli_session_by_uid(state->conn,
3764                                                                  uid);
3765                         }
3766
3767                         if (session == NULL) {
3768                                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3769                         }
3770
3771                         last_session = session;
3772                         signing_key = &session->smb2_channel.signing_key;
3773                 }
3774
3775                 if (opcode == SMB2_OP_SESSSETUP) {
3776                         /*
3777                          * We prefer the channel signing key, if it is
3778                          * already there.
3779                          *
3780                          * If we do not have a channel signing key yet,
3781                          * we try the main signing key, if it is not
3782                          * the final response.
3783                          */
3784                         if (signing_key && signing_key->length == 0 &&
3785                             !NT_STATUS_IS_OK(status)) {
3786                                 signing_key = &session->smb2->signing_key;
3787                         }
3788
3789                         if (signing_key && signing_key->length == 0) {
3790                                 /*
3791                                  * If we do not have a session key to
3792                                  * verify the signature, we defer the
3793                                  * signing check to the caller.
3794                                  *
3795                                  * The caller gets NT_STATUS_OK, it
3796                                  * has to call
3797                                  * smb2cli_session_set_session_key()
3798                                  * or
3799                                  * smb2cli_session_set_channel_key()
3800                                  * which will check the signature
3801                                  * with the channel signing key.
3802                                  */
3803                                 signing_key = NULL;
3804                         }
3805
3806                         if (!NT_STATUS_IS_OK(status)) {
3807                                 /*
3808                                  * Only check the signature of the last response
3809                                  * of a successfull session auth. This matches
3810                                  * Windows behaviour for NTLM auth and reauth.
3811                                  */
3812                                 state->smb2.require_signed_response = false;
3813                         }
3814                 }
3815
3816                 if (state->smb2.should_sign ||
3817                     state->smb2.require_signed_response)
3818                 {
3819                         if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3820                                 return NT_STATUS_ACCESS_DENIED;
3821                         }
3822                 }
3823
3824                 if (signing_key == NULL && state->smb2.require_signed_response) {
3825                         signing_key = &session->smb2_channel.signing_key;
3826                 }
3827
3828                 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3829                         const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3830                         uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3831
3832                         /*
3833                          * If the response was encrypted in a SMB2_TRANSFORM
3834                          * pdu, which belongs to the correct session,
3835                          * we do not need to do signing checks
3836                          *
3837                          * It could be the session the response belongs to
3838                          * or the session that was used to encrypt the
3839                          * SMB2_TRANSFORM request.
3840                          */
3841                         if ((session && session->smb2->session_id == uid) ||
3842                             (state->smb2.encryption_session_id == uid)) {
3843                                 signing_key = NULL;
3844                                 was_encrypted = true;
3845                         }
3846                 }
3847
3848                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3849                         /*
3850                          * if the server returns NT_STATUS_USER_SESSION_DELETED
3851                          * the response is not signed and we should
3852                          * propagate the NT_STATUS_USER_SESSION_DELETED
3853                          * status to the caller.
3854                          */
3855                         state->smb2.signing_skipped = true;
3856                         signing_key = NULL;
3857                 }
3858
3859                 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3860                         /*
3861                          * if the server returns
3862                          * NT_STATUS_INVALID_PARAMETER
3863                          * the response might not be encrypted.
3864                          */
3865                         if (state->smb2.should_encrypt && !was_encrypted) {
3866                                 state->smb2.signing_skipped = true;
3867                                 signing_key = NULL;
3868                         }
3869                 }
3870
3871                 if (state->smb2.should_encrypt && !was_encrypted) {
3872                         if (!state->smb2.signing_skipped) {
3873                                 return NT_STATUS_ACCESS_DENIED;
3874                         }
3875                 }
3876
3877                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3878                     NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3879                     NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3880                         /*
3881                          * if the server returns
3882                          * NT_STATUS_NETWORK_NAME_DELETED
3883                          * NT_STATUS_FILE_CLOSED
3884                          * NT_STATUS_INVALID_PARAMETER
3885                          * the response might not be signed
3886                          * as this happens before the signing checks.
3887                          *
3888                          * If server echos the signature (or all zeros)
3889                          * we should report the status from the server
3890                          * to the caller.
3891                          */
3892                         if (signing_key) {
3893                                 int cmp;
3894
3895                                 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3896                                              state->smb2.hdr+SMB2_HDR_SIGNATURE,
3897                                              16);
3898                                 if (cmp == 0) {
3899                                         state->smb2.signing_skipped = true;
3900                                         signing_key = NULL;
3901                                 }
3902                         }
3903                         if (signing_key) {
3904                                 bool zero;
3905                                 zero = all_zero(inhdr+SMB2_HDR_SIGNATURE, 16);
3906                                 if (zero) {
3907                                         state->smb2.signing_skipped = true;
3908                                         signing_key = NULL;
3909                                 }
3910                         }
3911                 }
3912
3913                 if (signing_key) {
3914                         NTSTATUS signing_status;
3915
3916                         signing_status = smb2_signing_check_pdu(*signing_key,
3917                                                                 state->conn->protocol,
3918                                                                 &cur[1], 3);
3919                         if (!NT_STATUS_IS_OK(signing_status)) {
3920                                 /*
3921                                  * If the signing check fails, we disconnect
3922                                  * the connection.
3923                                  */
3924                                 return signing_status;
3925                         }
3926                 }
3927
3928                 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
3929                     (session != NULL) && session->disconnect_expired)
3930                 {
3931                         /*
3932                          * this should be a short term hack
3933                          * until the upper layers have implemented
3934                          * re-authentication.
3935                          */
3936                         return status;
3937                 }
3938
3939                 smbXcli_req_unset_pending(req);
3940
3941                 /*
3942                  * There might be more than one response
3943                  * we need to defer the notifications
3944                  */
3945                 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
3946                         defer = false;
3947                 }
3948
3949                 if (defer) {
3950                         tevent_req_defer_callback(req, state->ev);
3951                 }
3952
3953                 /*
3954                  * Note: here we use talloc_reference() in a way
3955                  *       that does not expose it to the caller.
3956                  */
3957                 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
3958                 if (tevent_req_nomem(inbuf_ref, req)) {
3959                         continue;
3960                 }
3961
3962                 /* copy the related buffers */
3963                 state->smb2.recv_iov[0] = cur[1];
3964                 state->smb2.recv_iov[1] = cur[2];
3965                 state->smb2.recv_iov[2] = cur[3];
3966
3967                 tevent_req_done(req);
3968         }
3969
3970         if (defer) {
3971                 return NT_STATUS_RETRY;
3972         }
3973
3974         return NT_STATUS_OK;
3975 }
3976
3977 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3978                           struct iovec **piov,
3979                           const struct smb2cli_req_expected_response *expected,
3980                           size_t num_expected)
3981 {
3982         struct smbXcli_req_state *state =
3983                 tevent_req_data(req,
3984                 struct smbXcli_req_state);
3985         NTSTATUS status;
3986         size_t body_size;
3987         bool found_status = false;
3988         bool found_size = false;
3989         size_t i;
3990
3991         if (piov != NULL) {
3992                 *piov = NULL;
3993         }
3994
3995         if (tevent_req_is_in_progress(req) && state->smb2.got_async) {
3996                 return STATUS_PENDING;
3997         }
3998
3999         if (tevent_req_is_nterror(req, &status)) {
4000                 for (i=0; i < num_expected; i++) {
4001                         if (NT_STATUS_EQUAL(status, expected[i].status)) {
4002                                 found_status = true;
4003                                 break;
4004                         }
4005                 }
4006
4007                 if (found_status) {
4008                         return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
4009                 }
4010
4011                 return status;
4012         }
4013
4014         if (num_expected == 0) {
4015                 found_status = true;
4016                 found_size = true;
4017         }
4018
4019         status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
4020         body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
4021
4022         for (i=0; i < num_expected; i++) {
4023                 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
4024                         continue;
4025                 }
4026
4027                 found_status = true;
4028                 if (expected[i].body_size == 0) {
4029                         found_size = true;
4030                         break;
4031                 }
4032
4033                 if (expected[i].body_size == body_size) {
4034                         found_size = true;
4035                         break;
4036                 }
4037         }
4038
4039         if (!found_status) {
4040                 return status;
4041         }
4042
4043         if (state->smb2.signing_skipped) {
4044                 if (num_expected > 0) {
4045                         return NT_STATUS_ACCESS_DENIED;
4046                 }
4047                 if (!NT_STATUS_IS_ERR(status)) {
4048                         return NT_STATUS_ACCESS_DENIED;
4049                 }
4050         }
4051
4052         if (!found_size) {
4053                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4054         }
4055
4056         if (piov != NULL) {
4057                 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
4058         }
4059
4060         return status;
4061 }
4062
4063 NTSTATUS smb2cli_req_get_sent_iov(struct tevent_req *req,
4064                                   struct iovec *sent_iov)
4065 {
4066         struct smbXcli_req_state *state =
4067                 tevent_req_data(req,
4068                 struct smbXcli_req_state);
4069
4070         if (tevent_req_is_in_progress(req)) {
4071                 return STATUS_PENDING;
4072         }
4073
4074         sent_iov[0].iov_base = state->smb2.hdr;
4075         sent_iov[0].iov_len  = sizeof(state->smb2.hdr);
4076
4077         sent_iov[1].iov_base = discard_const(state->smb2.fixed);
4078         sent_iov[1].iov_len  = state->smb2.fixed_len;
4079
4080         if (state->smb2.dyn != NULL) {
4081                 sent_iov[2].iov_base = discard_const(state->smb2.dyn);
4082                 sent_iov[2].iov_len  = state->smb2.dyn_len;
4083         } else {
4084                 sent_iov[2].iov_base = NULL;
4085                 sent_iov[2].iov_len  = 0;
4086         }
4087
4088         return NT_STATUS_OK;
4089 }
4090
4091 static const struct {
4092         enum protocol_types proto;
4093         const char *smb1_name;
4094 } smb1cli_prots[] = {
4095         {PROTOCOL_CORE,         "PC NETWORK PROGRAM 1.0"},
4096         {PROTOCOL_COREPLUS,     "MICROSOFT NETWORKS 1.03"},
4097         {PROTOCOL_LANMAN1,      "MICROSOFT NETWORKS 3.0"},
4098         {PROTOCOL_LANMAN1,      "LANMAN1.0"},
4099         {PROTOCOL_LANMAN2,      "LM1.2X002"},
4100         {PROTOCOL_LANMAN2,      "DOS LANMAN2.1"},
4101         {PROTOCOL_LANMAN2,      "LANMAN2.1"},
4102         {PROTOCOL_LANMAN2,      "Samba"},
4103         {PROTOCOL_NT1,          "NT LANMAN 1.0"},
4104         {PROTOCOL_NT1,          "NT LM 0.12"},
4105         {PROTOCOL_SMB2_02,      "SMB 2.002"},
4106         {PROTOCOL_SMB2_10,      "SMB 2.???"},
4107 };
4108
4109 static const struct {
4110         enum protocol_types proto;
4111         uint16_t smb2_dialect;
4112 } smb2cli_prots[] = {
4113         {PROTOCOL_SMB2_02,      SMB2_DIALECT_REVISION_202},
4114         {PROTOCOL_SMB2_10,      SMB2_DIALECT_REVISION_210},
4115         {PROTOCOL_SMB2_22,      SMB2_DIALECT_REVISION_222},
4116         {PROTOCOL_SMB2_24,      SMB2_DIALECT_REVISION_224},
4117         {PROTOCOL_SMB3_00,      SMB3_DIALECT_REVISION_300},
4118         {PROTOCOL_SMB3_02,      SMB3_DIALECT_REVISION_302},
4119         {PROTOCOL_SMB3_10,      SMB3_DIALECT_REVISION_310},
4120         {PROTOCOL_SMB3_11,      SMB3_DIALECT_REVISION_311},
4121 };
4122
4123 struct smbXcli_negprot_state {
4124         struct smbXcli_conn *conn;
4125         struct tevent_context *ev;
4126         uint32_t timeout_msec;
4127
4128         struct {
4129                 uint8_t fixed[36];
4130         } smb2;
4131 };
4132
4133 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
4134 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
4135 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
4136 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
4137 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
4138 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4139                                                   TALLOC_CTX *frame,
4140                                                   uint8_t *inbuf);
4141
4142 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
4143                                         struct tevent_context *ev,
4144                                         struct smbXcli_conn *conn,
4145                                         uint32_t timeout_msec,
4146                                         enum protocol_types min_protocol,
4147                                         enum protocol_types max_protocol,
4148                                         uint16_t max_credits)
4149 {
4150         struct tevent_req *req, *subreq;
4151         struct smbXcli_negprot_state *state;
4152
4153         req = tevent_req_create(mem_ctx, &state,
4154                                 struct smbXcli_negprot_state);
4155         if (req == NULL) {
4156                 return NULL;
4157         }
4158         state->conn = conn;
4159         state->ev = ev;
4160         state->timeout_msec = timeout_msec;
4161
4162         if (min_protocol == PROTOCOL_NONE) {
4163                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4164                 return tevent_req_post(req, ev);
4165         }
4166
4167         if (max_protocol == PROTOCOL_NONE) {
4168                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4169                 return tevent_req_post(req, ev);
4170         }
4171
4172         if (min_protocol > max_protocol) {
4173                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4174                 return tevent_req_post(req, ev);
4175         }
4176
4177         conn->min_protocol = min_protocol;
4178         conn->max_protocol = max_protocol;
4179         conn->protocol = PROTOCOL_NONE;
4180
4181         if (max_protocol >= PROTOCOL_SMB2_02) {
4182                 conn->smb2.max_credits = max_credits;
4183         }
4184
4185         if ((min_protocol < PROTOCOL_SMB2_02) &&
4186             (max_protocol < PROTOCOL_SMB2_02)) {
4187                 /*
4188                  * SMB1 only...
4189                  */
4190                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4191
4192                 subreq = smbXcli_negprot_smb1_subreq(state);
4193                 if (tevent_req_nomem(subreq, req)) {
4194                         return tevent_req_post(req, ev);
4195                 }
4196                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4197                 return req;
4198         }
4199
4200         if ((min_protocol >= PROTOCOL_SMB2_02) &&
4201             (max_protocol >= PROTOCOL_SMB2_02)) {
4202                 /*
4203                  * SMB2 only...
4204                  */
4205                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4206
4207                 subreq = smbXcli_negprot_smb2_subreq(state);
4208                 if (tevent_req_nomem(subreq, req)) {
4209                         return tevent_req_post(req, ev);
4210                 }
4211                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4212                 return req;
4213         }
4214
4215         /*
4216          * We send an SMB1 negprot with the SMB2 dialects
4217          * and expect a SMB1 or a SMB2 response.
4218          *
4219          * smbXcli_negprot_dispatch_incoming() will fix the
4220          * callback to match protocol of the response.
4221          */
4222         conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
4223
4224         subreq = smbXcli_negprot_smb1_subreq(state);
4225         if (tevent_req_nomem(subreq, req)) {
4226                 return tevent_req_post(req, ev);
4227         }
4228         tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
4229         return req;
4230 }
4231
4232 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
4233 {
4234         struct tevent_req *req =
4235                 tevent_req_callback_data(subreq,
4236                 struct tevent_req);
4237         NTSTATUS status;
4238
4239         /*
4240          * we just want the low level error
4241          */
4242         status = tevent_req_simple_recv_ntstatus(subreq);
4243         TALLOC_FREE(subreq);
4244         if (tevent_req_nterror(req, status)) {
4245                 return;
4246         }
4247
4248         /* this should never happen */
4249         tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
4250 }
4251
4252 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
4253 {
4254         size_t i;
4255         DATA_BLOB bytes = data_blob_null;
4256         uint8_t flags;
4257         uint16_t flags2;
4258
4259         /* setup the protocol strings */
4260         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4261                 uint8_t c = 2;
4262                 bool ok;
4263
4264                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4265                         continue;
4266                 }
4267
4268                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4269                         continue;
4270                 }
4271
4272                 ok = data_blob_append(state, &bytes, &c, sizeof(c));
4273                 if (!ok) {
4274                         return NULL;
4275                 }
4276
4277                 /*
4278                  * We now it is already ascii and
4279                  * we want NULL termination.
4280                  */
4281                 ok = data_blob_append(state, &bytes,
4282                                       smb1cli_prots[i].smb1_name,
4283                                       strlen(smb1cli_prots[i].smb1_name)+1);
4284                 if (!ok) {
4285                         return NULL;
4286                 }
4287         }
4288
4289         smb1cli_req_flags(state->conn->max_protocol,
4290                           state->conn->smb1.client.capabilities,
4291                           SMBnegprot,
4292                           0, 0, &flags,
4293                           0, 0, &flags2);
4294
4295         return smb1cli_req_send(state, state->ev, state->conn,
4296                                 SMBnegprot,
4297                                 flags, ~flags,
4298                                 flags2, ~flags2,
4299                                 state->timeout_msec,
4300                                 0xFFFE, 0, NULL, /* pid, tid, session */
4301                                 0, NULL, /* wct, vwv */
4302                                 bytes.length, bytes.data);
4303 }
4304
4305 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
4306 {
4307         struct tevent_req *req =
4308                 tevent_req_callback_data(subreq,
4309                 struct tevent_req);
4310         struct smbXcli_negprot_state *state =
4311                 tevent_req_data(req,
4312                 struct smbXcli_negprot_state);
4313         struct smbXcli_conn *conn = state->conn;
4314         struct iovec *recv_iov = NULL;
4315         uint8_t *inhdr;
4316         uint8_t wct;
4317         uint16_t *vwv;
4318         uint32_t num_bytes;
4319         uint8_t *bytes;
4320         NTSTATUS status;
4321         uint16_t protnum;
4322         size_t i;
4323         size_t num_prots = 0;
4324         uint8_t flags;
4325         uint32_t client_capabilities = conn->smb1.client.capabilities;
4326         uint32_t both_capabilities;
4327         uint32_t server_capabilities = 0;
4328         uint32_t capabilities;
4329         uint32_t client_max_xmit = conn->smb1.client.max_xmit;
4330         uint32_t server_max_xmit = 0;
4331         uint32_t max_xmit;
4332         uint32_t server_max_mux = 0;
4333         uint16_t server_security_mode = 0;
4334         uint32_t server_session_key = 0;
4335         bool server_readbraw = false;
4336         bool server_writebraw = false;
4337         bool server_lockread = false;
4338         bool server_writeunlock = false;
4339         struct GUID server_guid = GUID_zero();
4340         DATA_BLOB server_gss_blob = data_blob_null;
4341         uint8_t server_challenge[8];
4342         char *server_workgroup = NULL;
4343         char *server_name = NULL;
4344         int server_time_zone = 0;
4345         NTTIME server_system_time = 0;
4346         static const struct smb1cli_req_expected_response expected[] = {
4347         {
4348                 .status = NT_STATUS_OK,
4349                 .wct = 0x11, /* NT1 */
4350         },
4351         {
4352                 .status = NT_STATUS_OK,
4353                 .wct = 0x0D, /* LM */
4354         },
4355         {
4356                 .status = NT_STATUS_OK,
4357                 .wct = 0x01, /* CORE */
4358         }
4359         };
4360
4361         ZERO_STRUCT(server_challenge);
4362
4363         status = smb1cli_req_recv(subreq, state,
4364                                   &recv_iov,
4365                                   &inhdr,
4366                                   &wct,
4367                                   &vwv,
4368                                   NULL, /* pvwv_offset */
4369                                   &num_bytes,
4370                                   &bytes,
4371                                   NULL, /* pbytes_offset */
4372                                   NULL, /* pinbuf */
4373                                   expected, ARRAY_SIZE(expected));
4374         TALLOC_FREE(subreq);
4375         if (tevent_req_nterror(req, status)) {
4376                 return;
4377         }
4378
4379         flags = CVAL(inhdr, HDR_FLG);
4380
4381         protnum = SVAL(vwv, 0);
4382
4383         for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4384                 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4385                         continue;
4386                 }
4387
4388                 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4389                         continue;
4390                 }
4391
4392                 if (protnum != num_prots) {
4393                         num_prots++;
4394                         continue;
4395                 }
4396
4397                 conn->protocol = smb1cli_prots[i].proto;
4398                 break;
4399         }
4400
4401         if (conn->protocol == PROTOCOL_NONE) {
4402                 DBG_ERR("No compatible protocol selected by server.\n");
4403                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4404                 return;
4405         }
4406
4407         if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
4408                 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
4409                          "and the selected protocol level doesn't support it.\n"));
4410                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4411                 return;
4412         }
4413
4414         if (flags & FLAG_SUPPORT_LOCKREAD) {
4415                 server_lockread = true;
4416                 server_writeunlock = true;
4417         }
4418
4419         if (conn->protocol >= PROTOCOL_NT1) {
4420                 const char *client_signing = NULL;
4421                 bool server_mandatory = false;
4422                 bool server_allowed = false;
4423                 const char *server_signing = NULL;
4424                 bool ok;
4425                 uint8_t key_len;
4426
4427                 if (wct != 0x11) {
4428                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4429                         return;
4430                 }
4431
4432                 /* NT protocol */
4433                 server_security_mode = CVAL(vwv + 1, 0);
4434                 server_max_mux = SVAL(vwv + 1, 1);
4435                 server_max_xmit = IVAL(vwv + 3, 1);
4436                 server_session_key = IVAL(vwv + 7, 1);
4437                 server_time_zone = SVALS(vwv + 15, 1);
4438                 server_time_zone *= 60;
4439                 /* this time arrives in real GMT */
4440                 server_system_time = BVAL(vwv + 11, 1);
4441                 server_capabilities = IVAL(vwv + 9, 1);
4442
4443                 key_len = CVAL(vwv + 16, 1);
4444
4445                 if (server_capabilities & CAP_RAW_MODE) {
4446                         server_readbraw = true;
4447                         server_writebraw = true;
4448                 }
4449                 if (server_capabilities & CAP_LOCK_AND_READ) {
4450                         server_lockread = true;
4451                 }
4452
4453                 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4454                         DATA_BLOB blob1, blob2;
4455
4456                         if (num_bytes < 16) {
4457                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4458                                 return;
4459                         }
4460
4461                         blob1 = data_blob_const(bytes, 16);
4462                         status = GUID_from_data_blob(&blob1, &server_guid);
4463                         if (tevent_req_nterror(req, status)) {
4464                                 return;
4465                         }
4466
4467                         blob1 = data_blob_const(bytes+16, num_bytes-16);
4468                         blob2 = data_blob_dup_talloc(state, blob1);
4469                         if (blob1.length > 0 &&
4470                             tevent_req_nomem(blob2.data, req)) {
4471                                 return;
4472                         }
4473                         server_gss_blob = blob2;
4474                 } else {
4475                         DATA_BLOB blob1, blob2;
4476
4477                         if (num_bytes < key_len) {
4478                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4479                                 return;
4480                         }
4481
4482                         if (key_len != 0 && key_len != 8) {
4483                                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4484                                 return;
4485                         }
4486
4487                         if (key_len == 8) {
4488                                 memcpy(server_challenge, bytes, 8);
4489                         }
4490
4491                         blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4492                         blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4493                         if (blob1.length > 0) {
4494                                 size_t len;
4495
4496                                 len = utf16_len_n(blob1.data,
4497                                                   blob1.length);
4498                                 blob1.length = len;
4499
4500                                 ok = convert_string_talloc(state,
4501                                                            CH_UTF16LE,
4502                                                            CH_UNIX,
4503                                                            blob1.data,
4504                                                            blob1.length,
4505                                                            &server_workgroup,
4506                                                            &len);
4507                                 if (!ok) {
4508                                         status = map_nt_error_from_unix_common(errno);
4509                                         tevent_req_nterror(req, status);
4510                                         return;
4511                                 }
4512                         }
4513
4514                         blob2.data += blob1.length;
4515                         blob2.length -= blob1.length;
4516                         if (blob2.length > 0) {
4517                                 size_t len;
4518
4519                                 len = utf16_len_n(blob1.data,
4520                                                   blob1.length);
4521                                 blob1.length = len;
4522
4523                                 ok = convert_string_talloc(state,
4524                                                            CH_UTF16LE,
4525                                                            CH_UNIX,
4526                                                            blob2.data,
4527                                                            blob2.length,
4528                                                            &server_name,
4529                                                            &len);
4530                                 if (!ok) {
4531                                         status = map_nt_error_from_unix_common(errno);
4532                                         tevent_req_nterror(req, status);
4533                                         return;
4534                                 }
4535                         }
4536                 }
4537
4538                 client_signing = "disabled";
4539                 if (conn->allow_signing) {
4540                         client_signing = "allowed";
4541                 }
4542                 if (conn->mandatory_signing) {
4543                         client_signing = "required";
4544                 }
4545
4546                 server_signing = "not supported";
4547                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4548                         server_signing = "supported";
4549                         server_allowed = true;
4550                 } else if (conn->mandatory_signing) {
4551                         /*
4552                          * We have mandatory signing as client
4553                          * lets assume the server will look at our
4554                          * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4555                          * flag in the session setup
4556                          */
4557                         server_signing = "not announced";
4558                         server_allowed = true;
4559                 }
4560                 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4561                         server_signing = "required";
4562                         server_mandatory = true;
4563                 }
4564
4565                 ok = smb_signing_set_negotiated(conn->smb1.signing,
4566                                                 server_allowed,
4567                                                 server_mandatory);
4568                 if (!ok) {
4569                         DEBUG(1,("cli_negprot: SMB signing is required, "
4570                                  "but client[%s] and server[%s] mismatch\n",
4571                                  client_signing, server_signing));
4572                         tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4573                         return;
4574                 }
4575
4576         } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4577                 DATA_BLOB blob1;
4578                 uint8_t key_len;
4579                 time_t t;
4580
4581                 if (wct != 0x0D) {
4582                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4583                         return;
4584                 }
4585
4586                 server_security_mode = SVAL(vwv + 1, 0);
4587                 server_max_xmit = SVAL(vwv + 2, 0);
4588                 server_max_mux = SVAL(vwv + 3, 0);
4589                 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4590                 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4591                 server_session_key = IVAL(vwv + 6, 0);
4592                 server_time_zone = SVALS(vwv + 10, 0);
4593                 server_time_zone *= 60;
4594                 /* this time is converted to GMT by make_unix_date */
4595                 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4596                 unix_to_nt_time(&server_system_time, t);
4597                 key_len = SVAL(vwv + 11, 0);
4598
4599                 if (num_bytes < key_len) {
4600                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4601                         return;
4602                 }
4603
4604                 if (key_len != 0 && key_len != 8) {
4605                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4606                         return;
4607                 }
4608
4609                 if (key_len == 8) {
4610                         memcpy(server_challenge, bytes, 8);
4611                 }
4612
4613                 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4614                 if (blob1.length > 0) {
4615                         size_t len;
4616                         bool ok;
4617
4618                         len = utf16_len_n(blob1.data,
4619                                           blob1.length);
4620                         blob1.length = len;
4621
4622                         ok = convert_string_talloc(state,
4623                                                    CH_DOS,
4624                                                    CH_UNIX,
4625                                                    blob1.data,
4626                                                    blob1.length,
4627                                                    &server_workgroup,
4628                                                    &len);
4629                         if (!ok) {
4630                                 status = map_nt_error_from_unix_common(errno);
4631                                 tevent_req_nterror(req, status);
4632                                 return;
4633                         }
4634                 }
4635
4636         } else {
4637                 /* the old core protocol */
4638                 server_time_zone = get_time_zone(time(NULL));
4639                 server_max_xmit = 1024;
4640                 server_max_mux = 1;
4641         }
4642
4643         if (server_max_xmit < 1024) {
4644                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4645                 return;
4646         }
4647
4648         if (server_max_mux < 1) {
4649                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4650                 return;
4651         }
4652
4653         /*
4654          * Now calculate the negotiated capabilities
4655          * based on the mask for:
4656          * - client only flags
4657          * - flags used in both directions
4658          * - server only flags
4659          */
4660         both_capabilities = client_capabilities & server_capabilities;
4661         capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4662         capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4663         capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4664
4665         max_xmit = MIN(client_max_xmit, server_max_xmit);
4666
4667         conn->smb1.server.capabilities = server_capabilities;
4668         conn->smb1.capabilities = capabilities;
4669
4670         conn->smb1.server.max_xmit = server_max_xmit;
4671         conn->smb1.max_xmit = max_xmit;
4672
4673         conn->smb1.server.max_mux = server_max_mux;
4674
4675         conn->smb1.server.security_mode = server_security_mode;
4676
4677         conn->smb1.server.readbraw = server_readbraw;
4678         conn->smb1.server.writebraw = server_writebraw;
4679         conn->smb1.server.lockread = server_lockread;
4680         conn->smb1.server.writeunlock = server_writeunlock;
4681
4682         conn->smb1.server.session_key = server_session_key;
4683
4684         talloc_steal(conn, server_gss_blob.data);
4685         conn->smb1.server.gss_blob = server_gss_blob;
4686         conn->smb1.server.guid = server_guid;
4687         memcpy(conn->smb1.server.challenge, server_challenge, 8);
4688         conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4689         conn->smb1.server.name = talloc_move(conn, &server_name);
4690
4691         conn->smb1.server.time_zone = server_time_zone;
4692         conn->smb1.server.system_time = server_system_time;
4693
4694         tevent_req_done(req);
4695 }
4696
4697 static size_t smbXcli_padding_helper(uint32_t offset, size_t n)
4698 {
4699         if ((offset & (n-1)) == 0) return 0;
4700         return n - (offset & (n-1));
4701 }
4702
4703 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4704 {
4705         size_t i;
4706         uint8_t *buf;
4707         uint16_t dialect_count = 0;
4708         DATA_BLOB dyn = data_blob_null;
4709
4710         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4711                 bool ok;
4712                 uint8_t val[2];
4713
4714                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4715                         continue;
4716                 }
4717
4718                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4719                         continue;
4720                 }
4721
4722                 SSVAL(val, 0, smb2cli_prots[i].smb2_dialect);
4723
4724                 ok = data_blob_append(state, &dyn, val, sizeof(val));
4725                 if (!ok) {
4726                         return NULL;
4727                 }
4728
4729                 dialect_count++;
4730         }
4731
4732         buf = state->smb2.fixed;
4733         SSVAL(buf, 0, 36);
4734         SSVAL(buf, 2, dialect_count);
4735         SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4736         SSVAL(buf, 6, 0);       /* Reserved */
4737         if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
4738                 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4739         } else {
4740                 SIVAL(buf, 8, 0);       /* Capabilities */
4741         }
4742         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4743                 NTSTATUS status;
4744                 DATA_BLOB blob;
4745
4746                 status = GUID_to_ndr_blob(&state->conn->smb2.client.guid,
4747                                           state, &blob);
4748                 if (!NT_STATUS_IS_OK(status)) {
4749                         return NULL;
4750                 }
4751                 memcpy(buf+12, blob.data, 16); /* ClientGuid */
4752         } else {
4753                 memset(buf+12, 0, 16);  /* ClientGuid */
4754         }
4755
4756         if (state->conn->max_protocol >= PROTOCOL_SMB3_10) {
4757                 NTSTATUS status;
4758                 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4759                 uint32_t offset;
4760                 DATA_BLOB b;
4761                 uint8_t p[38];
4762                 const uint8_t zeros[8] = {0, };
4763                 size_t pad;
4764                 bool ok;
4765
4766                 SSVAL(p, 0,  1); /* HashAlgorithmCount */
4767                 SSVAL(p, 2, 32); /* SaltLength */
4768                 SSVAL(p, 4, SMB2_PREAUTH_INTEGRITY_SHA512);
4769                 generate_random_buffer(p + 6, 32);
4770
4771                 status = smb2_negotiate_context_add(
4772                         state, &c, SMB2_PREAUTH_INTEGRITY_CAPABILITIES, p, 38);
4773                 if (!NT_STATUS_IS_OK(status)) {
4774                         return NULL;
4775                 }
4776
4777                 SSVAL(p, 0, 2); /* ChiperCount */
4778                 /*
4779                  * For now we preferr CCM because our implementation
4780                  * is faster than GCM, see bug #11451.
4781                  */
4782                 SSVAL(p, 2, SMB2_ENCRYPTION_AES128_CCM);
4783                 SSVAL(p, 4, SMB2_ENCRYPTION_AES128_GCM);
4784
4785                 status = smb2_negotiate_context_add(
4786                         state, &c, SMB2_ENCRYPTION_CAPABILITIES, p, 6);
4787                 if (!NT_STATUS_IS_OK(status)) {
4788                         return NULL;
4789                 }
4790
4791                 status = smb2_negotiate_context_push(state, &b, c);
4792                 if (!NT_STATUS_IS_OK(status)) {
4793                         return NULL;
4794                 }
4795
4796                 offset = SMB2_HDR_BODY + sizeof(state->smb2.fixed) + dyn.length;
4797                 pad = smbXcli_padding_helper(offset, 8);
4798
4799                 ok = data_blob_append(state, &dyn, zeros, pad);
4800                 if (!ok) {
4801                         return NULL;
4802                 }
4803                 offset += pad;
4804
4805                 ok = data_blob_append(state, &dyn, b.data, b.length);
4806                 if (!ok) {
4807                         return NULL;
4808                 }
4809
4810                 SIVAL(buf, 28, offset);   /* NegotiateContextOffset */
4811                 SSVAL(buf, 32, c.num_contexts); /* NegotiateContextCount */
4812                 SSVAL(buf, 34, 0);        /* Reserved */
4813         } else {
4814                 SBVAL(buf, 28, 0);      /* Reserved/ClientStartTime */
4815         }
4816
4817         return smb2cli_req_send(state, state->ev,
4818                                 state->conn, SMB2_OP_NEGPROT,
4819                                 0, 0, /* flags */
4820                                 state->timeout_msec,
4821                                 NULL, NULL, /* tcon, session */
4822                                 state->smb2.fixed, sizeof(state->smb2.fixed),
4823                                 dyn.data, dyn.length,
4824                                 UINT16_MAX); /* max_dyn_len */
4825 }
4826
4827 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
4828 {
4829         struct tevent_req *req =
4830                 tevent_req_callback_data(subreq,
4831                 struct tevent_req);
4832         struct smbXcli_negprot_state *state =
4833                 tevent_req_data(req,
4834                 struct smbXcli_negprot_state);
4835         struct smbXcli_conn *conn = state->conn;
4836         size_t security_offset, security_length;
4837         DATA_BLOB blob;
4838         NTSTATUS status;
4839         struct iovec *iov;
4840         uint8_t *body;
4841         size_t i;
4842         uint16_t dialect_revision;
4843         struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4844         uint32_t negotiate_context_offset = 0;
4845         uint16_t negotiate_context_count = 0;
4846         DATA_BLOB negotiate_context_blob = data_blob_null;
4847         size_t avail;
4848         size_t ctx_ofs;
4849         size_t needed;
4850         struct smb2_negotiate_context *preauth = NULL;
4851         uint16_t hash_count;
4852         uint16_t salt_length;
4853         uint16_t hash_selected;
4854         struct hc_sha512state sctx;
4855         struct smb2_negotiate_context *cipher = NULL;
4856         struct iovec sent_iov[3];
4857         static const struct smb2cli_req_expected_response expected[] = {
4858         {
4859                 .status = NT_STATUS_OK,
4860                 .body_size = 0x41
4861         }
4862         };
4863
4864         status = smb2cli_req_recv(subreq, state, &iov,
4865                                   expected, ARRAY_SIZE(expected));
4866         if (tevent_req_nterror(req, status)) {
4867                 return;
4868         }
4869
4870         body = (uint8_t *)iov[1].iov_base;
4871
4872         dialect_revision = SVAL(body, 4);
4873
4874         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4875                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4876                         continue;
4877                 }
4878
4879                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4880                         continue;
4881                 }
4882
4883                 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
4884                         continue;
4885                 }
4886
4887                 conn->protocol = smb2cli_prots[i].proto;
4888                 break;
4889         }
4890
4891         if (conn->protocol == PROTOCOL_NONE) {
4892                 TALLOC_FREE(subreq);
4893
4894                 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
4895                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4896                         return;
4897                 }
4898
4899                 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
4900                         tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4901                         return;
4902                 }
4903
4904                 /* make sure we do not loop forever */
4905                 state->conn->min_protocol = PROTOCOL_SMB2_02;
4906
4907                 /*
4908                  * send a SMB2 negprot, in order to negotiate
4909                  * the SMB2 dialect.
4910                  */
4911                 subreq = smbXcli_negprot_smb2_subreq(state);
4912                 if (tevent_req_nomem(subreq, req)) {
4913                         return;
4914                 }
4915                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4916                 return;
4917         }
4918
4919         conn->smb2.server.security_mode = SVAL(body, 2);
4920         if (conn->protocol >= PROTOCOL_SMB3_10) {
4921                 negotiate_context_count = SVAL(body, 6);
4922         }
4923
4924         blob = data_blob_const(body + 8, 16);
4925         status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
4926         if (tevent_req_nterror(req, status)) {
4927                 return;
4928         }
4929
4930         conn->smb2.server.capabilities  = IVAL(body, 24);
4931         conn->smb2.server.max_trans_size= IVAL(body, 28);
4932         conn->smb2.server.max_read_size = IVAL(body, 32);
4933         conn->smb2.server.max_write_size= IVAL(body, 36);
4934         conn->smb2.server.system_time   = BVAL(body, 40);
4935         conn->smb2.server.start_time    = BVAL(body, 48);
4936
4937         security_offset = SVAL(body, 56);
4938         security_length = SVAL(body, 58);
4939
4940         if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
4941                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4942                 return;
4943         }
4944
4945         if (security_length > iov[2].iov_len) {
4946                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4947                 return;
4948         }
4949
4950         conn->smb2.server.gss_blob = data_blob_talloc(conn,
4951                                                 iov[2].iov_base,
4952                                                 security_length);
4953         if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
4954                 return;
4955         }
4956
4957         if (conn->protocol < PROTOCOL_SMB3_10) {
4958                 TALLOC_FREE(subreq);
4959
4960                 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4961                         conn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
4962                 }
4963                 tevent_req_done(req);
4964                 return;
4965         }
4966
4967         /*
4968          * Here we are now at SMB3_11, so encryption should be
4969          * negotiated via context, not capabilities.
4970          */
4971
4972         if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4973                 /*
4974                  * Server set SMB2_CAP_ENCRYPTION capability,
4975                  * but *SHOULD* not, not *MUST* not. Just mask it off.
4976                  * NetApp seems to do this:
4977                  * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009
4978                  */
4979                 conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION;
4980         }
4981
4982         negotiate_context_offset = IVAL(body, 60);
4983         if (negotiate_context_offset < security_offset) {
4984                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4985                 return;
4986         }
4987
4988         ctx_ofs = negotiate_context_offset - security_offset;
4989         if (ctx_ofs > iov[2].iov_len) {
4990                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4991                 return;
4992         }
4993         avail = iov[2].iov_len - security_length;
4994         needed = iov[2].iov_len - ctx_ofs;
4995         if (needed > avail) {
4996                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4997                 return;
4998         }
4999
5000         negotiate_context_blob.data = (uint8_t *)iov[2].iov_base;
5001         negotiate_context_blob.length = iov[2].iov_len;
5002
5003         negotiate_context_blob.data += ctx_ofs;
5004         negotiate_context_blob.length -= ctx_ofs;
5005
5006         status = smb2_negotiate_context_parse(state, negotiate_context_blob, &c);
5007         if (tevent_req_nterror(req, status)) {
5008                 return;
5009         }
5010
5011         if (negotiate_context_count != c.num_contexts) {
5012                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5013                 return;
5014         }
5015
5016         preauth = smb2_negotiate_context_find(&c,
5017                                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
5018         if (preauth == NULL) {
5019                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5020                 return;
5021         }
5022
5023         if (preauth->data.length < 6) {
5024                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5025                 return;
5026         }
5027
5028         hash_count = SVAL(preauth->data.data, 0);
5029         salt_length = SVAL(preauth->data.data, 2);
5030         hash_selected = SVAL(preauth->data.data, 4);
5031
5032         if (hash_count != 1) {
5033                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5034                 return;
5035         }
5036
5037         if (preauth->data.length != (6 + salt_length)) {
5038                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5039                 return;
5040         }
5041
5042         if (hash_selected != SMB2_PREAUTH_INTEGRITY_SHA512) {
5043                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5044                 return;
5045         }
5046
5047         cipher = smb2_negotiate_context_find(&c, SMB2_ENCRYPTION_CAPABILITIES);
5048         if (cipher != NULL) {
5049                 uint16_t cipher_count;
5050
5051                 if (cipher->data.length < 2) {
5052                         tevent_req_nterror(req,
5053                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5054                         return;
5055                 }
5056
5057                 cipher_count = SVAL(cipher->data.data, 0);
5058
5059                 if (cipher_count > 1) {
5060                         tevent_req_nterror(req,
5061                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5062                         return;
5063                 }
5064
5065                 if (cipher->data.length < (2 + 2 * cipher_count)) {
5066                         tevent_req_nterror(req,
5067                                         NT_STATUS_INVALID_NETWORK_RESPONSE);
5068                         return;
5069                 }
5070
5071                 if (cipher_count == 1) {
5072                         uint16_t cipher_selected;
5073
5074                         cipher_selected = SVAL(cipher->data.data, 2);
5075
5076                         switch (cipher_selected) {
5077                         case SMB2_ENCRYPTION_AES128_GCM:
5078                         case SMB2_ENCRYPTION_AES128_CCM:
5079                                 conn->smb2.server.cipher = cipher_selected;
5080                                 break;
5081                         }
5082                 }
5083         }
5084
5085         /* First we hash the request */
5086         smb2cli_req_get_sent_iov(subreq, sent_iov);
5087         samba_SHA512_Init(&sctx);
5088         samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
5089                       sizeof(conn->smb2.preauth_sha512));
5090         for (i = 0; i < 3; i++) {
5091                 samba_SHA512_Update(&sctx, sent_iov[i].iov_base, sent_iov[i].iov_len);
5092         }
5093         samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
5094         TALLOC_FREE(subreq);
5095
5096         /* And now we hash the response */
5097         samba_SHA512_Init(&sctx);
5098         samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
5099                       sizeof(conn->smb2.preauth_sha512));
5100         for (i = 0; i < 3; i++) {
5101                 samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
5102         }
5103         samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
5104
5105         tevent_req_done(req);
5106 }
5107
5108 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
5109                                                   TALLOC_CTX *tmp_mem,
5110                                                   uint8_t *inbuf)
5111 {
5112         size_t num_pending = talloc_array_length(conn->pending);
5113         struct tevent_req *subreq;
5114         struct smbXcli_req_state *substate;
5115         struct tevent_req *req;
5116         uint32_t protocol_magic;
5117         size_t inbuf_len = smb_len_nbt(inbuf);
5118
5119         if (num_pending != 1) {
5120                 return NT_STATUS_INTERNAL_ERROR;
5121         }
5122
5123         if (inbuf_len < 4) {
5124                 return NT_STATUS_INVALID_NETWORK_RESPONSE;
5125         }
5126
5127         subreq = conn->pending[0];
5128         substate = tevent_req_data(subreq, struct smbXcli_req_state);
5129         req = tevent_req_callback_data(subreq, struct tevent_req);
5130
5131         protocol_magic = IVAL(inbuf, 4);
5132
5133         switch (protocol_magic) {
5134         case SMB_MAGIC:
5135                 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
5136                 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
5137                 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5138
5139         case SMB2_MAGIC:
5140                 if (substate->smb2.recv_iov == NULL) {
5141                         /*
5142                          * For the SMB1 negprot we have move it.
5143                          */
5144                         substate->smb2.recv_iov = substate->smb1.recv_iov;
5145                         substate->smb1.recv_iov = NULL;
5146                 }
5147
5148                 /*
5149                  * we got an SMB2 answer, which consumed sequence number 0
5150                  * so we need to use 1 as the next one.
5151                  *
5152                  * we also need to set the current credits to 0
5153                  * as we consumed the initial one. The SMB2 answer
5154                  * hopefully grant us a new credit.
5155                  */
5156                 conn->smb2.mid = 1;
5157                 conn->smb2.cur_credits = 0;
5158                 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5159                 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
5160                 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5161         }
5162
5163         DEBUG(10, ("Got non-SMB PDU\n"));
5164         return NT_STATUS_INVALID_NETWORK_RESPONSE;
5165 }
5166
5167 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
5168 {
5169         return tevent_req_simple_recv_ntstatus(req);
5170 }
5171
5172 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
5173                          uint32_t timeout_msec,
5174                          enum protocol_types min_protocol,
5175                          enum protocol_types max_protocol)
5176 {
5177         TALLOC_CTX *frame = talloc_stackframe();
5178         struct tevent_context *ev;
5179         struct tevent_req *req;
5180         NTSTATUS status = NT_STATUS_NO_MEMORY;
5181         bool ok;
5182
5183         if (smbXcli_conn_has_async_calls(conn)) {
5184                 /*
5185                  * Can't use sync call while an async call is in flight
5186                  */
5187                 status = NT_STATUS_INVALID_PARAMETER_MIX;
5188                 goto fail;
5189         }
5190         ev = samba_tevent_context_init(frame);
5191         if (ev == NULL) {
5192                 goto fail;
5193         }
5194         req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
5195                                    min_protocol, max_protocol,
5196                                    WINDOWS_CLIENT_PURE_SMB2_NEGPROT_INITIAL_CREDIT_ASK);
5197         if (req == NULL) {
5198                 goto fail;
5199         }
5200         ok = tevent_req_poll_ntstatus(req, ev, &status);
5201         if (!ok) {
5202                 goto fail;
5203         }
5204         status = smbXcli_negprot_recv(req);
5205  fail:
5206         TALLOC_FREE(frame);
5207         return status;
5208 }
5209
5210 struct smb2cli_validate_negotiate_info_state {
5211         struct smbXcli_conn *conn;
5212         DATA_BLOB in_input_buffer;
5213         DATA_BLOB in_output_buffer;
5214         DATA_BLOB out_input_buffer;
5215         DATA_BLOB out_output_buffer;
5216         uint16_t dialect;
5217 };
5218
5219 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq);
5220
5221 struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx,
5222                                                 struct tevent_context *ev,
5223                                                 struct smbXcli_conn *conn,
5224                                                 uint32_t timeout_msec,
5225                                                 struct smbXcli_session *session,
5226                                                 struct smbXcli_tcon *tcon)
5227 {
5228         struct tevent_req *req;
5229         struct smb2cli_validate_negotiate_info_state *state;
5230         uint8_t *buf;
5231         uint16_t dialect_count = 0;
5232         struct tevent_req *subreq;
5233         bool _save_should_sign;
5234         size_t i;
5235
5236         req = tevent_req_create(mem_ctx, &state,
5237                                 struct smb2cli_validate_negotiate_info_state);
5238         if (req == NULL) {
5239                 return NULL;
5240         }
5241         state->conn = conn;
5242
5243         state->in_input_buffer = data_blob_talloc_zero(state,
5244                                         4 + 16 + 1 + 1 + 2);
5245         if (tevent_req_nomem(state->in_input_buffer.data, req)) {
5246                 return tevent_req_post(req, ev);
5247         }
5248         buf = state->in_input_buffer.data;
5249
5250         if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
5251                 SIVAL(buf, 0, conn->smb2.client.capabilities);
5252         } else {
5253                 SIVAL(buf, 0, 0); /* Capabilities */
5254         }
5255         if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
5256                 NTSTATUS status;
5257                 DATA_BLOB blob;
5258
5259                 status = GUID_to_ndr_blob(&conn->smb2.client.guid,
5260                                           state, &blob);
5261                 if (!NT_STATUS_IS_OK(status)) {
5262                         return NULL;
5263                 }
5264                 memcpy(buf+4, blob.data, 16); /* ClientGuid */
5265         } else {
5266                 memset(buf+4, 0, 16);   /* ClientGuid */
5267         }
5268         if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5269                 SCVAL(buf, 20, conn->smb2.client.security_mode);
5270         } else {
5271                 SCVAL(buf, 20, 0);
5272         }
5273         SCVAL(buf, 21, 0); /* reserved */
5274
5275         for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5276                 bool ok;
5277                 size_t ofs;
5278
5279                 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5280                         continue;
5281                 }
5282
5283                 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5284                         continue;
5285                 }
5286
5287                 if (smb2cli_prots[i].proto == state->conn->protocol) {
5288                         state->dialect = smb2cli_prots[i].smb2_dialect;
5289                 }
5290
5291                 ofs = state->in_input_buffer.length;
5292                 ok = data_blob_realloc(state, &state->in_input_buffer,
5293                                        ofs + 2);
5294                 if (!ok) {
5295                         tevent_req_oom(req);
5296                         return tevent_req_post(req, ev);
5297                 }
5298
5299                 buf = state->in_input_buffer.data;
5300                 SSVAL(buf, ofs, smb2cli_prots[i].smb2_dialect);
5301
5302                 dialect_count++;
5303         }
5304         buf = state->in_input_buffer.data;
5305         SSVAL(buf, 22, dialect_count);
5306
5307         _save_should_sign = smb2cli_tcon_is_signing_on(tcon);
5308         smb2cli_tcon_should_sign(tcon, true);
5309         subreq = smb2cli_ioctl_send(state, ev, conn,
5310                                     timeout_msec, session, tcon,
5311                                     UINT64_MAX, /* in_fid_persistent */
5312                                     UINT64_MAX, /* in_fid_volatile */
5313                                     FSCTL_VALIDATE_NEGOTIATE_INFO,
5314                                     0, /* in_max_input_length */
5315                                     &state->in_input_buffer,
5316                                     24, /* in_max_output_length */
5317                                     &state->in_output_buffer,
5318                                     SMB2_IOCTL_FLAG_IS_FSCTL);
5319         smb2cli_tcon_should_sign(tcon, _save_should_sign);
5320         if (tevent_req_nomem(subreq, req)) {
5321                 return tevent_req_post(req, ev);
5322         }
5323         tevent_req_set_callback(subreq,
5324                                 smb2cli_validate_negotiate_info_done,
5325                                 req);
5326
5327         return req;
5328 }
5329
5330 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq)
5331 {
5332         struct tevent_req *req =
5333                 tevent_req_callback_data(subreq,
5334                 struct tevent_req);
5335         struct smb2cli_validate_negotiate_info_state *state =
5336                 tevent_req_data(req,
5337                 struct smb2cli_validate_negotiate_info_state);
5338         NTSTATUS status;
5339         const uint8_t *buf;
5340         uint32_t capabilities;
5341         DATA_BLOB guid_blob;
5342         struct GUID server_guid;
5343         uint16_t security_mode;
5344         uint16_t dialect;
5345
5346         status = smb2cli_ioctl_recv(subreq, state,
5347                                     &state->out_input_buffer,
5348                                     &state->out_output_buffer);
5349         TALLOC_FREE(subreq);
5350         if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED)) {
5351                 /*
5352                  * The response was signed, but not supported
5353                  *
5354                  * Older Windows and Samba releases return
5355                  * NT_STATUS_FILE_CLOSED.
5356                  */
5357                 tevent_req_done(req);
5358                 return;
5359         }
5360         if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST)) {
5361                 /*
5362                  * The response was signed, but not supported
5363                  *
5364                  * This is returned by the NTVFS based Samba 4.x file server
5365                  * for file shares.
5366                  */
5367                 tevent_req_done(req);
5368                 return;
5369         }
5370         if (NT_STATUS_EQUAL(status, NT_STATUS_FS_DRIVER_REQUIRED)) {
5371                 /*
5372                  * The response was signed, but not supported
5373                  *
5374                  * This is returned by the NTVFS based Samba 4.x file server
5375                  * for ipc shares.
5376                  */
5377                 tevent_req_done(req);
5378                 return;
5379         }
5380         if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
5381                 /*
5382                  * The response was signed, but not supported
5383                  *
5384                  * This might be returned by older Windows versions or by
5385                  * NetApp SMB server implementations.
5386                  *
5387                  * See
5388                  *
5389                  * https://blogs.msdn.microsoft.com/openspecification/2012/06/28/smb3-secure-dialect-negotiation/
5390                  *
5391                  */
5392                 tevent_req_done(req);
5393                 return;
5394         }
5395         if (tevent_req_nterror(req, status)) {
5396                 return;
5397         }
5398
5399         if (state->out_output_buffer.length != 24) {
5400                 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5401                 return;
5402         }
5403
5404         buf = state->out_output_buffer.data;
5405
5406         capabilities = IVAL(buf, 0);
5407         guid_blob = data_blob_const(buf + 4, 16);
5408         status = GUID_from_data_blob(&guid_blob, &server_guid);
5409         if (tevent_req_nterror(req, status)) {
5410                 return;
5411         }
5412         security_mode = CVAL(buf, 20);
5413         dialect = SVAL(buf, 22);
5414
5415         if (capabilities != state->conn->smb2.server.capabilities) {
5416                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5417                 return;
5418         }
5419
5420         if (!GUID_equal(&server_guid, &state->conn->smb2.server.guid)) {
5421                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5422                 return;
5423         }
5424
5425         if (security_mode != state->conn->smb2.server.security_mode) {
5426                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5427                 return;
5428         }
5429
5430         if (dialect != state->dialect) {
5431                 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5432                 return;
5433         }
5434
5435         tevent_req_done(req);
5436 }
5437
5438 NTSTATUS smb2cli_validate_negotiate_info_recv(struct tevent_req *req)
5439 {
5440         return tevent_req_simple_recv_ntstatus(req);
5441 }
5442
5443 static int smbXcli_session_destructor(struct smbXcli_session *session)
5444 {
5445         if (session->conn == NULL) {
5446                 return 0;
5447         }
5448
5449         DLIST_REMOVE(session->conn->sessions, session);
5450         return 0;
5451 }
5452
5453 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
5454                                                struct smbXcli_conn *conn)
5455 {
5456         struct smbXcli_session *session;
5457
5458         session = talloc_zero(mem_ctx, struct smbXcli_session);
5459         if (session == NULL) {
5460                 return NULL;
5461         }
5462         session->smb2 = talloc_zero(session, struct smb2cli_session);
5463         if (session->smb2 == NULL) {
5464                 talloc_free(session);
5465                 return NULL;
5466         }
5467         talloc_set_destructor(session, smbXcli_session_destructor);
5468
5469         DLIST_ADD_END(conn->sessions, session);
5470         session->conn = conn;
5471
5472         memcpy(session->smb2_channel.preauth_sha512,
5473                conn->smb2.preauth_sha512,
5474                sizeof(session->smb2_channel.preauth_sha512));
5475
5476         return session;
5477 }
5478
5479 struct smbXcli_session *smbXcli_session_copy(TALLOC_CTX *mem_ctx,
5480                                                 struct smbXcli_session *src)
5481 {
5482         struct smbXcli_session *session;
5483
5484         session = talloc_zero(mem_ctx, struct smbXcli_session);
5485         if (session == NULL) {
5486                 return NULL;
5487         }
5488         session->smb2 = talloc_zero(session, struct smb2cli_session);
5489         if (session->smb2 == NULL) {
5490                 talloc_free(session);
5491                 return NULL;
5492         }
5493
5494         session->conn = src->conn;
5495         *session->smb2 = *src->smb2;
5496         session->smb2_channel = src->smb2_channel;
5497         session->disconnect_expired = src->disconnect_expired;
5498
5499         DLIST_ADD_END(src->conn->sessions, session);
5500         talloc_set_destructor(session, smbXcli_session_destructor);
5501
5502         return session;
5503 }
5504
5505 bool smbXcli_session_is_guest(struct smbXcli_session *session)
5506 {
5507         if (session == NULL) {
5508                 return false;
5509         }
5510
5511         if (session->conn == NULL) {
5512                 return false;
5513         }
5514
5515         if (session->conn->mandatory_signing) {
5516                 return false;
5517         }
5518
5519         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5520                 if (session->smb2->session_flags & SMB2_SESSION_FLAG_IS_GUEST) {
5521                         return true;
5522                 }
5523                 return false;
5524         }
5525
5526         if (session->smb1.action & SMB_SETUP_GUEST) {
5527                 return true;
5528         }
5529
5530         return false;
5531 }
5532
5533 bool smbXcli_session_is_authenticated(struct smbXcli_session *session)
5534 {
5535         const DATA_BLOB *application_key;
5536
5537         if (session == NULL) {
5538                 return false;
5539         }
5540
5541         if (session->conn == NULL) {
5542                 return false;
5543         }
5544
5545         /*
5546          * If we have an application key we had a session key negotiated
5547          * at auth time.
5548          */
5549         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5550                 application_key = &session->smb2->application_key;
5551         } else {
5552                 application_key = &session->smb1.application_key;
5553         }
5554
5555         if (application_key->length == 0) {
5556                 return false;
5557         }
5558
5559         return true;
5560 }
5561
5562 NTSTATUS smb2cli_session_signing_key(struct smbXcli_session *session,
5563                                      TALLOC_CTX *mem_ctx,
5564                                      DATA_BLOB *key)
5565 {
5566         DATA_BLOB *sig = NULL;
5567
5568         if (session->conn == NULL) {
5569                 return NT_STATUS_NO_USER_SESSION_KEY;
5570         }
5571
5572         /*
5573          * Use channel signing key if there is one, otherwise fallback
5574          * to session.
5575          */
5576
5577         if (session->smb2_channel.signing_key.length != 0) {
5578                 sig = &session->smb2_channel.signing_key;
5579         } else if (session->smb2->signing_key.length != 0) {
5580                 sig = &session->smb2->signing_key;
5581         } else {
5582                 return NT_STATUS_NO_USER_SESSION_KEY;
5583         }
5584
5585         *key = data_blob_dup_talloc(mem_ctx, *sig);
5586         if (key->data == NULL) {
5587                 return NT_STATUS_NO_MEMORY;
5588         }
5589
5590         return NT_STATUS_OK;
5591 }
5592
5593 NTSTATUS smb2cli_session_encryption_key(struct smbXcli_session *session,
5594                                         TALLOC_CTX *mem_ctx,
5595                                         DATA_BLOB *key)
5596 {
5597         if (session->conn == NULL) {
5598                 return NT_STATUS_NO_USER_SESSION_KEY;
5599         }
5600
5601         if (session->conn->protocol < PROTOCOL_SMB3_00) {
5602                 return NT_STATUS_NO_USER_SESSION_KEY;
5603         }
5604
5605         if (session->smb2->encryption_key.length == 0) {
5606                 return NT_STATUS_NO_USER_SESSION_KEY;
5607         }
5608
5609         *key = data_blob_dup_talloc(mem_ctx, session->smb2->encryption_key);
5610         if (key->data == NULL) {
5611                 return NT_STATUS_NO_MEMORY;
5612         }
5613
5614         return NT_STATUS_OK;
5615 }
5616
5617 NTSTATUS smb2cli_session_decryption_key(struct smbXcli_session *session,
5618                                         TALLOC_CTX *mem_ctx,
5619                                         DATA_BLOB *key)
5620 {
5621         if (session->conn == NULL) {
5622                 return NT_STATUS_NO_USER_SESSION_KEY;
5623         }
5624
5625         if (session->conn->protocol < PROTOCOL_SMB3_00) {
5626                 return NT_STATUS_NO_USER_SESSION_KEY;
5627         }
5628
5629         if (session->smb2->decryption_key.length == 0) {
5630                 return NT_STATUS_NO_USER_SESSION_KEY;
5631         }
5632
5633         *key = data_blob_dup_talloc(mem_ctx, session->smb2->decryption_key);
5634         if (key->data == NULL) {
5635                 return NT_STATUS_NO_MEMORY;
5636         }
5637
5638         return NT_STATUS_OK;
5639 }
5640
5641 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
5642                                          TALLOC_CTX *mem_ctx,
5643                                          DATA_BLOB *key)
5644 {
5645         const DATA_BLOB *application_key;
5646
5647         *key = data_blob_null;
5648
5649         if (session->conn == NULL) {
5650                 return NT_STATUS_NO_USER_SESSION_KEY;
5651         }
5652
5653         if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5654                 application_key = &session->smb2->application_key;
5655         } else {
5656                 application_key = &session->smb1.application_key;
5657         }
5658
5659         if (application_key->length == 0) {
5660                 return NT_STATUS_NO_USER_SESSION_KEY;
5661         }
5662
5663         *key = data_blob_dup_talloc(mem_ctx, *application_key);
5664         if (key->data == NULL) {
5665                 return NT_STATUS_NO_MEMORY;
5666         }
5667
5668         return NT_STATUS_OK;
5669 }
5670
5671 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
5672 {
5673         session->disconnect_expired = true;
5674 }
5675
5676 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
5677 {
5678         return session->smb1.session_id;
5679 }
5680
5681 void smb1cli_session_set_id(struct smbXcli_session *session,
5682                             uint16_t session_id)
5683 {
5684         session->smb1.session_id = session_id;
5685 }
5686
5687 void smb1cli_session_set_action(struct smbXcli_session *session,
5688                                 uint16_t action)
5689 {
5690         session->smb1.action = action;
5691 }
5692
5693 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
5694                                          const DATA_BLOB _session_key)
5695 {
5696         struct smbXcli_conn *conn = session->conn;
5697         uint8_t session_key[16];
5698
5699         if (conn == NULL) {
5700                 return NT_STATUS_INVALID_PARAMETER_MIX;
5701         }
5702
5703         if (session->smb1.application_key.length != 0) {
5704                 /*
5705                  * TODO: do not allow this...
5706                  *
5707                  * return NT_STATUS_INVALID_PARAMETER_MIX;
5708                  */
5709                 data_blob_clear_free(&session->smb1.application_key);
5710                 session->smb1.protected_key = false;
5711         }
5712
5713         if (_session_key.length == 0) {
5714                 return NT_STATUS_OK;
5715         }
5716
5717         ZERO_STRUCT(session_key);
5718         memcpy(session_key, _session_key.data,
5719                MIN(_session_key.length, sizeof(session_key)));
5720
5721         session->smb1.application_key = data_blob_talloc(session,
5722                                                          session_key,
5723                                                          sizeof(session_key));
5724         ZERO_STRUCT(session_key);
5725         if (session->smb1.application_key.data == NULL) {
5726                 return NT_STATUS_NO_MEMORY;
5727         }
5728
5729         session->smb1.protected_key = false;
5730
5731         return NT_STATUS_OK;
5732 }
5733
5734 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
5735 {
5736         if (session->smb1.protected_key) {
5737                 /* already protected */
5738                 return NT_STATUS_OK;
5739         }
5740
5741         if (session->smb1.application_key.length != 16) {
5742                 return NT_STATUS_INVALID_PARAMETER_MIX;
5743         }
5744
5745         smb_key_derivation(session->smb1.application_key.data,
5746                            session->smb1.application_key.length,
5747                            session->smb1.application_key.data);
5748
5749         session->smb1.protected_key = true;
5750
5751         return NT_STATUS_OK;
5752 }
5753
5754 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
5755 {
5756         struct smbXcli_conn *conn = session->conn;
5757         uint8_t security_mode = 0;
5758
5759         if (conn == NULL) {
5760                 return security_mode;
5761         }
5762
5763         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
5764         if (conn->mandatory_signing) {
5765                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
5766         }
5767         if (session->smb2->should_sign) {
5768                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
5769         }
5770
5771         return security_mode;
5772 }
5773
5774 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
5775 {
5776         return session->smb2->session_id;
5777 }
5778
5779 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
5780 {
5781         return session->smb2->session_flags;
5782 }
5783
5784 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
5785                                       uint64_t session_id,
5786                                       uint16_t session_flags)
5787 {
5788         session->smb2->session_id = session_id;
5789         session->smb2->session_flags = session_flags;
5790 }
5791
5792 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
5793 {
5794         session->smb2->channel_sequence += 1;
5795 }
5796
5797 uint16_t smb2cli_session_reset_channel_sequence(struct smbXcli_session *session,
5798                                                 uint16_t channel_sequence)
5799 {
5800         uint16_t prev_cs;
5801
5802         prev_cs = session->smb2->channel_sequence;
5803         session->smb2->channel_sequence = channel_sequence;
5804
5805         return prev_cs;
5806 }
5807
5808 uint16_t smb2cli_session_current_channel_sequence(struct smbXcli_session *session)
5809 {
5810         return session->smb2->channel_sequence;
5811 }
5812
5813 void smb2cli_session_start_replay(struct smbXcli_session *session)
5814 {
5815         session->smb2->replay_active = true;
5816 }
5817
5818 void smb2cli_session_stop_replay(struct smbXcli_session *session)
5819 {
5820         session->smb2->replay_active = false;
5821 }
5822
5823 void smb2cli_session_require_signed_response(struct smbXcli_session *session,
5824                                              bool require_signed_response)
5825 {
5826         session->smb2->require_signed_response = require_signed_response;
5827 }
5828
5829 NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
5830                                         const struct iovec *iov)
5831 {
5832         struct hc_sha512state sctx;
5833         size_t i;
5834
5835         if (session->conn == NULL) {
5836                 return NT_STATUS_INTERNAL_ERROR;
5837         }
5838
5839         if (session->conn->protocol < PROTOCOL_SMB3_10) {
5840                 return NT_STATUS_OK;
5841         }
5842
5843         if (session->smb2_channel.signing_key.length != 0) {
5844                 return NT_STATUS_OK;
5845         }
5846
5847         samba_SHA512_Init(&sctx);
5848         samba_SHA512_Update(&sctx, session->smb2_channel.preauth_sha512,
5849                       sizeof(session->smb2_channel.preauth_sha512));
5850         for (i = 0; i < 3; i++) {
5851                 samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
5852         }
5853         samba_SHA512_Final(session->smb2_channel.preauth_sha512, &sctx);
5854
5855         return NT_STATUS_OK;
5856 }
5857
5858 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
5859                                          const DATA_BLOB _session_key,
5860                                          const struct iovec *recv_iov)
5861 {
5862         struct smbXcli_conn *conn = session->conn;
5863         uint16_t no_sign_flags = 0;
5864         uint8_t session_key[16];
5865         bool check_signature = true;
5866         uint32_t hdr_flags;
5867         NTSTATUS status;
5868         struct _derivation {
5869                 DATA_BLOB label;
5870                 DATA_BLOB context;
5871         };
5872         struct {
5873                 struct _derivation signing;
5874                 struct _derivation encryption;
5875                 struct _derivation decryption;
5876                 struct _derivation application;
5877         } derivation = {
5878                 .signing.label.length = 0,
5879         };
5880         size_t nonce_size = 0;
5881
5882         if (conn == NULL) {
5883                 return NT_STATUS_INVALID_PARAMETER_MIX;
5884         }
5885
5886         if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
5887                 return NT_STATUS_INVALID_PARAMETER_MIX;
5888         }
5889
5890         if (!conn->mandatory_signing) {
5891                 /*
5892                  * only allow guest sessions without
5893                  * mandatory signing.
5894                  *
5895                  * If we try an authentication with username != ""
5896                  * and the server let us in without verifying the
5897                  * password we don't have a negotiated session key
5898                  * for signing.
5899                  */
5900                 no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST;
5901         }
5902
5903         if (session->smb2->session_flags & no_sign_flags) {
5904                 session->smb2->should_sign = false;
5905                 return NT_STATUS_OK;
5906         }
5907
5908         if (session->smb2->signing_key.length != 0) {
5909                 return NT_STATUS_INVALID_PARAMETER_MIX;
5910         }
5911
5912         if (conn->protocol >= PROTOCOL_SMB3_10) {
5913                 struct _derivation *d;
5914                 DATA_BLOB p;
5915
5916                 p = data_blob_const(session->smb2_channel.preauth_sha512,
5917                                 sizeof(session->smb2_channel.preauth_sha512));
5918
5919                 d = &derivation.signing;
5920                 d->label = data_blob_string_const_null("SMBSigningKey");
5921                 d->context = p;
5922
5923                 d = &derivation.encryption;
5924                 d->label = data_blob_string_const_null("SMBC2SCipherKey");
5925                 d->context = p;
5926
5927                 d = &derivation.decryption;
5928                 d->label = data_blob_string_const_null("SMBS2CCipherKey");
5929                 d->context = p;
5930
5931                 d = &derivation.application;
5932                 d->label = data_blob_string_const_null("SMBAppKey");
5933                 d->context = p;
5934
5935         } else if (conn->protocol >= PROTOCOL_SMB2_24) {
5936                 struct _derivation *d;
5937
5938                 d = &derivation.signing;
5939                 d->label = data_blob_string_const_null("SMB2AESCMAC");
5940                 d->context = data_blob_string_const_null("SmbSign");
5941
5942                 d = &derivation.encryption;
5943                 d->label = data_blob_string_const_null("SMB2AESCCM");
5944                 d->context = data_blob_string_const_null("ServerIn ");
5945
5946                 d = &derivation.decryption;
5947                 d->label = data_blob_string_const_null("SMB2AESCCM");
5948                 d->context = data_blob_string_const_null("ServerOut");
5949
5950                 d = &derivation.application;
5951                 d->label = data_blob_string_const_null("SMB2APP");
5952                 d->context = data_blob_string_const_null("SmbRpc");
5953         }
5954
5955         ZERO_STRUCT(session_key);
5956         memcpy(session_key, _session_key.data,
5957                MIN(_session_key.length, sizeof(session_key)));
5958
5959         session->smb2->signing_key = data_blob_talloc(session,
5960                                                      session_key,
5961                                                      sizeof(session_key));
5962         if (session->smb2->signing_key.data == NULL) {
5963                 ZERO_STRUCT(session_key);
5964                 return NT_STATUS_NO_MEMORY;
5965         }
5966
5967         if (conn->protocol >= PROTOCOL_SMB2_24) {
5968                 struct _derivation *d = &derivation.signing;
5969
5970                 smb2_key_derivation(session_key, sizeof(session_key),
5971                                     d->label.data, d->label.length,
5972                                     d->context.data, d->context.length,
5973                                     session->smb2->signing_key.data);
5974         }
5975
5976         session->smb2->encryption_key = data_blob_dup_talloc(session,
5977                                                 session->smb2->signing_key);
5978         if (session->smb2->encryption_key.data == NULL) {
5979                 ZERO_STRUCT(session_key);
5980                 return NT_STATUS_NO_MEMORY;
5981         }
5982
5983         if (conn->protocol >= PROTOCOL_SMB2_24) {
5984                 struct _derivation *d = &derivation.encryption;
5985
5986                 smb2_key_derivation(session_key, sizeof(session_key),
5987                                     d->label.data, d->label.length,
5988                                     d->context.data, d->context.length,
5989                                     session->smb2->encryption_key.data);
5990         }
5991
5992         session->smb2->decryption_key = data_blob_dup_talloc(session,
5993                                                 session->smb2->signing_key);
5994         if (session->smb2->decryption_key.data == NULL) {
5995                 ZERO_STRUCT(session_key);
5996                 return NT_STATUS_NO_MEMORY;
5997         }
5998
5999         if (conn->protocol >= PROTOCOL_SMB2_24) {
6000                 struct _derivation *d = &derivation.decryption;
6001
6002                 smb2_key_derivation(session_key, sizeof(session_key),
6003                                     d->label.data, d->label.length,
6004                                     d->context.data, d->context.length,
6005                                     session->smb2->decryption_key.data);
6006         }
6007
6008         session->smb2->application_key = data_blob_dup_talloc(session,
6009                                                 session->smb2->signing_key);
6010         if (session->smb2->application_key.data == NULL) {
6011                 ZERO_STRUCT(session_key);
6012                 return NT_STATUS_NO_MEMORY;
6013         }
6014
6015         if (conn->protocol >= PROTOCOL_SMB2_24) {
6016                 struct _derivation *d = &derivation.application;
6017
6018                 smb2_key_derivation(session_key, sizeof(session_key),
6019                                     d->label.data, d->label.length,
6020                                     d->context.data, d->context.length,
6021                                     session->smb2->application_key.data);
6022         }
6023         ZERO_STRUCT(session_key);
6024
6025         session->smb2_channel.signing_key = data_blob_dup_talloc(session,
6026                                                 session->smb2->signing_key);
6027         if (session->smb2_channel.signing_key.data == NULL) {
6028                 return NT_STATUS_NO_MEMORY;
6029         }
6030
6031         check_signature = conn->mandatory_signing;
6032
6033         hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
6034         if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
6035                 /*
6036                  * Sadly some vendors don't sign the
6037                  * final SMB2 session setup response
6038                  *
6039                  * At least Windows and Samba are always doing this
6040                  * if there's a session key available.
6041                  *
6042                  * We only check the signature if it's mandatory
6043                  * or SMB2_HDR_FLAG_SIGNED is provided.
6044                  */
6045                 check_signature = true;
6046         }
6047
6048         if (conn->protocol >= PROTOCOL_SMB3_10) {
6049                 check_signature = true;
6050         }
6051
6052         if (check_signature) {
6053                 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6054                                                 session->conn->protocol,
6055                                                 recv_iov, 3);
6056                 if (!NT_STATUS_IS_OK(status)) {
6057                         return status;
6058                 }
6059         }
6060
6061         session->smb2->should_sign = false;
6062         session->smb2->should_encrypt = false;
6063
6064         if (conn->desire_signing) {
6065                 session->smb2->should_sign = true;
6066         }
6067
6068         if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
6069                 session->smb2->should_sign = true;
6070         }
6071
6072         if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
6073                 session->smb2->should_encrypt = true;
6074         }
6075
6076         if (conn->protocol < PROTOCOL_SMB2_24) {
6077                 session->smb2->should_encrypt = false;
6078         }
6079
6080         if (conn->smb2.server.cipher == 0) {
6081                 session->smb2->should_encrypt = false;
6082         }
6083
6084         /*
6085          * CCM and GCM algorithms must never have their
6086          * nonce wrap, or the security of the whole
6087          * communication and the keys is destroyed.
6088          * We must drop the connection once we have
6089          * transfered too much data.
6090          *
6091          * NOTE: We assume nonces greater than 8 bytes.
6092          */
6093         generate_random_buffer((uint8_t *)&session->smb2->nonce_high_random,
6094                                sizeof(session->smb2->nonce_high_random));
6095         switch (conn->smb2.server.cipher) {
6096         case SMB2_ENCRYPTION_AES128_CCM:
6097                 nonce_size = AES_CCM_128_NONCE_SIZE;
6098                 break;
6099         case SMB2_ENCRYPTION_AES128_GCM:
6100                 nonce_size = AES_GCM_128_IV_SIZE;
6101                 break;
6102         default:
6103                 nonce_size = 0;
6104                 break;
6105         }
6106         session->smb2->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
6107         session->smb2->nonce_high = 0;
6108         session->smb2->nonce_low = 0;
6109
6110         return NT_STATUS_OK;
6111 }
6112
6113 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
6114                                         struct smbXcli_session *session1,
6115                                         struct smbXcli_conn *conn,
6116                                         struct smbXcli_session **_session2)
6117 {
6118         struct smbXcli_session *session2;
6119
6120         if (session1->smb2->signing_key.length == 0) {
6121                 return NT_STATUS_INVALID_PARAMETER_MIX;
6122         }
6123
6124         if (conn == NULL) {
6125                 return NT_STATUS_INVALID_PARAMETER_MIX;
6126         }
6127
6128         session2 = talloc_zero(mem_ctx, struct smbXcli_session);
6129         if (session2 == NULL) {
6130                 return NT_STATUS_NO_MEMORY;
6131         }
6132         session2->smb2 = talloc_reference(session2, session1->smb2);
6133         if (session2->smb2 == NULL) {
6134                 talloc_free(session2);
6135                 return NT_STATUS_NO_MEMORY;
6136         }
6137
6138         talloc_set_destructor(session2, smbXcli_session_destructor);
6139         DLIST_ADD_END(conn->sessions, session2);
6140         session2->conn = conn;
6141
6142         memcpy(session2->smb2_channel.preauth_sha512,
6143                conn->smb2.preauth_sha512,
6144                sizeof(session2->smb2_channel.preauth_sha512));
6145
6146         *_session2 = session2;
6147         return NT_STATUS_OK;
6148 }
6149
6150 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
6151                                          const DATA_BLOB _channel_key,
6152                                          const struct iovec *recv_iov)
6153 {
6154         struct smbXcli_conn *conn = session->conn;
6155         uint8_t channel_key[16];
6156         NTSTATUS status;
6157         struct _derivation {
6158                 DATA_BLOB label;
6159                 DATA_BLOB context;
6160         };
6161         struct {
6162                 struct _derivation signing;
6163         } derivation = {
6164                 .signing.label.length = 0,
6165         };
6166
6167         if (conn == NULL) {
6168                 return NT_STATUS_INVALID_PARAMETER_MIX;
6169         }
6170
6171         if (session->smb2_channel.signing_key.length != 0) {
6172                 return NT_STATUS_INVALID_PARAMETER_MIX;
6173         }
6174
6175         if (conn->protocol >= PROTOCOL_SMB3_10) {
6176                 struct _derivation *d;
6177                 DATA_BLOB p;
6178
6179                 p = data_blob_const(session->smb2_channel.preauth_sha512,
6180                                 sizeof(session->smb2_channel.preauth_sha512));
6181
6182                 d = &derivation.signing;
6183                 d->label = data_blob_string_const_null("SMBSigningKey");
6184                 d->context = p;
6185         } else if (conn->protocol >= PROTOCOL_SMB2_24) {
6186                 struct _derivation *d;
6187
6188                 d = &derivation.signing;
6189                 d->label = data_blob_string_const_null("SMB2AESCMAC");
6190                 d->context = data_blob_string_const_null("SmbSign");
6191         }
6192
6193         ZERO_STRUCT(channel_key);
6194         memcpy(channel_key, _channel_key.data,
6195                MIN(_channel_key.length, sizeof(channel_key)));
6196
6197         session->smb2_channel.signing_key = data_blob_talloc(session,
6198                                                 channel_key,
6199                                                 sizeof(channel_key));
6200         if (session->smb2_channel.signing_key.data == NULL) {
6201                 ZERO_STRUCT(channel_key);
6202                 return NT_STATUS_NO_MEMORY;
6203         }
6204
6205         if (conn->protocol >= PROTOCOL_SMB2_24) {
6206                 struct _derivation *d = &derivation.signing;
6207
6208                 smb2_key_derivation(channel_key, sizeof(channel_key),
6209                                     d->label.data, d->label.length,
6210                                     d->context.data, d->context.length,
6211                                     session->smb2_channel.signing_key.data);
6212         }
6213         ZERO_STRUCT(channel_key);
6214
6215         status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6216                                         session->conn->protocol,
6217                                         recv_iov, 3);
6218         if (!NT_STATUS_IS_OK(status)) {
6219                 return status;
6220         }
6221
6222         return NT_STATUS_OK;
6223 }
6224
6225 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
6226 {
6227         if (!session->smb2->should_sign) {
6228                 /*
6229                  * We need required signing on the session
6230                  * in order to prevent man in the middle attacks.
6231                  */
6232                 return NT_STATUS_INVALID_PARAMETER_MIX;
6233         }
6234
6235         if (session->smb2->should_encrypt) {
6236                 return NT_STATUS_OK;
6237         }
6238
6239         if (session->conn->protocol < PROTOCOL_SMB2_24) {
6240                 return NT_STATUS_NOT_SUPPORTED;
6241         }
6242
6243         if (session->conn->smb2.server.cipher == 0) {
6244                 return NT_STATUS_NOT_SUPPORTED;
6245         }
6246
6247         if (session->smb2->signing_key.data == NULL) {
6248                 return NT_STATUS_NOT_SUPPORTED;
6249         }
6250         session->smb2->should_encrypt = true;
6251         return NT_STATUS_OK;
6252 }
6253
6254 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
6255 {
6256         struct smbXcli_tcon *tcon;
6257
6258         tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
6259         if (tcon == NULL) {
6260                 return NULL;
6261         }
6262
6263         return tcon;
6264 }
6265
6266 /*
6267  * Return a deep structure copy of a struct smbXcli_tcon *
6268  */
6269
6270 struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx,
6271                                 const struct smbXcli_tcon *tcon_in)
6272 {
6273         struct smbXcli_tcon *tcon;
6274
6275         tcon = talloc_memdup(mem_ctx, tcon_in, sizeof(struct smbXcli_tcon));
6276         if (tcon == NULL) {
6277                 return NULL;
6278         }
6279
6280         /* Deal with the SMB1 strings. */
6281         if (tcon_in->smb1.service != NULL) {
6282                 tcon->smb1.service = talloc_strdup(tcon, tcon_in->smb1.service);
6283                 if (tcon->smb1.service == NULL) {
6284                         TALLOC_FREE(tcon);
6285                         return NULL;
6286                 }
6287         }
6288         if (tcon->smb1.fs_type != NULL) {
6289                 tcon->smb1.fs_type = talloc_strdup(tcon, tcon_in->smb1.fs_type);
6290                 if (tcon->smb1.fs_type == NULL) {
6291                         TALLOC_FREE(tcon);
6292                         return NULL;
6293                 }
6294         }
6295         return tcon;
6296 }
6297
6298 void smbXcli_tcon_set_fs_attributes(struct smbXcli_tcon *tcon,
6299                                     uint32_t fs_attributes)
6300 {
6301         tcon->fs_attributes = fs_attributes;
6302 }
6303
6304 uint32_t smbXcli_tcon_get_fs_attributes(struct smbXcli_tcon *tcon)
6305 {
6306         return tcon->fs_attributes;
6307 }
6308
6309 bool smbXcli_tcon_is_dfs_share(struct smbXcli_tcon *tcon)
6310 {
6311         if (tcon == NULL) {
6312                 return false;
6313         }
6314
6315         if (tcon->is_smb1) {
6316                 if (tcon->smb1.optional_support & SMB_SHARE_IN_DFS) {
6317                         return true;
6318                 }
6319
6320                 return false;
6321         }
6322
6323         if (tcon->smb2.capabilities & SMB2_SHARE_CAP_DFS) {
6324                 return true;
6325         }
6326
6327         return false;
6328 }
6329
6330 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
6331 {
6332         return tcon->smb1.tcon_id;
6333 }
6334
6335 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
6336 {
6337         tcon->is_smb1 = true;
6338         tcon->smb1.tcon_id = tcon_id;
6339 }
6340
6341 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
6342                              uint16_t tcon_id,
6343                              uint16_t optional_support,
6344                              uint32_t maximal_access,
6345                              uint32_t guest_maximal_access,
6346                              const char *service,
6347                              const char *fs_type)
6348 {
6349         tcon->is_smb1 = true;
6350         tcon->fs_attributes = 0;
6351         tcon->smb1.tcon_id = tcon_id;
6352         tcon->smb1.optional_support = optional_support;
6353         tcon->smb1.maximal_access = maximal_access;
6354         tcon->smb1.guest_maximal_access = guest_maximal_access;
6355
6356         TALLOC_FREE(tcon->smb1.service);
6357         tcon->smb1.service = talloc_strdup(tcon, service);
6358         if (service != NULL && tcon->smb1.service == NULL) {
6359                 return false;
6360         }
6361
6362         TALLOC_FREE(tcon->smb1.fs_type);
6363         tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
6364         if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
6365                 return false;
6366         }
6367
6368         return true;
6369 }
6370
6371 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
6372 {
6373         return tcon->smb2.tcon_id;
6374 }
6375
6376 void smb2cli_tcon_set_id(struct smbXcli_tcon *tcon, uint32_t tcon_id)
6377 {
6378         tcon->smb2.tcon_id = tcon_id;
6379 }
6380
6381 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
6382 {
6383         return tcon->smb2.capabilities;
6384 }
6385
6386 uint32_t smb2cli_tcon_flags(struct smbXcli_tcon *tcon)
6387 {
6388         return tcon->smb2.flags;
6389 }
6390
6391 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
6392                              struct smbXcli_session *session,
6393                              uint32_t tcon_id,
6394                              uint8_t type,
6395                              uint32_t flags,
6396                              uint32_t capabilities,
6397                              uint32_t maximal_access)
6398 {
6399         tcon->is_smb1 = false;
6400         tcon->fs_attributes = 0;
6401         tcon->smb2.tcon_id = tcon_id;
6402         tcon->smb2.type = type;
6403         tcon->smb2.flags = flags;
6404         tcon->smb2.capabilities = capabilities;
6405         tcon->smb2.maximal_access = maximal_access;
6406
6407         tcon->smb2.should_sign = false;
6408         tcon->smb2.should_encrypt = false;
6409
6410         if (session == NULL) {
6411                 return;
6412         }
6413
6414         tcon->smb2.should_sign = session->smb2->should_sign;
6415         tcon->smb2.should_encrypt = session->smb2->should_encrypt;
6416
6417         if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
6418                 tcon->smb2.should_encrypt = true;
6419         }
6420 }
6421
6422 void smb2cli_tcon_should_sign(struct smbXcli_tcon *tcon,
6423                               bool should_sign)
6424 {
6425         tcon->smb2.should_sign = should_sign;
6426 }
6427
6428 bool smb2cli_tcon_is_signing_on(struct smbXcli_tcon *tcon)
6429 {
6430         if (tcon->smb2.should_encrypt) {
6431                 return true;
6432         }
6433
6434         return tcon->smb2.should_sign;
6435 }
6436
6437 void smb2cli_tcon_should_encrypt(struct smbXcli_tcon *tcon,
6438                                  bool should_encrypt)
6439 {
6440         tcon->smb2.should_encrypt = should_encrypt;
6441 }
6442
6443 bool smb2cli_tcon_is_encryption_on(struct smbXcli_tcon *tcon)
6444 {
6445         return tcon->smb2.should_encrypt;
6446 }
6447
6448 void smb2cli_conn_set_mid(struct smbXcli_conn *conn, uint64_t mid)
6449 {
6450         conn->smb2.mid = mid;
6451 }
6452
6453 uint64_t smb2cli_conn_get_mid(struct smbXcli_conn *conn)
6454 {
6455         return conn->smb2.mid;
6456 }