?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
netlogon_creds_cli: Remove tevent_req handling from netlogon_creds_cli_lock_fetch
[Samba.git] / libcli / smb / smbXcli_base.c
blob7322380d5018224bb71883961ed68dbadd8c7163
1 /*
2 Unix SMB/CIFS implementation.
3 Infrastructure for async SMB client requests
4 Copyright (C) Volker Lendecke 2008
5 Copyright (C) Stefan Metzmacher 2011
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "system/network.h"
23 #include "../lib/async_req/async_sock.h"
24 #include "../lib/util/tevent_ntstatus.h"
25 #include "../lib/util/tevent_unix.h"
26 #include "lib/util/util_net.h"
27 #include "lib/util/dlinklist.h"
28 #include "lib/util/iov_buf.h"
29 #include "../libcli/smb/smb_common.h"
30 #include "../libcli/smb/smb_seal.h"
31 #include "../libcli/smb/smb_signing.h"
32 #include "../libcli/smb/read_smb.h"
33 #include "smbXcli_base.h"
34 #include "librpc/ndr/libndr.h"
35 #include "libcli/smb/smb2_negotiate_context.h"
36 #include "lib/crypto/sha512.h"
37 #include "lib/crypto/aes.h"
38 #include "lib/crypto/aes_ccm_128.h"
39 #include "lib/crypto/aes_gcm_128.h"
40
41 struct smbXcli_conn;
42 struct smbXcli_req;
43 struct smbXcli_session;
44 struct smbXcli_tcon;
45
46 struct smbXcli_conn {
47 int sock_fd;
48 struct sockaddr_storage local_ss;
49 struct sockaddr_storage remote_ss;
50 const char *remote_name;
51
52 struct tevent_queue *outgoing;
53 struct tevent_req **pending;
54 struct tevent_req *read_smb_req;
55 struct tevent_req *suicide_req;
56
57 enum protocol_types min_protocol;
58 enum protocol_types max_protocol;
59 enum protocol_types protocol;
60 bool allow_signing;
61 bool desire_signing;
62 bool mandatory_signing;
63
64 /*
65 * The incoming dispatch function should return:
66 * - NT_STATUS_RETRY, if more incoming PDUs are expected.
67 * - NT_STATUS_OK, if no more processing is desired, e.g.
68 * the dispatch function called
69 * tevent_req_done().
70 * - All other return values disconnect the connection.
71 */
72 NTSTATUS (*dispatch_incoming)(struct smbXcli_conn *conn,
73 TALLOC_CTX *tmp_mem,
74 uint8_t *inbuf);
75
76 struct {
77 struct {
78 uint32_t capabilities;
79 uint32_t max_xmit;
80 } client;
81
82 struct {
83 uint32_t capabilities;
84 uint32_t max_xmit;
85 uint16_t max_mux;
86 uint16_t security_mode;
87 bool readbraw;
88 bool writebraw;
89 bool lockread;
90 bool writeunlock;
91 uint32_t session_key;
92 struct GUID guid;
93 DATA_BLOB gss_blob;
94 uint8_t challenge[8];
95 const char *workgroup;
96 const char *name;
97 int time_zone;
98 NTTIME system_time;
99 } server;
100
101 uint32_t capabilities;
102 uint32_t max_xmit;
103
104 uint16_t mid;
105
106 struct smb_signing_state *signing;
107 struct smb_trans_enc_state *trans_enc;
108
109 struct tevent_req *read_braw_req;
110 } smb1;
111
112 struct {
113 struct {
114 uint32_t capabilities;
115 uint16_t security_mode;
116 struct GUID guid;
117 } client;
118
119 struct {
120 uint32_t capabilities;
121 uint16_t security_mode;
122 struct GUID guid;
123 uint32_t max_trans_size;
124 uint32_t max_read_size;
125 uint32_t max_write_size;
126 NTTIME system_time;
127 NTTIME start_time;
128 DATA_BLOB gss_blob;
129 uint16_t cipher;
130 } server;
131
132 uint64_t mid;
133 uint16_t cur_credits;
134 uint16_t max_credits;
135
136 uint32_t cc_chunk_len;
137 uint32_t cc_max_chunks;
138
139 uint8_t io_priority;
140
141 uint8_t preauth_sha512[64];
142 } smb2;
143
144 struct smbXcli_session *sessions;
145 };
146
147 struct smb2cli_session {
148 uint64_t session_id;
149 uint16_t session_flags;
150 DATA_BLOB application_key;
151 DATA_BLOB signing_key;
152 bool should_sign;
153 bool should_encrypt;
154 DATA_BLOB encryption_key;
155 DATA_BLOB decryption_key;
156 uint64_t nonce_high_random;
157 uint64_t nonce_high_max;
158 uint64_t nonce_high;
159 uint64_t nonce_low;
160 uint16_t channel_sequence;
161 bool replay_active;
162 };
163
164 struct smbXcli_session {
165 struct smbXcli_session *prev, *next;
166 struct smbXcli_conn *conn;
167
168 struct {
169 uint16_t session_id;
170 uint16_t action;
171 DATA_BLOB application_key;
172 bool protected_key;
173 } smb1;
174
175 struct smb2cli_session *smb2;
176
177 struct {
178 DATA_BLOB signing_key;
179 uint8_t preauth_sha512[64];
180 } smb2_channel;
181
182 /*
183 * this should be a short term hack
184 * until the upper layers have implemented
185 * re-authentication.
186 */
187 bool disconnect_expired;
188 };
189
190 struct smbXcli_tcon {
191 bool is_smb1;
192 uint32_t fs_attributes;
193
194 struct {
195 uint16_t tcon_id;
196 uint16_t optional_support;
197 uint32_t maximal_access;
198 uint32_t guest_maximal_access;
199 char *service;
200 char *fs_type;
201 } smb1;
202
203 struct {
204 uint32_t tcon_id;
205 uint8_t type;
206 uint32_t flags;
207 uint32_t capabilities;
208 uint32_t maximal_access;
209 bool should_sign;
210 bool should_encrypt;
211 } smb2;
212 };
213
214 struct smbXcli_req_state {
215 struct tevent_context *ev;
216 struct smbXcli_conn *conn;
217 struct smbXcli_session *session; /* maybe NULL */
218 struct smbXcli_tcon *tcon; /* maybe NULL */
219
220 uint8_t length_hdr[4];
221
222 bool one_way;
223
224 uint8_t *inbuf;
225
226 struct tevent_req *write_req;
227
228 struct {
229 /* Space for the header including the wct */
230 uint8_t hdr[HDR_VWV];
231
232 /*
233 * For normal requests, smb1cli_req_send chooses a mid.
234 * SecondaryV trans requests need to use the mid of the primary
235 * request, so we need a place to store it.
236 * Assume it is set if != 0.
237 */
238 uint16_t mid;
239
240 uint16_t *vwv;
241 uint8_t bytecount_buf[2];
242
243 #define MAX_SMB_IOV 10
244 /* length_hdr, hdr, words, byte_count, buffers */
245 struct iovec iov[1 + 3 + MAX_SMB_IOV];
246 int iov_count;
247
248 bool one_way_seqnum;
249 uint32_t seqnum;
250 struct tevent_req **chained_requests;
251
252 uint8_t recv_cmd;
253 NTSTATUS recv_status;
254 /* always an array of 3 talloc elements */
255 struct iovec *recv_iov;
256 } smb1;
257
258 struct {
259 const uint8_t *fixed;
260 uint16_t fixed_len;
261 const uint8_t *dyn;
262 uint32_t dyn_len;
263
264 uint8_t transform[SMB2_TF_HDR_SIZE];
265 uint8_t hdr[SMB2_HDR_BODY];
266 uint8_t pad[7]; /* padding space for compounding */
267
268 /*
269 * always an array of 3 talloc elements
270 * (without a SMB2_TRANSFORM header!)
271 *
272 * HDR, BODY, DYN
273 */
274 struct iovec *recv_iov;
275
276 /*
277 * the expected max for the response dyn_len
278 */
279 uint32_t max_dyn_len;
280
281 uint16_t credit_charge;
282
283 bool should_sign;
284 bool should_encrypt;
285 uint64_t encryption_session_id;
286
287 bool signing_skipped;
288 bool notify_async;
289 bool got_async;
290 uint16_t cancel_flags;
291 uint64_t cancel_mid;
292 uint64_t cancel_aid;
293 } smb2;
294 };
295
296 static int smbXcli_conn_destructor(struct smbXcli_conn *conn)
297 {
298 /*
299 * NT_STATUS_OK, means we do not notify the callers
300 */
301 smbXcli_conn_disconnect(conn, NT_STATUS_OK);
302
303 while (conn->sessions) {
304 conn->sessions->conn = NULL;
305 DLIST_REMOVE(conn->sessions, conn->sessions);
306 }
307
308 if (conn->smb1.trans_enc) {
309 TALLOC_FREE(conn->smb1.trans_enc);
310 }
311
312 return 0;
313 }
314
315 struct smbXcli_conn *smbXcli_conn_create(TALLOC_CTX *mem_ctx,
316 int fd,
317 const char *remote_name,
318 enum smb_signing_setting signing_state,
319 uint32_t smb1_capabilities,
320 struct GUID *client_guid,
321 uint32_t smb2_capabilities)
322 {
323 struct smbXcli_conn *conn = NULL;
324 void *ss = NULL;
325 struct sockaddr *sa = NULL;
326 socklen_t sa_length;
327 int ret;
328
329 conn = talloc_zero(mem_ctx, struct smbXcli_conn);
330 if (!conn) {
331 return NULL;
332 }
333
334 conn->sock_fd = fd;
335
336 conn->remote_name = talloc_strdup(conn, remote_name);
337 if (conn->remote_name == NULL) {
338 goto error;
339 }
340
341 ss = (void *)&conn->local_ss;
342 sa = (struct sockaddr *)ss;
343 sa_length = sizeof(conn->local_ss);
344 ret = getsockname(fd, sa, &sa_length);
345 if (ret == -1) {
346 goto error;
347 }
348 ss = (void *)&conn->remote_ss;
349 sa = (struct sockaddr *)ss;
350 sa_length = sizeof(conn->remote_ss);
351 ret = getpeername(fd, sa, &sa_length);
352 if (ret == -1) {
353 goto error;
354 }
355
356 conn->outgoing = tevent_queue_create(conn, "smbXcli_outgoing");
357 if (conn->outgoing == NULL) {
358 goto error;
359 }
360 conn->pending = NULL;
361
362 conn->min_protocol = PROTOCOL_NONE;
363 conn->max_protocol = PROTOCOL_NONE;
364 conn->protocol = PROTOCOL_NONE;
365
366 switch (signing_state) {
367 case SMB_SIGNING_OFF:
368 /* never */
369 conn->allow_signing = false;
370 conn->desire_signing = false;
371 conn->mandatory_signing = false;
372 break;
373 case SMB_SIGNING_DEFAULT:
374 case SMB_SIGNING_IF_REQUIRED:
375 /* if the server requires it */
376 conn->allow_signing = true;
377 conn->desire_signing = false;
378 conn->mandatory_signing = false;
379 break;
380 case SMB_SIGNING_DESIRED:
381 /* if the server desires it */
382 conn->allow_signing = true;
383 conn->desire_signing = true;
384 conn->mandatory_signing = false;
385 break;
386 case SMB_SIGNING_IPC_DEFAULT:
387 case SMB_SIGNING_REQUIRED:
388 /* always */
389 conn->allow_signing = true;
390 conn->desire_signing = true;
391 conn->mandatory_signing = true;
392 break;
393 }
394
395 conn->smb1.client.capabilities = smb1_capabilities;
396 conn->smb1.client.max_xmit = UINT16_MAX;
397
398 conn->smb1.capabilities = conn->smb1.client.capabilities;
399 conn->smb1.max_xmit = 1024;
400
401 conn->smb1.mid = 1;
402
403 /* initialise signing */
404 conn->smb1.signing = smb_signing_init(conn,
405 conn->allow_signing,
406 conn->desire_signing,
407 conn->mandatory_signing);
408 if (!conn->smb1.signing) {
409 goto error;
410 }
411
412 conn->smb2.client.security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
413 if (conn->mandatory_signing) {
414 conn->smb2.client.security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
415 }
416 if (client_guid) {
417 conn->smb2.client.guid = *client_guid;
418 }
419 conn->smb2.client.capabilities = smb2_capabilities;
420
421 conn->smb2.cur_credits = 1;
422 conn->smb2.max_credits = 0;
423 conn->smb2.io_priority = 1;
424
425 /*
426 * Samba and Windows servers accept a maximum of 16 MiB with a maximum
427 * chunk length of 1 MiB.
428 */
429 conn->smb2.cc_chunk_len = 1024 * 1024;
430 conn->smb2.cc_max_chunks = 16;
431
432 talloc_set_destructor(conn, smbXcli_conn_destructor);
433 return conn;
434
435 error:
436 TALLOC_FREE(conn);
437 return NULL;
438 }
439
440 bool smbXcli_conn_is_connected(struct smbXcli_conn *conn)
441 {
442 if (conn == NULL) {
443 return false;
444 }
445
446 if (conn->sock_fd == -1) {
447 return false;
448 }
449
450 return true;
451 }
452
453 enum protocol_types smbXcli_conn_protocol(struct smbXcli_conn *conn)
454 {
455 return conn->protocol;
456 }
457
458 bool smbXcli_conn_use_unicode(struct smbXcli_conn *conn)
459 {
460 if (conn->protocol >= PROTOCOL_SMB2_02) {
461 return true;
462 }
463
464 if (conn->smb1.capabilities & CAP_UNICODE) {
465 return true;
466 }
467
468 return false;
469 }
470
471 bool smbXcli_conn_signing_mandatory(struct smbXcli_conn *conn)
472 {
473 return conn->mandatory_signing;
474 }
475
476 /*
477 * [MS-SMB] 2.2.2.3.5 - SMB1 support for passing through
478 * query/set commands to the file system
479 */
480 bool smbXcli_conn_support_passthrough(struct smbXcli_conn *conn)
481 {
482 if (conn->protocol >= PROTOCOL_SMB2_02) {
483 return true;
484 }
485
486 if (conn->smb1.capabilities & CAP_W2K_SMBS) {
487 return true;
488 }
489
490 return false;
491 }
492
493 void smbXcli_conn_set_sockopt(struct smbXcli_conn *conn, const char *options)
494 {
495 set_socket_options(conn->sock_fd, options);
496 }
497
498 const struct sockaddr_storage *smbXcli_conn_local_sockaddr(struct smbXcli_conn *conn)
499 {
500 return &conn->local_ss;
501 }
502
503 const struct sockaddr_storage *smbXcli_conn_remote_sockaddr(struct smbXcli_conn *conn)
504 {
505 return &conn->remote_ss;
506 }
507
508 const char *smbXcli_conn_remote_name(struct smbXcli_conn *conn)
509 {
510 return conn->remote_name;
511 }
512
513 uint16_t smbXcli_conn_max_requests(struct smbXcli_conn *conn)
514 {
515 if (conn->protocol >= PROTOCOL_SMB2_02) {
516 /*
517 * TODO...
518 */
519 return 1;
520 }
521
522 return conn->smb1.server.max_mux;
523 }
524
525 NTTIME smbXcli_conn_server_system_time(struct smbXcli_conn *conn)
526 {
527 if (conn->protocol >= PROTOCOL_SMB2_02) {
528 return conn->smb2.server.system_time;
529 }
530
531 return conn->smb1.server.system_time;
532 }
533
534 const DATA_BLOB *smbXcli_conn_server_gss_blob(struct smbXcli_conn *conn)
535 {
536 if (conn->protocol >= PROTOCOL_SMB2_02) {
537 return &conn->smb2.server.gss_blob;
538 }
539
540 return &conn->smb1.server.gss_blob;
541 }
542
543 const struct GUID *smbXcli_conn_server_guid(struct smbXcli_conn *conn)
544 {
545 if (conn->protocol >= PROTOCOL_SMB2_02) {
546 return &conn->smb2.server.guid;
547 }
548
549 return &conn->smb1.server.guid;
550 }
551
552 struct smbXcli_conn_samba_suicide_state {
553 struct smbXcli_conn *conn;
554 struct iovec iov;
555 uint8_t buf[9];
556 struct tevent_req *write_req;
557 };
558
559 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
560 enum tevent_req_state req_state);
561 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq);
562
563 struct tevent_req *smbXcli_conn_samba_suicide_send(TALLOC_CTX *mem_ctx,
564 struct tevent_context *ev,
565 struct smbXcli_conn *conn,
566 uint8_t exitcode)
567 {
568 struct tevent_req *req, *subreq;
569 struct smbXcli_conn_samba_suicide_state *state;
570
571 req = tevent_req_create(mem_ctx, &state,
572 struct smbXcli_conn_samba_suicide_state);
573 if (req == NULL) {
574 return NULL;
575 }
576 state->conn = conn;
577 SIVAL(state->buf, 4, 0x74697865);
578 SCVAL(state->buf, 8, exitcode);
579 _smb_setlen_nbt(state->buf, sizeof(state->buf)-4);
580
581 if (conn->suicide_req != NULL) {
582 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
583 return tevent_req_post(req, ev);
584 }
585
586 state->iov.iov_base = state->buf;
587 state->iov.iov_len = sizeof(state->buf);
588
589 subreq = writev_send(state, ev, conn->outgoing, conn->sock_fd,
590 false, &state->iov, 1);
591 if (tevent_req_nomem(subreq, req)) {
592 return tevent_req_post(req, ev);
593 }
594 tevent_req_set_callback(subreq, smbXcli_conn_samba_suicide_done, req);
595 state->write_req = subreq;
596
597 tevent_req_set_cleanup_fn(req, smbXcli_conn_samba_suicide_cleanup);
598
599 /*
600 * We need to use tevent_req_defer_callback()
601 * in order to allow smbXcli_conn_disconnect()
602 * to do a safe cleanup.
603 */
604 tevent_req_defer_callback(req, ev);
605 conn->suicide_req = req;
606
607 return req;
608 }
609
610 static void smbXcli_conn_samba_suicide_cleanup(struct tevent_req *req,
611 enum tevent_req_state req_state)
612 {
613 struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
614 req, struct smbXcli_conn_samba_suicide_state);
615
616 TALLOC_FREE(state->write_req);
617
618 if (state->conn == NULL) {
619 return;
620 }
621
622 if (state->conn->suicide_req == req) {
623 state->conn->suicide_req = NULL;
624 }
625 state->conn = NULL;
626 }
627
628 static void smbXcli_conn_samba_suicide_done(struct tevent_req *subreq)
629 {
630 struct tevent_req *req = tevent_req_callback_data(
631 subreq, struct tevent_req);
632 struct smbXcli_conn_samba_suicide_state *state = tevent_req_data(
633 req, struct smbXcli_conn_samba_suicide_state);
634 ssize_t nwritten;
635 int err;
636
637 state->write_req = NULL;
638
639 nwritten = writev_recv(subreq, &err);
640 TALLOC_FREE(subreq);
641 if (nwritten == -1) {
642 /* here, we need to notify all pending requests */
643 NTSTATUS status = map_nt_error_from_unix_common(err);
644 smbXcli_conn_disconnect(state->conn, status);
645 return;
646 }
647 tevent_req_done(req);
648 }
649
650 NTSTATUS smbXcli_conn_samba_suicide_recv(struct tevent_req *req)
651 {
652 return tevent_req_simple_recv_ntstatus(req);
653 }
654
655 NTSTATUS smbXcli_conn_samba_suicide(struct smbXcli_conn *conn,
656 uint8_t exitcode)
657 {
658 TALLOC_CTX *frame = talloc_stackframe();
659 struct tevent_context *ev;
660 struct tevent_req *req;
661 NTSTATUS status = NT_STATUS_NO_MEMORY;
662 bool ok;
663
664 if (smbXcli_conn_has_async_calls(conn)) {
665 /*
666 * Can't use sync call while an async call is in flight
667 */
668 status = NT_STATUS_INVALID_PARAMETER_MIX;
669 goto fail;
670 }
671 ev = samba_tevent_context_init(frame);
672 if (ev == NULL) {
673 goto fail;
674 }
675 req = smbXcli_conn_samba_suicide_send(frame, ev, conn, exitcode);
676 if (req == NULL) {
677 goto fail;
678 }
679 ok = tevent_req_poll_ntstatus(req, ev, &status);
680 if (!ok) {
681 goto fail;
682 }
683 status = smbXcli_conn_samba_suicide_recv(req);
684 fail:
685 TALLOC_FREE(frame);
686 return status;
687 }
688
689 uint32_t smb1cli_conn_capabilities(struct smbXcli_conn *conn)
690 {
691 return conn->smb1.capabilities;
692 }
693
694 uint32_t smb1cli_conn_max_xmit(struct smbXcli_conn *conn)
695 {
696 return conn->smb1.max_xmit;
697 }
698
699 bool smb1cli_conn_req_possible(struct smbXcli_conn *conn)
700 {
701 size_t pending = talloc_array_length(conn->pending);
702 uint16_t possible = conn->smb1.server.max_mux;
703
704 if (pending >= possible) {
705 return false;
706 }
707
708 return true;
709 }
710
711 uint32_t smb1cli_conn_server_session_key(struct smbXcli_conn *conn)
712 {
713 return conn->smb1.server.session_key;
714 }
715
716 const uint8_t *smb1cli_conn_server_challenge(struct smbXcli_conn *conn)
717 {
718 return conn->smb1.server.challenge;
719 }
720
721 uint16_t smb1cli_conn_server_security_mode(struct smbXcli_conn *conn)
722 {
723 return conn->smb1.server.security_mode;
724 }
725
726 bool smb1cli_conn_server_readbraw(struct smbXcli_conn *conn)
727 {
728 return conn->smb1.server.readbraw;
729 }
730
731 bool smb1cli_conn_server_writebraw(struct smbXcli_conn *conn)
732 {
733 return conn->smb1.server.writebraw;
734 }
735
736 bool smb1cli_conn_server_lockread(struct smbXcli_conn *conn)
737 {
738 return conn->smb1.server.lockread;
739 }
740
741 bool smb1cli_conn_server_writeunlock(struct smbXcli_conn *conn)
742 {
743 return conn->smb1.server.writeunlock;
744 }
745
746 int smb1cli_conn_server_time_zone(struct smbXcli_conn *conn)
747 {
748 return conn->smb1.server.time_zone;
749 }
750
751 bool smb1cli_conn_activate_signing(struct smbXcli_conn *conn,
752 const DATA_BLOB user_session_key,
753 const DATA_BLOB response)
754 {
755 return smb_signing_activate(conn->smb1.signing,
756 user_session_key,
757 response);
758 }
759
760 bool smb1cli_conn_check_signing(struct smbXcli_conn *conn,
761 const uint8_t *buf, uint32_t seqnum)
762 {
763 const uint8_t *hdr = buf + NBT_HDR_SIZE;
764 size_t len = smb_len_nbt(buf);
765
766 return smb_signing_check_pdu(conn->smb1.signing, hdr, len, seqnum);
767 }
768
769 bool smb1cli_conn_signing_is_active(struct smbXcli_conn *conn)
770 {
771 return smb_signing_is_active(conn->smb1.signing);
772 }
773
774 void smb1cli_conn_set_encryption(struct smbXcli_conn *conn,
775 struct smb_trans_enc_state *es)
776 {
777 /* Replace the old state, if any. */
778 if (conn->smb1.trans_enc) {
779 TALLOC_FREE(conn->smb1.trans_enc);
780 }
781 conn->smb1.trans_enc = es;
782 }
783
784 bool smb1cli_conn_encryption_on(struct smbXcli_conn *conn)
785 {
786 return common_encryption_on(conn->smb1.trans_enc);
787 }
788
789
790 static NTSTATUS smb1cli_pull_raw_error(const uint8_t *hdr)
791 {
792 uint32_t flags2 = SVAL(hdr, HDR_FLG2);
793 NTSTATUS status = NT_STATUS(IVAL(hdr, HDR_RCLS));
794
795 if (NT_STATUS_IS_OK(status)) {
796 return NT_STATUS_OK;
797 }
798
799 if (flags2 & FLAGS2_32_BIT_ERROR_CODES) {
800 return status;
801 }
802
803 return NT_STATUS_DOS(CVAL(hdr, HDR_RCLS), SVAL(hdr, HDR_ERR));
804 }
805
806 /**
807 * Is the SMB command able to hold an AND_X successor
808 * @param[in] cmd The SMB command in question
809 * @retval Can we add a chained request after "cmd"?
810 */
811 bool smb1cli_is_andx_req(uint8_t cmd)
812 {
813 switch (cmd) {
814 case SMBtconX:
815 case SMBlockingX:
816 case SMBopenX:
817 case SMBreadX:
818 case SMBwriteX:
819 case SMBsesssetupX:
820 case SMBulogoffX:
821 case SMBntcreateX:
822 return true;
823 break;
824 default:
825 break;
826 }
827
828 return false;
829 }
830
831 static uint16_t smb1cli_alloc_mid(struct smbXcli_conn *conn)
832 {
833 size_t num_pending = talloc_array_length(conn->pending);
834 uint16_t result;
835
836 if (conn->protocol == PROTOCOL_NONE) {
837 /*
838 * This is what windows sends on the SMB1 Negprot request
839 * and some vendors reuse the SMB1 MID as SMB2 sequence number.
840 */
841 return 0;
842 }
843
844 while (true) {
845 size_t i;
846
847 result = conn->smb1.mid++;
848 if ((result == 0) || (result == 0xffff)) {
849 continue;
850 }
851
852 for (i=0; i<num_pending; i++) {
853 if (result == smb1cli_req_mid(conn->pending[i])) {
854 break;
855 }
856 }
857
858 if (i == num_pending) {
859 return result;
860 }
861 }
862 }
863
864 static NTSTATUS smbXcli_req_cancel_write_req(struct tevent_req *req)
865 {
866 struct smbXcli_req_state *state =
867 tevent_req_data(req,
868 struct smbXcli_req_state);
869 struct smbXcli_conn *conn = state->conn;
870 size_t num_pending = talloc_array_length(conn->pending);
871 ssize_t ret;
872 int err;
873 bool ok;
874
875 if (state->write_req == NULL) {
876 return NT_STATUS_OK;
877 }
878
879 /*
880 * Check if it's possible to cancel the request.
881 * If the result is true it's not to late.
882 * See writev_cancel().
883 */
884 ok = tevent_req_cancel(state->write_req);
885 if (ok) {
886 TALLOC_FREE(state->write_req);
887
888 if (conn->protocol >= PROTOCOL_SMB2_02) {
889 /*
890 * SMB2 has a sane signing state.
891 */
892 return NT_STATUS_OK;
893 }
894
895 if (num_pending > 1) {
896 /*
897 * We have more pending requests following us. This
898 * means the signing state will be broken for them.
899 *
900 * As a solution we could add the requests directly to
901 * our outgoing queue and do the signing in the trigger
902 * function and then use writev_send() without passing a
903 * queue. That way we'll only sign packets we're most
904 * likely send to the wire.
905 */
906 return NT_STATUS_REQUEST_OUT_OF_SEQUENCE;
907 }
908
909 /*
910 * If we're the only request that's
911 * pending, we're able to recover the signing
912 * state.
913 */
914 smb_signing_cancel_reply(conn->smb1.signing,
915 state->smb1.one_way_seqnum);
916 return NT_STATUS_OK;
917 }
918
919 ret = writev_recv(state->write_req, &err);
920 TALLOC_FREE(state->write_req);
921 if (ret == -1) {
922 return map_nt_error_from_unix_common(err);
923 }
924
925 return NT_STATUS_OK;
926 }
927
928 void smbXcli_req_unset_pending(struct tevent_req *req)
929 {
930 struct smbXcli_req_state *state =
931 tevent_req_data(req,
932 struct smbXcli_req_state);
933 struct smbXcli_conn *conn = state->conn;
934 size_t num_pending = talloc_array_length(conn->pending);
935 size_t i;
936 NTSTATUS cancel_status;
937
938 cancel_status = smbXcli_req_cancel_write_req(req);
939
940 if (state->smb1.mid != 0) {
941 /*
942 * This is a [nt]trans[2] request which waits
943 * for more than one reply.
944 */
945 if (!NT_STATUS_IS_OK(cancel_status)) {
946 /*
947 * If the write_req cancel didn't work
948 * we can't use the connection anymore.
949 */
950 smbXcli_conn_disconnect(conn, cancel_status);
951 return;
952 }
953 return;
954 }
955
956 tevent_req_set_cleanup_fn(req, NULL);
957
958 if (num_pending == 1) {
959 /*
960 * The pending read_smb tevent_req is a child of
961 * conn->pending. So if nothing is pending anymore, we need to
962 * delete the socket read fde.
963 */
964 /* TODO: smbXcli_conn_cancel_read_req */
965 TALLOC_FREE(conn->pending);
966 conn->read_smb_req = NULL;
967
968 if (!NT_STATUS_IS_OK(cancel_status)) {
969 /*
970 * If the write_req cancel didn't work
971 * we can't use the connection anymore.
972 */
973 smbXcli_conn_disconnect(conn, cancel_status);
974 return;
975 }
976 return;
977 }
978
979 for (i=0; i<num_pending; i++) {
980 if (req == conn->pending[i]) {
981 break;
982 }
983 }
984 if (i == num_pending) {
985 /*
986 * Something's seriously broken. Just returning here is the
987 * right thing nevertheless, the point of this routine is to
988 * remove ourselves from conn->pending.
989 */
990
991 if (!NT_STATUS_IS_OK(cancel_status)) {
992 /*
993 * If the write_req cancel didn't work
994 * we can't use the connection anymore.
995 */
996 smbXcli_conn_disconnect(conn, cancel_status);
997 return;
998 }
999 return;
1000 }
1001
1002 /*
1003 * Remove ourselves from the conn->pending array
1004 */
1005 for (; i < (num_pending - 1); i++) {
1006 conn->pending[i] = conn->pending[i+1];
1007 }
1008
1009 /*
1010 * No NULL check here, we're shrinking by sizeof(void *), and
1011 * talloc_realloc just adjusts the size for this.
1012 */
1013 conn->pending = talloc_realloc(NULL, conn->pending, struct tevent_req *,
1014 num_pending - 1);
1015
1016 if (!NT_STATUS_IS_OK(cancel_status)) {
1017 /*
1018 * If the write_req cancel didn't work
1019 * we can't use the connection anymore.
1020 */
1021 smbXcli_conn_disconnect(conn, cancel_status);
1022 return;
1023 }
1024 return;
1025 }
1026
1027 static void smbXcli_req_cleanup(struct tevent_req *req,
1028 enum tevent_req_state req_state)
1029 {
1030 struct smbXcli_req_state *state =
1031 tevent_req_data(req,
1032 struct smbXcli_req_state);
1033 struct smbXcli_conn *conn = state->conn;
1034 NTSTATUS cancel_status;
1035
1036 switch (req_state) {
1037 case TEVENT_REQ_RECEIVED:
1038 /*
1039 * Make sure we really remove it from
1040 * the pending array on destruction.
1041 *
1042 * smbXcli_req_unset_pending() calls
1043 * smbXcli_req_cancel_write_req() internal
1044 */
1045 state->smb1.mid = 0;
1046 smbXcli_req_unset_pending(req);
1047 return;
1048 default:
1049 cancel_status = smbXcli_req_cancel_write_req(req);
1050 if (!NT_STATUS_IS_OK(cancel_status)) {
1051 /*
1052 * If the write_req cancel didn't work
1053 * we can't use the connection anymore.
1054 */
1055 smbXcli_conn_disconnect(conn, cancel_status);
1056 return;
1057 }
1058 return;
1059 }
1060 }
1061
1062 static bool smb1cli_req_cancel(struct tevent_req *req);
1063 static bool smb2cli_req_cancel(struct tevent_req *req);
1064
1065 static bool smbXcli_req_cancel(struct tevent_req *req)
1066 {
1067 struct smbXcli_req_state *state =
1068 tevent_req_data(req,
1069 struct smbXcli_req_state);
1070
1071 if (!smbXcli_conn_is_connected(state->conn)) {
1072 return false;
1073 }
1074
1075 if (state->conn->protocol == PROTOCOL_NONE) {
1076 return false;
1077 }
1078
1079 if (state->conn->protocol >= PROTOCOL_SMB2_02) {
1080 return smb2cli_req_cancel(req);
1081 }
1082
1083 return smb1cli_req_cancel(req);
1084 }
1085
1086 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn);
1087
1088 bool smbXcli_req_set_pending(struct tevent_req *req)
1089 {
1090 struct smbXcli_req_state *state =
1091 tevent_req_data(req,
1092 struct smbXcli_req_state);
1093 struct smbXcli_conn *conn;
1094 struct tevent_req **pending;
1095 size_t num_pending;
1096
1097 conn = state->conn;
1098
1099 if (!smbXcli_conn_is_connected(conn)) {
1100 return false;
1101 }
1102
1103 num_pending = talloc_array_length(conn->pending);
1104
1105 pending = talloc_realloc(conn, conn->pending, struct tevent_req *,
1106 num_pending+1);
1107 if (pending == NULL) {
1108 return false;
1109 }
1110 pending[num_pending] = req;
1111 conn->pending = pending;
1112 tevent_req_set_cleanup_fn(req, smbXcli_req_cleanup);
1113 tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1114
1115 if (!smbXcli_conn_receive_next(conn)) {
1116 /*
1117 * the caller should notify the current request
1118 *
1119 * And all other pending requests get notified
1120 * by smbXcli_conn_disconnect().
1121 */
1122 smbXcli_req_unset_pending(req);
1123 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1124 return false;
1125 }
1126
1127 return true;
1128 }
1129
1130 static void smbXcli_conn_received(struct tevent_req *subreq);
1131
1132 static bool smbXcli_conn_receive_next(struct smbXcli_conn *conn)
1133 {
1134 size_t num_pending = talloc_array_length(conn->pending);
1135 struct tevent_req *req;
1136 struct smbXcli_req_state *state;
1137
1138 if (conn->read_smb_req != NULL) {
1139 return true;
1140 }
1141
1142 if (num_pending == 0) {
1143 if (conn->smb2.mid < UINT64_MAX) {
1144 /* no more pending requests, so we are done for now */
1145 return true;
1146 }
1147
1148 /*
1149 * If there are no more SMB2 requests possible,
1150 * because we are out of message ids,
1151 * we need to disconnect.
1152 */
1153 smbXcli_conn_disconnect(conn, NT_STATUS_CONNECTION_ABORTED);
1154 return true;
1155 }
1156
1157 req = conn->pending[0];
1158 state = tevent_req_data(req, struct smbXcli_req_state);
1159
1160 /*
1161 * We're the first ones, add the read_smb request that waits for the
1162 * answer from the server
1163 */
1164 conn->read_smb_req = read_smb_send(conn->pending,
1165 state->ev,
1166 conn->sock_fd);
1167 if (conn->read_smb_req == NULL) {
1168 return false;
1169 }
1170 tevent_req_set_callback(conn->read_smb_req, smbXcli_conn_received, conn);
1171 return true;
1172 }
1173
1174 void smbXcli_conn_disconnect(struct smbXcli_conn *conn, NTSTATUS status)
1175 {
1176 struct smbXcli_session *session;
1177 int sock_fd = conn->sock_fd;
1178
1179 tevent_queue_stop(conn->outgoing);
1180
1181 conn->sock_fd = -1;
1182
1183 session = conn->sessions;
1184 if (talloc_array_length(conn->pending) == 0) {
1185 /*
1186 * if we do not have pending requests
1187 * there is no need to update the channel_sequence
1188 */
1189 session = NULL;
1190 }
1191 for (; session; session = session->next) {
1192 smb2cli_session_increment_channel_sequence(session);
1193 }
1194
1195 if (conn->suicide_req != NULL) {
1196 /*
1197 * smbXcli_conn_samba_suicide_send()
1198 * used tevent_req_defer_callback() already.
1199 */
1200 if (!NT_STATUS_IS_OK(status)) {
1201 tevent_req_nterror(conn->suicide_req, status);
1202 }
1203 conn->suicide_req = NULL;
1204 }
1205
1206 /*
1207 * Cancel all pending requests. We do not do a for-loop walking
1208 * conn->pending because that array changes in
1209 * smbXcli_req_unset_pending.
1210 */
1211 while (talloc_array_length(conn->pending) > 0) {
1212 struct tevent_req *req;
1213 struct smbXcli_req_state *state;
1214 struct tevent_req **chain;
1215 size_t num_chained;
1216 size_t i;
1217
1218 req = conn->pending[0];
1219 state = tevent_req_data(req, struct smbXcli_req_state);
1220
1221 if (state->smb1.chained_requests == NULL) {
1222 bool in_progress;
1223
1224 /*
1225 * We're dead. No point waiting for trans2
1226 * replies.
1227 */
1228 state->smb1.mid = 0;
1229
1230 smbXcli_req_unset_pending(req);
1231
1232 if (NT_STATUS_IS_OK(status)) {
1233 /* do not notify the callers */
1234 continue;
1235 }
1236
1237 in_progress = tevent_req_is_in_progress(req);
1238 if (!in_progress) {
1239 /*
1240 * already finished
1241 */
1242 continue;
1243 }
1244
1245 /*
1246 * we need to defer the callback, because we may notify
1247 * more then one caller.
1248 */
1249 tevent_req_defer_callback(req, state->ev);
1250 tevent_req_nterror(req, status);
1251 continue;
1252 }
1253
1254 chain = talloc_move(conn, &state->smb1.chained_requests);
1255 num_chained = talloc_array_length(chain);
1256
1257 for (i=0; i<num_chained; i++) {
1258 bool in_progress;
1259
1260 req = chain[i];
1261 state = tevent_req_data(req, struct smbXcli_req_state);
1262
1263 /*
1264 * We're dead. No point waiting for trans2
1265 * replies.
1266 */
1267 state->smb1.mid = 0;
1268
1269 smbXcli_req_unset_pending(req);
1270
1271 if (NT_STATUS_IS_OK(status)) {
1272 /* do not notify the callers */
1273 continue;
1274 }
1275
1276 in_progress = tevent_req_is_in_progress(req);
1277 if (!in_progress) {
1278 /*
1279 * already finished
1280 */
1281 continue;
1282 }
1283
1284 /*
1285 * we need to defer the callback, because we may notify
1286 * more than one caller.
1287 */
1288 tevent_req_defer_callback(req, state->ev);
1289 tevent_req_nterror(req, status);
1290 }
1291 TALLOC_FREE(chain);
1292 }
1293
1294 if (sock_fd != -1) {
1295 close(sock_fd);
1296 }
1297 }
1298
1299 /*
1300 * Fetch a smb request's mid. Only valid after the request has been sent by
1301 * smb1cli_req_send().
1302 */
1303 uint16_t smb1cli_req_mid(struct tevent_req *req)
1304 {
1305 struct smbXcli_req_state *state =
1306 tevent_req_data(req,
1307 struct smbXcli_req_state);
1308
1309 if (state->smb1.mid != 0) {
1310 return state->smb1.mid;
1311 }
1312
1313 return SVAL(state->smb1.hdr, HDR_MID);
1314 }
1315
1316 void smb1cli_req_set_mid(struct tevent_req *req, uint16_t mid)
1317 {
1318 struct smbXcli_req_state *state =
1319 tevent_req_data(req,
1320 struct smbXcli_req_state);
1321
1322 state->smb1.mid = mid;
1323 }
1324
1325 uint32_t smb1cli_req_seqnum(struct tevent_req *req)
1326 {
1327 struct smbXcli_req_state *state =
1328 tevent_req_data(req,
1329 struct smbXcli_req_state);
1330
1331 return state->smb1.seqnum;
1332 }
1333
1334 void smb1cli_req_set_seqnum(struct tevent_req *req, uint32_t seqnum)
1335 {
1336 struct smbXcli_req_state *state =
1337 tevent_req_data(req,
1338 struct smbXcli_req_state);
1339
1340 state->smb1.seqnum = seqnum;
1341 }
1342
1343 static size_t smbXcli_iov_len(const struct iovec *iov, int count)
1344 {
1345 ssize_t ret = iov_buflen(iov, count);
1346
1347 /* Ignore the overflow case for now ... */
1348 return ret;
1349 }
1350
1351 static void smb1cli_req_flags(enum protocol_types protocol,
1352 uint32_t smb1_capabilities,
1353 uint8_t smb_command,
1354 uint8_t additional_flags,
1355 uint8_t clear_flags,
1356 uint8_t *_flags,
1357 uint16_t additional_flags2,
1358 uint16_t clear_flags2,
1359 uint16_t *_flags2)
1360 {
1361 uint8_t flags = 0;
1362 uint16_t flags2 = 0;
1363
1364 if (protocol >= PROTOCOL_LANMAN1) {
1365 flags |= FLAG_CASELESS_PATHNAMES;
1366 flags |= FLAG_CANONICAL_PATHNAMES;
1367 }
1368
1369 if (protocol >= PROTOCOL_LANMAN2) {
1370 flags2 |= FLAGS2_LONG_PATH_COMPONENTS;
1371 flags2 |= FLAGS2_EXTENDED_ATTRIBUTES;
1372 }
1373
1374 if (protocol >= PROTOCOL_NT1) {
1375 flags2 |= FLAGS2_IS_LONG_NAME;
1376
1377 if (smb1_capabilities & CAP_UNICODE) {
1378 flags2 |= FLAGS2_UNICODE_STRINGS;
1379 }
1380 if (smb1_capabilities & CAP_STATUS32) {
1381 flags2 |= FLAGS2_32_BIT_ERROR_CODES;
1382 }
1383 if (smb1_capabilities & CAP_EXTENDED_SECURITY) {
1384 flags2 |= FLAGS2_EXTENDED_SECURITY;
1385 }
1386 }
1387
1388 flags |= additional_flags;
1389 flags &= ~clear_flags;
1390 flags2 |= additional_flags2;
1391 flags2 &= ~clear_flags2;
1392
1393 *_flags = flags;
1394 *_flags2 = flags2;
1395 }
1396
1397 static void smb1cli_req_cancel_done(struct tevent_req *subreq);
1398
1399 static bool smb1cli_req_cancel(struct tevent_req *req)
1400 {
1401 struct smbXcli_req_state *state =
1402 tevent_req_data(req,
1403 struct smbXcli_req_state);
1404 uint8_t flags;
1405 uint16_t flags2;
1406 uint32_t pid;
1407 uint16_t mid;
1408 struct tevent_req *subreq;
1409 NTSTATUS status;
1410
1411 flags = CVAL(state->smb1.hdr, HDR_FLG);
1412 flags2 = SVAL(state->smb1.hdr, HDR_FLG2);
1413 pid = SVAL(state->smb1.hdr, HDR_PID);
1414 pid |= SVAL(state->smb1.hdr, HDR_PIDHIGH)<<16;
1415 mid = SVAL(state->smb1.hdr, HDR_MID);
1416
1417 subreq = smb1cli_req_create(state, state->ev,
1418 state->conn,
1419 SMBntcancel,
1420 flags, 0,
1421 flags2, 0,
1422 0, /* timeout */
1423 pid,
1424 state->tcon,
1425 state->session,
1426 0, NULL, /* vwv */
1427 0, NULL); /* bytes */
1428 if (subreq == NULL) {
1429 return false;
1430 }
1431 smb1cli_req_set_mid(subreq, mid);
1432
1433 status = smb1cli_req_chain_submit(&subreq, 1);
1434 if (!NT_STATUS_IS_OK(status)) {
1435 TALLOC_FREE(subreq);
1436 return false;
1437 }
1438 smb1cli_req_set_mid(subreq, 0);
1439
1440 tevent_req_set_callback(subreq, smb1cli_req_cancel_done, NULL);
1441
1442 return true;
1443 }
1444
1445 static void smb1cli_req_cancel_done(struct tevent_req *subreq)
1446 {
1447 /* we do not care about the result */
1448 TALLOC_FREE(subreq);
1449 }
1450
1451 struct tevent_req *smb1cli_req_create(TALLOC_CTX *mem_ctx,
1452 struct tevent_context *ev,
1453 struct smbXcli_conn *conn,
1454 uint8_t smb_command,
1455 uint8_t additional_flags,
1456 uint8_t clear_flags,
1457 uint16_t additional_flags2,
1458 uint16_t clear_flags2,
1459 uint32_t timeout_msec,
1460 uint32_t pid,
1461 struct smbXcli_tcon *tcon,
1462 struct smbXcli_session *session,
1463 uint8_t wct, uint16_t *vwv,
1464 int iov_count,
1465 struct iovec *bytes_iov)
1466 {
1467 struct tevent_req *req;
1468 struct smbXcli_req_state *state;
1469 uint8_t flags = 0;
1470 uint16_t flags2 = 0;
1471 uint16_t uid = 0;
1472 uint16_t tid = 0;
1473 ssize_t num_bytes;
1474
1475 if (iov_count > MAX_SMB_IOV) {
1476 /*
1477 * Should not happen :-)
1478 */
1479 return NULL;
1480 }
1481
1482 req = tevent_req_create(mem_ctx, &state,
1483 struct smbXcli_req_state);
1484 if (req == NULL) {
1485 return NULL;
1486 }
1487 state->ev = ev;
1488 state->conn = conn;
1489 state->session = session;
1490 state->tcon = tcon;
1491
1492 if (session) {
1493 uid = session->smb1.session_id;
1494 }
1495
1496 if (tcon) {
1497 tid = tcon->smb1.tcon_id;
1498
1499 if (tcon->fs_attributes & FILE_CASE_SENSITIVE_SEARCH) {
1500 clear_flags |= FLAG_CASELESS_PATHNAMES;
1501 } else {
1502 /* Default setting, case insensitive. */
1503 additional_flags |= FLAG_CASELESS_PATHNAMES;
1504 }
1505
1506 if (smbXcli_conn_dfs_supported(conn) &&
1507 smbXcli_tcon_is_dfs_share(tcon))
1508 {
1509 additional_flags2 |= FLAGS2_DFS_PATHNAMES;
1510 }
1511 }
1512
1513 state->smb1.recv_cmd = 0xFF;
1514 state->smb1.recv_status = NT_STATUS_INTERNAL_ERROR;
1515 state->smb1.recv_iov = talloc_zero_array(state, struct iovec, 3);
1516 if (state->smb1.recv_iov == NULL) {
1517 TALLOC_FREE(req);
1518 return NULL;
1519 }
1520
1521 smb1cli_req_flags(conn->protocol,
1522 conn->smb1.capabilities,
1523 smb_command,
1524 additional_flags,
1525 clear_flags,
1526 &flags,
1527 additional_flags2,
1528 clear_flags2,
1529 &flags2);
1530
1531 SIVAL(state->smb1.hdr, 0, SMB_MAGIC);
1532 SCVAL(state->smb1.hdr, HDR_COM, smb_command);
1533 SIVAL(state->smb1.hdr, HDR_RCLS, NT_STATUS_V(NT_STATUS_OK));
1534 SCVAL(state->smb1.hdr, HDR_FLG, flags);
1535 SSVAL(state->smb1.hdr, HDR_FLG2, flags2);
1536 SSVAL(state->smb1.hdr, HDR_PIDHIGH, pid >> 16);
1537 SSVAL(state->smb1.hdr, HDR_TID, tid);
1538 SSVAL(state->smb1.hdr, HDR_PID, pid);
1539 SSVAL(state->smb1.hdr, HDR_UID, uid);
1540 SSVAL(state->smb1.hdr, HDR_MID, 0); /* this comes later */
1541 SCVAL(state->smb1.hdr, HDR_WCT, wct);
1542
1543 state->smb1.vwv = vwv;
1544
1545 num_bytes = iov_buflen(bytes_iov, iov_count);
1546 if (num_bytes == -1) {
1547 /*
1548 * I'd love to add a check for num_bytes<=UINT16_MAX here, but
1549 * the smbclient->samba connections can lie and transfer more.
1550 */
1551 TALLOC_FREE(req);
1552 return NULL;
1553 }
1554
1555 SSVAL(state->smb1.bytecount_buf, 0, num_bytes);
1556
1557 state->smb1.iov[0].iov_base = (void *)state->length_hdr;
1558 state->smb1.iov[0].iov_len = sizeof(state->length_hdr);
1559 state->smb1.iov[1].iov_base = (void *)state->smb1.hdr;
1560 state->smb1.iov[1].iov_len = sizeof(state->smb1.hdr);
1561 state->smb1.iov[2].iov_base = (void *)state->smb1.vwv;
1562 state->smb1.iov[2].iov_len = wct * sizeof(uint16_t);
1563 state->smb1.iov[3].iov_base = (void *)state->smb1.bytecount_buf;
1564 state->smb1.iov[3].iov_len = sizeof(uint16_t);
1565
1566 if (iov_count != 0) {
1567 memcpy(&state->smb1.iov[4], bytes_iov,
1568 iov_count * sizeof(*bytes_iov));
1569 }
1570 state->smb1.iov_count = iov_count + 4;
1571
1572 if (timeout_msec > 0) {
1573 struct timeval endtime;
1574
1575 endtime = timeval_current_ofs_msec(timeout_msec);
1576 if (!tevent_req_set_endtime(req, ev, endtime)) {
1577 return req;
1578 }
1579 }
1580
1581 switch (smb_command) {
1582 case SMBtranss:
1583 case SMBtranss2:
1584 case SMBnttranss:
1585 state->one_way = true;
1586 break;
1587 case SMBntcancel:
1588 state->one_way = true;
1589 state->smb1.one_way_seqnum = true;
1590 break;
1591 case SMBlockingX:
1592 if ((wct == 8) &&
1593 (CVAL(vwv+3, 0) == LOCKING_ANDX_OPLOCK_RELEASE)) {
1594 state->one_way = true;
1595 }
1596 break;
1597 }
1598
1599 return req;
1600 }
1601
1602 static NTSTATUS smb1cli_conn_signv(struct smbXcli_conn *conn,
1603 struct iovec *iov, int iov_count,
1604 uint32_t *seqnum,
1605 bool one_way_seqnum)
1606 {
1607 TALLOC_CTX *frame = NULL;
1608 uint8_t *buf;
1609
1610 /*
1611 * Obvious optimization: Make cli_calculate_sign_mac work with struct
1612 * iovec directly. MD5Update would do that just fine.
1613 */
1614
1615 if (iov_count < 4) {
1616 return NT_STATUS_INVALID_PARAMETER_MIX;
1617 }
1618 if (iov[0].iov_len != NBT_HDR_SIZE) {
1619 return NT_STATUS_INVALID_PARAMETER_MIX;
1620 }
1621 if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1622 return NT_STATUS_INVALID_PARAMETER_MIX;
1623 }
1624 if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1625 return NT_STATUS_INVALID_PARAMETER_MIX;
1626 }
1627 if (iov[3].iov_len != sizeof(uint16_t)) {
1628 return NT_STATUS_INVALID_PARAMETER_MIX;
1629 }
1630
1631 frame = talloc_stackframe();
1632
1633 buf = iov_concat(frame, &iov[1], iov_count - 1);
1634 if (buf == NULL) {
1635 return NT_STATUS_NO_MEMORY;
1636 }
1637
1638 *seqnum = smb_signing_next_seqnum(conn->smb1.signing,
1639 one_way_seqnum);
1640 smb_signing_sign_pdu(conn->smb1.signing,
1641 buf, talloc_get_size(buf),
1642 *seqnum);
1643 memcpy(iov[1].iov_base, buf, iov[1].iov_len);
1644
1645 TALLOC_FREE(frame);
1646 return NT_STATUS_OK;
1647 }
1648
1649 static void smb1cli_req_writev_done(struct tevent_req *subreq);
1650 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
1651 TALLOC_CTX *tmp_mem,
1652 uint8_t *inbuf);
1653
1654 static NTSTATUS smb1cli_req_writev_submit(struct tevent_req *req,
1655 struct smbXcli_req_state *state,
1656 struct iovec *iov, int iov_count)
1657 {
1658 struct tevent_req *subreq;
1659 NTSTATUS status;
1660 uint8_t cmd;
1661 uint16_t mid;
1662 ssize_t nbtlen;
1663
1664 if (!smbXcli_conn_is_connected(state->conn)) {
1665 return NT_STATUS_CONNECTION_DISCONNECTED;
1666 }
1667
1668 if (state->conn->protocol > PROTOCOL_NT1) {
1669 DBG_ERR("called for dialect[%s] server[%s]\n",
1670 smb_protocol_types_string(state->conn->protocol),
1671 smbXcli_conn_remote_name(state->conn));
1672 return NT_STATUS_REVISION_MISMATCH;
1673 }
1674
1675 if (iov_count < 4) {
1676 return NT_STATUS_INVALID_PARAMETER_MIX;
1677 }
1678 if (iov[0].iov_len != NBT_HDR_SIZE) {
1679 return NT_STATUS_INVALID_PARAMETER_MIX;
1680 }
1681 if (iov[1].iov_len != (MIN_SMB_SIZE-sizeof(uint16_t))) {
1682 return NT_STATUS_INVALID_PARAMETER_MIX;
1683 }
1684 if (iov[2].iov_len > (0xFF * sizeof(uint16_t))) {
1685 return NT_STATUS_INVALID_PARAMETER_MIX;
1686 }
1687 if (iov[3].iov_len != sizeof(uint16_t)) {
1688 return NT_STATUS_INVALID_PARAMETER_MIX;
1689 }
1690
1691 cmd = CVAL(iov[1].iov_base, HDR_COM);
1692 if (cmd == SMBreadBraw) {
1693 if (smbXcli_conn_has_async_calls(state->conn)) {
1694 return NT_STATUS_INVALID_PARAMETER_MIX;
1695 }
1696 state->conn->smb1.read_braw_req = req;
1697 }
1698
1699 if (state->smb1.mid != 0) {
1700 mid = state->smb1.mid;
1701 } else {
1702 mid = smb1cli_alloc_mid(state->conn);
1703 }
1704 SSVAL(iov[1].iov_base, HDR_MID, mid);
1705
1706 nbtlen = iov_buflen(&iov[1], iov_count-1);
1707 if ((nbtlen == -1) || (nbtlen > 0x1FFFF)) {
1708 return NT_STATUS_INVALID_PARAMETER_MIX;
1709 }
1710
1711 _smb_setlen_nbt(iov[0].iov_base, nbtlen);
1712
1713 status = smb1cli_conn_signv(state->conn, iov, iov_count,
1714 &state->smb1.seqnum,
1715 state->smb1.one_way_seqnum);
1716
1717 if (!NT_STATUS_IS_OK(status)) {
1718 return status;
1719 }
1720
1721 /*
1722 * If we supported multiple encrytion contexts
1723 * here we'd look up based on tid.
1724 */
1725 if (common_encryption_on(state->conn->smb1.trans_enc)) {
1726 char *buf, *enc_buf;
1727
1728 buf = (char *)iov_concat(talloc_tos(), iov, iov_count);
1729 if (buf == NULL) {
1730 return NT_STATUS_NO_MEMORY;
1731 }
1732 status = common_encrypt_buffer(state->conn->smb1.trans_enc,
1733 (char *)buf, &enc_buf);
1734 TALLOC_FREE(buf);
1735 if (!NT_STATUS_IS_OK(status)) {
1736 DEBUG(0, ("Error in encrypting client message: %s\n",
1737 nt_errstr(status)));
1738 return status;
1739 }
1740 buf = (char *)talloc_memdup(state, enc_buf,
1741 smb_len_nbt(enc_buf)+4);
1742 SAFE_FREE(enc_buf);
1743 if (buf == NULL) {
1744 return NT_STATUS_NO_MEMORY;
1745 }
1746 iov[0].iov_base = (void *)buf;
1747 iov[0].iov_len = talloc_get_size(buf);
1748 iov_count = 1;
1749 }
1750
1751 if (state->conn->dispatch_incoming == NULL) {
1752 state->conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
1753 }
1754
1755 if (!smbXcli_req_set_pending(req)) {
1756 return NT_STATUS_NO_MEMORY;
1757 }
1758
1759 tevent_req_set_cancel_fn(req, smbXcli_req_cancel);
1760
1761 subreq = writev_send(state, state->ev, state->conn->outgoing,
1762 state->conn->sock_fd, false, iov, iov_count);
1763 if (subreq == NULL) {
1764 return NT_STATUS_NO_MEMORY;
1765 }
1766 tevent_req_set_callback(subreq, smb1cli_req_writev_done, req);
1767 state->write_req = subreq;
1768
1769 return NT_STATUS_OK;
1770 }
1771
1772 struct tevent_req *smb1cli_req_send(TALLOC_CTX *mem_ctx,
1773 struct tevent_context *ev,
1774 struct smbXcli_conn *conn,
1775 uint8_t smb_command,
1776 uint8_t additional_flags,
1777 uint8_t clear_flags,
1778 uint16_t additional_flags2,
1779 uint16_t clear_flags2,
1780 uint32_t timeout_msec,
1781 uint32_t pid,
1782 struct smbXcli_tcon *tcon,
1783 struct smbXcli_session *session,
1784 uint8_t wct, uint16_t *vwv,
1785 uint32_t num_bytes,
1786 const uint8_t *bytes)
1787 {
1788 struct tevent_req *req;
1789 struct iovec iov;
1790 NTSTATUS status;
1791
1792 iov.iov_base = discard_const_p(void, bytes);
1793 iov.iov_len = num_bytes;
1794
1795 req = smb1cli_req_create(mem_ctx, ev, conn, smb_command,
1796 additional_flags, clear_flags,
1797 additional_flags2, clear_flags2,
1798 timeout_msec,
1799 pid, tcon, session,
1800 wct, vwv, 1, &iov);
1801 if (req == NULL) {
1802 return NULL;
1803 }
1804 if (!tevent_req_is_in_progress(req)) {
1805 return tevent_req_post(req, ev);
1806 }
1807 status = smb1cli_req_chain_submit(&req, 1);
1808 if (tevent_req_nterror(req, status)) {
1809 return tevent_req_post(req, ev);
1810 }
1811 return req;
1812 }
1813
1814 static void smb1cli_req_writev_done(struct tevent_req *subreq)
1815 {
1816 struct tevent_req *req =
1817 tevent_req_callback_data(subreq,
1818 struct tevent_req);
1819 struct smbXcli_req_state *state =
1820 tevent_req_data(req,
1821 struct smbXcli_req_state);
1822 ssize_t nwritten;
1823 int err;
1824
1825 state->write_req = NULL;
1826
1827 nwritten = writev_recv(subreq, &err);
1828 TALLOC_FREE(subreq);
1829 if (nwritten == -1) {
1830 /* here, we need to notify all pending requests */
1831 NTSTATUS status = map_nt_error_from_unix_common(err);
1832 smbXcli_conn_disconnect(state->conn, status);
1833 return;
1834 }
1835
1836 if (state->one_way) {
1837 state->inbuf = NULL;
1838 tevent_req_done(req);
1839 return;
1840 }
1841 }
1842
1843 static void smbXcli_conn_received(struct tevent_req *subreq)
1844 {
1845 struct smbXcli_conn *conn =
1846 tevent_req_callback_data(subreq,
1847 struct smbXcli_conn);
1848 TALLOC_CTX *frame = talloc_stackframe();
1849 NTSTATUS status;
1850 uint8_t *inbuf;
1851 ssize_t received;
1852 int err;
1853
1854 if (subreq != conn->read_smb_req) {
1855 DEBUG(1, ("Internal error: cli_smb_received called with "
1856 "unexpected subreq\n"));
1857 smbXcli_conn_disconnect(conn, NT_STATUS_INTERNAL_ERROR);
1858 TALLOC_FREE(frame);
1859 return;
1860 }
1861 conn->read_smb_req = NULL;
1862
1863 received = read_smb_recv(subreq, frame, &inbuf, &err);
1864 TALLOC_FREE(subreq);
1865 if (received == -1) {
1866 status = map_nt_error_from_unix_common(err);
1867 smbXcli_conn_disconnect(conn, status);
1868 TALLOC_FREE(frame);
1869 return;
1870 }
1871
1872 status = conn->dispatch_incoming(conn, frame, inbuf);
1873 TALLOC_FREE(frame);
1874 if (NT_STATUS_IS_OK(status)) {
1875 /*
1876 * We should not do any more processing
1877 * as the dispatch function called
1878 * tevent_req_done().
1879 */
1880 return;
1881 }
1882
1883 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
1884 /*
1885 * We got an error, so notify all pending requests
1886 */
1887 smbXcli_conn_disconnect(conn, status);
1888 return;
1889 }
1890
1891 /*
1892 * We got NT_STATUS_RETRY, so we may ask for a
1893 * next incoming pdu.
1894 */
1895 if (!smbXcli_conn_receive_next(conn)) {
1896 smbXcli_conn_disconnect(conn, NT_STATUS_NO_MEMORY);
1897 }
1898 }
1899
1900 static NTSTATUS smb1cli_inbuf_parse_chain(uint8_t *buf, TALLOC_CTX *mem_ctx,
1901 struct iovec **piov, int *pnum_iov)
1902 {
1903 struct iovec *iov;
1904 int num_iov;
1905 size_t buflen;
1906 size_t taken;
1907 size_t remaining;
1908 uint8_t *hdr;
1909 uint8_t cmd;
1910 uint32_t wct_ofs;
1911 NTSTATUS status;
1912 size_t min_size = MIN_SMB_SIZE;
1913
1914 buflen = smb_len_tcp(buf);
1915 taken = 0;
1916
1917 hdr = buf + NBT_HDR_SIZE;
1918
1919 status = smb1cli_pull_raw_error(hdr);
1920 if (NT_STATUS_IS_ERR(status)) {
1921 /*
1922 * This is an ugly hack to support OS/2
1923 * which skips the byte_count in the DATA block
1924 * on some error responses.
1925 *
1926 * See bug #9096
1927 */
1928 min_size -= sizeof(uint16_t);
1929 }
1930
1931 if (buflen < min_size) {
1932 return NT_STATUS_INVALID_NETWORK_RESPONSE;
1933 }
1934
1935 /*
1936 * This returns iovec elements in the following order:
1937 *
1938 * - SMB header
1939 *
1940 * - Parameter Block
1941 * - Data Block
1942 *
1943 * - Parameter Block
1944 * - Data Block
1945 *
1946 * - Parameter Block
1947 * - Data Block
1948 */
1949 num_iov = 1;
1950
1951 iov = talloc_array(mem_ctx, struct iovec, num_iov);
1952 if (iov == NULL) {
1953 return NT_STATUS_NO_MEMORY;
1954 }
1955 iov[0].iov_base = hdr;
1956 iov[0].iov_len = HDR_WCT;
1957 taken += HDR_WCT;
1958
1959 cmd = CVAL(hdr, HDR_COM);
1960 wct_ofs = HDR_WCT;
1961
1962 while (true) {
1963 size_t len = buflen - taken;
1964 struct iovec *cur;
1965 struct iovec *iov_tmp;
1966 uint8_t wct;
1967 uint32_t bcc_ofs;
1968 uint16_t bcc;
1969 size_t needed;
1970
1971 /*
1972 * we need at least WCT
1973 */
1974 needed = sizeof(uint8_t);
1975 if (len < needed) {
1976 DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1977 __location__, (int)len, (int)needed));
1978 goto inval;
1979 }
1980
1981 /*
1982 * Now we check if the specified words are there
1983 */
1984 wct = CVAL(hdr, wct_ofs);
1985 needed += wct * sizeof(uint16_t);
1986 if (len < needed) {
1987 DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
1988 __location__, (int)len, (int)needed));
1989 goto inval;
1990 }
1991
1992 if ((num_iov == 1) &&
1993 (len == needed) &&
1994 NT_STATUS_IS_ERR(status))
1995 {
1996 /*
1997 * This is an ugly hack to support OS/2
1998 * which skips the byte_count in the DATA block
1999 * on some error responses.
2000 *
2001 * See bug #9096
2002 */
2003 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2004 num_iov + 2);
2005 if (iov_tmp == NULL) {
2006 TALLOC_FREE(iov);
2007 return NT_STATUS_NO_MEMORY;
2008 }
2009 iov = iov_tmp;
2010 cur = &iov[num_iov];
2011 num_iov += 2;
2012
2013 cur[0].iov_len = 0;
2014 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2015 cur[1].iov_len = 0;
2016 cur[1].iov_base = cur[0].iov_base;
2017
2018 taken += needed;
2019 break;
2020 }
2021
2022 /*
2023 * we need at least BCC
2024 */
2025 needed += sizeof(uint16_t);
2026 if (len < needed) {
2027 DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2028 __location__, (int)len, (int)needed));
2029 goto inval;
2030 }
2031
2032 /*
2033 * Now we check if the specified bytes are there
2034 */
2035 bcc_ofs = wct_ofs + sizeof(uint8_t) + wct * sizeof(uint16_t);
2036 bcc = SVAL(hdr, bcc_ofs);
2037 needed += bcc * sizeof(uint8_t);
2038 if (len < needed) {
2039 DEBUG(10, ("%s: %d bytes left, expected at least %d\n",
2040 __location__, (int)len, (int)needed));
2041 goto inval;
2042 }
2043
2044 /*
2045 * we allocate 2 iovec structures for words and bytes
2046 */
2047 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
2048 num_iov + 2);
2049 if (iov_tmp == NULL) {
2050 TALLOC_FREE(iov);
2051 return NT_STATUS_NO_MEMORY;
2052 }
2053 iov = iov_tmp;
2054 cur = &iov[num_iov];
2055 num_iov += 2;
2056
2057 cur[0].iov_len = wct * sizeof(uint16_t);
2058 cur[0].iov_base = hdr + (wct_ofs + sizeof(uint8_t));
2059 cur[1].iov_len = bcc * sizeof(uint8_t);
2060 cur[1].iov_base = hdr + (bcc_ofs + sizeof(uint16_t));
2061
2062 taken += needed;
2063
2064 if (!smb1cli_is_andx_req(cmd)) {
2065 /*
2066 * If the current command does not have AndX chanining
2067 * we are done.
2068 */
2069 break;
2070 }
2071
2072 if (wct == 0 && bcc == 0) {
2073 /*
2074 * An empty response also ends the chain,
2075 * most likely with an error.
2076 */
2077 break;
2078 }
2079
2080 if (wct < 2) {
2081 DEBUG(10, ("%s: wct[%d] < 2 for cmd[0x%02X]\n",
2082 __location__, (int)wct, (int)cmd));
2083 goto inval;
2084 }
2085 cmd = CVAL(cur[0].iov_base, 0);
2086 if (cmd == 0xFF) {
2087 /*
2088 * If it is the end of the chain we are also done.
2089 */
2090 break;
2091 }
2092 wct_ofs = SVAL(cur[0].iov_base, 2);
2093
2094 if (wct_ofs < taken) {
2095 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2096 }
2097 if (wct_ofs > buflen) {
2098 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2099 }
2100
2101 /*
2102 * we consumed everything up to the start of the next
2103 * parameter block.
2104 */
2105 taken = wct_ofs;
2106 }
2107
2108 remaining = buflen - taken;
2109
2110 if (remaining > 0 && num_iov >= 3) {
2111 /*
2112 * The last DATA block gets the remaining
2113 * bytes, this is needed to support
2114 * CAP_LARGE_WRITEX and CAP_LARGE_READX.
2115 */
2116 iov[num_iov-1].iov_len += remaining;
2117 }
2118
2119 *piov = iov;
2120 *pnum_iov = num_iov;
2121 return NT_STATUS_OK;
2122
2123 inval:
2124 TALLOC_FREE(iov);
2125 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2126 }
2127
2128 static NTSTATUS smb1cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
2129 TALLOC_CTX *tmp_mem,
2130 uint8_t *inbuf)
2131 {
2132 struct tevent_req *req;
2133 struct smbXcli_req_state *state;
2134 NTSTATUS status;
2135 size_t num_pending;
2136 size_t i;
2137 uint8_t cmd;
2138 uint16_t mid;
2139 bool oplock_break;
2140 uint8_t *inhdr = inbuf + NBT_HDR_SIZE;
2141 size_t len = smb_len_tcp(inbuf);
2142 struct iovec *iov = NULL;
2143 int num_iov = 0;
2144 struct tevent_req **chain = NULL;
2145 size_t num_chained = 0;
2146 size_t num_responses = 0;
2147
2148 if (conn->smb1.read_braw_req != NULL) {
2149 req = conn->smb1.read_braw_req;
2150 conn->smb1.read_braw_req = NULL;
2151 state = tevent_req_data(req, struct smbXcli_req_state);
2152
2153 smbXcli_req_unset_pending(req);
2154
2155 if (state->smb1.recv_iov == NULL) {
2156 /*
2157 * For requests with more than
2158 * one response, we have to readd the
2159 * recv_iov array.
2160 */
2161 state->smb1.recv_iov = talloc_zero_array(state,
2162 struct iovec,
2163 3);
2164 if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2165 return NT_STATUS_OK;
2166 }
2167 }
2168
2169 state->smb1.recv_iov[0].iov_base = (void *)(inhdr);
2170 state->smb1.recv_iov[0].iov_len = len;
2171 ZERO_STRUCT(state->smb1.recv_iov[1]);
2172 ZERO_STRUCT(state->smb1.recv_iov[2]);
2173
2174 state->smb1.recv_cmd = SMBreadBraw;
2175 state->smb1.recv_status = NT_STATUS_OK;
2176 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2177
2178 tevent_req_done(req);
2179 return NT_STATUS_OK;
2180 }
2181
2182 if ((IVAL(inhdr, 0) != SMB_MAGIC) /* 0xFF"SMB" */
2183 && (SVAL(inhdr, 0) != 0x45ff)) /* 0xFF"E" */ {
2184 DEBUG(10, ("Got non-SMB PDU\n"));
2185 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2186 }
2187
2188 /*
2189 * If we supported multiple encrytion contexts
2190 * here we'd look up based on tid.
2191 */
2192 if (common_encryption_on(conn->smb1.trans_enc)
2193 && (CVAL(inbuf, 0) == 0)) {
2194 uint16_t enc_ctx_num;
2195
2196 status = get_enc_ctx_num(inbuf, &enc_ctx_num);
2197 if (!NT_STATUS_IS_OK(status)) {
2198 DEBUG(10, ("get_enc_ctx_num returned %s\n",
2199 nt_errstr(status)));
2200 return status;
2201 }
2202
2203 if (enc_ctx_num != conn->smb1.trans_enc->enc_ctx_num) {
2204 DEBUG(10, ("wrong enc_ctx %d, expected %d\n",
2205 enc_ctx_num,
2206 conn->smb1.trans_enc->enc_ctx_num));
2207 return NT_STATUS_INVALID_HANDLE;
2208 }
2209
2210 status = common_decrypt_buffer(conn->smb1.trans_enc,
2211 (char *)inbuf);
2212 if (!NT_STATUS_IS_OK(status)) {
2213 DEBUG(10, ("common_decrypt_buffer returned %s\n",
2214 nt_errstr(status)));
2215 return status;
2216 }
2217 inhdr = inbuf + NBT_HDR_SIZE;
2218 len = smb_len_nbt(inbuf);
2219 }
2220
2221 mid = SVAL(inhdr, HDR_MID);
2222 num_pending = talloc_array_length(conn->pending);
2223
2224 for (i=0; i<num_pending; i++) {
2225 if (mid == smb1cli_req_mid(conn->pending[i])) {
2226 break;
2227 }
2228 }
2229 if (i == num_pending) {
2230 /* Dump unexpected reply */
2231 return NT_STATUS_RETRY;
2232 }
2233
2234 oplock_break = false;
2235
2236 if (mid == 0xffff) {
2237 /*
2238 * Paranoia checks that this is really an oplock break request.
2239 */
2240 oplock_break = (len == 51); /* hdr + 8 words */
2241 oplock_break &= ((CVAL(inhdr, HDR_FLG) & FLAG_REPLY) == 0);
2242 oplock_break &= (CVAL(inhdr, HDR_COM) == SMBlockingX);
2243 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(6)) == 0);
2244 oplock_break &= (SVAL(inhdr, HDR_VWV+VWV(7)) == 0);
2245
2246 if (!oplock_break) {
2247 /* Dump unexpected reply */
2248 return NT_STATUS_RETRY;
2249 }
2250 }
2251
2252 req = conn->pending[i];
2253 state = tevent_req_data(req, struct smbXcli_req_state);
2254
2255 if (!oplock_break /* oplock breaks are not signed */
2256 && !smb_signing_check_pdu(conn->smb1.signing,
2257 inhdr, len, state->smb1.seqnum+1)) {
2258 DEBUG(10, ("cli_check_sign_mac failed\n"));
2259 return NT_STATUS_ACCESS_DENIED;
2260 }
2261
2262 status = smb1cli_inbuf_parse_chain(inbuf, tmp_mem,
2263 &iov, &num_iov);
2264 if (!NT_STATUS_IS_OK(status)) {
2265 DEBUG(10,("smb1cli_inbuf_parse_chain - %s\n",
2266 nt_errstr(status)));
2267 return status;
2268 }
2269
2270 cmd = CVAL(inhdr, HDR_COM);
2271 status = smb1cli_pull_raw_error(inhdr);
2272
2273 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
2274 (state->session != NULL) && state->session->disconnect_expired)
2275 {
2276 /*
2277 * this should be a short term hack
2278 * until the upper layers have implemented
2279 * re-authentication.
2280 */
2281 return status;
2282 }
2283
2284 if (state->smb1.chained_requests == NULL) {
2285 if (num_iov != 3) {
2286 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2287 }
2288
2289 smbXcli_req_unset_pending(req);
2290
2291 if (state->smb1.recv_iov == NULL) {
2292 /*
2293 * For requests with more than
2294 * one response, we have to readd the
2295 * recv_iov array.
2296 */
2297 state->smb1.recv_iov = talloc_zero_array(state,
2298 struct iovec,
2299 3);
2300 if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2301 return NT_STATUS_OK;
2302 }
2303 }
2304
2305 state->smb1.recv_cmd = cmd;
2306 state->smb1.recv_status = status;
2307 state->inbuf = talloc_move(state->smb1.recv_iov, &inbuf);
2308
2309 state->smb1.recv_iov[0] = iov[0];
2310 state->smb1.recv_iov[1] = iov[1];
2311 state->smb1.recv_iov[2] = iov[2];
2312
2313 if (talloc_array_length(conn->pending) == 0) {
2314 tevent_req_done(req);
2315 return NT_STATUS_OK;
2316 }
2317
2318 tevent_req_defer_callback(req, state->ev);
2319 tevent_req_done(req);
2320 return NT_STATUS_RETRY;
2321 }
2322
2323 chain = talloc_move(tmp_mem, &state->smb1.chained_requests);
2324 num_chained = talloc_array_length(chain);
2325 num_responses = (num_iov - 1)/2;
2326
2327 if (num_responses > num_chained) {
2328 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2329 }
2330
2331 for (i=0; i<num_chained; i++) {
2332 size_t iov_idx = 1 + (i*2);
2333 struct iovec *cur = &iov[iov_idx];
2334 uint8_t *inbuf_ref;
2335
2336 req = chain[i];
2337 state = tevent_req_data(req, struct smbXcli_req_state);
2338
2339 smbXcli_req_unset_pending(req);
2340
2341 /*
2342 * as we finish multiple requests here
2343 * we need to defer the callbacks as
2344 * they could destroy our current stack state.
2345 */
2346 tevent_req_defer_callback(req, state->ev);
2347
2348 if (i >= num_responses) {
2349 tevent_req_nterror(req, NT_STATUS_REQUEST_ABORTED);
2350 continue;
2351 }
2352
2353 if (state->smb1.recv_iov == NULL) {
2354 /*
2355 * For requests with more than
2356 * one response, we have to readd the
2357 * recv_iov array.
2358 */
2359 state->smb1.recv_iov = talloc_zero_array(state,
2360 struct iovec,
2361 3);
2362 if (tevent_req_nomem(state->smb1.recv_iov, req)) {
2363 continue;
2364 }
2365 }
2366
2367 state->smb1.recv_cmd = cmd;
2368
2369 if (i == (num_responses - 1)) {
2370 /*
2371 * The last request in the chain gets the status
2372 */
2373 state->smb1.recv_status = status;
2374 } else {
2375 cmd = CVAL(cur[0].iov_base, 0);
2376 state->smb1.recv_status = NT_STATUS_OK;
2377 }
2378
2379 state->inbuf = inbuf;
2380
2381 /*
2382 * Note: here we use talloc_reference() in a way
2383 * that does not expose it to the caller.
2384 */
2385 inbuf_ref = talloc_reference(state->smb1.recv_iov, inbuf);
2386 if (tevent_req_nomem(inbuf_ref, req)) {
2387 continue;
2388 }
2389
2390 /* copy the related buffers */
2391 state->smb1.recv_iov[0] = iov[0];
2392 state->smb1.recv_iov[1] = cur[0];
2393 state->smb1.recv_iov[2] = cur[1];
2394
2395 tevent_req_done(req);
2396 }
2397
2398 return NT_STATUS_RETRY;
2399 }
2400
2401 NTSTATUS smb1cli_req_recv(struct tevent_req *req,
2402 TALLOC_CTX *mem_ctx,
2403 struct iovec **piov,
2404 uint8_t **phdr,
2405 uint8_t *pwct,
2406 uint16_t **pvwv,
2407 uint32_t *pvwv_offset,
2408 uint32_t *pnum_bytes,
2409 uint8_t **pbytes,
2410 uint32_t *pbytes_offset,
2411 uint8_t **pinbuf,
2412 const struct smb1cli_req_expected_response *expected,
2413 size_t num_expected)
2414 {
2415 struct smbXcli_req_state *state =
2416 tevent_req_data(req,
2417 struct smbXcli_req_state);
2418 NTSTATUS status = NT_STATUS_OK;
2419 struct iovec *recv_iov = NULL;
2420 uint8_t *hdr = NULL;
2421 uint8_t wct = 0;
2422 uint32_t vwv_offset = 0;
2423 uint16_t *vwv = NULL;
2424 uint32_t num_bytes = 0;
2425 uint32_t bytes_offset = 0;
2426 uint8_t *bytes = NULL;
2427 size_t i;
2428 bool found_status = false;
2429 bool found_size = false;
2430
2431 if (piov != NULL) {
2432 *piov = NULL;
2433 }
2434 if (phdr != NULL) {
2435 *phdr = 0;
2436 }
2437 if (pwct != NULL) {
2438 *pwct = 0;
2439 }
2440 if (pvwv != NULL) {
2441 *pvwv = NULL;
2442 }
2443 if (pvwv_offset != NULL) {
2444 *pvwv_offset = 0;
2445 }
2446 if (pnum_bytes != NULL) {
2447 *pnum_bytes = 0;
2448 }
2449 if (pbytes != NULL) {
2450 *pbytes = NULL;
2451 }
2452 if (pbytes_offset != NULL) {
2453 *pbytes_offset = 0;
2454 }
2455 if (pinbuf != NULL) {
2456 *pinbuf = NULL;
2457 }
2458
2459 if (state->inbuf != NULL) {
2460 recv_iov = state->smb1.recv_iov;
2461 state->smb1.recv_iov = NULL;
2462 if (state->smb1.recv_cmd != SMBreadBraw) {
2463 hdr = (uint8_t *)recv_iov[0].iov_base;
2464 wct = recv_iov[1].iov_len/2;
2465 vwv = (uint16_t *)recv_iov[1].iov_base;
2466 vwv_offset = PTR_DIFF(vwv, hdr);
2467 num_bytes = recv_iov[2].iov_len;
2468 bytes = (uint8_t *)recv_iov[2].iov_base;
2469 bytes_offset = PTR_DIFF(bytes, hdr);
2470 }
2471 }
2472
2473 if (tevent_req_is_nterror(req, &status)) {
2474 for (i=0; i < num_expected; i++) {
2475 if (NT_STATUS_EQUAL(status, expected[i].status)) {
2476 found_status = true;
2477 break;
2478 }
2479 }
2480
2481 if (found_status) {
2482 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2483 }
2484
2485 return status;
2486 }
2487
2488 if (num_expected == 0) {
2489 found_status = true;
2490 found_size = true;
2491 }
2492
2493 status = state->smb1.recv_status;
2494
2495 for (i=0; i < num_expected; i++) {
2496 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
2497 continue;
2498 }
2499
2500 found_status = true;
2501 if (expected[i].wct == 0) {
2502 found_size = true;
2503 break;
2504 }
2505
2506 if (expected[i].wct == wct) {
2507 found_size = true;
2508 break;
2509 }
2510 }
2511
2512 if (!found_status) {
2513 return status;
2514 }
2515
2516 if (!found_size) {
2517 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2518 }
2519
2520 if (piov != NULL) {
2521 *piov = talloc_move(mem_ctx, &recv_iov);
2522 }
2523
2524 if (phdr != NULL) {
2525 *phdr = hdr;
2526 }
2527 if (pwct != NULL) {
2528 *pwct = wct;
2529 }
2530 if (pvwv != NULL) {
2531 *pvwv = vwv;
2532 }
2533 if (pvwv_offset != NULL) {
2534 *pvwv_offset = vwv_offset;
2535 }
2536 if (pnum_bytes != NULL) {
2537 *pnum_bytes = num_bytes;
2538 }
2539 if (pbytes != NULL) {
2540 *pbytes = bytes;
2541 }
2542 if (pbytes_offset != NULL) {
2543 *pbytes_offset = bytes_offset;
2544 }
2545 if (pinbuf != NULL) {
2546 *pinbuf = state->inbuf;
2547 }
2548
2549 return status;
2550 }
2551
2552 size_t smb1cli_req_wct_ofs(struct tevent_req **reqs, int num_reqs)
2553 {
2554 size_t wct_ofs;
2555 int i;
2556
2557 wct_ofs = HDR_WCT;
2558
2559 for (i=0; i<num_reqs; i++) {
2560 struct smbXcli_req_state *state;
2561 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2562 wct_ofs += smbXcli_iov_len(state->smb1.iov+2,
2563 state->smb1.iov_count-2);
2564 wct_ofs = (wct_ofs + 3) & ~3;
2565 }
2566 return wct_ofs;
2567 }
2568
2569 NTSTATUS smb1cli_req_chain_submit(struct tevent_req **reqs, int num_reqs)
2570 {
2571 struct smbXcli_req_state *first_state =
2572 tevent_req_data(reqs[0],
2573 struct smbXcli_req_state);
2574 struct smbXcli_req_state *state;
2575 size_t wct_offset;
2576 size_t chain_padding = 0;
2577 int i, iovlen;
2578 struct iovec *iov = NULL;
2579 struct iovec *this_iov;
2580 NTSTATUS status;
2581 ssize_t nbt_len;
2582
2583 if (num_reqs == 1) {
2584 return smb1cli_req_writev_submit(reqs[0], first_state,
2585 first_state->smb1.iov,
2586 first_state->smb1.iov_count);
2587 }
2588
2589 iovlen = 0;
2590 for (i=0; i<num_reqs; i++) {
2591 if (!tevent_req_is_in_progress(reqs[i])) {
2592 return NT_STATUS_INTERNAL_ERROR;
2593 }
2594
2595 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2596
2597 if (state->smb1.iov_count < 4) {
2598 return NT_STATUS_INVALID_PARAMETER_MIX;
2599 }
2600
2601 if (i == 0) {
2602 /*
2603 * The NBT and SMB header
2604 */
2605 iovlen += 2;
2606 } else {
2607 /*
2608 * Chain padding
2609 */
2610 iovlen += 1;
2611 }
2612
2613 /*
2614 * words and bytes
2615 */
2616 iovlen += state->smb1.iov_count - 2;
2617 }
2618
2619 iov = talloc_zero_array(first_state, struct iovec, iovlen);
2620 if (iov == NULL) {
2621 return NT_STATUS_NO_MEMORY;
2622 }
2623
2624 first_state->smb1.chained_requests = (struct tevent_req **)talloc_memdup(
2625 first_state, reqs, sizeof(*reqs) * num_reqs);
2626 if (first_state->smb1.chained_requests == NULL) {
2627 TALLOC_FREE(iov);
2628 return NT_STATUS_NO_MEMORY;
2629 }
2630
2631 wct_offset = HDR_WCT;
2632 this_iov = iov;
2633
2634 for (i=0; i<num_reqs; i++) {
2635 size_t next_padding = 0;
2636 uint16_t *vwv;
2637
2638 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
2639
2640 if (i < num_reqs-1) {
2641 if (!smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))
2642 || CVAL(state->smb1.hdr, HDR_WCT) < 2) {
2643 TALLOC_FREE(iov);
2644 TALLOC_FREE(first_state->smb1.chained_requests);
2645 return NT_STATUS_INVALID_PARAMETER_MIX;
2646 }
2647 }
2648
2649 wct_offset += smbXcli_iov_len(state->smb1.iov+2,
2650 state->smb1.iov_count-2) + 1;
2651 if ((wct_offset % 4) != 0) {
2652 next_padding = 4 - (wct_offset % 4);
2653 }
2654 wct_offset += next_padding;
2655 vwv = state->smb1.vwv;
2656
2657 if (i < num_reqs-1) {
2658 struct smbXcli_req_state *next_state =
2659 tevent_req_data(reqs[i+1],
2660 struct smbXcli_req_state);
2661 SCVAL(vwv+0, 0, CVAL(next_state->smb1.hdr, HDR_COM));
2662 SCVAL(vwv+0, 1, 0);
2663 SSVAL(vwv+1, 0, wct_offset);
2664 } else if (smb1cli_is_andx_req(CVAL(state->smb1.hdr, HDR_COM))) {
2665 /* properly end the chain */
2666 SCVAL(vwv+0, 0, 0xff);
2667 SCVAL(vwv+0, 1, 0xff);
2668 SSVAL(vwv+1, 0, 0);
2669 }
2670
2671 if (i == 0) {
2672 /*
2673 * The NBT and SMB header
2674 */
2675 this_iov[0] = state->smb1.iov[0];
2676 this_iov[1] = state->smb1.iov[1];
2677 this_iov += 2;
2678 } else {
2679 /*
2680 * This one is a bit subtle. We have to add
2681 * chain_padding bytes between the requests, and we
2682 * have to also include the wct field of the
2683 * subsequent requests. We use the subsequent header
2684 * for the padding, it contains the wct field in its
2685 * last byte.
2686 */
2687 this_iov[0].iov_len = chain_padding+1;
2688 this_iov[0].iov_base = (void *)&state->smb1.hdr[
2689 sizeof(state->smb1.hdr) - this_iov[0].iov_len];
2690 memset(this_iov[0].iov_base, 0, this_iov[0].iov_len-1);
2691 this_iov += 1;
2692 }
2693
2694 /*
2695 * copy the words and bytes
2696 */
2697 memcpy(this_iov, state->smb1.iov+2,
2698 sizeof(struct iovec) * (state->smb1.iov_count-2));
2699 this_iov += state->smb1.iov_count - 2;
2700 chain_padding = next_padding;
2701 }
2702
2703 nbt_len = iov_buflen(&iov[1], iovlen-1);
2704 if ((nbt_len == -1) || (nbt_len > first_state->conn->smb1.max_xmit)) {
2705 TALLOC_FREE(iov);
2706 TALLOC_FREE(first_state->smb1.chained_requests);
2707 return NT_STATUS_INVALID_PARAMETER_MIX;
2708 }
2709
2710 status = smb1cli_req_writev_submit(reqs[0], first_state, iov, iovlen);
2711 if (!NT_STATUS_IS_OK(status)) {
2712 TALLOC_FREE(iov);
2713 TALLOC_FREE(first_state->smb1.chained_requests);
2714 return status;
2715 }
2716
2717 return NT_STATUS_OK;
2718 }
2719
2720 bool smbXcli_conn_has_async_calls(struct smbXcli_conn *conn)
2721 {
2722 return ((tevent_queue_length(conn->outgoing) != 0)
2723 || (talloc_array_length(conn->pending) != 0));
2724 }
2725
2726 bool smbXcli_conn_dfs_supported(struct smbXcli_conn *conn)
2727 {
2728 if (conn->protocol >= PROTOCOL_SMB2_02) {
2729 return (smb2cli_conn_server_capabilities(conn) & SMB2_CAP_DFS);
2730 }
2731
2732 return (smb1cli_conn_capabilities(conn) & CAP_DFS);
2733 }
2734
2735 bool smb2cli_conn_req_possible(struct smbXcli_conn *conn, uint32_t *max_dyn_len)
2736 {
2737 uint16_t credits = 1;
2738
2739 if (conn->smb2.cur_credits == 0) {
2740 if (max_dyn_len != NULL) {
2741 *max_dyn_len = 0;
2742 }
2743 return false;
2744 }
2745
2746 if (conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
2747 credits = conn->smb2.cur_credits;
2748 }
2749
2750 if (max_dyn_len != NULL) {
2751 *max_dyn_len = credits * 65536;
2752 }
2753
2754 return true;
2755 }
2756
2757 uint32_t smb2cli_conn_server_capabilities(struct smbXcli_conn *conn)
2758 {
2759 return conn->smb2.server.capabilities;
2760 }
2761
2762 uint16_t smb2cli_conn_server_security_mode(struct smbXcli_conn *conn)
2763 {
2764 return conn->smb2.server.security_mode;
2765 }
2766
2767 uint32_t smb2cli_conn_max_trans_size(struct smbXcli_conn *conn)
2768 {
2769 return conn->smb2.server.max_trans_size;
2770 }
2771
2772 uint32_t smb2cli_conn_max_read_size(struct smbXcli_conn *conn)
2773 {
2774 return conn->smb2.server.max_read_size;
2775 }
2776
2777 uint32_t smb2cli_conn_max_write_size(struct smbXcli_conn *conn)
2778 {
2779 return conn->smb2.server.max_write_size;
2780 }
2781
2782 void smb2cli_conn_set_max_credits(struct smbXcli_conn *conn,
2783 uint16_t max_credits)
2784 {
2785 conn->smb2.max_credits = max_credits;
2786 }
2787
2788 uint16_t smb2cli_conn_get_cur_credits(struct smbXcli_conn *conn)
2789 {
2790 return conn->smb2.cur_credits;
2791 }
2792
2793 uint8_t smb2cli_conn_get_io_priority(struct smbXcli_conn *conn)
2794 {
2795 if (conn->protocol < PROTOCOL_SMB3_11) {
2796 return 0;
2797 }
2798
2799 return conn->smb2.io_priority;
2800 }
2801
2802 void smb2cli_conn_set_io_priority(struct smbXcli_conn *conn,
2803 uint8_t io_priority)
2804 {
2805 conn->smb2.io_priority = io_priority;
2806 }
2807
2808 uint32_t smb2cli_conn_cc_chunk_len(struct smbXcli_conn *conn)
2809 {
2810 return conn->smb2.cc_chunk_len;
2811 }
2812
2813 void smb2cli_conn_set_cc_chunk_len(struct smbXcli_conn *conn,
2814 uint32_t chunk_len)
2815 {
2816 conn->smb2.cc_chunk_len = chunk_len;
2817 }
2818
2819 uint32_t smb2cli_conn_cc_max_chunks(struct smbXcli_conn *conn)
2820 {
2821 return conn->smb2.cc_max_chunks;
2822 }
2823
2824 void smb2cli_conn_set_cc_max_chunks(struct smbXcli_conn *conn,
2825 uint32_t max_chunks)
2826 {
2827 conn->smb2.cc_max_chunks = max_chunks;
2828 }
2829
2830 static void smb2cli_req_cancel_done(struct tevent_req *subreq);
2831
2832 static bool smb2cli_req_cancel(struct tevent_req *req)
2833 {
2834 struct smbXcli_req_state *state =
2835 tevent_req_data(req,
2836 struct smbXcli_req_state);
2837 struct smbXcli_tcon *tcon = state->tcon;
2838 struct smbXcli_session *session = state->session;
2839 uint8_t *fixed = state->smb2.pad;
2840 uint16_t fixed_len = 4;
2841 struct tevent_req *subreq;
2842 struct smbXcli_req_state *substate;
2843 NTSTATUS status;
2844
2845 SSVAL(fixed, 0, 0x04);
2846 SSVAL(fixed, 2, 0);
2847
2848 subreq = smb2cli_req_create(state, state->ev,
2849 state->conn,
2850 SMB2_OP_CANCEL,
2851 0, 0, /* flags */
2852 0, /* timeout */
2853 tcon, session,
2854 fixed, fixed_len,
2855 NULL, 0, 0);
2856 if (subreq == NULL) {
2857 return false;
2858 }
2859 substate = tevent_req_data(subreq, struct smbXcli_req_state);
2860
2861 SIVAL(substate->smb2.hdr, SMB2_HDR_FLAGS, state->smb2.cancel_flags);
2862 SBVAL(substate->smb2.hdr, SMB2_HDR_MESSAGE_ID, state->smb2.cancel_mid);
2863 SBVAL(substate->smb2.hdr, SMB2_HDR_ASYNC_ID, state->smb2.cancel_aid);
2864
2865 status = smb2cli_req_compound_submit(&subreq, 1);
2866 if (!NT_STATUS_IS_OK(status)) {
2867 TALLOC_FREE(subreq);
2868 return false;
2869 }
2870
2871 tevent_req_set_callback(subreq, smb2cli_req_cancel_done, NULL);
2872
2873 return true;
2874 }
2875
2876 static void smb2cli_req_cancel_done(struct tevent_req *subreq)
2877 {
2878 /* we do not care about the result */
2879 TALLOC_FREE(subreq);
2880 }
2881
2882 struct tevent_req *smb2cli_req_create(TALLOC_CTX *mem_ctx,
2883 struct tevent_context *ev,
2884 struct smbXcli_conn *conn,
2885 uint16_t cmd,
2886 uint32_t additional_flags,
2887 uint32_t clear_flags,
2888 uint32_t timeout_msec,
2889 struct smbXcli_tcon *tcon,
2890 struct smbXcli_session *session,
2891 const uint8_t *fixed,
2892 uint16_t fixed_len,
2893 const uint8_t *dyn,
2894 uint32_t dyn_len,
2895 uint32_t max_dyn_len)
2896 {
2897 struct tevent_req *req;
2898 struct smbXcli_req_state *state;
2899 uint32_t flags = 0;
2900 uint32_t tid = 0;
2901 uint64_t uid = 0;
2902 bool use_channel_sequence = false;
2903 uint16_t channel_sequence = 0;
2904 bool use_replay_flag = false;
2905
2906 req = tevent_req_create(mem_ctx, &state,
2907 struct smbXcli_req_state);
2908 if (req == NULL) {
2909 return NULL;
2910 }
2911
2912 state->ev = ev;
2913 state->conn = conn;
2914 state->session = session;
2915 state->tcon = tcon;
2916
2917 if (conn->smb2.server.capabilities & SMB2_CAP_PERSISTENT_HANDLES) {
2918 use_channel_sequence = true;
2919 } else if (conn->smb2.server.capabilities & SMB2_CAP_MULTI_CHANNEL) {
2920 use_channel_sequence = true;
2921 }
2922
2923 if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_00) {
2924 use_replay_flag = true;
2925 }
2926
2927 if (smbXcli_conn_protocol(conn) >= PROTOCOL_SMB3_11) {
2928 flags |= SMB2_PRIORITY_VALUE_TO_MASK(conn->smb2.io_priority);
2929 }
2930
2931 if (session) {
2932 uid = session->smb2->session_id;
2933
2934 if (use_channel_sequence) {
2935 channel_sequence = session->smb2->channel_sequence;
2936 }
2937
2938 if (use_replay_flag && session->smb2->replay_active) {
2939 additional_flags |= SMB2_HDR_FLAG_REPLAY_OPERATION;
2940 }
2941
2942 state->smb2.should_sign = session->smb2->should_sign;
2943 state->smb2.should_encrypt = session->smb2->should_encrypt;
2944
2945 if (cmd == SMB2_OP_SESSSETUP &&
2946 session->smb2_channel.signing_key.length == 0 &&
2947 session->smb2->signing_key.length != 0)
2948 {
2949 /*
2950 * a session bind needs to be signed
2951 */
2952 state->smb2.should_sign = true;
2953 }
2954
2955 if (cmd == SMB2_OP_SESSSETUP &&
2956 session->smb2_channel.signing_key.length == 0) {
2957 state->smb2.should_encrypt = false;
2958 }
2959
2960 if (additional_flags & SMB2_HDR_FLAG_SIGNED) {
2961 if (session->smb2_channel.signing_key.length == 0) {
2962 tevent_req_nterror(req, NT_STATUS_NO_USER_SESSION_KEY);
2963 return req;
2964 }
2965
2966 additional_flags &= ~SMB2_HDR_FLAG_SIGNED;
2967 state->smb2.should_sign = true;
2968 }
2969 }
2970
2971 if (tcon) {
2972 tid = tcon->smb2.tcon_id;
2973
2974 if (tcon->smb2.should_sign) {
2975 state->smb2.should_sign = true;
2976 }
2977 if (tcon->smb2.should_encrypt) {
2978 state->smb2.should_encrypt = true;
2979 }
2980 }
2981
2982 if (state->smb2.should_encrypt) {
2983 state->smb2.should_sign = false;
2984 }
2985
2986 state->smb2.recv_iov = talloc_zero_array(state, struct iovec, 3);
2987 if (state->smb2.recv_iov == NULL) {
2988 TALLOC_FREE(req);
2989 return NULL;
2990 }
2991
2992 flags |= additional_flags;
2993 flags &= ~clear_flags;
2994
2995 state->smb2.fixed = fixed;
2996 state->smb2.fixed_len = fixed_len;
2997 state->smb2.dyn = dyn;
2998 state->smb2.dyn_len = dyn_len;
2999 state->smb2.max_dyn_len = max_dyn_len;
3000
3001 if (state->smb2.should_encrypt) {
3002 SIVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3003 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID, uid);
3004 }
3005
3006 SIVAL(state->smb2.hdr, SMB2_HDR_PROTOCOL_ID, SMB2_MAGIC);
3007 SSVAL(state->smb2.hdr, SMB2_HDR_LENGTH, SMB2_HDR_BODY);
3008 SSVAL(state->smb2.hdr, SMB2_HDR_OPCODE, cmd);
3009 SSVAL(state->smb2.hdr, SMB2_HDR_CHANNEL_SEQUENCE, channel_sequence);
3010 SIVAL(state->smb2.hdr, SMB2_HDR_FLAGS, flags);
3011 SIVAL(state->smb2.hdr, SMB2_HDR_PID, 0); /* reserved */
3012 SIVAL(state->smb2.hdr, SMB2_HDR_TID, tid);
3013 SBVAL(state->smb2.hdr, SMB2_HDR_SESSION_ID, uid);
3014
3015 switch (cmd) {
3016 case SMB2_OP_CANCEL:
3017 state->one_way = true;
3018 break;
3019 case SMB2_OP_BREAK:
3020 /*
3021 * If this is a dummy request, it will have
3022 * UINT64_MAX as message id.
3023 * If we send on break acknowledgement,
3024 * this gets overwritten later.
3025 */
3026 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, UINT64_MAX);
3027 break;
3028 }
3029
3030 if (timeout_msec > 0) {
3031 struct timeval endtime;
3032
3033 endtime = timeval_current_ofs_msec(timeout_msec);
3034 if (!tevent_req_set_endtime(req, ev, endtime)) {
3035 return req;
3036 }
3037 }
3038
3039 return req;
3040 }
3041
3042 void smb2cli_req_set_notify_async(struct tevent_req *req)
3043 {
3044 struct smbXcli_req_state *state =
3045 tevent_req_data(req,
3046 struct smbXcli_req_state);
3047
3048 state->smb2.notify_async = true;
3049 }
3050
3051 static void smb2cli_req_writev_done(struct tevent_req *subreq);
3052 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3053 TALLOC_CTX *tmp_mem,
3054 uint8_t *inbuf);
3055
3056 NTSTATUS smb2cli_req_compound_submit(struct tevent_req **reqs,
3057 int num_reqs)
3058 {
3059 struct smbXcli_req_state *state;
3060 struct tevent_req *subreq;
3061 struct iovec *iov;
3062 int i, num_iov, nbt_len;
3063 int tf_iov = -1;
3064 const DATA_BLOB *encryption_key = NULL;
3065 uint64_t encryption_session_id = 0;
3066 uint64_t nonce_high = UINT64_MAX;
3067 uint64_t nonce_low = UINT64_MAX;
3068
3069 /*
3070 * 1 for the nbt length, optional TRANSFORM
3071 * per request: HDR, fixed, dyn, padding
3072 * -1 because the last one does not need padding
3073 */
3074
3075 iov = talloc_array(reqs[0], struct iovec, 1 + 1 + 4*num_reqs - 1);
3076 if (iov == NULL) {
3077 return NT_STATUS_NO_MEMORY;
3078 }
3079
3080 num_iov = 1;
3081 nbt_len = 0;
3082
3083 /*
3084 * the session of the first request that requires encryption
3085 * specifies the encryption key.
3086 */
3087 for (i=0; i<num_reqs; i++) {
3088 if (!tevent_req_is_in_progress(reqs[i])) {
3089 return NT_STATUS_INTERNAL_ERROR;
3090 }
3091
3092 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3093
3094 if (!smbXcli_conn_is_connected(state->conn)) {
3095 return NT_STATUS_CONNECTION_DISCONNECTED;
3096 }
3097
3098 if ((state->conn->protocol != PROTOCOL_NONE) &&
3099 (state->conn->protocol < PROTOCOL_SMB2_02)) {
3100 return NT_STATUS_REVISION_MISMATCH;
3101 }
3102
3103 if (state->session == NULL) {
3104 continue;
3105 }
3106
3107 if (!state->smb2.should_encrypt) {
3108 continue;
3109 }
3110
3111 encryption_key = &state->session->smb2->encryption_key;
3112 if (encryption_key->length == 0) {
3113 return NT_STATUS_INVALID_PARAMETER_MIX;
3114 }
3115
3116 encryption_session_id = state->session->smb2->session_id;
3117
3118 state->session->smb2->nonce_low += 1;
3119 if (state->session->smb2->nonce_low == 0) {
3120 state->session->smb2->nonce_high += 1;
3121 state->session->smb2->nonce_low += 1;
3122 }
3123
3124 /*
3125 * CCM and GCM algorithms must never have their
3126 * nonce wrap, or the security of the whole
3127 * communication and the keys is destroyed.
3128 * We must drop the connection once we have
3129 * transfered too much data.
3130 *
3131 * NOTE: We assume nonces greater than 8 bytes.
3132 */
3133 if (state->session->smb2->nonce_high >=
3134 state->session->smb2->nonce_high_max)
3135 {
3136 return NT_STATUS_ENCRYPTION_FAILED;
3137 }
3138
3139 nonce_high = state->session->smb2->nonce_high_random;
3140 nonce_high += state->session->smb2->nonce_high;
3141 nonce_low = state->session->smb2->nonce_low;
3142
3143 tf_iov = num_iov;
3144 iov[num_iov].iov_base = state->smb2.transform;
3145 iov[num_iov].iov_len = sizeof(state->smb2.transform);
3146 num_iov += 1;
3147
3148 SBVAL(state->smb2.transform, SMB2_TF_PROTOCOL_ID, SMB2_TF_MAGIC);
3149 SBVAL(state->smb2.transform, SMB2_TF_NONCE,
3150 nonce_low);
3151 SBVAL(state->smb2.transform, SMB2_TF_NONCE+8,
3152 nonce_high);
3153 SBVAL(state->smb2.transform, SMB2_TF_SESSION_ID,
3154 encryption_session_id);
3155
3156 nbt_len += SMB2_TF_HDR_SIZE;
3157 break;
3158 }
3159
3160 for (i=0; i<num_reqs; i++) {
3161 int hdr_iov;
3162 size_t reqlen;
3163 bool ret;
3164 uint16_t opcode;
3165 uint64_t avail;
3166 uint16_t charge;
3167 uint16_t credits;
3168 uint64_t mid;
3169 const DATA_BLOB *signing_key = NULL;
3170
3171 if (!tevent_req_is_in_progress(reqs[i])) {
3172 return NT_STATUS_INTERNAL_ERROR;
3173 }
3174
3175 state = tevent_req_data(reqs[i], struct smbXcli_req_state);
3176
3177 if (!smbXcli_conn_is_connected(state->conn)) {
3178 return NT_STATUS_CONNECTION_DISCONNECTED;
3179 }
3180
3181 if ((state->conn->protocol != PROTOCOL_NONE) &&
3182 (state->conn->protocol < PROTOCOL_SMB2_02)) {
3183 return NT_STATUS_REVISION_MISMATCH;
3184 }
3185
3186 opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3187 if (opcode == SMB2_OP_CANCEL) {
3188 goto skip_credits;
3189 }
3190
3191 avail = UINT64_MAX - state->conn->smb2.mid;
3192 if (avail < 1) {
3193 return NT_STATUS_CONNECTION_ABORTED;
3194 }
3195
3196 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3197 uint32_t max_dyn_len = 1;
3198
3199 max_dyn_len = MAX(max_dyn_len, state->smb2.dyn_len);
3200 max_dyn_len = MAX(max_dyn_len, state->smb2.max_dyn_len);
3201
3202 charge = (max_dyn_len - 1)/ 65536 + 1;
3203 } else {
3204 charge = 1;
3205 }
3206
3207 charge = MAX(state->smb2.credit_charge, charge);
3208
3209 avail = MIN(avail, state->conn->smb2.cur_credits);
3210 if (avail < charge) {
3211 return NT_STATUS_INTERNAL_ERROR;
3212 }
3213
3214 credits = 0;
3215 if (state->conn->smb2.max_credits > state->conn->smb2.cur_credits) {
3216 credits = state->conn->smb2.max_credits -
3217 state->conn->smb2.cur_credits;
3218 }
3219 if (state->conn->smb2.max_credits >= state->conn->smb2.cur_credits) {
3220 credits += 1;
3221 }
3222
3223 mid = state->conn->smb2.mid;
3224 state->conn->smb2.mid += charge;
3225 state->conn->smb2.cur_credits -= charge;
3226
3227 if (state->conn->smb2.server.capabilities & SMB2_CAP_LARGE_MTU) {
3228 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT_CHARGE, charge);
3229 }
3230 SSVAL(state->smb2.hdr, SMB2_HDR_CREDIT, credits);
3231 SBVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID, mid);
3232
3233 state->smb2.cancel_flags = 0;
3234 state->smb2.cancel_mid = mid;
3235 state->smb2.cancel_aid = 0;
3236
3237 skip_credits:
3238 if (state->session && encryption_key == NULL) {
3239 /*
3240 * We prefer the channel signing key if it is
3241 * already there.
3242 */
3243 if (state->smb2.should_sign) {
3244 signing_key = &state->session->smb2_channel.signing_key;
3245 }
3246
3247 /*
3248 * If it is a channel binding, we already have the main
3249 * signing key and try that one.
3250 */
3251 if (signing_key && signing_key->length == 0) {
3252 signing_key = &state->session->smb2->signing_key;
3253 }
3254
3255 /*
3256 * If we do not have any session key yet, we skip the
3257 * signing of SMB2_OP_SESSSETUP requests.
3258 */
3259 if (signing_key && signing_key->length == 0) {
3260 signing_key = NULL;
3261 }
3262 }
3263
3264 hdr_iov = num_iov;
3265 iov[num_iov].iov_base = state->smb2.hdr;
3266 iov[num_iov].iov_len = sizeof(state->smb2.hdr);
3267 num_iov += 1;
3268
3269 iov[num_iov].iov_base = discard_const(state->smb2.fixed);
3270 iov[num_iov].iov_len = state->smb2.fixed_len;
3271 num_iov += 1;
3272
3273 if (state->smb2.dyn != NULL) {
3274 iov[num_iov].iov_base = discard_const(state->smb2.dyn);
3275 iov[num_iov].iov_len = state->smb2.dyn_len;
3276 num_iov += 1;
3277 }
3278
3279 reqlen = sizeof(state->smb2.hdr);
3280 reqlen += state->smb2.fixed_len;
3281 reqlen += state->smb2.dyn_len;
3282
3283 if (i < num_reqs-1) {
3284 if ((reqlen % 8) > 0) {
3285 uint8_t pad = 8 - (reqlen % 8);
3286 iov[num_iov].iov_base = state->smb2.pad;
3287 iov[num_iov].iov_len = pad;
3288 num_iov += 1;
3289 reqlen += pad;
3290 }
3291 SIVAL(state->smb2.hdr, SMB2_HDR_NEXT_COMMAND, reqlen);
3292 }
3293
3294 state->smb2.encryption_session_id = encryption_session_id;
3295
3296 if (signing_key != NULL) {
3297 NTSTATUS status;
3298
3299 status = smb2_signing_sign_pdu(*signing_key,
3300 state->session->conn->protocol,
3301 &iov[hdr_iov], num_iov - hdr_iov);
3302 if (!NT_STATUS_IS_OK(status)) {
3303 return status;
3304 }
3305 }
3306
3307 nbt_len += reqlen;
3308
3309 ret = smbXcli_req_set_pending(reqs[i]);
3310 if (!ret) {
3311 return NT_STATUS_NO_MEMORY;
3312 }
3313 }
3314
3315 state = tevent_req_data(reqs[0], struct smbXcli_req_state);
3316 _smb_setlen_tcp(state->length_hdr, nbt_len);
3317 iov[0].iov_base = state->length_hdr;
3318 iov[0].iov_len = sizeof(state->length_hdr);
3319
3320 if (encryption_key != NULL) {
3321 NTSTATUS status;
3322 size_t buflen = nbt_len - SMB2_TF_HDR_SIZE;
3323 uint8_t *buf;
3324 int vi;
3325
3326 buf = talloc_array(iov, uint8_t, buflen);
3327 if (buf == NULL) {
3328 return NT_STATUS_NO_MEMORY;
3329 }
3330
3331 /*
3332 * We copy the buffers before encrypting them,
3333 * this is at least currently needed for the
3334 * to keep state->smb2.hdr.
3335 *
3336 * Also the callers may expect there buffers
3337 * to be const.
3338 */
3339 for (vi = tf_iov + 1; vi < num_iov; vi++) {
3340 struct iovec *v = &iov[vi];
3341 const uint8_t *o = (const uint8_t *)v->iov_base;
3342
3343 memcpy(buf, o, v->iov_len);
3344 v->iov_base = (void *)buf;
3345 buf += v->iov_len;
3346 }
3347
3348 status = smb2_signing_encrypt_pdu(*encryption_key,
3349 state->conn->smb2.server.cipher,
3350 &iov[tf_iov], num_iov - tf_iov);
3351 if (!NT_STATUS_IS_OK(status)) {
3352 return status;
3353 }
3354 }
3355
3356 if (state->conn->dispatch_incoming == NULL) {
3357 state->conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
3358 }
3359
3360 subreq = writev_send(state, state->ev, state->conn->outgoing,
3361 state->conn->sock_fd, false, iov, num_iov);
3362 if (subreq == NULL) {
3363 return NT_STATUS_NO_MEMORY;
3364 }
3365 tevent_req_set_callback(subreq, smb2cli_req_writev_done, reqs[0]);
3366 state->write_req = subreq;
3367
3368 return NT_STATUS_OK;
3369 }
3370
3371 void smb2cli_req_set_credit_charge(struct tevent_req *req, uint16_t charge)
3372 {
3373 struct smbXcli_req_state *state =
3374 tevent_req_data(req,
3375 struct smbXcli_req_state);
3376
3377 state->smb2.credit_charge = charge;
3378 }
3379
3380 struct tevent_req *smb2cli_req_send(TALLOC_CTX *mem_ctx,
3381 struct tevent_context *ev,
3382 struct smbXcli_conn *conn,
3383 uint16_t cmd,
3384 uint32_t additional_flags,
3385 uint32_t clear_flags,
3386 uint32_t timeout_msec,
3387 struct smbXcli_tcon *tcon,
3388 struct smbXcli_session *session,
3389 const uint8_t *fixed,
3390 uint16_t fixed_len,
3391 const uint8_t *dyn,
3392 uint32_t dyn_len,
3393 uint32_t max_dyn_len)
3394 {
3395 struct tevent_req *req;
3396 NTSTATUS status;
3397
3398 req = smb2cli_req_create(mem_ctx, ev, conn, cmd,
3399 additional_flags, clear_flags,
3400 timeout_msec,
3401 tcon, session,
3402 fixed, fixed_len,
3403 dyn, dyn_len,
3404 max_dyn_len);
3405 if (req == NULL) {
3406 return NULL;
3407 }
3408 if (!tevent_req_is_in_progress(req)) {
3409 return tevent_req_post(req, ev);
3410 }
3411 status = smb2cli_req_compound_submit(&req, 1);
3412 if (tevent_req_nterror(req, status)) {
3413 return tevent_req_post(req, ev);
3414 }
3415 return req;
3416 }
3417
3418 static void smb2cli_req_writev_done(struct tevent_req *subreq)
3419 {
3420 struct tevent_req *req =
3421 tevent_req_callback_data(subreq,
3422 struct tevent_req);
3423 struct smbXcli_req_state *state =
3424 tevent_req_data(req,
3425 struct smbXcli_req_state);
3426 ssize_t nwritten;
3427 int err;
3428
3429 state->write_req = NULL;
3430
3431 nwritten = writev_recv(subreq, &err);
3432 TALLOC_FREE(subreq);
3433 if (nwritten == -1) {
3434 /* here, we need to notify all pending requests */
3435 NTSTATUS status = map_nt_error_from_unix_common(err);
3436 smbXcli_conn_disconnect(state->conn, status);
3437 return;
3438 }
3439 }
3440
3441 static struct smbXcli_session* smbXcli_session_by_uid(struct smbXcli_conn *conn,
3442 uint64_t uid)
3443 {
3444 struct smbXcli_session *s = conn->sessions;
3445
3446 for (; s; s = s->next) {
3447 if (s->smb2->session_id != uid) {
3448 continue;
3449 }
3450 break;
3451 }
3452
3453 return s;
3454 }
3455
3456 static NTSTATUS smb2cli_inbuf_parse_compound(struct smbXcli_conn *conn,
3457 uint8_t *buf,
3458 size_t buflen,
3459 TALLOC_CTX *mem_ctx,
3460 struct iovec **piov, int *pnum_iov)
3461 {
3462 struct iovec *iov;
3463 int num_iov = 0;
3464 size_t taken = 0;
3465 uint8_t *first_hdr = buf;
3466 size_t verified_buflen = 0;
3467 uint8_t *tf = NULL;
3468 size_t tf_len = 0;
3469
3470 iov = talloc_array(mem_ctx, struct iovec, num_iov);
3471 if (iov == NULL) {
3472 return NT_STATUS_NO_MEMORY;
3473 }
3474
3475 while (taken < buflen) {
3476 size_t len = buflen - taken;
3477 uint8_t *hdr = first_hdr + taken;
3478 struct iovec *cur;
3479 size_t full_size;
3480 size_t next_command_ofs;
3481 uint16_t body_size;
3482 struct iovec *iov_tmp;
3483
3484 if (verified_buflen > taken) {
3485 len = verified_buflen - taken;
3486 } else {
3487 tf = NULL;
3488 tf_len = 0;
3489 }
3490
3491 if (len < 4) {
3492 DEBUG(10, ("%d bytes left, expected at least %d\n",
3493 (int)len, 4));
3494 goto inval;
3495 }
3496 if (IVAL(hdr, 0) == SMB2_TF_MAGIC) {
3497 struct smbXcli_session *s;
3498 uint64_t uid;
3499 struct iovec tf_iov[2];
3500 size_t enc_len;
3501 NTSTATUS status;
3502
3503 if (len < SMB2_TF_HDR_SIZE) {
3504 DEBUG(10, ("%d bytes left, expected at least %d\n",
3505 (int)len, SMB2_TF_HDR_SIZE));
3506 goto inval;
3507 }
3508 tf = hdr;
3509 tf_len = SMB2_TF_HDR_SIZE;
3510 taken += tf_len;
3511
3512 hdr = first_hdr + taken;
3513 enc_len = IVAL(tf, SMB2_TF_MSG_SIZE);
3514 uid = BVAL(tf, SMB2_TF_SESSION_ID);
3515
3516 if (len < SMB2_TF_HDR_SIZE + enc_len) {
3517 DEBUG(10, ("%d bytes left, expected at least %d\n",
3518 (int)len,
3519 (int)(SMB2_TF_HDR_SIZE + enc_len)));
3520 goto inval;
3521 }
3522
3523 s = smbXcli_session_by_uid(conn, uid);
3524 if (s == NULL) {
3525 DEBUG(10, ("unknown session_id %llu\n",
3526 (unsigned long long)uid));
3527 goto inval;
3528 }
3529
3530 tf_iov[0].iov_base = (void *)tf;
3531 tf_iov[0].iov_len = tf_len;
3532 tf_iov[1].iov_base = (void *)hdr;
3533 tf_iov[1].iov_len = enc_len;
3534
3535 status = smb2_signing_decrypt_pdu(s->smb2->decryption_key,
3536 conn->smb2.server.cipher,
3537 tf_iov, 2);
3538 if (!NT_STATUS_IS_OK(status)) {
3539 TALLOC_FREE(iov);
3540 return status;
3541 }
3542
3543 verified_buflen = taken + enc_len;
3544 len = enc_len;
3545 }
3546
3547 /*
3548 * We need the header plus the body length field
3549 */
3550
3551 if (len < SMB2_HDR_BODY + 2) {
3552 DEBUG(10, ("%d bytes left, expected at least %d\n",
3553 (int)len, SMB2_HDR_BODY));
3554 goto inval;
3555 }
3556 if (IVAL(hdr, 0) != SMB2_MAGIC) {
3557 DEBUG(10, ("Got non-SMB2 PDU: %x\n",
3558 IVAL(hdr, 0)));
3559 goto inval;
3560 }
3561 if (SVAL(hdr, 4) != SMB2_HDR_BODY) {
3562 DEBUG(10, ("Got HDR len %d, expected %d\n",
3563 SVAL(hdr, 4), SMB2_HDR_BODY));
3564 goto inval;
3565 }
3566
3567 full_size = len;
3568 next_command_ofs = IVAL(hdr, SMB2_HDR_NEXT_COMMAND);
3569 body_size = SVAL(hdr, SMB2_HDR_BODY);
3570
3571 if (next_command_ofs != 0) {
3572 if (next_command_ofs < (SMB2_HDR_BODY + 2)) {
3573 goto inval;
3574 }
3575 if (next_command_ofs > full_size) {
3576 goto inval;
3577 }
3578 full_size = next_command_ofs;
3579 }
3580 if (body_size < 2) {
3581 goto inval;
3582 }
3583 body_size &= 0xfffe;
3584
3585 if (body_size > (full_size - SMB2_HDR_BODY)) {
3586 goto inval;
3587 }
3588
3589 iov_tmp = talloc_realloc(mem_ctx, iov, struct iovec,
3590 num_iov + 4);
3591 if (iov_tmp == NULL) {
3592 TALLOC_FREE(iov);
3593 return NT_STATUS_NO_MEMORY;
3594 }
3595 iov = iov_tmp;
3596 cur = &iov[num_iov];
3597 num_iov += 4;
3598
3599 cur[0].iov_base = tf;
3600 cur[0].iov_len = tf_len;
3601 cur[1].iov_base = hdr;
3602 cur[1].iov_len = SMB2_HDR_BODY;
3603 cur[2].iov_base = hdr + SMB2_HDR_BODY;
3604 cur[2].iov_len = body_size;
3605 cur[3].iov_base = hdr + SMB2_HDR_BODY + body_size;
3606 cur[3].iov_len = full_size - (SMB2_HDR_BODY + body_size);
3607
3608 taken += full_size;
3609 }
3610
3611 *piov = iov;
3612 *pnum_iov = num_iov;
3613 return NT_STATUS_OK;
3614
3615 inval:
3616 TALLOC_FREE(iov);
3617 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3618 }
3619
3620 static struct tevent_req *smb2cli_conn_find_pending(struct smbXcli_conn *conn,
3621 uint64_t mid)
3622 {
3623 size_t num_pending = talloc_array_length(conn->pending);
3624 size_t i;
3625
3626 for (i=0; i<num_pending; i++) {
3627 struct tevent_req *req = conn->pending[i];
3628 struct smbXcli_req_state *state =
3629 tevent_req_data(req,
3630 struct smbXcli_req_state);
3631
3632 if (mid == BVAL(state->smb2.hdr, SMB2_HDR_MESSAGE_ID)) {
3633 return req;
3634 }
3635 }
3636 return NULL;
3637 }
3638
3639 static NTSTATUS smb2cli_conn_dispatch_incoming(struct smbXcli_conn *conn,
3640 TALLOC_CTX *tmp_mem,
3641 uint8_t *inbuf)
3642 {
3643 struct tevent_req *req;
3644 struct smbXcli_req_state *state = NULL;
3645 struct iovec *iov = NULL;
3646 int i, num_iov = 0;
3647 NTSTATUS status;
3648 bool defer = true;
3649 struct smbXcli_session *last_session = NULL;
3650 size_t inbuf_len = smb_len_tcp(inbuf);
3651
3652 status = smb2cli_inbuf_parse_compound(conn,
3653 inbuf + NBT_HDR_SIZE,
3654 inbuf_len,
3655 tmp_mem,
3656 &iov, &num_iov);
3657 if (!NT_STATUS_IS_OK(status)) {
3658 return status;
3659 }
3660
3661 for (i=0; i<num_iov; i+=4) {
3662 uint8_t *inbuf_ref = NULL;
3663 struct iovec *cur = &iov[i];
3664 uint8_t *inhdr = (uint8_t *)cur[1].iov_base;
3665 uint16_t opcode = SVAL(inhdr, SMB2_HDR_OPCODE);
3666 uint32_t flags = IVAL(inhdr, SMB2_HDR_FLAGS);
3667 uint64_t mid = BVAL(inhdr, SMB2_HDR_MESSAGE_ID);
3668 uint16_t req_opcode;
3669 uint32_t req_flags;
3670 uint16_t credits = SVAL(inhdr, SMB2_HDR_CREDIT);
3671 uint32_t new_credits;
3672 struct smbXcli_session *session = NULL;
3673 const DATA_BLOB *signing_key = NULL;
3674 bool was_encrypted = false;
3675
3676 new_credits = conn->smb2.cur_credits;
3677 new_credits += credits;
3678 if (new_credits > UINT16_MAX) {
3679 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3680 }
3681 conn->smb2.cur_credits += credits;
3682
3683 req = smb2cli_conn_find_pending(conn, mid);
3684 if (req == NULL) {
3685 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3686 }
3687 state = tevent_req_data(req, struct smbXcli_req_state);
3688
3689 req_opcode = SVAL(state->smb2.hdr, SMB2_HDR_OPCODE);
3690 if (opcode != req_opcode) {
3691 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3692 }
3693 req_flags = SVAL(state->smb2.hdr, SMB2_HDR_FLAGS);
3694
3695 if (!(flags & SMB2_HDR_FLAG_REDIRECT)) {
3696 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3697 }
3698
3699 status = NT_STATUS(IVAL(inhdr, SMB2_HDR_STATUS));
3700 if ((flags & SMB2_HDR_FLAG_ASYNC) &&
3701 NT_STATUS_EQUAL(status, STATUS_PENDING)) {
3702 uint64_t async_id = BVAL(inhdr, SMB2_HDR_ASYNC_ID);
3703
3704 if (state->smb2.got_async) {
3705 /* We only expect one STATUS_PENDING response */
3706 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3707 }
3708 state->smb2.got_async = true;
3709
3710 /*
3711 * async interim responses are not signed,
3712 * even if the SMB2_HDR_FLAG_SIGNED flag
3713 * is set.
3714 */
3715 state->smb2.cancel_flags = SMB2_HDR_FLAG_ASYNC;
3716 state->smb2.cancel_mid = 0;
3717 state->smb2.cancel_aid = async_id;
3718
3719 if (state->smb2.notify_async) {
3720 tevent_req_defer_callback(req, state->ev);
3721 tevent_req_notify_callback(req);
3722 }
3723 continue;
3724 }
3725
3726 session = state->session;
3727 if (req_flags & SMB2_HDR_FLAG_CHAINED) {
3728 session = last_session;
3729 }
3730 last_session = session;
3731
3732 if (state->smb2.should_sign) {
3733 if (!(flags & SMB2_HDR_FLAG_SIGNED)) {
3734 return NT_STATUS_ACCESS_DENIED;
3735 }
3736 }
3737
3738 if (flags & SMB2_HDR_FLAG_SIGNED) {
3739 uint64_t uid = BVAL(inhdr, SMB2_HDR_SESSION_ID);
3740
3741 if (session == NULL) {
3742 session = smbXcli_session_by_uid(state->conn,
3743 uid);
3744 }
3745
3746 if (session == NULL) {
3747 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3748 }
3749
3750 last_session = session;
3751 signing_key = &session->smb2_channel.signing_key;
3752 }
3753
3754 if (opcode == SMB2_OP_SESSSETUP) {
3755 /*
3756 * We prefer the channel signing key, if it is
3757 * already there.
3758 *
3759 * If we do not have a channel signing key yet,
3760 * we try the main signing key, if it is not
3761 * the final response.
3762 */
3763 if (signing_key && signing_key->length == 0 &&
3764 !NT_STATUS_IS_OK(status)) {
3765 signing_key = &session->smb2->signing_key;
3766 }
3767
3768 if (signing_key && signing_key->length == 0) {
3769 /*
3770 * If we do not have a session key to
3771 * verify the signature, we defer the
3772 * signing check to the caller.
3773 *
3774 * The caller gets NT_STATUS_OK, it
3775 * has to call
3776 * smb2cli_session_set_session_key()
3777 * or
3778 * smb2cli_session_set_channel_key()
3779 * which will check the signature
3780 * with the channel signing key.
3781 */
3782 signing_key = NULL;
3783 }
3784 }
3785
3786 if (cur[0].iov_len == SMB2_TF_HDR_SIZE) {
3787 const uint8_t *tf = (const uint8_t *)cur[0].iov_base;
3788 uint64_t uid = BVAL(tf, SMB2_TF_SESSION_ID);
3789
3790 /*
3791 * If the response was encrypted in a SMB2_TRANSFORM
3792 * pdu, which belongs to the correct session,
3793 * we do not need to do signing checks
3794 *
3795 * It could be the session the response belongs to
3796 * or the session that was used to encrypt the
3797 * SMB2_TRANSFORM request.
3798 */
3799 if ((session && session->smb2->session_id == uid) ||
3800 (state->smb2.encryption_session_id == uid)) {
3801 signing_key = NULL;
3802 was_encrypted = true;
3803 }
3804 }
3805
3806 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
3807 /*
3808 * if the server returns NT_STATUS_USER_SESSION_DELETED
3809 * the response is not signed and we should
3810 * propagate the NT_STATUS_USER_SESSION_DELETED
3811 * status to the caller.
3812 */
3813 state->smb2.signing_skipped = true;
3814 signing_key = NULL;
3815 }
3816
3817 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3818 /*
3819 * if the server returns
3820 * NT_STATUS_INVALID_PARAMETER
3821 * the response might not be encrypted.
3822 */
3823 if (state->smb2.should_encrypt && !was_encrypted) {
3824 state->smb2.signing_skipped = true;
3825 signing_key = NULL;
3826 }
3827 }
3828
3829 if (state->smb2.should_encrypt && !was_encrypted) {
3830 if (!state->smb2.signing_skipped) {
3831 return NT_STATUS_ACCESS_DENIED;
3832 }
3833 }
3834
3835 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_NAME_DELETED) ||
3836 NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED) ||
3837 NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
3838 /*
3839 * if the server returns
3840 * NT_STATUS_NETWORK_NAME_DELETED
3841 * NT_STATUS_FILE_CLOSED
3842 * NT_STATUS_INVALID_PARAMETER
3843 * the response might not be signed
3844 * as this happens before the signing checks.
3845 *
3846 * If server echos the signature (or all zeros)
3847 * we should report the status from the server
3848 * to the caller.
3849 */
3850 if (signing_key) {
3851 int cmp;
3852
3853 cmp = memcmp(inhdr+SMB2_HDR_SIGNATURE,
3854 state->smb2.hdr+SMB2_HDR_SIGNATURE,
3855 16);
3856 if (cmp == 0) {
3857 state->smb2.signing_skipped = true;
3858 signing_key = NULL;
3859 }
3860 }
3861 if (signing_key) {
3862 bool zero;
3863 zero = all_zero(inhdr+SMB2_HDR_SIGNATURE, 16);
3864 if (zero) {
3865 state->smb2.signing_skipped = true;
3866 signing_key = NULL;
3867 }
3868 }
3869 }
3870
3871 if (signing_key) {
3872 status = smb2_signing_check_pdu(*signing_key,
3873 state->conn->protocol,
3874 &cur[1], 3);
3875 if (!NT_STATUS_IS_OK(status)) {
3876 /*
3877 * If the signing check fails, we disconnect
3878 * the connection.
3879 */
3880 return status;
3881 }
3882 }
3883
3884 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED) &&
3885 (session != NULL) && session->disconnect_expired)
3886 {
3887 /*
3888 * this should be a short term hack
3889 * until the upper layers have implemented
3890 * re-authentication.
3891 */
3892 return status;
3893 }
3894
3895 smbXcli_req_unset_pending(req);
3896
3897 /*
3898 * There might be more than one response
3899 * we need to defer the notifications
3900 */
3901 if ((num_iov == 5) && (talloc_array_length(conn->pending) == 0)) {
3902 defer = false;
3903 }
3904
3905 if (defer) {
3906 tevent_req_defer_callback(req, state->ev);
3907 }
3908
3909 /*
3910 * Note: here we use talloc_reference() in a way
3911 * that does not expose it to the caller.
3912 */
3913 inbuf_ref = talloc_reference(state->smb2.recv_iov, inbuf);
3914 if (tevent_req_nomem(inbuf_ref, req)) {
3915 continue;
3916 }
3917
3918 /* copy the related buffers */
3919 state->smb2.recv_iov[0] = cur[1];
3920 state->smb2.recv_iov[1] = cur[2];
3921 state->smb2.recv_iov[2] = cur[3];
3922
3923 tevent_req_done(req);
3924 }
3925
3926 if (defer) {
3927 return NT_STATUS_RETRY;
3928 }
3929
3930 return NT_STATUS_OK;
3931 }
3932
3933 NTSTATUS smb2cli_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
3934 struct iovec **piov,
3935 const struct smb2cli_req_expected_response *expected,
3936 size_t num_expected)
3937 {
3938 struct smbXcli_req_state *state =
3939 tevent_req_data(req,
3940 struct smbXcli_req_state);
3941 NTSTATUS status;
3942 size_t body_size;
3943 bool found_status = false;
3944 bool found_size = false;
3945 size_t i;
3946
3947 if (piov != NULL) {
3948 *piov = NULL;
3949 }
3950
3951 if (tevent_req_is_in_progress(req) && state->smb2.got_async) {
3952 return STATUS_PENDING;
3953 }
3954
3955 if (tevent_req_is_nterror(req, &status)) {
3956 for (i=0; i < num_expected; i++) {
3957 if (NT_STATUS_EQUAL(status, expected[i].status)) {
3958 found_status = true;
3959 break;
3960 }
3961 }
3962
3963 if (found_status) {
3964 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
3965 }
3966
3967 return status;
3968 }
3969
3970 if (num_expected == 0) {
3971 found_status = true;
3972 found_size = true;
3973 }
3974
3975 status = NT_STATUS(IVAL(state->smb2.recv_iov[0].iov_base, SMB2_HDR_STATUS));
3976 body_size = SVAL(state->smb2.recv_iov[1].iov_base, 0);
3977
3978 for (i=0; i < num_expected; i++) {
3979 if (!NT_STATUS_EQUAL(status, expected[i].status)) {
3980 continue;
3981 }
3982
3983 found_status = true;
3984 if (expected[i].body_size == 0) {
3985 found_size = true;
3986 break;
3987 }
3988
3989 if (expected[i].body_size == body_size) {
3990 found_size = true;
3991 break;
3992 }
3993 }
3994
3995 if (!found_status) {
3996 return status;
3997 }
3998
3999 if (state->smb2.signing_skipped) {
4000 if (num_expected > 0) {
4001 return NT_STATUS_ACCESS_DENIED;
4002 }
4003 if (!NT_STATUS_IS_ERR(status)) {
4004 return NT_STATUS_ACCESS_DENIED;
4005 }
4006 }
4007
4008 if (!found_size) {
4009 return NT_STATUS_INVALID_NETWORK_RESPONSE;
4010 }
4011
4012 if (piov != NULL) {
4013 *piov = talloc_move(mem_ctx, &state->smb2.recv_iov);
4014 }
4015
4016 return status;
4017 }
4018
4019 NTSTATUS smb2cli_req_get_sent_iov(struct tevent_req *req,
4020 struct iovec *sent_iov)
4021 {
4022 struct smbXcli_req_state *state =
4023 tevent_req_data(req,
4024 struct smbXcli_req_state);
4025
4026 if (tevent_req_is_in_progress(req)) {
4027 return STATUS_PENDING;
4028 }
4029
4030 sent_iov[0].iov_base = state->smb2.hdr;
4031 sent_iov[0].iov_len = sizeof(state->smb2.hdr);
4032
4033 sent_iov[1].iov_base = discard_const(state->smb2.fixed);
4034 sent_iov[1].iov_len = state->smb2.fixed_len;
4035
4036 if (state->smb2.dyn != NULL) {
4037 sent_iov[2].iov_base = discard_const(state->smb2.dyn);
4038 sent_iov[2].iov_len = state->smb2.dyn_len;
4039 } else {
4040 sent_iov[2].iov_base = NULL;
4041 sent_iov[2].iov_len = 0;
4042 }
4043
4044 return NT_STATUS_OK;
4045 }
4046
4047 static const struct {
4048 enum protocol_types proto;
4049 const char *smb1_name;
4050 } smb1cli_prots[] = {
4051 {PROTOCOL_CORE, "PC NETWORK PROGRAM 1.0"},
4052 {PROTOCOL_COREPLUS, "MICROSOFT NETWORKS 1.03"},
4053 {PROTOCOL_LANMAN1, "MICROSOFT NETWORKS 3.0"},
4054 {PROTOCOL_LANMAN1, "LANMAN1.0"},
4055 {PROTOCOL_LANMAN2, "LM1.2X002"},
4056 {PROTOCOL_LANMAN2, "DOS LANMAN2.1"},
4057 {PROTOCOL_LANMAN2, "LANMAN2.1"},
4058 {PROTOCOL_LANMAN2, "Samba"},
4059 {PROTOCOL_NT1, "NT LANMAN 1.0"},
4060 {PROTOCOL_NT1, "NT LM 0.12"},
4061 {PROTOCOL_SMB2_02, "SMB 2.002"},
4062 {PROTOCOL_SMB2_10, "SMB 2.???"},
4063 };
4064
4065 static const struct {
4066 enum protocol_types proto;
4067 uint16_t smb2_dialect;
4068 } smb2cli_prots[] = {
4069 {PROTOCOL_SMB2_02, SMB2_DIALECT_REVISION_202},
4070 {PROTOCOL_SMB2_10, SMB2_DIALECT_REVISION_210},
4071 {PROTOCOL_SMB2_22, SMB2_DIALECT_REVISION_222},
4072 {PROTOCOL_SMB2_24, SMB2_DIALECT_REVISION_224},
4073 {PROTOCOL_SMB3_00, SMB3_DIALECT_REVISION_300},
4074 {PROTOCOL_SMB3_02, SMB3_DIALECT_REVISION_302},
4075 {PROTOCOL_SMB3_10, SMB3_DIALECT_REVISION_310},
4076 {PROTOCOL_SMB3_11, SMB3_DIALECT_REVISION_311},
4077 };
4078
4079 struct smbXcli_negprot_state {
4080 struct smbXcli_conn *conn;
4081 struct tevent_context *ev;
4082 uint32_t timeout_msec;
4083
4084 struct {
4085 uint8_t fixed[36];
4086 } smb2;
4087 };
4088
4089 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq);
4090 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state);
4091 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq);
4092 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state);
4093 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq);
4094 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
4095 TALLOC_CTX *frame,
4096 uint8_t *inbuf);
4097
4098 struct tevent_req *smbXcli_negprot_send(TALLOC_CTX *mem_ctx,
4099 struct tevent_context *ev,
4100 struct smbXcli_conn *conn,
4101 uint32_t timeout_msec,
4102 enum protocol_types min_protocol,
4103 enum protocol_types max_protocol,
4104 uint16_t max_credits)
4105 {
4106 struct tevent_req *req, *subreq;
4107 struct smbXcli_negprot_state *state;
4108
4109 req = tevent_req_create(mem_ctx, &state,
4110 struct smbXcli_negprot_state);
4111 if (req == NULL) {
4112 return NULL;
4113 }
4114 state->conn = conn;
4115 state->ev = ev;
4116 state->timeout_msec = timeout_msec;
4117
4118 if (min_protocol == PROTOCOL_NONE) {
4119 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4120 return tevent_req_post(req, ev);
4121 }
4122
4123 if (max_protocol == PROTOCOL_NONE) {
4124 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4125 return tevent_req_post(req, ev);
4126 }
4127
4128 if (min_protocol > max_protocol) {
4129 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER_MIX);
4130 return tevent_req_post(req, ev);
4131 }
4132
4133 conn->min_protocol = min_protocol;
4134 conn->max_protocol = max_protocol;
4135 conn->protocol = PROTOCOL_NONE;
4136
4137 if (max_protocol >= PROTOCOL_SMB2_02) {
4138 conn->smb2.max_credits = max_credits;
4139 }
4140
4141 if ((min_protocol < PROTOCOL_SMB2_02) &&
4142 (max_protocol < PROTOCOL_SMB2_02)) {
4143 /*
4144 * SMB1 only...
4145 */
4146 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
4147
4148 subreq = smbXcli_negprot_smb1_subreq(state);
4149 if (tevent_req_nomem(subreq, req)) {
4150 return tevent_req_post(req, ev);
4151 }
4152 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
4153 return req;
4154 }
4155
4156 if ((min_protocol >= PROTOCOL_SMB2_02) &&
4157 (max_protocol >= PROTOCOL_SMB2_02)) {
4158 /*
4159 * SMB2 only...
4160 */
4161 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
4162
4163 subreq = smbXcli_negprot_smb2_subreq(state);
4164 if (tevent_req_nomem(subreq, req)) {
4165 return tevent_req_post(req, ev);
4166 }
4167 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4168 return req;
4169 }
4170
4171 /*
4172 * We send an SMB1 negprot with the SMB2 dialects
4173 * and expect a SMB1 or a SMB2 response.
4174 *
4175 * smbXcli_negprot_dispatch_incoming() will fix the
4176 * callback to match protocol of the response.
4177 */
4178 conn->dispatch_incoming = smbXcli_negprot_dispatch_incoming;
4179
4180 subreq = smbXcli_negprot_smb1_subreq(state);
4181 if (tevent_req_nomem(subreq, req)) {
4182 return tevent_req_post(req, ev);
4183 }
4184 tevent_req_set_callback(subreq, smbXcli_negprot_invalid_done, req);
4185 return req;
4186 }
4187
4188 static void smbXcli_negprot_invalid_done(struct tevent_req *subreq)
4189 {
4190 struct tevent_req *req =
4191 tevent_req_callback_data(subreq,
4192 struct tevent_req);
4193 NTSTATUS status;
4194
4195 /*
4196 * we just want the low level error
4197 */
4198 status = tevent_req_simple_recv_ntstatus(subreq);
4199 TALLOC_FREE(subreq);
4200 if (tevent_req_nterror(req, status)) {
4201 return;
4202 }
4203
4204 /* this should never happen */
4205 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
4206 }
4207
4208 static struct tevent_req *smbXcli_negprot_smb1_subreq(struct smbXcli_negprot_state *state)
4209 {
4210 size_t i;
4211 DATA_BLOB bytes = data_blob_null;
4212 uint8_t flags;
4213 uint16_t flags2;
4214
4215 /* setup the protocol strings */
4216 for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4217 uint8_t c = 2;
4218 bool ok;
4219
4220 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4221 continue;
4222 }
4223
4224 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4225 continue;
4226 }
4227
4228 ok = data_blob_append(state, &bytes, &c, sizeof(c));
4229 if (!ok) {
4230 return NULL;
4231 }
4232
4233 /*
4234 * We now it is already ascii and
4235 * we want NULL termination.
4236 */
4237 ok = data_blob_append(state, &bytes,
4238 smb1cli_prots[i].smb1_name,
4239 strlen(smb1cli_prots[i].smb1_name)+1);
4240 if (!ok) {
4241 return NULL;
4242 }
4243 }
4244
4245 smb1cli_req_flags(state->conn->max_protocol,
4246 state->conn->smb1.client.capabilities,
4247 SMBnegprot,
4248 0, 0, &flags,
4249 0, 0, &flags2);
4250
4251 return smb1cli_req_send(state, state->ev, state->conn,
4252 SMBnegprot,
4253 flags, ~flags,
4254 flags2, ~flags2,
4255 state->timeout_msec,
4256 0xFFFE, 0, NULL, /* pid, tid, session */
4257 0, NULL, /* wct, vwv */
4258 bytes.length, bytes.data);
4259 }
4260
4261 static void smbXcli_negprot_smb1_done(struct tevent_req *subreq)
4262 {
4263 struct tevent_req *req =
4264 tevent_req_callback_data(subreq,
4265 struct tevent_req);
4266 struct smbXcli_negprot_state *state =
4267 tevent_req_data(req,
4268 struct smbXcli_negprot_state);
4269 struct smbXcli_conn *conn = state->conn;
4270 struct iovec *recv_iov = NULL;
4271 uint8_t *inhdr;
4272 uint8_t wct;
4273 uint16_t *vwv;
4274 uint32_t num_bytes;
4275 uint8_t *bytes;
4276 NTSTATUS status;
4277 uint16_t protnum;
4278 size_t i;
4279 size_t num_prots = 0;
4280 uint8_t flags;
4281 uint32_t client_capabilities = conn->smb1.client.capabilities;
4282 uint32_t both_capabilities;
4283 uint32_t server_capabilities = 0;
4284 uint32_t capabilities;
4285 uint32_t client_max_xmit = conn->smb1.client.max_xmit;
4286 uint32_t server_max_xmit = 0;
4287 uint32_t max_xmit;
4288 uint32_t server_max_mux = 0;
4289 uint16_t server_security_mode = 0;
4290 uint32_t server_session_key = 0;
4291 bool server_readbraw = false;
4292 bool server_writebraw = false;
4293 bool server_lockread = false;
4294 bool server_writeunlock = false;
4295 struct GUID server_guid = GUID_zero();
4296 DATA_BLOB server_gss_blob = data_blob_null;
4297 uint8_t server_challenge[8];
4298 char *server_workgroup = NULL;
4299 char *server_name = NULL;
4300 int server_time_zone = 0;
4301 NTTIME server_system_time = 0;
4302 static const struct smb1cli_req_expected_response expected[] = {
4303 {
4304 .status = NT_STATUS_OK,
4305 .wct = 0x11, /* NT1 */
4306 },
4307 {
4308 .status = NT_STATUS_OK,
4309 .wct = 0x0D, /* LM */
4310 },
4311 {
4312 .status = NT_STATUS_OK,
4313 .wct = 0x01, /* CORE */
4314 }
4315 };
4316
4317 ZERO_STRUCT(server_challenge);
4318
4319 status = smb1cli_req_recv(subreq, state,
4320 &recv_iov,
4321 &inhdr,
4322 &wct,
4323 &vwv,
4324 NULL, /* pvwv_offset */
4325 &num_bytes,
4326 &bytes,
4327 NULL, /* pbytes_offset */
4328 NULL, /* pinbuf */
4329 expected, ARRAY_SIZE(expected));
4330 TALLOC_FREE(subreq);
4331 if (tevent_req_nterror(req, status)) {
4332 return;
4333 }
4334
4335 flags = CVAL(inhdr, HDR_FLG);
4336
4337 protnum = SVAL(vwv, 0);
4338
4339 for (i=0; i < ARRAY_SIZE(smb1cli_prots); i++) {
4340 if (smb1cli_prots[i].proto < state->conn->min_protocol) {
4341 continue;
4342 }
4343
4344 if (smb1cli_prots[i].proto > state->conn->max_protocol) {
4345 continue;
4346 }
4347
4348 if (protnum != num_prots) {
4349 num_prots++;
4350 continue;
4351 }
4352
4353 conn->protocol = smb1cli_prots[i].proto;
4354 break;
4355 }
4356
4357 if (conn->protocol == PROTOCOL_NONE) {
4358 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4359 return;
4360 }
4361
4362 if ((conn->protocol < PROTOCOL_NT1) && conn->mandatory_signing) {
4363 DEBUG(0,("smbXcli_negprot: SMB signing is mandatory "
4364 "and the selected protocol level doesn't support it.\n"));
4365 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4366 return;
4367 }
4368
4369 if (flags & FLAG_SUPPORT_LOCKREAD) {
4370 server_lockread = true;
4371 server_writeunlock = true;
4372 }
4373
4374 if (conn->protocol >= PROTOCOL_NT1) {
4375 const char *client_signing = NULL;
4376 bool server_mandatory = false;
4377 bool server_allowed = false;
4378 const char *server_signing = NULL;
4379 bool ok;
4380 uint8_t key_len;
4381
4382 if (wct != 0x11) {
4383 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4384 return;
4385 }
4386
4387 /* NT protocol */
4388 server_security_mode = CVAL(vwv + 1, 0);
4389 server_max_mux = SVAL(vwv + 1, 1);
4390 server_max_xmit = IVAL(vwv + 3, 1);
4391 server_session_key = IVAL(vwv + 7, 1);
4392 server_time_zone = SVALS(vwv + 15, 1);
4393 server_time_zone *= 60;
4394 /* this time arrives in real GMT */
4395 server_system_time = BVAL(vwv + 11, 1);
4396 server_capabilities = IVAL(vwv + 9, 1);
4397
4398 key_len = CVAL(vwv + 16, 1);
4399
4400 if (server_capabilities & CAP_RAW_MODE) {
4401 server_readbraw = true;
4402 server_writebraw = true;
4403 }
4404 if (server_capabilities & CAP_LOCK_AND_READ) {
4405 server_lockread = true;
4406 }
4407
4408 if (server_capabilities & CAP_EXTENDED_SECURITY) {
4409 DATA_BLOB blob1, blob2;
4410
4411 if (num_bytes < 16) {
4412 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4413 return;
4414 }
4415
4416 blob1 = data_blob_const(bytes, 16);
4417 status = GUID_from_data_blob(&blob1, &server_guid);
4418 if (tevent_req_nterror(req, status)) {
4419 return;
4420 }
4421
4422 blob1 = data_blob_const(bytes+16, num_bytes-16);
4423 blob2 = data_blob_dup_talloc(state, blob1);
4424 if (blob1.length > 0 &&
4425 tevent_req_nomem(blob2.data, req)) {
4426 return;
4427 }
4428 server_gss_blob = blob2;
4429 } else {
4430 DATA_BLOB blob1, blob2;
4431
4432 if (num_bytes < key_len) {
4433 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4434 return;
4435 }
4436
4437 if (key_len != 0 && key_len != 8) {
4438 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4439 return;
4440 }
4441
4442 if (key_len == 8) {
4443 memcpy(server_challenge, bytes, 8);
4444 }
4445
4446 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4447 blob2 = data_blob_const(bytes+key_len, num_bytes-key_len);
4448 if (blob1.length > 0) {
4449 size_t len;
4450
4451 len = utf16_len_n(blob1.data,
4452 blob1.length);
4453 blob1.length = len;
4454
4455 ok = convert_string_talloc(state,
4456 CH_UTF16LE,
4457 CH_UNIX,
4458 blob1.data,
4459 blob1.length,
4460 &server_workgroup,
4461 &len);
4462 if (!ok) {
4463 status = map_nt_error_from_unix_common(errno);
4464 tevent_req_nterror(req, status);
4465 return;
4466 }
4467 }
4468
4469 blob2.data += blob1.length;
4470 blob2.length -= blob1.length;
4471 if (blob2.length > 0) {
4472 size_t len;
4473
4474 len = utf16_len_n(blob1.data,
4475 blob1.length);
4476 blob1.length = len;
4477
4478 ok = convert_string_talloc(state,
4479 CH_UTF16LE,
4480 CH_UNIX,
4481 blob2.data,
4482 blob2.length,
4483 &server_name,
4484 &len);
4485 if (!ok) {
4486 status = map_nt_error_from_unix_common(errno);
4487 tevent_req_nterror(req, status);
4488 return;
4489 }
4490 }
4491 }
4492
4493 client_signing = "disabled";
4494 if (conn->allow_signing) {
4495 client_signing = "allowed";
4496 }
4497 if (conn->mandatory_signing) {
4498 client_signing = "required";
4499 }
4500
4501 server_signing = "not supported";
4502 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_ENABLED) {
4503 server_signing = "supported";
4504 server_allowed = true;
4505 } else if (conn->mandatory_signing) {
4506 /*
4507 * We have mandatory signing as client
4508 * lets assume the server will look at our
4509 * FLAGS2_SMB_SECURITY_SIGNATURES_REQUIRED
4510 * flag in the session setup
4511 */
4512 server_signing = "not announced";
4513 server_allowed = true;
4514 }
4515 if (server_security_mode & NEGOTIATE_SECURITY_SIGNATURES_REQUIRED) {
4516 server_signing = "required";
4517 server_mandatory = true;
4518 }
4519
4520 ok = smb_signing_set_negotiated(conn->smb1.signing,
4521 server_allowed,
4522 server_mandatory);
4523 if (!ok) {
4524 DEBUG(1,("cli_negprot: SMB signing is required, "
4525 "but client[%s] and server[%s] mismatch\n",
4526 client_signing, server_signing));
4527 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
4528 return;
4529 }
4530
4531 } else if (conn->protocol >= PROTOCOL_LANMAN1) {
4532 DATA_BLOB blob1;
4533 uint8_t key_len;
4534 time_t t;
4535
4536 if (wct != 0x0D) {
4537 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4538 return;
4539 }
4540
4541 server_security_mode = SVAL(vwv + 1, 0);
4542 server_max_xmit = SVAL(vwv + 2, 0);
4543 server_max_mux = SVAL(vwv + 3, 0);
4544 server_readbraw = ((SVAL(vwv + 5, 0) & 0x1) != 0);
4545 server_writebraw = ((SVAL(vwv + 5, 0) & 0x2) != 0);
4546 server_session_key = IVAL(vwv + 6, 0);
4547 server_time_zone = SVALS(vwv + 10, 0);
4548 server_time_zone *= 60;
4549 /* this time is converted to GMT by make_unix_date */
4550 t = pull_dos_date((const uint8_t *)(vwv + 8), server_time_zone);
4551 unix_to_nt_time(&server_system_time, t);
4552 key_len = SVAL(vwv + 11, 0);
4553
4554 if (num_bytes < key_len) {
4555 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4556 return;
4557 }
4558
4559 if (key_len != 0 && key_len != 8) {
4560 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4561 return;
4562 }
4563
4564 if (key_len == 8) {
4565 memcpy(server_challenge, bytes, 8);
4566 }
4567
4568 blob1 = data_blob_const(bytes+key_len, num_bytes-key_len);
4569 if (blob1.length > 0) {
4570 size_t len;
4571 bool ok;
4572
4573 len = utf16_len_n(blob1.data,
4574 blob1.length);
4575 blob1.length = len;
4576
4577 ok = convert_string_talloc(state,
4578 CH_DOS,
4579 CH_UNIX,
4580 blob1.data,
4581 blob1.length,
4582 &server_workgroup,
4583 &len);
4584 if (!ok) {
4585 status = map_nt_error_from_unix_common(errno);
4586 tevent_req_nterror(req, status);
4587 return;
4588 }
4589 }
4590
4591 } else {
4592 /* the old core protocol */
4593 server_time_zone = get_time_zone(time(NULL));
4594 server_max_xmit = 1024;
4595 server_max_mux = 1;
4596 }
4597
4598 if (server_max_xmit < 1024) {
4599 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4600 return;
4601 }
4602
4603 if (server_max_mux < 1) {
4604 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4605 return;
4606 }
4607
4608 /*
4609 * Now calculate the negotiated capabilities
4610 * based on the mask for:
4611 * - client only flags
4612 * - flags used in both directions
4613 * - server only flags
4614 */
4615 both_capabilities = client_capabilities & server_capabilities;
4616 capabilities = client_capabilities & SMB_CAP_CLIENT_MASK;
4617 capabilities |= both_capabilities & SMB_CAP_BOTH_MASK;
4618 capabilities |= server_capabilities & SMB_CAP_SERVER_MASK;
4619
4620 max_xmit = MIN(client_max_xmit, server_max_xmit);
4621
4622 conn->smb1.server.capabilities = server_capabilities;
4623 conn->smb1.capabilities = capabilities;
4624
4625 conn->smb1.server.max_xmit = server_max_xmit;
4626 conn->smb1.max_xmit = max_xmit;
4627
4628 conn->smb1.server.max_mux = server_max_mux;
4629
4630 conn->smb1.server.security_mode = server_security_mode;
4631
4632 conn->smb1.server.readbraw = server_readbraw;
4633 conn->smb1.server.writebraw = server_writebraw;
4634 conn->smb1.server.lockread = server_lockread;
4635 conn->smb1.server.writeunlock = server_writeunlock;
4636
4637 conn->smb1.server.session_key = server_session_key;
4638
4639 talloc_steal(conn, server_gss_blob.data);
4640 conn->smb1.server.gss_blob = server_gss_blob;
4641 conn->smb1.server.guid = server_guid;
4642 memcpy(conn->smb1.server.challenge, server_challenge, 8);
4643 conn->smb1.server.workgroup = talloc_move(conn, &server_workgroup);
4644 conn->smb1.server.name = talloc_move(conn, &server_name);
4645
4646 conn->smb1.server.time_zone = server_time_zone;
4647 conn->smb1.server.system_time = server_system_time;
4648
4649 tevent_req_done(req);
4650 }
4651
4652 static size_t smbXcli_padding_helper(uint32_t offset, size_t n)
4653 {
4654 if ((offset & (n-1)) == 0) return 0;
4655 return n - (offset & (n-1));
4656 }
4657
4658 static struct tevent_req *smbXcli_negprot_smb2_subreq(struct smbXcli_negprot_state *state)
4659 {
4660 size_t i;
4661 uint8_t *buf;
4662 uint16_t dialect_count = 0;
4663 DATA_BLOB dyn = data_blob_null;
4664
4665 for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4666 bool ok;
4667 uint8_t val[2];
4668
4669 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4670 continue;
4671 }
4672
4673 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4674 continue;
4675 }
4676
4677 SSVAL(val, 0, smb2cli_prots[i].smb2_dialect);
4678
4679 ok = data_blob_append(state, &dyn, val, sizeof(val));
4680 if (!ok) {
4681 return NULL;
4682 }
4683
4684 dialect_count++;
4685 }
4686
4687 buf = state->smb2.fixed;
4688 SSVAL(buf, 0, 36);
4689 SSVAL(buf, 2, dialect_count);
4690 SSVAL(buf, 4, state->conn->smb2.client.security_mode);
4691 SSVAL(buf, 6, 0); /* Reserved */
4692 if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
4693 SIVAL(buf, 8, state->conn->smb2.client.capabilities);
4694 } else {
4695 SIVAL(buf, 8, 0); /* Capabilities */
4696 }
4697 if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
4698 NTSTATUS status;
4699 DATA_BLOB blob;
4700
4701 status = GUID_to_ndr_blob(&state->conn->smb2.client.guid,
4702 state, &blob);
4703 if (!NT_STATUS_IS_OK(status)) {
4704 return NULL;
4705 }
4706 memcpy(buf+12, blob.data, 16); /* ClientGuid */
4707 } else {
4708 memset(buf+12, 0, 16); /* ClientGuid */
4709 }
4710
4711 if (state->conn->max_protocol >= PROTOCOL_SMB3_10) {
4712 NTSTATUS status;
4713 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4714 uint32_t offset;
4715 DATA_BLOB b;
4716 uint8_t p[38];
4717 const uint8_t zeros[8] = {0, };
4718 size_t pad;
4719 bool ok;
4720
4721 SSVAL(p, 0, 1); /* HashAlgorithmCount */
4722 SSVAL(p, 2, 32); /* SaltLength */
4723 SSVAL(p, 4, SMB2_PREAUTH_INTEGRITY_SHA512);
4724 generate_random_buffer(p + 6, 32);
4725
4726 b = data_blob_const(p, 38);
4727 status = smb2_negotiate_context_add(state, &c,
4728 SMB2_PREAUTH_INTEGRITY_CAPABILITIES, b);
4729 if (!NT_STATUS_IS_OK(status)) {
4730 return NULL;
4731 }
4732
4733 SSVAL(p, 0, 2); /* ChiperCount */
4734 /*
4735 * For now we preferr CCM because our implementation
4736 * is faster than GCM, see bug #11451.
4737 */
4738 SSVAL(p, 2, SMB2_ENCRYPTION_AES128_CCM);
4739 SSVAL(p, 4, SMB2_ENCRYPTION_AES128_GCM);
4740
4741 b = data_blob_const(p, 6);
4742 status = smb2_negotiate_context_add(state, &c,
4743 SMB2_ENCRYPTION_CAPABILITIES, b);
4744 if (!NT_STATUS_IS_OK(status)) {
4745 return NULL;
4746 }
4747
4748 status = smb2_negotiate_context_push(state, &b, c);
4749 if (!NT_STATUS_IS_OK(status)) {
4750 return NULL;
4751 }
4752
4753 offset = SMB2_HDR_BODY + sizeof(state->smb2.fixed) + dyn.length;
4754 pad = smbXcli_padding_helper(offset, 8);
4755
4756 ok = data_blob_append(state, &dyn, zeros, pad);
4757 if (!ok) {
4758 return NULL;
4759 }
4760 offset += pad;
4761
4762 ok = data_blob_append(state, &dyn, b.data, b.length);
4763 if (!ok) {
4764 return NULL;
4765 }
4766
4767 SIVAL(buf, 28, offset); /* NegotiateContextOffset */
4768 SSVAL(buf, 32, c.num_contexts); /* NegotiateContextCount */
4769 SSVAL(buf, 34, 0); /* Reserved */
4770 } else {
4771 SBVAL(buf, 28, 0); /* Reserved/ClientStartTime */
4772 }
4773
4774 return smb2cli_req_send(state, state->ev,
4775 state->conn, SMB2_OP_NEGPROT,
4776 0, 0, /* flags */
4777 state->timeout_msec,
4778 NULL, NULL, /* tcon, session */
4779 state->smb2.fixed, sizeof(state->smb2.fixed),
4780 dyn.data, dyn.length,
4781 UINT16_MAX); /* max_dyn_len */
4782 }
4783
4784 static void smbXcli_negprot_smb2_done(struct tevent_req *subreq)
4785 {
4786 struct tevent_req *req =
4787 tevent_req_callback_data(subreq,
4788 struct tevent_req);
4789 struct smbXcli_negprot_state *state =
4790 tevent_req_data(req,
4791 struct smbXcli_negprot_state);
4792 struct smbXcli_conn *conn = state->conn;
4793 size_t security_offset, security_length;
4794 DATA_BLOB blob;
4795 NTSTATUS status;
4796 struct iovec *iov;
4797 uint8_t *body;
4798 size_t i;
4799 uint16_t dialect_revision;
4800 struct smb2_negotiate_contexts c = { .num_contexts = 0, };
4801 uint32_t negotiate_context_offset = 0;
4802 uint16_t negotiate_context_count = 0;
4803 DATA_BLOB negotiate_context_blob = data_blob_null;
4804 size_t avail;
4805 size_t ctx_ofs;
4806 size_t needed;
4807 struct smb2_negotiate_context *preauth = NULL;
4808 uint16_t hash_count;
4809 uint16_t salt_length;
4810 uint16_t hash_selected;
4811 struct hc_sha512state sctx;
4812 struct smb2_negotiate_context *cipher = NULL;
4813 struct iovec sent_iov[3];
4814 static const struct smb2cli_req_expected_response expected[] = {
4815 {
4816 .status = NT_STATUS_OK,
4817 .body_size = 0x41
4818 }
4819 };
4820
4821 status = smb2cli_req_recv(subreq, state, &iov,
4822 expected, ARRAY_SIZE(expected));
4823 if (tevent_req_nterror(req, status)) {
4824 return;
4825 }
4826
4827 body = (uint8_t *)iov[1].iov_base;
4828
4829 dialect_revision = SVAL(body, 4);
4830
4831 for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
4832 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
4833 continue;
4834 }
4835
4836 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
4837 continue;
4838 }
4839
4840 if (smb2cli_prots[i].smb2_dialect != dialect_revision) {
4841 continue;
4842 }
4843
4844 conn->protocol = smb2cli_prots[i].proto;
4845 break;
4846 }
4847
4848 if (conn->protocol == PROTOCOL_NONE) {
4849 TALLOC_FREE(subreq);
4850
4851 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
4852 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4853 return;
4854 }
4855
4856 if (dialect_revision != SMB2_DIALECT_REVISION_2FF) {
4857 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4858 return;
4859 }
4860
4861 /* make sure we do not loop forever */
4862 state->conn->min_protocol = PROTOCOL_SMB2_02;
4863
4864 /*
4865 * send a SMB2 negprot, in order to negotiate
4866 * the SMB2 dialect.
4867 */
4868 subreq = smbXcli_negprot_smb2_subreq(state);
4869 if (tevent_req_nomem(subreq, req)) {
4870 return;
4871 }
4872 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
4873 return;
4874 }
4875
4876 conn->smb2.server.security_mode = SVAL(body, 2);
4877 if (conn->protocol >= PROTOCOL_SMB3_10) {
4878 negotiate_context_count = SVAL(body, 6);
4879 }
4880
4881 blob = data_blob_const(body + 8, 16);
4882 status = GUID_from_data_blob(&blob, &conn->smb2.server.guid);
4883 if (tevent_req_nterror(req, status)) {
4884 return;
4885 }
4886
4887 conn->smb2.server.capabilities = IVAL(body, 24);
4888 conn->smb2.server.max_trans_size= IVAL(body, 28);
4889 conn->smb2.server.max_read_size = IVAL(body, 32);
4890 conn->smb2.server.max_write_size= IVAL(body, 36);
4891 conn->smb2.server.system_time = BVAL(body, 40);
4892 conn->smb2.server.start_time = BVAL(body, 48);
4893
4894 security_offset = SVAL(body, 56);
4895 security_length = SVAL(body, 58);
4896
4897 if (security_offset != SMB2_HDR_BODY + iov[1].iov_len) {
4898 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4899 return;
4900 }
4901
4902 if (security_length > iov[2].iov_len) {
4903 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4904 return;
4905 }
4906
4907 conn->smb2.server.gss_blob = data_blob_talloc(conn,
4908 iov[2].iov_base,
4909 security_length);
4910 if (tevent_req_nomem(conn->smb2.server.gss_blob.data, req)) {
4911 return;
4912 }
4913
4914 if (conn->protocol < PROTOCOL_SMB3_10) {
4915 TALLOC_FREE(subreq);
4916
4917 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4918 conn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
4919 }
4920 tevent_req_done(req);
4921 return;
4922 }
4923
4924 /*
4925 * Here we are now at SMB3_11, so encryption should be
4926 * negotiated via context, not capabilities.
4927 */
4928
4929 if (conn->smb2.server.capabilities & SMB2_CAP_ENCRYPTION) {
4930 /*
4931 * Server set SMB2_CAP_ENCRYPTION capability,
4932 * but *SHOULD* not, not *MUST* not. Just mask it off.
4933 * NetApp seems to do this:
4934 * BUG: https://bugzilla.samba.org/show_bug.cgi?id=13009
4935 */
4936 conn->smb2.server.capabilities &= ~SMB2_CAP_ENCRYPTION;
4937 }
4938
4939 negotiate_context_offset = IVAL(body, 60);
4940 if (negotiate_context_offset < security_offset) {
4941 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4942 return;
4943 }
4944
4945 ctx_ofs = negotiate_context_offset - security_offset;
4946 if (ctx_ofs > iov[2].iov_len) {
4947 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4948 return;
4949 }
4950 avail = iov[2].iov_len - security_length;
4951 needed = iov[2].iov_len - ctx_ofs;
4952 if (needed > avail) {
4953 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4954 return;
4955 }
4956
4957 negotiate_context_blob.data = (uint8_t *)iov[2].iov_base;
4958 negotiate_context_blob.length = iov[2].iov_len;
4959
4960 negotiate_context_blob.data += ctx_ofs;
4961 negotiate_context_blob.length -= ctx_ofs;
4962
4963 status = smb2_negotiate_context_parse(state, negotiate_context_blob, &c);
4964 if (tevent_req_nterror(req, status)) {
4965 return;
4966 }
4967
4968 if (negotiate_context_count != c.num_contexts) {
4969 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4970 return;
4971 }
4972
4973 preauth = smb2_negotiate_context_find(&c,
4974 SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
4975 if (preauth == NULL) {
4976 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4977 return;
4978 }
4979
4980 if (preauth->data.length < 6) {
4981 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4982 return;
4983 }
4984
4985 hash_count = SVAL(preauth->data.data, 0);
4986 salt_length = SVAL(preauth->data.data, 2);
4987 hash_selected = SVAL(preauth->data.data, 4);
4988
4989 if (hash_count != 1) {
4990 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4991 return;
4992 }
4993
4994 if (preauth->data.length != (6 + salt_length)) {
4995 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
4996 return;
4997 }
4998
4999 if (hash_selected != SMB2_PREAUTH_INTEGRITY_SHA512) {
5000 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5001 return;
5002 }
5003
5004 cipher = smb2_negotiate_context_find(&c, SMB2_ENCRYPTION_CAPABILITIES);
5005 if (cipher != NULL) {
5006 uint16_t cipher_count;
5007
5008 if (cipher->data.length < 2) {
5009 tevent_req_nterror(req,
5010 NT_STATUS_INVALID_NETWORK_RESPONSE);
5011 return;
5012 }
5013
5014 cipher_count = SVAL(cipher->data.data, 0);
5015
5016 if (cipher_count > 1) {
5017 tevent_req_nterror(req,
5018 NT_STATUS_INVALID_NETWORK_RESPONSE);
5019 return;
5020 }
5021
5022 if (cipher->data.length != (2 + 2 * cipher_count)) {
5023 tevent_req_nterror(req,
5024 NT_STATUS_INVALID_NETWORK_RESPONSE);
5025 return;
5026 }
5027
5028 if (cipher_count == 1) {
5029 uint16_t cipher_selected;
5030
5031 cipher_selected = SVAL(cipher->data.data, 2);
5032
5033 switch (cipher_selected) {
5034 case SMB2_ENCRYPTION_AES128_GCM:
5035 case SMB2_ENCRYPTION_AES128_CCM:
5036 conn->smb2.server.cipher = cipher_selected;
5037 break;
5038 }
5039 }
5040 }
5041
5042 /* First we hash the request */
5043 smb2cli_req_get_sent_iov(subreq, sent_iov);
5044 samba_SHA512_Init(&sctx);
5045 samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
5046 sizeof(conn->smb2.preauth_sha512));
5047 for (i = 0; i < 3; i++) {
5048 samba_SHA512_Update(&sctx, sent_iov[i].iov_base, sent_iov[i].iov_len);
5049 }
5050 samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
5051 TALLOC_FREE(subreq);
5052
5053 /* And now we hash the response */
5054 samba_SHA512_Init(&sctx);
5055 samba_SHA512_Update(&sctx, conn->smb2.preauth_sha512,
5056 sizeof(conn->smb2.preauth_sha512));
5057 for (i = 0; i < 3; i++) {
5058 samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
5059 }
5060 samba_SHA512_Final(conn->smb2.preauth_sha512, &sctx);
5061
5062 tevent_req_done(req);
5063 }
5064
5065 static NTSTATUS smbXcli_negprot_dispatch_incoming(struct smbXcli_conn *conn,
5066 TALLOC_CTX *tmp_mem,
5067 uint8_t *inbuf)
5068 {
5069 size_t num_pending = talloc_array_length(conn->pending);
5070 struct tevent_req *subreq;
5071 struct smbXcli_req_state *substate;
5072 struct tevent_req *req;
5073 uint32_t protocol_magic;
5074 size_t inbuf_len = smb_len_nbt(inbuf);
5075
5076 if (num_pending != 1) {
5077 return NT_STATUS_INTERNAL_ERROR;
5078 }
5079
5080 if (inbuf_len < 4) {
5081 return NT_STATUS_INVALID_NETWORK_RESPONSE;
5082 }
5083
5084 subreq = conn->pending[0];
5085 substate = tevent_req_data(subreq, struct smbXcli_req_state);
5086 req = tevent_req_callback_data(subreq, struct tevent_req);
5087
5088 protocol_magic = IVAL(inbuf, 4);
5089
5090 switch (protocol_magic) {
5091 case SMB_MAGIC:
5092 tevent_req_set_callback(subreq, smbXcli_negprot_smb1_done, req);
5093 conn->dispatch_incoming = smb1cli_conn_dispatch_incoming;
5094 return smb1cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5095
5096 case SMB2_MAGIC:
5097 if (substate->smb2.recv_iov == NULL) {
5098 /*
5099 * For the SMB1 negprot we have move it.
5100 */
5101 substate->smb2.recv_iov = substate->smb1.recv_iov;
5102 substate->smb1.recv_iov = NULL;
5103 }
5104
5105 /*
5106 * we got an SMB2 answer, which consumed sequence number 0
5107 * so we need to use 1 as the next one.
5108 *
5109 * we also need to set the current credits to 0
5110 * as we consumed the initial one. The SMB2 answer
5111 * hopefully grant us a new credit.
5112 */
5113 conn->smb2.mid = 1;
5114 conn->smb2.cur_credits = 0;
5115 tevent_req_set_callback(subreq, smbXcli_negprot_smb2_done, req);
5116 conn->dispatch_incoming = smb2cli_conn_dispatch_incoming;
5117 return smb2cli_conn_dispatch_incoming(conn, tmp_mem, inbuf);
5118 }
5119
5120 DEBUG(10, ("Got non-SMB PDU\n"));
5121 return NT_STATUS_INVALID_NETWORK_RESPONSE;
5122 }
5123
5124 NTSTATUS smbXcli_negprot_recv(struct tevent_req *req)
5125 {
5126 return tevent_req_simple_recv_ntstatus(req);
5127 }
5128
5129 NTSTATUS smbXcli_negprot(struct smbXcli_conn *conn,
5130 uint32_t timeout_msec,
5131 enum protocol_types min_protocol,
5132 enum protocol_types max_protocol)
5133 {
5134 TALLOC_CTX *frame = talloc_stackframe();
5135 struct tevent_context *ev;
5136 struct tevent_req *req;
5137 NTSTATUS status = NT_STATUS_NO_MEMORY;
5138 bool ok;
5139
5140 if (smbXcli_conn_has_async_calls(conn)) {
5141 /*
5142 * Can't use sync call while an async call is in flight
5143 */
5144 status = NT_STATUS_INVALID_PARAMETER_MIX;
5145 goto fail;
5146 }
5147 ev = samba_tevent_context_init(frame);
5148 if (ev == NULL) {
5149 goto fail;
5150 }
5151 req = smbXcli_negprot_send(frame, ev, conn, timeout_msec,
5152 min_protocol, max_protocol,
5153 WINDOWS_CLIENT_PURE_SMB2_NEGPROT_INITIAL_CREDIT_ASK);
5154 if (req == NULL) {
5155 goto fail;
5156 }
5157 ok = tevent_req_poll_ntstatus(req, ev, &status);
5158 if (!ok) {
5159 goto fail;
5160 }
5161 status = smbXcli_negprot_recv(req);
5162 fail:
5163 TALLOC_FREE(frame);
5164 return status;
5165 }
5166
5167 struct smb2cli_validate_negotiate_info_state {
5168 struct smbXcli_conn *conn;
5169 DATA_BLOB in_input_buffer;
5170 DATA_BLOB in_output_buffer;
5171 DATA_BLOB out_input_buffer;
5172 DATA_BLOB out_output_buffer;
5173 uint16_t dialect;
5174 };
5175
5176 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq);
5177
5178 struct tevent_req *smb2cli_validate_negotiate_info_send(TALLOC_CTX *mem_ctx,
5179 struct tevent_context *ev,
5180 struct smbXcli_conn *conn,
5181 uint32_t timeout_msec,
5182 struct smbXcli_session *session,
5183 struct smbXcli_tcon *tcon)
5184 {
5185 struct tevent_req *req;
5186 struct smb2cli_validate_negotiate_info_state *state;
5187 uint8_t *buf;
5188 uint16_t dialect_count = 0;
5189 struct tevent_req *subreq;
5190 bool _save_should_sign;
5191 size_t i;
5192
5193 req = tevent_req_create(mem_ctx, &state,
5194 struct smb2cli_validate_negotiate_info_state);
5195 if (req == NULL) {
5196 return NULL;
5197 }
5198 state->conn = conn;
5199
5200 state->in_input_buffer = data_blob_talloc_zero(state,
5201 4 + 16 + 1 + 1 + 2);
5202 if (tevent_req_nomem(state->in_input_buffer.data, req)) {
5203 return tevent_req_post(req, ev);
5204 }
5205 buf = state->in_input_buffer.data;
5206
5207 if (state->conn->max_protocol >= PROTOCOL_SMB2_22) {
5208 SIVAL(buf, 0, conn->smb2.client.capabilities);
5209 } else {
5210 SIVAL(buf, 0, 0); /* Capabilities */
5211 }
5212 if (state->conn->max_protocol >= PROTOCOL_SMB2_10) {
5213 NTSTATUS status;
5214 DATA_BLOB blob;
5215
5216 status = GUID_to_ndr_blob(&conn->smb2.client.guid,
5217 state, &blob);
5218 if (!NT_STATUS_IS_OK(status)) {
5219 return NULL;
5220 }
5221 memcpy(buf+4, blob.data, 16); /* ClientGuid */
5222 } else {
5223 memset(buf+4, 0, 16); /* ClientGuid */
5224 }
5225 if (state->conn->min_protocol >= PROTOCOL_SMB2_02) {
5226 SCVAL(buf, 20, conn->smb2.client.security_mode);
5227 } else {
5228 SCVAL(buf, 20, 0);
5229 }
5230 SCVAL(buf, 21, 0); /* reserved */
5231
5232 for (i=0; i < ARRAY_SIZE(smb2cli_prots); i++) {
5233 bool ok;
5234 size_t ofs;
5235
5236 if (smb2cli_prots[i].proto < state->conn->min_protocol) {
5237 continue;
5238 }
5239
5240 if (smb2cli_prots[i].proto > state->conn->max_protocol) {
5241 continue;
5242 }
5243
5244 if (smb2cli_prots[i].proto == state->conn->protocol) {
5245 state->dialect = smb2cli_prots[i].smb2_dialect;
5246 }
5247
5248 ofs = state->in_input_buffer.length;
5249 ok = data_blob_realloc(state, &state->in_input_buffer,
5250 ofs + 2);
5251 if (!ok) {
5252 tevent_req_oom(req);
5253 return tevent_req_post(req, ev);
5254 }
5255
5256 buf = state->in_input_buffer.data;
5257 SSVAL(buf, ofs, smb2cli_prots[i].smb2_dialect);
5258
5259 dialect_count++;
5260 }
5261 buf = state->in_input_buffer.data;
5262 SSVAL(buf, 22, dialect_count);
5263
5264 _save_should_sign = smb2cli_tcon_is_signing_on(tcon);
5265 smb2cli_tcon_should_sign(tcon, true);
5266 subreq = smb2cli_ioctl_send(state, ev, conn,
5267 timeout_msec, session, tcon,
5268 UINT64_MAX, /* in_fid_persistent */
5269 UINT64_MAX, /* in_fid_volatile */
5270 FSCTL_VALIDATE_NEGOTIATE_INFO,
5271 0, /* in_max_input_length */
5272 &state->in_input_buffer,
5273 24, /* in_max_output_length */
5274 &state->in_output_buffer,
5275 SMB2_IOCTL_FLAG_IS_FSCTL);
5276 smb2cli_tcon_should_sign(tcon, _save_should_sign);
5277 if (tevent_req_nomem(subreq, req)) {
5278 return tevent_req_post(req, ev);
5279 }
5280 tevent_req_set_callback(subreq,
5281 smb2cli_validate_negotiate_info_done,
5282 req);
5283
5284 return req;
5285 }
5286
5287 static void smb2cli_validate_negotiate_info_done(struct tevent_req *subreq)
5288 {
5289 struct tevent_req *req =
5290 tevent_req_callback_data(subreq,
5291 struct tevent_req);
5292 struct smb2cli_validate_negotiate_info_state *state =
5293 tevent_req_data(req,
5294 struct smb2cli_validate_negotiate_info_state);
5295 NTSTATUS status;
5296 const uint8_t *buf;
5297 uint32_t capabilities;
5298 DATA_BLOB guid_blob;
5299 struct GUID server_guid;
5300 uint16_t security_mode;
5301 uint16_t dialect;
5302
5303 status = smb2cli_ioctl_recv(subreq, state,
5304 &state->out_input_buffer,
5305 &state->out_output_buffer);
5306 TALLOC_FREE(subreq);
5307 if (NT_STATUS_EQUAL(status, NT_STATUS_FILE_CLOSED)) {
5308 /*
5309 * The response was signed, but not supported
5310 *
5311 * Older Windows and Samba releases return
5312 * NT_STATUS_FILE_CLOSED.
5313 */
5314 tevent_req_done(req);
5315 return;
5316 }
5317 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_DEVICE_REQUEST)) {
5318 /*
5319 * The response was signed, but not supported
5320 *
5321 * This is returned by the NTVFS based Samba 4.x file server
5322 * for file shares.
5323 */
5324 tevent_req_done(req);
5325 return;
5326 }
5327 if (NT_STATUS_EQUAL(status, NT_STATUS_FS_DRIVER_REQUIRED)) {
5328 /*
5329 * The response was signed, but not supported
5330 *
5331 * This is returned by the NTVFS based Samba 4.x file server
5332 * for ipc shares.
5333 */
5334 tevent_req_done(req);
5335 return;
5336 }
5337 if (NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED)) {
5338 /*
5339 * The response was signed, but not supported
5340 *
5341 * This might be returned by older Windows versions or by
5342 * NetApp SMB server implementations.
5343 *
5344 * See
5345 *
5346 * https://blogs.msdn.microsoft.com/openspecification/2012/06/28/smb3-secure-dialect-negotiation/
5347 *
5348 */
5349 tevent_req_done(req);
5350 return;
5351 }
5352 if (tevent_req_nterror(req, status)) {
5353 return;
5354 }
5355
5356 if (state->out_output_buffer.length != 24) {
5357 tevent_req_nterror(req, NT_STATUS_INVALID_NETWORK_RESPONSE);
5358 return;
5359 }
5360
5361 buf = state->out_output_buffer.data;
5362
5363 capabilities = IVAL(buf, 0);
5364 guid_blob = data_blob_const(buf + 4, 16);
5365 status = GUID_from_data_blob(&guid_blob, &server_guid);
5366 if (tevent_req_nterror(req, status)) {
5367 return;
5368 }
5369 security_mode = CVAL(buf, 20);
5370 dialect = SVAL(buf, 22);
5371
5372 if (capabilities != state->conn->smb2.server.capabilities) {
5373 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5374 return;
5375 }
5376
5377 if (!GUID_equal(&server_guid, &state->conn->smb2.server.guid)) {
5378 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5379 return;
5380 }
5381
5382 if (security_mode != state->conn->smb2.server.security_mode) {
5383 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5384 return;
5385 }
5386
5387 if (dialect != state->dialect) {
5388 tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
5389 return;
5390 }
5391
5392 tevent_req_done(req);
5393 }
5394
5395 NTSTATUS smb2cli_validate_negotiate_info_recv(struct tevent_req *req)
5396 {
5397 return tevent_req_simple_recv_ntstatus(req);
5398 }
5399
5400 static int smbXcli_session_destructor(struct smbXcli_session *session)
5401 {
5402 if (session->conn == NULL) {
5403 return 0;
5404 }
5405
5406 DLIST_REMOVE(session->conn->sessions, session);
5407 return 0;
5408 }
5409
5410 struct smbXcli_session *smbXcli_session_create(TALLOC_CTX *mem_ctx,
5411 struct smbXcli_conn *conn)
5412 {
5413 struct smbXcli_session *session;
5414
5415 session = talloc_zero(mem_ctx, struct smbXcli_session);
5416 if (session == NULL) {
5417 return NULL;
5418 }
5419 session->smb2 = talloc_zero(session, struct smb2cli_session);
5420 if (session->smb2 == NULL) {
5421 talloc_free(session);
5422 return NULL;
5423 }
5424 talloc_set_destructor(session, smbXcli_session_destructor);
5425
5426 DLIST_ADD_END(conn->sessions, session);
5427 session->conn = conn;
5428
5429 memcpy(session->smb2_channel.preauth_sha512,
5430 conn->smb2.preauth_sha512,
5431 sizeof(session->smb2_channel.preauth_sha512));
5432
5433 return session;
5434 }
5435
5436 struct smbXcli_session *smbXcli_session_copy(TALLOC_CTX *mem_ctx,
5437 struct smbXcli_session *src)
5438 {
5439 struct smbXcli_session *session;
5440
5441 session = talloc_zero(mem_ctx, struct smbXcli_session);
5442 if (session == NULL) {
5443 return NULL;
5444 }
5445 session->smb2 = talloc_zero(session, struct smb2cli_session);
5446 if (session->smb2 == NULL) {
5447 talloc_free(session);
5448 return NULL;
5449 }
5450
5451 session->conn = src->conn;
5452 *session->smb2 = *src->smb2;
5453 session->smb2_channel = src->smb2_channel;
5454 session->disconnect_expired = src->disconnect_expired;
5455
5456 DLIST_ADD_END(src->conn->sessions, session);
5457 talloc_set_destructor(session, smbXcli_session_destructor);
5458
5459 return session;
5460 }
5461
5462 bool smbXcli_session_is_guest(struct smbXcli_session *session)
5463 {
5464 if (session == NULL) {
5465 return false;
5466 }
5467
5468 if (session->conn == NULL) {
5469 return false;
5470 }
5471
5472 if (session->conn->mandatory_signing) {
5473 return false;
5474 }
5475
5476 if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5477 if (session->smb2->session_flags & SMB2_SESSION_FLAG_IS_GUEST) {
5478 return true;
5479 }
5480 return false;
5481 }
5482
5483 if (session->smb1.action & SMB_SETUP_GUEST) {
5484 return true;
5485 }
5486
5487 return false;
5488 }
5489
5490 bool smbXcli_session_is_authenticated(struct smbXcli_session *session)
5491 {
5492 const DATA_BLOB *application_key;
5493
5494 if (session == NULL) {
5495 return false;
5496 }
5497
5498 if (session->conn == NULL) {
5499 return false;
5500 }
5501
5502 /*
5503 * If we have an application key we had a session key negotiated
5504 * at auth time.
5505 */
5506 if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5507 application_key = &session->smb2->application_key;
5508 } else {
5509 application_key = &session->smb1.application_key;
5510 }
5511
5512 if (application_key->length == 0) {
5513 return false;
5514 }
5515
5516 return true;
5517 }
5518
5519 NTSTATUS smbXcli_session_application_key(struct smbXcli_session *session,
5520 TALLOC_CTX *mem_ctx,
5521 DATA_BLOB *key)
5522 {
5523 const DATA_BLOB *application_key;
5524
5525 *key = data_blob_null;
5526
5527 if (session->conn == NULL) {
5528 return NT_STATUS_NO_USER_SESSION_KEY;
5529 }
5530
5531 if (session->conn->protocol >= PROTOCOL_SMB2_02) {
5532 application_key = &session->smb2->application_key;
5533 } else {
5534 application_key = &session->smb1.application_key;
5535 }
5536
5537 if (application_key->length == 0) {
5538 return NT_STATUS_NO_USER_SESSION_KEY;
5539 }
5540
5541 *key = data_blob_dup_talloc(mem_ctx, *application_key);
5542 if (key->data == NULL) {
5543 return NT_STATUS_NO_MEMORY;
5544 }
5545
5546 return NT_STATUS_OK;
5547 }
5548
5549 void smbXcli_session_set_disconnect_expired(struct smbXcli_session *session)
5550 {
5551 session->disconnect_expired = true;
5552 }
5553
5554 uint16_t smb1cli_session_current_id(struct smbXcli_session *session)
5555 {
5556 return session->smb1.session_id;
5557 }
5558
5559 void smb1cli_session_set_id(struct smbXcli_session *session,
5560 uint16_t session_id)
5561 {
5562 session->smb1.session_id = session_id;
5563 }
5564
5565 void smb1cli_session_set_action(struct smbXcli_session *session,
5566 uint16_t action)
5567 {
5568 session->smb1.action = action;
5569 }
5570
5571 NTSTATUS smb1cli_session_set_session_key(struct smbXcli_session *session,
5572 const DATA_BLOB _session_key)
5573 {
5574 struct smbXcli_conn *conn = session->conn;
5575 uint8_t session_key[16];
5576
5577 if (conn == NULL) {
5578 return NT_STATUS_INVALID_PARAMETER_MIX;
5579 }
5580
5581 if (session->smb1.application_key.length != 0) {
5582 /*
5583 * TODO: do not allow this...
5584 *
5585 * return NT_STATUS_INVALID_PARAMETER_MIX;
5586 */
5587 data_blob_clear_free(&session->smb1.application_key);
5588 session->smb1.protected_key = false;
5589 }
5590
5591 if (_session_key.length == 0) {
5592 return NT_STATUS_OK;
5593 }
5594
5595 ZERO_STRUCT(session_key);
5596 memcpy(session_key, _session_key.data,
5597 MIN(_session_key.length, sizeof(session_key)));
5598
5599 session->smb1.application_key = data_blob_talloc(session,
5600 session_key,
5601 sizeof(session_key));
5602 ZERO_STRUCT(session_key);
5603 if (session->smb1.application_key.data == NULL) {
5604 return NT_STATUS_NO_MEMORY;
5605 }
5606
5607 session->smb1.protected_key = false;
5608
5609 return NT_STATUS_OK;
5610 }
5611
5612 NTSTATUS smb1cli_session_protect_session_key(struct smbXcli_session *session)
5613 {
5614 if (session->smb1.protected_key) {
5615 /* already protected */
5616 return NT_STATUS_OK;
5617 }
5618
5619 if (session->smb1.application_key.length != 16) {
5620 return NT_STATUS_INVALID_PARAMETER_MIX;
5621 }
5622
5623 smb_key_derivation(session->smb1.application_key.data,
5624 session->smb1.application_key.length,
5625 session->smb1.application_key.data);
5626
5627 session->smb1.protected_key = true;
5628
5629 return NT_STATUS_OK;
5630 }
5631
5632 uint8_t smb2cli_session_security_mode(struct smbXcli_session *session)
5633 {
5634 struct smbXcli_conn *conn = session->conn;
5635 uint8_t security_mode = 0;
5636
5637 if (conn == NULL) {
5638 return security_mode;
5639 }
5640
5641 security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
5642 if (conn->mandatory_signing) {
5643 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
5644 }
5645 if (session->smb2->should_sign) {
5646 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
5647 }
5648
5649 return security_mode;
5650 }
5651
5652 uint64_t smb2cli_session_current_id(struct smbXcli_session *session)
5653 {
5654 return session->smb2->session_id;
5655 }
5656
5657 uint16_t smb2cli_session_get_flags(struct smbXcli_session *session)
5658 {
5659 return session->smb2->session_flags;
5660 }
5661
5662 void smb2cli_session_set_id_and_flags(struct smbXcli_session *session,
5663 uint64_t session_id,
5664 uint16_t session_flags)
5665 {
5666 session->smb2->session_id = session_id;
5667 session->smb2->session_flags = session_flags;
5668 }
5669
5670 void smb2cli_session_increment_channel_sequence(struct smbXcli_session *session)
5671 {
5672 session->smb2->channel_sequence += 1;
5673 }
5674
5675 uint16_t smb2cli_session_reset_channel_sequence(struct smbXcli_session *session,
5676 uint16_t channel_sequence)
5677 {
5678 uint16_t prev_cs;
5679
5680 prev_cs = session->smb2->channel_sequence;
5681 session->smb2->channel_sequence = channel_sequence;
5682
5683 return prev_cs;
5684 }
5685
5686 uint16_t smb2cli_session_current_channel_sequence(struct smbXcli_session *session)
5687 {
5688 return session->smb2->channel_sequence;
5689 }
5690
5691 void smb2cli_session_start_replay(struct smbXcli_session *session)
5692 {
5693 session->smb2->replay_active = true;
5694 }
5695
5696 void smb2cli_session_stop_replay(struct smbXcli_session *session)
5697 {
5698 session->smb2->replay_active = false;
5699 }
5700
5701 NTSTATUS smb2cli_session_update_preauth(struct smbXcli_session *session,
5702 const struct iovec *iov)
5703 {
5704 struct hc_sha512state sctx;
5705 size_t i;
5706
5707 if (session->conn == NULL) {
5708 return NT_STATUS_INTERNAL_ERROR;
5709 }
5710
5711 if (session->conn->protocol < PROTOCOL_SMB3_10) {
5712 return NT_STATUS_OK;
5713 }
5714
5715 if (session->smb2_channel.signing_key.length != 0) {
5716 return NT_STATUS_OK;
5717 }
5718
5719 samba_SHA512_Init(&sctx);
5720 samba_SHA512_Update(&sctx, session->smb2_channel.preauth_sha512,
5721 sizeof(session->smb2_channel.preauth_sha512));
5722 for (i = 0; i < 3; i++) {
5723 samba_SHA512_Update(&sctx, iov[i].iov_base, iov[i].iov_len);
5724 }
5725 samba_SHA512_Final(session->smb2_channel.preauth_sha512, &sctx);
5726
5727 return NT_STATUS_OK;
5728 }
5729
5730 NTSTATUS smb2cli_session_set_session_key(struct smbXcli_session *session,
5731 const DATA_BLOB _session_key,
5732 const struct iovec *recv_iov)
5733 {
5734 struct smbXcli_conn *conn = session->conn;
5735 uint16_t no_sign_flags = 0;
5736 uint8_t session_key[16];
5737 bool check_signature = true;
5738 uint32_t hdr_flags;
5739 NTSTATUS status;
5740 struct _derivation {
5741 DATA_BLOB label;
5742 DATA_BLOB context;
5743 };
5744 struct {
5745 struct _derivation signing;
5746 struct _derivation encryption;
5747 struct _derivation decryption;
5748 struct _derivation application;
5749 } derivation = { };
5750 size_t nonce_size = 0;
5751
5752 if (conn == NULL) {
5753 return NT_STATUS_INVALID_PARAMETER_MIX;
5754 }
5755
5756 if (recv_iov[0].iov_len != SMB2_HDR_BODY) {
5757 return NT_STATUS_INVALID_PARAMETER_MIX;
5758 }
5759
5760 if (!conn->mandatory_signing) {
5761 /*
5762 * only allow guest sessions without
5763 * mandatory signing.
5764 *
5765 * If we try an authentication with username != ""
5766 * and the server let us in without verifying the
5767 * password we don't have a negotiated session key
5768 * for signing.
5769 */
5770 no_sign_flags = SMB2_SESSION_FLAG_IS_GUEST;
5771 }
5772
5773 if (session->smb2->session_flags & no_sign_flags) {
5774 session->smb2->should_sign = false;
5775 return NT_STATUS_OK;
5776 }
5777
5778 if (session->smb2->signing_key.length != 0) {
5779 return NT_STATUS_INVALID_PARAMETER_MIX;
5780 }
5781
5782 if (conn->protocol >= PROTOCOL_SMB3_10) {
5783 struct _derivation *d;
5784 DATA_BLOB p;
5785
5786 p = data_blob_const(session->smb2_channel.preauth_sha512,
5787 sizeof(session->smb2_channel.preauth_sha512));
5788
5789 d = &derivation.signing;
5790 d->label = data_blob_string_const_null("SMBSigningKey");
5791 d->context = p;
5792
5793 d = &derivation.encryption;
5794 d->label = data_blob_string_const_null("SMBC2SCipherKey");
5795 d->context = p;
5796
5797 d = &derivation.decryption;
5798 d->label = data_blob_string_const_null("SMBS2CCipherKey");
5799 d->context = p;
5800
5801 d = &derivation.application;
5802 d->label = data_blob_string_const_null("SMBAppKey");
5803 d->context = p;
5804
5805 } else if (conn->protocol >= PROTOCOL_SMB2_24) {
5806 struct _derivation *d;
5807
5808 d = &derivation.signing;
5809 d->label = data_blob_string_const_null("SMB2AESCMAC");
5810 d->context = data_blob_string_const_null("SmbSign");
5811
5812 d = &derivation.encryption;
5813 d->label = data_blob_string_const_null("SMB2AESCCM");
5814 d->context = data_blob_string_const_null("ServerIn ");
5815
5816 d = &derivation.decryption;
5817 d->label = data_blob_string_const_null("SMB2AESCCM");
5818 d->context = data_blob_string_const_null("ServerOut");
5819
5820 d = &derivation.application;
5821 d->label = data_blob_string_const_null("SMB2APP");
5822 d->context = data_blob_string_const_null("SmbRpc");
5823 }
5824
5825 ZERO_STRUCT(session_key);
5826 memcpy(session_key, _session_key.data,
5827 MIN(_session_key.length, sizeof(session_key)));
5828
5829 session->smb2->signing_key = data_blob_talloc(session,
5830 session_key,
5831 sizeof(session_key));
5832 if (session->smb2->signing_key.data == NULL) {
5833 ZERO_STRUCT(session_key);
5834 return NT_STATUS_NO_MEMORY;
5835 }
5836
5837 if (conn->protocol >= PROTOCOL_SMB2_24) {
5838 struct _derivation *d = &derivation.signing;
5839
5840 smb2_key_derivation(session_key, sizeof(session_key),
5841 d->label.data, d->label.length,
5842 d->context.data, d->context.length,
5843 session->smb2->signing_key.data);
5844 }
5845
5846 session->smb2->encryption_key = data_blob_dup_talloc(session,
5847 session->smb2->signing_key);
5848 if (session->smb2->encryption_key.data == NULL) {
5849 ZERO_STRUCT(session_key);
5850 return NT_STATUS_NO_MEMORY;
5851 }
5852
5853 if (conn->protocol >= PROTOCOL_SMB2_24) {
5854 struct _derivation *d = &derivation.encryption;
5855
5856 smb2_key_derivation(session_key, sizeof(session_key),
5857 d->label.data, d->label.length,
5858 d->context.data, d->context.length,
5859 session->smb2->encryption_key.data);
5860 }
5861
5862 session->smb2->decryption_key = data_blob_dup_talloc(session,
5863 session->smb2->signing_key);
5864 if (session->smb2->decryption_key.data == NULL) {
5865 ZERO_STRUCT(session_key);
5866 return NT_STATUS_NO_MEMORY;
5867 }
5868
5869 if (conn->protocol >= PROTOCOL_SMB2_24) {
5870 struct _derivation *d = &derivation.decryption;
5871
5872 smb2_key_derivation(session_key, sizeof(session_key),
5873 d->label.data, d->label.length,
5874 d->context.data, d->context.length,
5875 session->smb2->decryption_key.data);
5876 }
5877
5878 session->smb2->application_key = data_blob_dup_talloc(session,
5879 session->smb2->signing_key);
5880 if (session->smb2->application_key.data == NULL) {
5881 ZERO_STRUCT(session_key);
5882 return NT_STATUS_NO_MEMORY;
5883 }
5884
5885 if (conn->protocol >= PROTOCOL_SMB2_24) {
5886 struct _derivation *d = &derivation.application;
5887
5888 smb2_key_derivation(session_key, sizeof(session_key),
5889 d->label.data, d->label.length,
5890 d->context.data, d->context.length,
5891 session->smb2->application_key.data);
5892 }
5893 ZERO_STRUCT(session_key);
5894
5895 session->smb2_channel.signing_key = data_blob_dup_talloc(session,
5896 session->smb2->signing_key);
5897 if (session->smb2_channel.signing_key.data == NULL) {
5898 return NT_STATUS_NO_MEMORY;
5899 }
5900
5901 check_signature = conn->mandatory_signing;
5902
5903 hdr_flags = IVAL(recv_iov[0].iov_base, SMB2_HDR_FLAGS);
5904 if (hdr_flags & SMB2_HDR_FLAG_SIGNED) {
5905 /*
5906 * Sadly some vendors don't sign the
5907 * final SMB2 session setup response
5908 *
5909 * At least Windows and Samba are always doing this
5910 * if there's a session key available.
5911 *
5912 * We only check the signature if it's mandatory
5913 * or SMB2_HDR_FLAG_SIGNED is provided.
5914 */
5915 check_signature = true;
5916 }
5917
5918 if (conn->protocol >= PROTOCOL_SMB3_10) {
5919 check_signature = true;
5920 }
5921
5922 if (check_signature) {
5923 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
5924 session->conn->protocol,
5925 recv_iov, 3);
5926 if (!NT_STATUS_IS_OK(status)) {
5927 return status;
5928 }
5929 }
5930
5931 session->smb2->should_sign = false;
5932 session->smb2->should_encrypt = false;
5933
5934 if (conn->desire_signing) {
5935 session->smb2->should_sign = true;
5936 }
5937
5938 if (conn->smb2.server.security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) {
5939 session->smb2->should_sign = true;
5940 }
5941
5942 if (session->smb2->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA) {
5943 session->smb2->should_encrypt = true;
5944 }
5945
5946 if (conn->protocol < PROTOCOL_SMB2_24) {
5947 session->smb2->should_encrypt = false;
5948 }
5949
5950 if (conn->smb2.server.cipher == 0) {
5951 session->smb2->should_encrypt = false;
5952 }
5953
5954 /*
5955 * CCM and GCM algorithms must never have their
5956 * nonce wrap, or the security of the whole
5957 * communication and the keys is destroyed.
5958 * We must drop the connection once we have
5959 * transfered too much data.
5960 *
5961 * NOTE: We assume nonces greater than 8 bytes.
5962 */
5963 generate_random_buffer((uint8_t *)&session->smb2->nonce_high_random,
5964 sizeof(session->smb2->nonce_high_random));
5965 switch (conn->smb2.server.cipher) {
5966 case SMB2_ENCRYPTION_AES128_CCM:
5967 nonce_size = AES_CCM_128_NONCE_SIZE;
5968 break;
5969 case SMB2_ENCRYPTION_AES128_GCM:
5970 nonce_size = AES_GCM_128_IV_SIZE;
5971 break;
5972 default:
5973 nonce_size = 0;
5974 break;
5975 }
5976 session->smb2->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size);
5977 session->smb2->nonce_high = 0;
5978 session->smb2->nonce_low = 0;
5979
5980 return NT_STATUS_OK;
5981 }
5982
5983 NTSTATUS smb2cli_session_create_channel(TALLOC_CTX *mem_ctx,
5984 struct smbXcli_session *session1,
5985 struct smbXcli_conn *conn,
5986 struct smbXcli_session **_session2)
5987 {
5988 struct smbXcli_session *session2;
5989
5990 if (session1->smb2->signing_key.length == 0) {
5991 return NT_STATUS_INVALID_PARAMETER_MIX;
5992 }
5993
5994 if (conn == NULL) {
5995 return NT_STATUS_INVALID_PARAMETER_MIX;
5996 }
5997
5998 session2 = talloc_zero(mem_ctx, struct smbXcli_session);
5999 if (session2 == NULL) {
6000 return NT_STATUS_NO_MEMORY;
6001 }
6002 session2->smb2 = talloc_reference(session2, session1->smb2);
6003 if (session2->smb2 == NULL) {
6004 talloc_free(session2);
6005 return NT_STATUS_NO_MEMORY;
6006 }
6007
6008 talloc_set_destructor(session2, smbXcli_session_destructor);
6009 DLIST_ADD_END(conn->sessions, session2);
6010 session2->conn = conn;
6011
6012 memcpy(session2->smb2_channel.preauth_sha512,
6013 conn->smb2.preauth_sha512,
6014 sizeof(session2->smb2_channel.preauth_sha512));
6015
6016 *_session2 = session2;
6017 return NT_STATUS_OK;
6018 }
6019
6020 NTSTATUS smb2cli_session_set_channel_key(struct smbXcli_session *session,
6021 const DATA_BLOB _channel_key,
6022 const struct iovec *recv_iov)
6023 {
6024 struct smbXcli_conn *conn = session->conn;
6025 uint8_t channel_key[16];
6026 NTSTATUS status;
6027 struct _derivation {
6028 DATA_BLOB label;
6029 DATA_BLOB context;
6030 };
6031 struct {
6032 struct _derivation signing;
6033 } derivation = { };
6034
6035 if (conn == NULL) {
6036 return NT_STATUS_INVALID_PARAMETER_MIX;
6037 }
6038
6039 if (session->smb2_channel.signing_key.length != 0) {
6040 return NT_STATUS_INVALID_PARAMETER_MIX;
6041 }
6042
6043 if (conn->protocol >= PROTOCOL_SMB3_10) {
6044 struct _derivation *d;
6045 DATA_BLOB p;
6046
6047 p = data_blob_const(session->smb2_channel.preauth_sha512,
6048 sizeof(session->smb2_channel.preauth_sha512));
6049
6050 d = &derivation.signing;
6051 d->label = data_blob_string_const_null("SMBSigningKey");
6052 d->context = p;
6053 } else if (conn->protocol >= PROTOCOL_SMB2_24) {
6054 struct _derivation *d;
6055
6056 d = &derivation.signing;
6057 d->label = data_blob_string_const_null("SMB2AESCMAC");
6058 d->context = data_blob_string_const_null("SmbSign");
6059 }
6060
6061 ZERO_STRUCT(channel_key);
6062 memcpy(channel_key, _channel_key.data,
6063 MIN(_channel_key.length, sizeof(channel_key)));
6064
6065 session->smb2_channel.signing_key = data_blob_talloc(session,
6066 channel_key,
6067 sizeof(channel_key));
6068 if (session->smb2_channel.signing_key.data == NULL) {
6069 ZERO_STRUCT(channel_key);
6070 return NT_STATUS_NO_MEMORY;
6071 }
6072
6073 if (conn->protocol >= PROTOCOL_SMB2_24) {
6074 struct _derivation *d = &derivation.signing;
6075
6076 smb2_key_derivation(channel_key, sizeof(channel_key),
6077 d->label.data, d->label.length,
6078 d->context.data, d->context.length,
6079 session->smb2_channel.signing_key.data);
6080 }
6081 ZERO_STRUCT(channel_key);
6082
6083 status = smb2_signing_check_pdu(session->smb2_channel.signing_key,
6084 session->conn->protocol,
6085 recv_iov, 3);
6086 if (!NT_STATUS_IS_OK(status)) {
6087 return status;
6088 }
6089
6090 return NT_STATUS_OK;
6091 }
6092
6093 NTSTATUS smb2cli_session_encryption_on(struct smbXcli_session *session)
6094 {
6095 if (!session->smb2->should_sign) {
6096 /*
6097 * We need required signing on the session
6098 * in order to prevent man in the middle attacks.
6099 */
6100 return NT_STATUS_INVALID_PARAMETER_MIX;
6101 }
6102
6103 if (session->smb2->should_encrypt) {
6104 return NT_STATUS_OK;
6105 }
6106
6107 if (session->conn->protocol < PROTOCOL_SMB2_24) {
6108 return NT_STATUS_NOT_SUPPORTED;
6109 }
6110
6111 if (session->conn->smb2.server.cipher == 0) {
6112 return NT_STATUS_NOT_SUPPORTED;
6113 }
6114
6115 if (session->smb2->signing_key.data == NULL) {
6116 return NT_STATUS_NOT_SUPPORTED;
6117 }
6118 session->smb2->should_encrypt = true;
6119 return NT_STATUS_OK;
6120 }
6121
6122 struct smbXcli_tcon *smbXcli_tcon_create(TALLOC_CTX *mem_ctx)
6123 {
6124 struct smbXcli_tcon *tcon;
6125
6126 tcon = talloc_zero(mem_ctx, struct smbXcli_tcon);
6127 if (tcon == NULL) {
6128 return NULL;
6129 }
6130
6131 return tcon;
6132 }
6133
6134 /*
6135 * Return a deep structure copy of a struct smbXcli_tcon *
6136 */
6137
6138 struct smbXcli_tcon *smbXcli_tcon_copy(TALLOC_CTX *mem_ctx,
6139 const struct smbXcli_tcon *tcon_in)
6140 {
6141 struct smbXcli_tcon *tcon;
6142
6143 tcon = talloc_memdup(mem_ctx, tcon_in, sizeof(struct smbXcli_tcon));
6144 if (tcon == NULL) {
6145 return NULL;
6146 }
6147
6148 /* Deal with the SMB1 strings. */
6149 if (tcon_in->smb1.service != NULL) {
6150 tcon->smb1.service = talloc_strdup(tcon, tcon_in->smb1.service);
6151 if (tcon->smb1.service == NULL) {
6152 TALLOC_FREE(tcon);
6153 return NULL;
6154 }
6155 }
6156 if (tcon->smb1.fs_type != NULL) {
6157 tcon->smb1.fs_type = talloc_strdup(tcon, tcon_in->smb1.fs_type);
6158 if (tcon->smb1.fs_type == NULL) {
6159 TALLOC_FREE(tcon);
6160 return NULL;
6161 }
6162 }
6163 return tcon;
6164 }
6165
6166 void smbXcli_tcon_set_fs_attributes(struct smbXcli_tcon *tcon,
6167 uint32_t fs_attributes)
6168 {
6169 tcon->fs_attributes = fs_attributes;
6170 }
6171
6172 uint32_t smbXcli_tcon_get_fs_attributes(struct smbXcli_tcon *tcon)
6173 {
6174 return tcon->fs_attributes;
6175 }
6176
6177 bool smbXcli_tcon_is_dfs_share(struct smbXcli_tcon *tcon)
6178 {
6179 if (tcon == NULL) {
6180 return false;
6181 }
6182
6183 if (tcon->is_smb1) {
6184 if (tcon->smb1.optional_support & SMB_SHARE_IN_DFS) {
6185 return true;
6186 }
6187
6188 return false;
6189 }
6190
6191 if (tcon->smb2.capabilities & SMB2_SHARE_CAP_DFS) {
6192 return true;
6193 }
6194
6195 return false;
6196 }
6197
6198 uint16_t smb1cli_tcon_current_id(struct smbXcli_tcon *tcon)
6199 {
6200 return tcon->smb1.tcon_id;
6201 }
6202
6203 void smb1cli_tcon_set_id(struct smbXcli_tcon *tcon, uint16_t tcon_id)
6204 {
6205 tcon->is_smb1 = true;
6206 tcon->smb1.tcon_id = tcon_id;
6207 }
6208
6209 bool smb1cli_tcon_set_values(struct smbXcli_tcon *tcon,
6210 uint16_t tcon_id,
6211 uint16_t optional_support,
6212 uint32_t maximal_access,
6213 uint32_t guest_maximal_access,
6214 const char *service,
6215 const char *fs_type)
6216 {
6217 tcon->is_smb1 = true;
6218 tcon->fs_attributes = 0;
6219 tcon->smb1.tcon_id = tcon_id;
6220 tcon->smb1.optional_support = optional_support;
6221 tcon->smb1.maximal_access = maximal_access;
6222 tcon->smb1.guest_maximal_access = guest_maximal_access;
6223
6224 TALLOC_FREE(tcon->smb1.service);
6225 tcon->smb1.service = talloc_strdup(tcon, service);
6226 if (service != NULL && tcon->smb1.service == NULL) {
6227 return false;
6228 }
6229
6230 TALLOC_FREE(tcon->smb1.fs_type);
6231 tcon->smb1.fs_type = talloc_strdup(tcon, fs_type);
6232 if (fs_type != NULL && tcon->smb1.fs_type == NULL) {
6233 return false;
6234 }
6235
6236 return true;
6237 }
6238
6239 uint32_t smb2cli_tcon_current_id(struct smbXcli_tcon *tcon)
6240 {
6241 return tcon->smb2.tcon_id;
6242 }
6243
6244 void smb2cli_tcon_set_id(struct smbXcli_tcon *tcon, uint32_t tcon_id)
6245 {
6246 tcon->smb2.tcon_id = tcon_id;
6247 }
6248
6249 uint32_t smb2cli_tcon_capabilities(struct smbXcli_tcon *tcon)
6250 {
6251 return tcon->smb2.capabilities;
6252 }
6253
6254 uint32_t smb2cli_tcon_flags(struct smbXcli_tcon *tcon)
6255 {
6256 return tcon->smb2.flags;
6257 }
6258
6259 void smb2cli_tcon_set_values(struct smbXcli_tcon *tcon,
6260 struct smbXcli_session *session,
6261 uint32_t tcon_id,
6262 uint8_t type,
6263 uint32_t flags,
6264 uint32_t capabilities,
6265 uint32_t maximal_access)
6266 {
6267 tcon->is_smb1 = false;
6268 tcon->fs_attributes = 0;
6269 tcon->smb2.tcon_id = tcon_id;
6270 tcon->smb2.type = type;
6271 tcon->smb2.flags = flags;
6272 tcon->smb2.capabilities = capabilities;
6273 tcon->smb2.maximal_access = maximal_access;
6274
6275 tcon->smb2.should_sign = false;
6276 tcon->smb2.should_encrypt = false;
6277
6278 if (session == NULL) {
6279 return;
6280 }
6281
6282 tcon->smb2.should_sign = session->smb2->should_sign;
6283 tcon->smb2.should_encrypt = session->smb2->should_encrypt;
6284
6285 if (flags & SMB2_SHAREFLAG_ENCRYPT_DATA) {
6286 tcon->smb2.should_encrypt = true;
6287 }
6288 }
6289
6290 void smb2cli_tcon_should_sign(struct smbXcli_tcon *tcon,
6291 bool should_sign)
6292 {
6293 tcon->smb2.should_sign = should_sign;
6294 }
6295
6296 bool smb2cli_tcon_is_signing_on(struct smbXcli_tcon *tcon)
6297 {
6298 if (tcon->smb2.should_encrypt) {
6299 return true;
6300 }
6301
6302 return tcon->smb2.should_sign;
6303 }
6304
6305 void smb2cli_tcon_should_encrypt(struct smbXcli_tcon *tcon,
6306 bool should_encrypt)
6307 {
6308 tcon->smb2.should_encrypt = should_encrypt;
6309 }
6310
6311 bool smb2cli_tcon_is_encryption_on(struct smbXcli_tcon *tcon)
6312 {
6313 return tcon->smb2.should_encrypt;
6314 }
6315
6316 void smb2cli_conn_set_mid(struct smbXcli_conn *conn, uint64_t mid)
6317 {
6318 conn->smb2.mid = mid;
6319 }
6320
6321 uint64_t smb2cli_conn_get_mid(struct smbXcli_conn *conn)
6322 {
6323 return conn->smb2.mid;
6324 }
Samba GIT mirror