source3/smbd/smb2_negprot.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Core SMB2 server
   4
   5    Copyright (C) Stefan Metzmacher 2009
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 3 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19 */
  20
  21 #include "includes.h"
  22 #include "smbd/smbd.h"
  23 #include "smbd/globals.h"
  24 #include "../libcli/smb/smb_common.h"
  25 #include "../libcli/smb/smb2_negotiate_context.h"
  26 #include "../lib/tsocket/tsocket.h"
  27 #include "../librpc/ndr/libndr.h"
  28 #include "../libcli/smb/smb_signing.h"
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_SMB2
  32
  33 extern fstring remote_proto;
  34
  35 /*
  36  * this is the entry point if SMB2 is selected via
  37  * the SMB negprot and the given dialect.
  38  */
  39 static NTSTATUS reply_smb20xx(struct smb_request *req, uint16_t dialect)
  40 {
  41         uint8_t *smb2_inpdu;
  42         uint8_t *smb2_hdr;
  43         uint8_t *smb2_body;
  44         uint8_t *smb2_dyn;
  45         size_t len = SMB2_HDR_BODY + 0x24 + 2;
  46
  47         smb2_inpdu = talloc_zero_array(talloc_tos(), uint8_t, len);
  48         if (smb2_inpdu == NULL) {
  49                 DEBUG(0, ("Could not push spnego blob\n"));
  50                 reply_nterror(req, NT_STATUS_NO_MEMORY);
  51                 return NT_STATUS_NO_MEMORY;
  52         }
  53         smb2_hdr = smb2_inpdu;
  54         smb2_body = smb2_hdr + SMB2_HDR_BODY;
  55         smb2_dyn = smb2_body + 0x24;
  56
  57         SIVAL(smb2_hdr, SMB2_HDR_PROTOCOL_ID,   SMB2_MAGIC);
  58         SIVAL(smb2_hdr, SMB2_HDR_LENGTH,        SMB2_HDR_BODY);
  59
  60         SSVAL(smb2_body, 0x00, 0x0024); /* struct size */
  61         SSVAL(smb2_body, 0x02, 0x0001); /* dialect count */
  62
  63         SSVAL(smb2_dyn,  0x00, dialect);
  64
  65         req->outbuf = NULL;
  66
  67         return smbd_smb2_process_negprot(req->xconn, 0, smb2_inpdu, len);
  68 }
  69
  70 /*
  71  * this is the entry point if SMB2 is selected via
  72  * the SMB negprot and the "SMB 2.002" dialect.
  73  */
  74 NTSTATUS reply_smb2002(struct smb_request *req, uint16_t choice)
  75 {
  76         return reply_smb20xx(req, SMB2_DIALECT_REVISION_202);
  77 }
  78
  79 /*
  80  * this is the entry point if SMB2 is selected via
  81  * the SMB negprot and the "SMB 2.???" dialect.
  82  */
  83 NTSTATUS reply_smb20ff(struct smb_request *req, uint16_t choice)
  84 {
  85         struct smbXsrv_connection *xconn = req->xconn;
  86         xconn->smb2.allow_2ff = true;
  87         return reply_smb20xx(req, SMB2_DIALECT_REVISION_2FF);
  88 }
  89
  90 enum protocol_types smbd_smb2_protocol_dialect_match(const uint8_t *indyn,
  91                                 const int dialect_count,
  92                                 uint16_t *dialect)
  93 {
  94         struct {
  95                 enum protocol_types proto;
  96                 uint16_t dialect;
  97         } pd[] = {
  98                 { PROTOCOL_SMB3_11, SMB3_DIALECT_REVISION_311 },
  99                 { PROTOCOL_SMB3_10, SMB3_DIALECT_REVISION_310 },
 100                 { PROTOCOL_SMB3_02, SMB3_DIALECT_REVISION_302 },
 101                 { PROTOCOL_SMB3_00, SMB3_DIALECT_REVISION_300 },
 102                 { PROTOCOL_SMB2_24, SMB2_DIALECT_REVISION_224 },
 103                 { PROTOCOL_SMB2_22, SMB2_DIALECT_REVISION_222 },
 104                 { PROTOCOL_SMB2_10, SMB2_DIALECT_REVISION_210 },
 105                 { PROTOCOL_SMB2_02, SMB2_DIALECT_REVISION_202 },
 106         };
 107         size_t i;
 108
 109         for (i = 0; i < ARRAY_SIZE(pd); i ++) {
 110                 int c = 0;
 111
 112                 if (lp_server_max_protocol() < pd[i].proto) {
 113                         continue;
 114                 }
 115                 if (lp_server_min_protocol() > pd[i].proto) {
 116                         continue;
 117                 }
 118
 119                 for (c = 0; c < dialect_count; c++) {
 120                         *dialect = SVAL(indyn, c*2);
 121                         if (*dialect == pd[i].dialect) {
 122                                 return pd[i].proto;
 123                         }
 124                 }
 125         }
 126
 127         return PROTOCOL_NONE;
 128 }
 129
 130 NTSTATUS smbd_smb2_request_process_negprot(struct smbd_smb2_request *req)
 131 {
 132         struct smbXsrv_connection *xconn = req->xconn;
 133         struct smbXsrv_client_global0 *global0 = NULL;
 134         NTSTATUS status;
 135         const uint8_t *inbody;
 136         const uint8_t *indyn = NULL;
 137         DATA_BLOB outbody;
 138         DATA_BLOB outdyn;
 139         DATA_BLOB negprot_spnego_blob;
 140         uint16_t security_offset;
 141         DATA_BLOB security_buffer;
 142         size_t expected_dyn_size = 0;
 143         size_t c;
 144         uint16_t security_mode;
 145         uint16_t dialect_count;
 146         uint16_t in_security_mode;
 147         uint32_t in_capabilities;
 148         DATA_BLOB in_guid_blob;
 149         struct GUID in_guid;
 150         struct smb2_negotiate_contexts in_c = { .num_contexts = 0, };
 151         struct smb2_negotiate_context *in_preauth = NULL;
 152         struct smb2_negotiate_context *in_cipher = NULL;
 153         struct smb2_negotiate_contexts out_c = { .num_contexts = 0, };
 154         DATA_BLOB out_negotiate_context_blob = data_blob_null;
 155         uint32_t out_negotiate_context_offset = 0;
 156         uint16_t out_negotiate_context_count = 0;
 157         uint16_t dialect = 0;
 158         uint32_t capabilities;
 159         DATA_BLOB out_guid_blob;
 160         struct GUID out_guid;
 161         enum protocol_types protocol = PROTOCOL_NONE;
 162         uint32_t max_limit;
 163         uint32_t max_trans = lp_smb2_max_trans();
 164         uint32_t max_read = lp_smb2_max_read();
 165         uint32_t max_write = lp_smb2_max_write();
 166         NTTIME now = timeval_to_nttime(&req->request_time);
 167         bool signing_required = true;
 168         bool ok;
 169
 170         status = smbd_smb2_request_verify_sizes(req, 0x24);
 171         if (!NT_STATUS_IS_OK(status)) {
 172                 return smbd_smb2_request_error(req, status);
 173         }
 174         inbody = SMBD_SMB2_IN_BODY_PTR(req);
 175
 176         dialect_count = SVAL(inbody, 0x02);
 177
 178         in_security_mode = SVAL(inbody, 0x04);
 179         in_capabilities = IVAL(inbody, 0x08);
 180         in_guid_blob = data_blob_const(inbody + 0x0C, 16);
 181
 182         if (dialect_count == 0) {
 183                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 184         }
 185
 186         status = GUID_from_ndr_blob(&in_guid_blob, &in_guid);
 187         if (!NT_STATUS_IS_OK(status)) {
 188                 return smbd_smb2_request_error(req, status);
 189         }
 190
 191         expected_dyn_size = dialect_count * 2;
 192         if (SMBD_SMB2_IN_DYN_LEN(req) < expected_dyn_size) {
 193                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 194         }
 195         indyn = SMBD_SMB2_IN_DYN_PTR(req);
 196
 197         protocol = smbd_smb2_protocol_dialect_match(indyn,
 198                                         dialect_count,
 199                                         &dialect);
 200
 201         for (c=0; protocol == PROTOCOL_NONE && c < dialect_count; c++) {
 202                 if (lp_server_max_protocol() < PROTOCOL_SMB2_10) {
 203                         break;
 204                 }
 205
 206                 dialect = SVAL(indyn, c*2);
 207                 if (dialect == SMB2_DIALECT_REVISION_2FF) {
 208                         if (xconn->smb2.allow_2ff) {
 209                                 xconn->smb2.allow_2ff = false;
 210                                 protocol = PROTOCOL_SMB2_10;
 211                                 break;
 212                         }
 213                 }
 214         }
 215
 216         if (protocol == PROTOCOL_NONE) {
 217                 return smbd_smb2_request_error(req, NT_STATUS_NOT_SUPPORTED);
 218         }
 219
 220         if (protocol >= PROTOCOL_SMB3_10) {
 221                 uint32_t in_negotiate_context_offset = 0;
 222                 uint16_t in_negotiate_context_count = 0;
 223                 DATA_BLOB in_negotiate_context_blob = data_blob_null;
 224                 size_t ofs;
 225
 226                 in_negotiate_context_offset = IVAL(inbody, 0x1C);
 227                 in_negotiate_context_count = SVAL(inbody, 0x20);
 228
 229                 ofs = SMB2_HDR_BODY;
 230                 ofs += SMBD_SMB2_IN_BODY_LEN(req);
 231                 ofs += expected_dyn_size;
 232                 if ((ofs % 8) != 0) {
 233                         ofs += 8 - (ofs % 8);
 234                 }
 235
 236                 if (in_negotiate_context_offset != ofs) {
 237                         return smbd_smb2_request_error(req,
 238                                         NT_STATUS_INVALID_PARAMETER);
 239                 }
 240
 241                 ofs -= SMB2_HDR_BODY;
 242                 ofs -= SMBD_SMB2_IN_BODY_LEN(req);
 243
 244                 if (SMBD_SMB2_IN_DYN_LEN(req) < ofs) {
 245                         return smbd_smb2_request_error(req,
 246                                         NT_STATUS_INVALID_PARAMETER);
 247                 }
 248
 249                 in_negotiate_context_blob = data_blob_const(indyn,
 250                                                 SMBD_SMB2_IN_DYN_LEN(req));
 251
 252                 in_negotiate_context_blob.data += ofs;
 253                 in_negotiate_context_blob.length -= ofs;
 254
 255                 status = smb2_negotiate_context_parse(req,
 256                                         in_negotiate_context_blob, &in_c);
 257                 if (!NT_STATUS_IS_OK(status)) {
 258                         return smbd_smb2_request_error(req, status);
 259                 }
 260
 261                 if (in_negotiate_context_count != in_c.num_contexts) {
 262                         return smbd_smb2_request_error(req,
 263                                         NT_STATUS_INVALID_PARAMETER);
 264                 }
 265         }
 266
 267         if ((dialect != SMB2_DIALECT_REVISION_2FF) &&
 268             (protocol >= PROTOCOL_SMB2_10) &&
 269             !GUID_all_zero(&in_guid))
 270         {
 271                 ok = remote_arch_cache_update(&in_guid);
 272                 if (!ok) {
 273                         return smbd_smb2_request_error(
 274                                 req, NT_STATUS_UNSUCCESSFUL);
 275                 }
 276         }
 277
 278         switch (get_remote_arch()) {
 279         case RA_VISTA:
 280         case RA_SAMBA:
 281         case RA_CIFSFS:
 282         case RA_OSX:
 283                 break;
 284         default:
 285                 set_remote_arch(RA_VISTA);
 286                 break;
 287         }
 288
 289         fstr_sprintf(remote_proto, "SMB%X_%02X",
 290                      (dialect >> 8) & 0xFF, dialect & 0xFF);
 291
 292         reload_services(req->sconn, conn_snum_used, true);
 293         DEBUG(3,("Selected protocol %s\n", remote_proto));
 294
 295         in_preauth = smb2_negotiate_context_find(&in_c,
 296                                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES);
 297         if (protocol >= PROTOCOL_SMB3_10 && in_preauth == NULL) {
 298                 return smbd_smb2_request_error(req, NT_STATUS_INVALID_PARAMETER);
 299         }
 300         in_cipher = smb2_negotiate_context_find(&in_c,
 301                                         SMB2_ENCRYPTION_CAPABILITIES);
 302
 303         /* negprot_spnego() returns a the server guid in the first 16 bytes */
 304         negprot_spnego_blob = negprot_spnego(req, xconn);
 305         if (negprot_spnego_blob.data == NULL) {
 306                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 307         }
 308
 309         if (negprot_spnego_blob.length < 16) {
 310                 return smbd_smb2_request_error(req, NT_STATUS_INTERNAL_ERROR);
 311         }
 312
 313         security_mode = SMB2_NEGOTIATE_SIGNING_ENABLED;
 314         /*
 315          * We use xconn->smb1.signing_state as that's already present
 316          * and used lpcfg_server_signing_allowed() to get the correct
 317          * defaults, e.g. signing_required for an ad_dc.
 318          */
 319         signing_required = smb_signing_is_mandatory(xconn->smb1.signing_state);
 320         if (signing_required) {
 321                 security_mode |= SMB2_NEGOTIATE_SIGNING_REQUIRED;
 322         }
 323
 324         capabilities = 0;
 325         if (lp_host_msdfs()) {
 326                 capabilities |= SMB2_CAP_DFS;
 327         }
 328
 329         if (protocol >= PROTOCOL_SMB2_10 &&
 330             lp_smb2_leases() &&
 331             lp_oplocks(GLOBAL_SECTION_SNUM) &&
 332             !lp_kernel_oplocks(GLOBAL_SECTION_SNUM))
 333         {
 334                 capabilities |= SMB2_CAP_LEASING;
 335         }
 336
 337         if ((protocol >= PROTOCOL_SMB2_24) &&
 338             (lp_smb_encrypt(-1) != SMB_SIGNING_OFF) &&
 339             (in_capabilities & SMB2_CAP_ENCRYPTION)) {
 340                 capabilities |= SMB2_CAP_ENCRYPTION;
 341         }
 342
 343         /*
 344          * 0x10000 (65536) is the maximum allowed message size
 345          * for SMB 2.0
 346          */
 347         max_limit = 0x10000;
 348
 349         if (protocol >= PROTOCOL_SMB2_10) {
 350                 int p = 0;
 351
 352                 if (tsocket_address_is_inet(req->sconn->local_address, "ip")) {
 353                         p = tsocket_address_inet_port(req->sconn->local_address);
 354                 }
 355
 356                 /* largeMTU is not supported over NBT (tcp port 139) */
 357                 if (p != NBT_SMB_PORT) {
 358                         capabilities |= SMB2_CAP_LARGE_MTU;
 359                         xconn->smb2.credits.multicredit = true;
 360
 361                         /*
 362                          * We allow up to almost 16MB.
 363                          *
 364                          * The maximum PDU size is 0xFFFFFF (16776960)
 365                          * and we need some space for the header.
 366                          */
 367                         max_limit = 0xFFFF00;
 368                 }
 369         }
 370
 371         /*
 372          * the defaults are 8MB, but we'll limit this to max_limit based on
 373          * the dialect (64kb for SMB 2.0, 8MB for SMB >= 2.1 with LargeMTU)
 374          *
 375          * user configured values exceeding the limits will be overwritten,
 376          * only smaller values will be accepted
 377          */
 378
 379         max_trans = MIN(max_limit, lp_smb2_max_trans());
 380         max_read = MIN(max_limit, lp_smb2_max_read());
 381         max_write = MIN(max_limit, lp_smb2_max_write());
 382
 383         if (in_preauth != NULL) {
 384                 size_t needed = 4;
 385                 uint16_t hash_count;
 386                 uint16_t salt_length;
 387                 uint16_t selected_preauth = 0;
 388                 const uint8_t *p;
 389                 uint8_t buf[38];
 390                 size_t i;
 391
 392                 if (in_preauth->data.length < needed) {
 393                         return smbd_smb2_request_error(req,
 394                                         NT_STATUS_INVALID_PARAMETER);
 395                 }
 396
 397                 hash_count = SVAL(in_preauth->data.data, 0);
 398                 salt_length = SVAL(in_preauth->data.data, 2);
 399
 400                 if (hash_count == 0) {
 401                         return smbd_smb2_request_error(req,
 402                                         NT_STATUS_INVALID_PARAMETER);
 403                 }
 404
 405                 p = in_preauth->data.data + needed;
 406                 needed += hash_count * 2;
 407                 needed += salt_length;
 408
 409                 if (in_preauth->data.length < needed) {
 410                         return smbd_smb2_request_error(req,
 411                                         NT_STATUS_INVALID_PARAMETER);
 412                 }
 413
 414                 for (i=0; i < hash_count; i++) {
 415                         uint16_t v;
 416
 417                         v = SVAL(p, 0);
 418                         p += 2;
 419
 420                         if (v == SMB2_PREAUTH_INTEGRITY_SHA512) {
 421                                 selected_preauth = v;
 422                                 break;
 423                         }
 424                 }
 425
 426                 if (selected_preauth == 0) {
 427                         return smbd_smb2_request_error(req,
 428                                 NT_STATUS_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP);
 429                 }
 430
 431                 SSVAL(buf, 0,  1); /* HashAlgorithmCount */
 432                 SSVAL(buf, 2, 32); /* SaltLength */
 433                 SSVAL(buf, 4, selected_preauth);
 434                 generate_random_buffer(buf + 6, 32);
 435
 436                 status = smb2_negotiate_context_add(
 437                         req,
 438                         &out_c,
 439                         SMB2_PREAUTH_INTEGRITY_CAPABILITIES,
 440                         buf,
 441                         sizeof(buf));
 442                 if (!NT_STATUS_IS_OK(status)) {
 443                         return smbd_smb2_request_error(req, status);
 444                 }
 445
 446                 req->preauth = &req->xconn->smb2.preauth;
 447         }
 448
 449         if ((capabilities & SMB2_CAP_ENCRYPTION) && (in_cipher != NULL)) {
 450                 size_t needed = 2;
 451                 uint16_t cipher_count;
 452                 const uint8_t *p;
 453                 uint8_t buf[4];
 454                 size_t i;
 455                 bool aes_128_ccm_supported = false;
 456                 bool aes_128_gcm_supported = false;
 457
 458                 capabilities &= ~SMB2_CAP_ENCRYPTION;
 459
 460                 if (in_cipher->data.length < needed) {
 461                         return smbd_smb2_request_error(req,
 462                                         NT_STATUS_INVALID_PARAMETER);
 463                 }
 464
 465                 cipher_count = SVAL(in_cipher->data.data, 0);
 466
 467                 if (cipher_count == 0) {
 468                         return smbd_smb2_request_error(req,
 469                                         NT_STATUS_INVALID_PARAMETER);
 470                 }
 471
 472                 p = in_cipher->data.data + needed;
 473                 needed += cipher_count * 2;
 474
 475                 if (in_cipher->data.length < needed) {
 476                         return smbd_smb2_request_error(req,
 477                                         NT_STATUS_INVALID_PARAMETER);
 478                 }
 479
 480                 for (i=0; i < cipher_count; i++) {
 481                         uint16_t v;
 482
 483                         v = SVAL(p, 0);
 484                         p += 2;
 485
 486                         if (v == SMB2_ENCRYPTION_AES128_GCM) {
 487                                 aes_128_gcm_supported = true;
 488                         }
 489                         if (v == SMB2_ENCRYPTION_AES128_CCM) {
 490                                 aes_128_ccm_supported = true;
 491                         }
 492                 }
 493
 494                 if (aes_128_gcm_supported) {
 495                         xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_GCM;
 496                 } else if (aes_128_ccm_supported) {
 497                         xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
 498                 }
 499
 500                 SSVAL(buf, 0, 1); /* ChiperCount */
 501                 SSVAL(buf, 2, xconn->smb2.server.cipher);
 502
 503                 status = smb2_negotiate_context_add(
 504                         req,
 505                         &out_c,
 506                         SMB2_ENCRYPTION_CAPABILITIES,
 507                         buf,
 508                         sizeof(buf));
 509                 if (!NT_STATUS_IS_OK(status)) {
 510                         return smbd_smb2_request_error(req, status);
 511                 }
 512         }
 513
 514         if (capabilities & SMB2_CAP_ENCRYPTION) {
 515                 xconn->smb2.server.cipher = SMB2_ENCRYPTION_AES128_CCM;
 516         }
 517
 518         if (protocol >= PROTOCOL_SMB2_22 &&
 519             xconn->client->server_multi_channel_enabled)
 520         {
 521                 if (in_capabilities & SMB2_CAP_MULTI_CHANNEL) {
 522                         capabilities |= SMB2_CAP_MULTI_CHANNEL;
 523                 }
 524         }
 525
 526         security_offset = SMB2_HDR_BODY + 0x40;
 527
 528 #if 1
 529         /* Try SPNEGO auth... */
 530         security_buffer = data_blob_const(negprot_spnego_blob.data + 16,
 531                                           negprot_spnego_blob.length - 16);
 532 #else
 533         /* for now we want raw NTLMSSP */
 534         security_buffer = data_blob_const(NULL, 0);
 535 #endif
 536
 537         if (out_c.num_contexts != 0) {
 538                 status = smb2_negotiate_context_push(req,
 539                                                 &out_negotiate_context_blob,
 540                                                 out_c);
 541                 if (!NT_STATUS_IS_OK(status)) {
 542                         return smbd_smb2_request_error(req, status);
 543                 }
 544         }
 545
 546         if (out_negotiate_context_blob.length != 0) {
 547                 static const uint8_t zeros[8];
 548                 size_t pad = 0;
 549                 size_t ofs;
 550
 551                 outdyn = data_blob_dup_talloc(req, security_buffer);
 552                 if (outdyn.length != security_buffer.length) {
 553                         return smbd_smb2_request_error(req,
 554                                                 NT_STATUS_NO_MEMORY);
 555                 }
 556
 557                 ofs = security_offset + security_buffer.length;
 558                 if ((ofs % 8) != 0) {
 559                         pad = 8 - (ofs % 8);
 560                 }
 561                 ofs += pad;
 562
 563                 ok = data_blob_append(req, &outdyn, zeros, pad);
 564                 if (!ok) {
 565                         return smbd_smb2_request_error(req,
 566                                                 NT_STATUS_NO_MEMORY);
 567                 }
 568
 569                 ok = data_blob_append(req, &outdyn,
 570                                       out_negotiate_context_blob.data,
 571                                       out_negotiate_context_blob.length);
 572                 if (!ok) {
 573                         return smbd_smb2_request_error(req,
 574                                                 NT_STATUS_NO_MEMORY);
 575                 }
 576
 577                 out_negotiate_context_offset = ofs;
 578                 out_negotiate_context_count = out_c.num_contexts;
 579         } else {
 580                 outdyn = security_buffer;
 581         }
 582
 583         out_guid_blob = data_blob_const(negprot_spnego_blob.data, 16);
 584         status = GUID_from_ndr_blob(&out_guid_blob, &out_guid);
 585         if (!NT_STATUS_IS_OK(status)) {
 586                 return smbd_smb2_request_error(req, status);
 587         }
 588
 589         outbody = smbd_smb2_generate_outbody(req, 0x40);
 590         if (outbody.data == NULL) {
 591                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 592         }
 593
 594         SSVAL(outbody.data, 0x00, 0x40 + 1);    /* struct size */
 595         SSVAL(outbody.data, 0x02,
 596               security_mode);                   /* security mode */
 597         SSVAL(outbody.data, 0x04, dialect);     /* dialect revision */
 598         SSVAL(outbody.data, 0x06,
 599               out_negotiate_context_count);     /* reserved/NegotiateContextCount */
 600         memcpy(outbody.data + 0x08,
 601                out_guid_blob.data, 16); /* server guid */
 602         SIVAL(outbody.data, 0x18,
 603               capabilities);                    /* capabilities */
 604         SIVAL(outbody.data, 0x1C, max_trans);   /* max transact size */
 605         SIVAL(outbody.data, 0x20, max_read);    /* max read size */
 606         SIVAL(outbody.data, 0x24, max_write);   /* max write size */
 607         SBVAL(outbody.data, 0x28, now);         /* system time */
 608         SBVAL(outbody.data, 0x30, 0);           /* server start time */
 609         SSVAL(outbody.data, 0x38,
 610               security_offset);                 /* security buffer offset */
 611         SSVAL(outbody.data, 0x3A,
 612               security_buffer.length);          /* security buffer length */
 613         SIVAL(outbody.data, 0x3C,
 614               out_negotiate_context_offset);    /* reserved/NegotiateContextOffset */
 615
 616         req->sconn->using_smb2 = true;
 617
 618         if (dialect == SMB2_DIALECT_REVISION_2FF) {
 619                 return smbd_smb2_request_done(req, outbody, &outdyn);
 620         }
 621
 622         status = smbXsrv_connection_init_tables(xconn, protocol);
 623         if (!NT_STATUS_IS_OK(status)) {
 624                 return smbd_smb2_request_error(req, status);
 625         }
 626
 627         xconn->smb2.client.capabilities = in_capabilities;
 628         xconn->smb2.client.security_mode = in_security_mode;
 629         xconn->smb2.client.guid = in_guid;
 630         xconn->smb2.client.num_dialects = dialect_count;
 631         xconn->smb2.client.dialects = talloc_array(xconn,
 632                                                    uint16_t,
 633                                                    dialect_count);
 634         if (xconn->smb2.client.dialects == NULL) {
 635                 return smbd_smb2_request_error(req, NT_STATUS_NO_MEMORY);
 636         }
 637         for (c=0; c < dialect_count; c++) {
 638                 xconn->smb2.client.dialects[c] = SVAL(indyn, c*2);
 639         }
 640
 641         xconn->smb2.server.capabilities = capabilities;
 642         xconn->smb2.server.security_mode = security_mode;
 643         xconn->smb2.server.guid = out_guid;
 644         xconn->smb2.server.dialect = dialect;
 645         xconn->smb2.server.max_trans = max_trans;
 646         xconn->smb2.server.max_read  = max_read;
 647         xconn->smb2.server.max_write = max_write;
 648
 649         if (xconn->protocol < PROTOCOL_SMB2_10) {
 650                 /*
 651                  * SMB2_02 doesn't support client guids
 652                  */
 653                 return smbd_smb2_request_done(req, outbody, &outdyn);
 654         }
 655
 656         if (!xconn->client->server_multi_channel_enabled) {
 657                 /*
 658                  * Only deal with the client guid database
 659                  * if multi-channel is enabled.
 660                  *
 661                  * But we still need to setup
 662                  * xconn->client->global->client_guid to
 663                  * the correct value.
 664                  */
 665                 xconn->client->global->client_guid =
 666                         xconn->smb2.client.guid;
 667                 return smbd_smb2_request_done(req, outbody, &outdyn);
 668         }
 669
 670         if (xconn->smb2.client.guid_verified) {
 671                 /*
 672                  * The connection was passed from another
 673                  * smbd process.
 674                  */
 675                 return smbd_smb2_request_done(req, outbody, &outdyn);
 676         }
 677
 678         status = smb2srv_client_lookup_global(xconn->client,
 679                                               xconn->smb2.client.guid,
 680                                               req, &global0);
 681         /*
 682          * TODO: check for races...
 683          */
 684         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECTID_NOT_FOUND)) {
 685                 /*
 686                  * This stores the new client information in
 687                  * smbXsrv_client_global.tdb
 688                  */
 689                 xconn->client->global->client_guid =
 690                         xconn->smb2.client.guid;
 691                 status = smbXsrv_client_update(xconn->client);
 692                 if (!NT_STATUS_IS_OK(status)) {
 693                         return status;
 694                 }
 695
 696                 xconn->smb2.client.guid_verified = true;
 697         } else if (NT_STATUS_IS_OK(status)) {
 698                 status = smb2srv_client_connection_pass(req,
 699                                                         global0);
 700                 if (!NT_STATUS_IS_OK(status)) {
 701                         return smbd_smb2_request_error(req, status);
 702                 }
 703
 704                 smbd_server_connection_terminate(xconn,
 705                                                  "passed connection");
 706                 return NT_STATUS_OBJECTID_EXISTS;
 707         } else {
 708                 return smbd_smb2_request_error(req, status);
 709         }
 710
 711         return smbd_smb2_request_done(req, outbody, &outdyn);
 712 }